Patent ID: 7644138

Claim:
A method of conducting electronic forensic examination on a target device comprising the steps of: loading a client component comprising a client program residing on a physical portable memory device onto said target device; said client program analyzing hardware and software configurations of said target device and displaying available data storage devices for analysis; selecting a data storage device and requesting a limited examination of said data storage device for data of interest; said client program displaying limited results of said limited examination, wherein said limited results display limited information concerning underlying data identified by said limited examination; wherein underlying data identified by said limited examination is not copyable without obtaining a command block; wherein underlying data identified by said limited examination is not extractable without obtaining a command block; wherein underlying data identified by said limited examination is not exportable without obtaining a command block; wherein underlying data identified by said limited examination is not further interpretable without obtaining a command block; and wherein underlying data of interest identified by said limited examination is not further accessible beyond portions shown in said limited results display without obtaining a command block; determining whether further access to said data of interest is desired; obtaining said command block from a control server, wherein said command block comprises one or more directives that command said client program to conduct additional command-block enabled functionalities; transferring said command block from said control server to said target device; and said client program recognizing and accepting said command block and executing said directives; and wherein said command-block enabled functionalities comprise one or more of: copying underlying data identified by said limited examination result; extracting underlying data identified by said limited examination result; exporting underlying data identified by said limited examination result; further interpreting underlying data identified by said limited examination result; further accessing underlying data identified by said limited examination result; and conducting one or more additional command-block enabled examination of said target device wherein said client program further enables a user to forensically read or view limited results of said limited examination or forensically copy data from said data storage device of said target device for external review; and wherein said command block is executable only on one or more data storage devices matching one or more drive keys contained in said command block.