Method and apparatus for data evidence collection

A method for operating a data processing system for collecting evidence of unauthorized access to a host computer system from a telephone line suspected of being a possible source of calls resulting in unauthorized access, comprising the steps, executed in real time of:

• monitoring the telephone line for a signal indicating the beginning of a call;
• capturing in volatile memory all data traffic on the telephone line for said call;
• analyzing the data traffic for content that identifies said call as an unauthorized access to said host computer;
• writing to non-volatile memory a file containing said captured data traffic and all subsequent data traffic upon determination during said analyzing step that said call has accessed said host computer;
• and
• erasing from said volatile memory said captured data upon the detection of the end of the call occurring before identification of said call as an unauthorized access.

A method of collecting evidence of unauthorized access from a potential intruder's line to equipment connected to the telecommunication network comprising the steps, executed in real time, of:

• monitoring all signals appearing on the subscriber's line on initiation and during a communication session established by the intruder;
• storing in a store said monitored signals and information identifying the communication session;
• responsive to said monitoring step comparing said monitored signals known to indentify equipment to which the intruder does not have legitimate access;
• detecting the end of a communication session;
• and
• deleting from the store the priorly stored information on detection of the end of a communication session before the identification of equipment to which the intruder does not have legitimate access.