Re: [Full-Disclosure] Hard drive images

[Craig Pratt <craig@strong-box.net>]

On Tuesday, Aug 5, 2003, at 13:23 US/Pacific, Ron DuFresne wrote:
> On Tue, 5 Aug 2003, David Hayes wrote:
>
>> Our old standby, "dd", is perfectly acceptable for making an image of
>> a hard drive to be used in court.  It's even the #1 choice of the FBI,
>> and accepted by U.S. federal courts.  From the trial court order on
>> admission of evidence in the case of Zacarias Moussaoui (the accused
>> 20th hijacker of 9/11):
>>
>
> Interesting, I would have thought that the original was required for 
> the
> courts, and that forensics was conducted on the copy.
>
> Thanks,
>
> Ron DuFresne

I believe there are ways to recover data at the physical/magnetic level 
- magnetic  remnants of previously-deleted data, for instance - which 
would require access to the original platters. I read an article about 
this somewhere - would have to be SciAm or /.

C

---
Craig Pratt
Strongbox Network Services Inc.
mailto:craig@strong-box.net
dtmf:503.706.2933


-- 
This message checked for dangerous content by MailScanner on StrongBox.


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html