# How to Secretly Collect Digital Evidence from Computers > This patent describes a system for secretly collecting digital evidence and monitoring activity from computers using a single software agent that runs only in memory and sends data to a cloud server for smart analysis. - **Patent:** US 12739263 - **Original title:** Remote operations forensics - **Granted:** 2026 - **Status:** Active - **Times cited:** 0 - **Field:** software, cybersecurity, cloud_computing, telecommunications ## What it does The patent describes a system for monitoring computers and collecting digital evidence, called "forensic artifacts." It uses a single software program, or "agent," installed on the target computer, known as an "endpoint." This agent is designed to run entirely "in memory," meaning it avoids writing data to the computer's hard drive, making it harder to detect. The collected evidence is then broken into smaller pieces, or "chunked," prior to being sent to a "cloud server." This cloud server then organizes the data by "category," processes it, and can even summarize it or highlight the most important parts. The cloud server also allows users to ask questions about the data using everyday language, like asking a search engine. For example, a company's security team could use this system to investigate a computer suspected of being hacked, collecting evidence without leaving traces on the disk that an attacker might find and remove. ## What it does NOT cover - Does not cover systems where separate software agents are used for monitoring and for collecting forensic evidence. - Does not cover agents that primarily store collected forensic data on the local computer's hard drive before transfer. - Does not cover transferring forensic artifacts to a cloud server without first breaking them into smaller chunks. - Does not cover cloud analysis systems that only provide raw data without summaries or identification of relevant information. - Does not cover systems that require complex, non-natural language commands to query monitoring data and forensic artifacts. ## The clever bit The truly clever part is the "in memory" operation of the agent, which allows it to collect sensitive "forensic artifacts" and monitoring data without leaving persistent traces on the target computer's disk. This stealthy approach significantly reduces the risk of detection and evidence tampering during an investigation. ## Real-world examples 1. Endpoint Detection and Response (EDR) platforms 2. Incident response tools 3. Cloud-based security analytics services 4. Digital forensics software ## Why it matters This technology matters because it allows for more discreet and efficient cybersecurity investigations. By operating "in memory" and avoiding disk writes, the system makes it harder for sophisticated attackers to detect and tamper with the evidence collection process. The integrated agent and cloud-based analysis, including natural language queries, streamline the process of understanding complex security incidents, helping organizations respond faster to threats. ## Frequently asked questions ### What does How to Secretly Collect Digital Evidence from Computers cover? This patent describes a system for secretly collecting digital evidence and monitoring activity from computers using a single software agent that runs only in memory and sends data to a cloud server for smart analysis. ### When does this patent expire? This patent is expected to expire on September 15, 2046, when the invention enters the public domain. ### What problem does this patent solve? This technology matters because it allows for more discreet and efficient cybersecurity investigations. By operating "in memory" and avoiding disk writes, the system makes it harder for sophisticated attackers to detect and tamper with the evidence collection process. The integrated agent and cloud-based analysis, including natural language queries, streamline the process of understanding complex security incidents, helping organizations respond faster to threats. ### What does this patent NOT cover? Does not cover systems where separate software agents are used for monitoring and for collecting forensic evidence. **Full plain-English explainer:** https://patentbrief.org/patent/us/12739263/remote-operations-forensics **Original patent:** https://patents.google.com/patent/US12739263 --- _Source: PatentBrief — https://patentbrief.org. Patent facts are from public records; the plain-English explanation is PatentBrief's._ ## Related patents Semantically similar inventions in the PatentBrief corpus: - [How to Monitor Secure Government Computer Networks Automatically](https://patentbrief.org/patent/us/12244567/spacex-philosophy) — A system that automatically collects, organizes, and displays security data from highly secure government networks to help administrators spot potential threats or performance issues. - [Managing and Updating AI on Many Smart Devices from the Cloud](https://patentbrief.org/patent/us/11876858/cloud-based-fleet-and-asset-management-for-edge-computing-of-machine-learning-an) — This patent describes a system for remotely monitoring and updating artificial intelligence models running on a fleet of connected smart devices, like factory robots or smart cameras, all managed from a central cloud-based control panel. - [How Software Automatically Collects and Organizes Data from Multiple Websites](https://patentbrief.org/patent/us/8112476/amazon-ec2-elastic-compute-cloud) — A system that automatically logs into multiple websites, pulls information, and stores it locally before you even ask for it, so it is ready to view instantly. - [How Microsoft Protects Corporate Data on Employee Devices](https://patentbrief.org/patent/us/9430664/windows-defender-antivirus) — A system that lets companies remotely lock or delete specific work data on a phone or computer without wiping the user's personal files. - [How a Single Command Deploys Cloud Infrastructure Automatically](https://patentbrief.org/patent/us/12739267/automated-cloud-infrastructure-deployment) — This patent describes an automated system that takes one command to deploy computing resources across different cloud platforms using various Infrastructure as Code tools, then connects them to a monitoring system.