System and method for preserving forensic computer data

A computer system, comprising:

• a processor including code therein configured to receive evidentiary data from a data source;
• a memory configured to collect the evidentiary data;
• a protected hardware-based forensic data reserve including code therein configured to store the collected evidentiary data as forensic data;
• and
• a remediation module including code therein configured to remediate a data attack on the computer system using the stored forensic data by restoring deleted data from the stored forensic data, wherein the deleted data were removed from the computer system during the data attack.

A system, comprising:

• a network;
• an external data source communicatively connected to the network;
• and
• a computer communicatively connected to the network and including:
• a processor including code therein configured to receive evidentiary data from an internal data source or the external data source;
• a memory configured to collect the evidentiary data;
• a protected hardware-based forensic data reserve including code therein configured to store the collected evidentiary data as forensic data;
• and
• a remediation module including code therein configured to remediate a data attack on the computer using the stored forensic data by restoring deleted data from the stored forensic data, wherein the deleted data were removed from the computer during the data attack.