Abstract: Systems, methods, and devices for real-time searching are disclosed. A method comprises receiving a real-time data stream comprised of a plurality of characters and placing the characters in shift registers, the shift registers holding a current term. During each clock cycle of the data stream, the current term is evaluated to determine whether it matches any terms in a dictionary of terms, including indexing a plurality of look-up tables with the characters in each of the shift registers. A match data is output based on the evaluating. The method may be implemented in hardware in a computer forensic device, a controller, a computing device, and in other devices.

Abstract: Systems, methods, and devices for nondestructive data transfer are disclosed. A method comprises monitoring commands directed to a storage device and evaluating the commands to determine whether the commands are harmful or benign. Benign commands are presented to the storage device. If a command is harmful to the contents of the storage medium, a replacement command is presented to the storage device, and a response expected from the storage device is emulated. A device implementing the method may include an intercept logic, a bridge unit and an isolate switch. In an embodiment of a system that implements the method, the device is coupled between a storage device and a computing device. The method may be implemented in software instructions stored on a machine readable medium and executed by a processor.

Abstract: Systems, methods, and devices for real-time searching are disclosed. A method comprises receiving a real-time data stream comprised of a plurality of characters and placing the characters in shift registers, the shift registers holding a current term. During each clock cycle of the data stream, the current term is evaluated to determine whether it matches any terms in a dictionary of terms, including indexing a plurality of look-up tables with the characters in each of the shift registers. A match data is output based on the evaluating. The method may be implemented in hardware in a computer forensic device, a controller, a computing device, and in other devices.