|
Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com |
Re: [Dataloss] Stolen laptop returned to Beaumont Hospital
From: Chris Walsh (cwalsh
cwalsh.org)
Date: Sun Aug 27 2006 - 18:51:24 CDT
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]
Indeed, the ability to copy a disk w/out altering it is necessary in order for
evidence to hold up in court. If the police change the disk by examining it,
then how could the defense independently examine the same body of evidence?
http://www.cftt.nist.gov/disk_imaging.htm is a useful link, IMO.
Chris
On Thu, Aug 24, 2006 at 01:49:36PM -0700, George Toft wrote:
> In the wake of similar statements in the VA laptop case, I talked to a
> computer forensics expert and he confirmed that as long as Windows was
> not used to access the drive, then the markers used to indicate file
> access will remain intact and indicate no access.
_______________________________________________
Dataloss Mailing List (datalossattrition.org)
http://attrition.org/dataloss
Tracking more than 142 million compromised records in 315 incidents over 6 years.
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]