Patent ID: 7640323

Claim:
An electronic forensics tool comprising: a client component comprising a client program residing on a physical portable memory device, wherein said physical portable memory device is connected to a target device; wherein said client program loads onto said target device and analyzes hardware and software configurations of said target device; said client program further enabling a user to conduct a limited examination of data in a data storage device of said target device; said client program further displaying limited results of said limited examination, wherein said limited results display limited information concerning underlying data identified by said limited examination; wherein underlying data identified by said limited examination is not copyable without obtaining a command block; wherein underlying data identified by said limited examination is not extractable without obtaining a command block; wherein underlying data identified by said limited examination is not exportable without obtaining a command block; wherein underlying data identified by said limited examination is not further interpretable without obtaining a command block; and wherein underlying data identified by said limited examination is not further accessible beyond portions shown in said limited results display without obtaining a command block; said user obtaining a command block from a control server for providing said command block; wherein said command block comprises one or more directives that command said client component to conduct one or more command-block enabled functionalities; wherein said command block is transferred from said control server to said target device for application by said client program; and wherein said command-block enabled functionalities comprise one or more of: copying underlying data identified by said limited examination result; extracting underlying data identified by said limited examination result; exporting underlying data identified by said limited examination result; further interpreting underlying data identified by said limited examination result; further accessing underlying data identified by said limited examination result; and conducting one or more additional command-block enabled examination of said target device wherein said client program further enables a user to forensically read or view limited results of said limited examination or forensically copy data from said data storage device of said target device for external review; and wherein said command block is executable only on one or more data storage devices matching one or more drive keys contained in said command block.