Abstract: Associating location information with forensic data is disclosed. A location information module may include an antenna, a controller and a display. The location information module may be included in or be removably coupled to a forensic device, and may be removably coupled with a computing device or other device. The location information module may obtain location information from a location system such as a global position system (GPS) or other system. The location information module may prompt a user to remove the location information module from a forensic device, computing device or other device and instruct the user to go to a place with good reception. The location information may be transferred to the forensic device, computing device, or other device where it may be paired with forensic data, hard disk data and/or other data and/or information.

Abstract: There is disclosed a data transfer device to allow a host to access a universal serial bus (USB) storage device as if it were a hard disk drive. The data transfer device may include a first interface unit to allow for communication with a host and a second interface unit to allow for communication with the USB storage device. The data transfer device may include a transfer logic unit to allow the host to access the USB storage device as if the USB storage device were a hard disk drive. The transfer logic unit may prevent harmful commands from reaching the USB storage device.

Abstract: Techniques for multiple virtual devices are disclosed. A method allowing for sharing a storage device among multiple users of a computing device may be implemented on a sharing device coupled with the computing device. The storage device may be a hard disk. Users may designate multiple virtual devices and select an active virtual device for booting. A method may include creating a virtual device table including identifying information for virtual devices and copying an operating system and application programs to each of the virtual devices on the storage device. The sharing device may be included in an add-on card, on a motherboard in the computing device, in the storage device, as part of the basic input output system chip of a computing device, and as a separate device between the storage device and the motherboard.

Abstract: Systems, methods, and devices for real-time searching are disclosed. A method comprises receiving a real-time data stream comprised of a plurality of characters and placing the characters in shift registers, the shift registers holding a current term. During each clock cycle of the data stream, the current term is evaluated to determine whether it matches any terms in a dictionary of terms, including indexing a plurality of look-up tables with the characters in each of the shift registers. A match data is output based on the evaluating. The method may be implemented in hardware in a computer forensic device, a controller, a computing device, and in other devices.

Abstract: Systems, methods, and devices for nondestructive data transfer are disclosed. A method comprises monitoring commands directed to a storage device and evaluating the commands to determine whether the commands are harmful or benign. Benign commands are presented to the storage device. If a command is harmful to the contents of the storage medium, a replacement command is presented to the storage device, and a response expected from the storage device is emulated. A device implementing the method may include an intercept logic, a bridge unit and an isolate switch. In an embodiment of a system that implements the method, the device is coupled between a storage device and a computing device. The method may be implemented in software instructions stored on a machine readable medium and executed by a processor.

Abstract: Techniques for multiple virtual devices are disclosed. A method allowing for sharing a storage device among multiple users of a computing device may be implemented on a sharing device coupled with the computing device. The storage device may be a hard disk. The method may comprise receiving a storage device access command including a virtual device address, translating the virtual device address to a translated address, and forwarding to the storage device the access command with the translated address in place of the virtual device address. Users may designate multiple virtual devices and select an active virtual device for booting. The sharing device may be included in an add-on card, on a motherboard in the computing device, in the storage device, as part of the basic input output system chip of a computing device, and as a separate device between the storage device and the motherboard.

Abstract: Systems, methods, and devices for real-time searching are disclosed. A method comprises receiving a real-time data stream comprised of a plurality of characters and placing the characters in shift registers, the shift registers holding a current term. During each clock cycle of the data stream, the current term is evaluated to determine whether it matches any terms in a dictionary of terms, including indexing a plurality of look-up tables with the characters in each of the shift registers. A match data is output based on the evaluating. The method may be implemented in hardware in a computer forensic device, a controller, a computing device, and in other devices.