US Patent 10140475 Forensic computer examination systems and methods

Systems, methods, and computer program products for facilitating write-protected virtual access to a target computing device, wherein the use and inspection of the computer device may occur without altering the digital data thereon, are disclosed. In an aspect, a user inserts a virtualization media device, which will boot the computer system in a write-protected mode. The computing device will operate through an operating system on the target computing device and instantiate the subject computer through a virtual machine environment. Such virtualization will protect target computing device files from accidental alteration during, for example, investigatory searches of the target computing device storage device.