Patent ID: 7899882
Filing Date: 2011-03-01
Classification: H04L

Abstract:
1. A method of performing a forensic investigation of a first computer that comprises a subject computer with a second computer, comprising: executing modified iSCSI target program code on the subject computer; wherein the modified iSCSI target program code is modified to be read only and cannot write to non-volatile memory in response to receiving any command including a write command; executing iSCSI Initiator program code on the second computer; establishing a secure authenticated connection between the subject computer and the second computer, wherein the modified iSCSI target program code is configured to respond to a plurality of iSCSI commands from an iSCSI Initiator substantially in accordance an iSCSI standard; executing a forensic instruction set on the second computer to analyze data of the subject computer via the connection; and generating a report based on said executing the forensic instruction set to analyze the data on the subject computer.