Systems for automated forensic data capture

Abstract

Systems for the automated capture of forensic data information are presented. An example system may receive an access/modification request directed to a data item(s), generate an initial data capture record for the data item(s), and send the record to an isolated, secure data preservation module before granting the request. After the access/modification, the system may generate a post-access data capture record and send it to the preservation module. The system may determine the content of the generated records, based on, e.g., content of the data item(s), before generation. For example, the system may determine a first content type for records where data item(s) include critical data, and a second content type for records that do not, to, e.g., efficiently allocate system resources while minimizing any disruption to an accessing user. The system may also utilize different encryption and decryption key techniques based on, e.g., the content of the data item(s).