|
-
September 29th, 2004, 12:37 AM
#2
I'll try to address these in order.
Data isn't "copied" per se. It's *officially*(I say officially because it's just a buzz word) called a bit stream copy. It's really just a mirror image of the original disk.
Securing the data is one of the simplest, yet most botched part of forensics. An improperly imaged disk, or modified data can destroy any case. To my knowledge, obstruction of justice charges can only be applied IF it can be proven that the person in question caused the damage.
Connecting a person to a crime is difficult and it's also a weak point in the system. Recently there was a kid in Europe that "hacked" an port harbor system in texas.(I can't remember all of the details..if someone can dig up the story..paste it here). In short, the kid got off because the prosecutors failed to link him to the use of the tools in question. The defense claimed that hackers compromised his system and used his computer a jump point. Whether this is true or not..we'll never know. Just like a regular crime..it must be proven without doubt. This is why the evidence collecting methods are imperative and why chain of evidence is so important.
How do you recover physically damaged disks... Well it takes money and someone that is damn good with an electron microscope. Typically the hard drive will be put in a clean lab, the covers will be removed and the platters will be removed as well. The platters are then placed under the scope and what is left of them is recovered by determining a 1 or 0. Very tedious..very difficult..VERY expensive.
The government deems something "unrecoverable" after the 5220 process but I don't think they trust it all that well. The air force has an even more rigorous procedure.
Having never recovered something from a physically damaged disk I don't know exactly how it's done.
the chain of evidence is what prevents things from being planted. never being alone with the evidence, documenting everything..
here's a little snippet from a website: G) Remember to document everything that goes on! Who did what, how, why, and at what time. Also, make sure that you have your designated custodian for the chain of custody initial each item after double-checking the list you have created AT THE SCENE. So, you have noted the configuration, the components, etc., and then the custodian of the evidence double checks your list and puts his/her initials next to yours while at the scene. It is imperative to do this checking at the scene so as to dispel the possibility of evidence tainting at a later date.
Decrypting encrypted files is a huge chore. This is partially where the volatile data collection comes in to play because the decryption key could potentially be resident in memory. Typically though, things like EFS have recovery keys, and using password crackers is always fun. If you have specific questions regarding decrypting encrypted files I, and others will try our best to answer them.
HTH
Antionline in a nutshell
\"You\'re putting the fate of the world in the hands of a bunch of idiots I wouldn\'t trust with a potato gun\"
Trust your Technolust
Posting Permissions
- You may not post new threads
- You may not post replies
- You may not post attachments
- You may not edit your posts
-
Forum Rules
|
|