Patent ID: 7640323
Filing Date: 2009-12-29
Classification: G06F

Abstract:
1. An electronic forensics tool comprising: a client component comprising a client program residing on a physical portable memory device, said user obtaining a command block from a control server for providing said command block; wherein said command block comprises one or more directives that command said client component to conduct one or more command-block enabled functionalities; wherein said command block is transferred from said control server to said target device for application by said client program; and wherein said command-block enabled functionalities comprise one or more of: copying underlying data identified by said limited examination result; extracting underlying data identified by said limited examination result; exporting underlying data identified by said limited examination result; further interpreting underlying data identified by said limited examination result; further accessing underlying data identified by said limited examination result; and conducting one or more additional command-block enabled examination of said target device wherein said client program further enables a user to forensically read or view limited results of said limited examination or forensically copy data from said data storage device of said target device for external review; and wherein said command block is executable only on one or more data storage devices matching one or more drive keys contained in said command block.