Patent ID: 9087207
Filing Date: 2015-07-21
Classification: G06F,G06Q

Abstract:
1. A method of a first computer system obtaining a complete forensic image of an electronic storage media that is part of a second computer system containing electronic data, by collecting forensic data, the storage media being part of the second computer system which includes a display screen, the method comprising the steps of: a. using the first computer system to store a data collection program on a password-encrypted external storage device, the storage device having a USB 1.1 or greater interface, the storage device receiving all of its operating power via the USB interface, the first computer system modifying the data collection program, b. sending the external storage device to the custodian of the electronic data, together with means for the custodian to easily return the external storage device; c. the custodian connecting the external storage device to the second computer system containing the storage media, once connected, the data collection program displaying a splash screen on the display screen; d. the data collection program, via the splash screen, using the second computer system to forensically collect the electronic data to create a complete forensic image, on the external storage device, of the storage media containing the electronic data; e. the data collection program encrypting the external storage device; f. the data collection program auditing the forensic image; and g. the data collection program preserving an exact copy of the forensic image onto the external storage device without making changes to the forensic image.