Patent ID: 7886049

Claim:
A non-transitory computer-readable medium comprising instructions that cause one or more processors, in a forensics device, to: determine, with an analysis control module executing on the forensics device, whether two or more peer-to-peer clients are or have been installed on a target device by identifying usage information associated with two or more peer-to-peer modules installed on the forensics device, wherein each of the peer-to-peer clients corresponds to a different one of a plurality of peer-to-peer file sharing protocols, wherein each of the peer-to-peer modules installed on the forensics device provides configuration data, to the analysis control module, for a corresponding one of the peer-to-peer file sharing protocols to determine whether a peer-to-peer client associated with that peer-to-peer file sharing protocol is or has been installed on the target device, and wherein the configuration data from each of the peer-to-peer modules configures the analysis control module to detect and extract the specific usage information from the target device for the corresponding peer-to-peer client; gather, with the analysis control module, the usage information for the peer-to-peer clients that had been determined to be installed on the target device based on the configuration data provided by the peer-to-peer modules installed on the forensics device; analyze the gathered usage information for the peer-to-peer clients that had been determined to be installed on the target device; and generate a report of the analyzed gathered usage information for the peer-to-peer clients that had been determined to be installed or had been installed on the target device.