Method and apparatus for transferring and reconstructing an image of a computer readable medium

A method for reconstructing a bit-for-bit copy of an image of a computer readable medium, the method comprising:

• receiving a skeleton image via a communications network, the skeleton image generated by excluding redundant data duplicative of locally stored data from the image of the computer readable medium;
• receiving at least one hash value for the redundant data and at least one location identifier specifying a location of the redundant data on the image of the computer readable medium;
• and
• reconstructing a bit-for-bit copy of the image of the computer readable medium by compiling the locally stored data with the skeleton image based, at least in part, on the received hash value of the redundant data and the received location identifier of the redundant data.

A computer program product, tangibly embodied in a computer readable storage medium, for transferring a forensically sound image of a second computer readable storage medium across a communications network, the computer program product including instructions operable to cause a data processing apparatus to:

• scan an image of the second computer readable storage medium for redundant data, the redundant data duplicative of locally stored data;
• generate a skeleton image based on the image of the second computer readable storage medium by excluding the redundant data from the image of the second computer readable storage medium;
• and
• transmit, by a transmitting device, the skeleton image over the communications network to a receiving device to enable reconstruction of an image copy of the second computer readable storage medium using the skeleton image and the locally stored data.

A computer program product, tangibly embodied in a computer readable storage medium, for reconstructing a bit-for-bit copy of a second computer readable storage medium, the computer program product including instructions operable to cause a data processing apparatus to:

• receive a skeleton image transmitted via a communications network, the skeleton image generated by excluding redundant data from the image of the second computer readable medium, the redundant data duplicative of locally stored data;
• receive at least one hash value for the redundant data and at least one location identifier specifying a location of the redundant data on the image of the second computer readable medium;
• and
• reconstruct a bit-for-bit copy of the image of the second computer readable medium by compiling the locally stored data with the skeleton image, based, at least in part, on the received hash value of the redundant data and the received location identifier of the redundant data.

A method for transferring an image of a computer readable storage medium across a low bandwidth communications network, the method comprising:

• scanning the image of the computer readable storage medium for known data;
• generating a skeleton image of the image of the computer readable storage medium by excluding the known data from the image of the computer readable storage medium so that skeleton image includes unknown data in the computer readable storage medium;
• and
• transmitting, by a transmitting device, the skeleton image over the communications network to a receiving device to enable analysis of the skeleton image.