The present invention is directed to an electronic forensic method for electronic discovery and computer forensics. The invention allows a user to conduct limited preliminary examination of computers using a client program on a physical memory device, whereby limited information about the examination result is displayed. To further access and examine the actual underlying data, the user must obtain additional functionality by obtaining a command block from a control server. The additional functionality will allow the client program to extract, copy, export, or further access the data of interest.