Patent ID: 8171108

Claim:
A method of performing a forensic analysis of a first computer having a non-volatile memory with a second computer, comprising: executing on the first computer a first program code configured to provide communications via a non-proprietary communication protocol; executing on the second computer a second program code configured to provide communications via the non-proprietary communication protocol; establishing a connection between the second computer and the first computer via the non-proprietary communication protocol; wherein the non-proprietary communication protocol operates in accordance with a non-proprietary communication protocol standard that includes one or more write commands for writing data to a non-volatile memory; wherein the first program code is configured to respond to at least one non-proprietary protocol command in accordance with the non-proprietary communication protocol standard; wherein the first program code is configured to not write data to the non-volatile memory of the first computer in response to receiving the one or more write commands of the non-proprietary communication protocol standard; and wherein the non-proprietary communication protocol comprises an Internet Small Computer System Interface (iSCSI) protocol, or any Small Computer System Interface (SCSI) protocol communication exchanged over a network via HTTPS; performing a first forensic analysis of the first computer via the connection; and outputting a report based on the first forensic analysis.