Patent ID: 9037630
Filing Date: 2015-05-19
Classification: G06F,H04L

Abstract:
1. A method of performing an Internet based forensic analysis or eDiscovery of a subject computer having a non-transitory computer-readable media comprising: executing on a cloud-based control computer a control program code configured to provide communications via a communication protocol; executing on the subject computer a subject program code configured to provide communications via a communication protocol; establishing a connection over the Internet between the cloud-based control computer and the subject computer via the communication protocol; executing an examiner program code on an examiner computer configured to provide communications via a communication protocol; establishing a connection over the Internet between the cloud-based control computer and the examiner computer via the communication protocol; establishing a connection over the Internet between the subject computer and a cloud-based data-repository computer, wherein no direct connection between the control computer and the data-repository computer is established and no direct connection between the examiner computer and the subject computer is established; executing commands on the examiner computer which directs the control computer to direct the subject computer to copy selected data stored in a non-transitory computer-readable media memory of the subject computer to a non-volatile memory on the data-repository computer in a manner that catalogues and preserves the integrity of the data, wherein the communication protocol operates in accordance with a communication protocol standard that includes one or more write commands for writing data to a non-volatile memory, wherein the subject program code is configured to respond to at least one protocol command in accordance with the communication protocol standard, wherein the subject program code is configured to not write data to the non-transitory computer-readable media of the subject computer in response to receiving the one or more write commands of the communication protocol standard from the control computer; establishing a connection over the Internet between the data-repository computer and the examiner computer; performing a forensic analysis or eDiscovery process of the data stored on the data-repository computer via the Internet connection to the examiner computer; and outputting a report based on the forensic analysis or eDiscovery process.