Patent ID: 7370072

Claim:
A method for collecting electronic evidence data from one or more computers, wherein the method comprises: providing an agent software application to the one or more computers, wherein the agent software application includes criteria to identify data that is characteristic of electronic evidence, said criteria comprising at least one predetermined keyword to search for in a data file, a data file attribute that indicates a time when the data file was accessed, a file type, and a directory location in which the data file is stored, wherein said electronic evidence data further concerns an operational aspect of the one or more computers on which the agent software application is executing, and wherein the agent software application is configured to transmit the identified electronic evidence data to a server; executing the agent software application on at least one computer, wherein the execution of the agent software application searches a local memory of the computer and identifies said electronic evidence data in said local memory; transmitting the identified data from at least one computer executing the agent software application to the server; receiving the identified data at the server, wherein the identified data is received from at least one computer executing the agent software application; storing the identified data on a memory device of the server; verifying a receipt of the identified data at the server; and generating a report of the identified data.