| 摘要 |
<p>The Collector process (10) may be conveyed to the target computer on any media from which the target computer is capable of performing the boot process (12), and the results of the collector process (10) may be recorded on any removal medium upon which the target computer is capable of recording. The collector process is manufactured onto an industry standard diskette which may be stored for an indefinite amount of time until it is needed. The collector process (10) is initiated by placing the diskette (11) into the diskette drive of the target computer while it is in a power-off condition and then turning power on. This will cause the collector process (10) to be loaded into the volatile memory (14) of the target computer but will not affect the non-volatile memory (16). The collector process (10) then examines each of the non-volatile storage devices (16) connected to the target computer and constructs a record of their contents in the volatile memory (14) of the target computer. The records of contents are generated by the collector process (10) first looking to the directory (18) on the target computer to construct a database. The database is then compressed, encrypted, and stored (24) as described below. The data collected from the non-volatile disk devices (16) are reducted in size by an arbitrary data compression technique (22). These compressed, and optionally encrypted (24), data are then written to the original diskette replacing the collector process (10). Power on the target computer is then turned off (26) causing all records of the collector process (10) to be erased from volatile memory of the computer thereby not leaving any 'footprint' for the computer user to see or find.</p> |
