Patent ID: 7899828

Claim:
A computer readable medium having stored thereon data representing instructions that, when executed by a processor, cause the processor to perform operations comprising: generating a tag describing an object of a communication captured during transmission of the communication from an origination address to a destination address, extracted from the communication, and stored in a memory block, wherein the tag includes, a source address field to indicate an origination address of the object, a destination address field to indicate a destination address of the object, a source port field to indicate an origination port of the object, a destination port field to indicate a destination port of the object, a content field to indicate a content type from a plurality of content types identifying a type of content contained in the object, and a time field to indicate when the object was captured; and storing the tag in a database, wherein the tag indexes the object in the memory block, the tag being stored to allow subsequent searching for the object based on one or more of the fields, wherein the fields are obtained from the communication, and wherein the object is part of a document captured based on a capture rule that defines which objects are to be captured, wherein the capture rule is part of a default rule set for a capture system configured to monitor network traffic, and wherein a determination is made based on the capture rule to discard or to store the document, and wherein the capture rule identifies a first internet protocol (IP) address from which the document was sent and a second IP address associated with an intended destination of the document.