Patent ID: 8365297

Claim:
An automated computer-implemented method for investigating a presence of an unknown program on a target computer system that includes a processor, memory, and a basic input/output system (BIOS), and that further includes a bootable device that contains boot code at least partially defining a boot process for the target computer system, the method comprising: obtaining, by an automated protection system, physical parameter data defining a storage arrangement structure of the bootable device; emulating, by the automated protection system, the boot process of the target computer system based on the physical parameter data, wherein the emulating is carried out in a virtual environment representing the target computer system, and includes executing the boot code and obtaining boot process information in response to executing of the boot code; generating, by the automated protection system, a data structure representing at least the boot process information; and based on the data structure, obtaining a determination of whether the boot process information includes an unknown program.