System and method for collecting electronic evidence data

A method for collecting electronic evidence data from a computer, wherein the method comprises:

• obtaining an agent software application, wherein the agent software application includes predefined criteria to identify data that is characteristic of electronic evidence, wherein the agent software application is configured to transmit the identified data to a server;
• executing the agent software application;
• and
• transmitting the identified data from the computer to the server.

A computer system for collecting electronic evidence on a server from a plurality of computers, wherein the computer system comprises:

• means for providing an agent software application to the plurality of computers, wherein the agent software application is configured and arranged with a predefined criteria to identify data that is characteristic of electronic evidence, wherein the agent software application is configured and arranged to transmit the identified data to the server;
• means for executing the agent software application on at least one computer of the plurality of computers;
• means for receiving the identified data at the server, wherein the identified data is received from at least one computer of the plurality of computers;
• and
• means for storing the identified data on a memory device of the server.

A computer system for collecting electronic evidence on a server from a computer, wherein the computer system comprises:

• means for receiving an agent software application, wherein the agent software application is configured and arranged with a predefined criteria to identify data that is characteristic of electronic evidence, wherein the agent software application is configured and arranged to transmit the identified data to the server;
• means for executing the agent software application;
• and
• means for transmitting the identified data from the computer to the server.

A computer-readable medium having computer-executable components for collecting electronic evidence data, wherein the components comprise:

• a template data component operable to define a criterion that instructs a software application to identify and collect information describing a plurality of hardware components of a computer executing the software application;
• an identification data component operable to define a criterion that instructs a software application to access secured data stored in the computer executing the software application;
• and
• a transfer data component operable to define a criterion that instructs a software application to transmit the secured data stored in the computer and the data that is identified in the template component.

A computer system comprising a plurality of computers and a collection server, wherein the computer system is configured for collecting electronic evidence data from the plurality of computers and storing the electronic evidence data on the collection server, the system comprises:

• means for generating an agent software application, wherein the agent software application is configured and arranged with a predefined criteria to identify data that is characteristic of electronic evidence, wherein the agent software application is configured and arranged to transmit the identified data to the collection server;
• means for transmitting the agent software application to the plurality of computers;
• means for executing the agent software application, wherein the execution of the agent software application produces identified data that is characteristic of electronic evidence;
• and
• means for transmitting the identified data from the plurality of computers to the collection server.

A method for collecting electronic evidence data from a computer, wherein the method comprises:

• obtaining an agent software application, wherein the agent software application includes predefined criteria to identify data that is characteristic of electronic evidence, wherein the agent software application is configured to transmit the identified data to a server;
• executing the agent software application;
• and
• storing the identified data on a computer-readable medium.