Patent ID: 8271794

Claim:
A method, comprising: receiving a request to present a previously captured object to a user, wherein the captured object was intercepted by a capture system configured to intercept packets from data streams, and store network transmitted objects from the data streams according to a capture rule that defines which objects are to be captured by the capture system; accessing a tag associated with the object being requested, the tag containing metadata related to the object, wherein the metadata includes an object signature; verifying the tag has not been altered using a tag signature, wherein the tag signature is generated using at least a portion of the metadata, wherein the portion of the metadata used to generate the tag signature contains the object signature; verifying that the object has not been altered since capture using the object signature in the tag associated with the object; and presenting the object if the object and the tag are verified, and wherein if either the object or the tag is not verified, then an alert is generated to indicate whether the object or the tag has been compromised.