Patent ID: 8656095
Filing Date: 2014-02-18
Classification: G06F,G06Q

Abstract:
1. An electronic forensics tool comprising: a physical portable memory device, wherein said physical portable memory device is capable of connecting to a target device; and a forensic acquisition script, wherein said forensic acquisition script is able to load onto said target device and analyze hardware and software configurations of said target device and copy physical memory from the target device to the physical portable memory device, wherein the forensic acquisition script calculates digital signatures, message digests or hash values of available data storage devices in said target device and said physical portable memory device to verify that no modifications are made to the devices by comparing the corresponding digital signatures, message digests or hash values to each other; wherein a virtual machine file is generated based on the forensic acquisition script which, when executed by a virtual machine in a virtual machine environment, provides an exact copy of the target device to enable a user to navigate files of the target device in the virtual machine environment.