Obtaining Complete Forensic Images Of Electronic Storage Media
First Claim
1. A method of obtaining a complete forensic image of an electronic storage media containing electronic data, the storage media being part of a computer system, the method comprising the steps of:
- (a) storing a data collection program on an external storage device;
(b) sending the external storage device to a custodian of the electronic data, together with means for the custodian to easily return the external storage device;
(c) requiring the custodian to connect the external storage device to a computer system containing the storage media;
(d) requiring the custodian to use the data collection program to forensically collect the electronic data to create a complete forensic image of the storage media containing the electronic data;
(e) authenticating the forensic image; and
(f) preserving an exact copy of the forensic image without making changes to the forensic image.
3 Assignments
0 Petitions
Accused Products
Abstract
In a method of obtaining a complete forensic image of an electronic storage media containing electronic data, the storage media is part of a computer system. The method includes the steps of: (a) storing a data collection program on an external storage device; (b) sending the external storage device to a custodian of the electronic data, together with means for the custodian to easily return the external storage device; (c) requiring the custodian to connect the external storage device to a computer system containing the storage media; (d) requiring the custodian to use the data collection program to forensically collect the electronic data to create a complete forensic image of the storage media containing the electronic data; (e) authenticating the forensic image; and (f) preserving an exact copy of the forensic image without making changes to the forensic image.
-
Citations
13 Claims
-
1. A method of obtaining a complete forensic image of an electronic storage media containing electronic data, the storage media being part of a computer system, the method comprising the steps of:
-
(a) storing a data collection program on an external storage device; (b) sending the external storage device to a custodian of the electronic data, together with means for the custodian to easily return the external storage device; (c) requiring the custodian to connect the external storage device to a computer system containing the storage media; (d) requiring the custodian to use the data collection program to forensically collect the electronic data to create a complete forensic image of the storage media containing the electronic data; (e) authenticating the forensic image; and (f) preserving an exact copy of the forensic image without making changes to the forensic image. - View Dependent Claims (2, 3, 4, 5, 6, 7)
-
-
8. A computer-readable, encrypted portable data storage device encoded with a computer program containing a method of obtaining from a custodian of electronic data a complete forensic image of an electronic storage media containing the electronic data, the storage media being part of a computer system, the method comprising the steps of:
-
(a) creating a sector-by-sector forensic image of the storage media by calling a data collection program; (b) storing the forensic image on the portable data storage device; (c) verifying the integrity of the forensic image; (d) performing an audit of the forensic image, and storing the resulting information in a file on the portable data storage device; (e) displaying a message advising the custodian that (i) the process is completed, and (ii) the portable data storage device can now be disconnected from the computer system; and (f) preserving an exact copy of the forensic image without making changes to the forensic image. - View Dependent Claims (9, 10, 11, 12, 13)
-
Specification