Patent ID: 9148418
Filing Date: 2015-09-29
Classification: H04L

Abstract:
1. A method of performing an Internet based forensic analysis or eDiscovery of a subject computer having a non-transitory computer-readable media comprising: executing on a Software Switch computer a switch control program code configured to provide communications via a communication protocol; executing on a subject computer a subject program code configured to provide communications via a communication protocol; establishing a connection over the Internet between the Software Switch and the subject computer via the communication protocol; executing a user program code on a user computer configured to provide communications via a communication protocol; establishing a connection over the Internet between the Software Switch and the user computer via the communication protocol; establishing a connection over the Internet between the subject computer and user computer via the software switch, wherein no direct connection between the user computer and the subject computer is established; executing commands from the user computer via the software switch computer and to the subject computer which directs the subject computer to copy selected data stored in a non-transitory computer-readable media memory of the subject computer to a non-volatile memory on the user computer in a manner that catalogues and preserves the integrity of the data, wherein the communication protocol operates in accordance with a communication protocol standard that permits transmission of one or more write commands for writing data to a non-volatile memory, wherein the subject program code is configured to respond to at least one protocol command in accordance with the communication protocol standard, wherein the subject program code is optionally configured to not write data to the non-transitory computer-readable media of the subject computer in response to receiving the one or more write commands of the communication protocol standard from the user computer; establishing a software switch connection over the Internet between the subject computer and the user computer; performing a forensic analysis or eDiscovery process of the data stored on the subject computer via the Software Switch connection to the user computer; and outputting a report based on the forensic analysis or eDiscovery process.