METHODOLOGY, SYSTEM, AND COMPUTER-READABLE MEDIUM FOR COLLECTING DATA FROM A COMPUTER

摘要

A computerized method for collecting suspected data of interest from a computer comprises searching the computer's shot-term memory to locate at least one target memory range containing the suspected data of interest, and copying (229) the suspected data of interest within the target memory range to an alternate data storage location in a manner which avoids writing the suspected data to the computer's long-term memory. Alternatively, the suspected data of interest can be copied to a previously unused data storage location while preserving integrity of non-volatile memory resources. A computer-readable medium and a system for collecting target forensics data are also provided.