Problem with prosecution...
Most X-Rays will not damage most hard drives. Hard drives are
shielded.
Proof of no mutation is the checksums on each sector of the hard
drive. Unless those fail to pass, the data didn't "mutate".
-----Original Message-----
From: full-disclosure-bounces@xxxxxxxxxxxxxxxxx
[mailto:full-disclosure-
bounces@xxxxxxxxxxxxxxxxx] On Behalf Of Gaurav Kumar
Sent: Tuesday, July 05, 2005 8:50 AM
To: full-disclosure@xxxxxxxxxxxxxxxxx
Subject: Re: [Full-disclosure] Re: Tools accepted by the courts
i wish to share what happened in real life-
the lawyer shows proofs of the hacking done. the judge say "ok" the
defense guy asked, is this proof passed through the x-ray detector
of
airport while the proof was shipped. "yes" was the obvious reply.
defense lawyer continued .."since this proof has passed thru xrays,
there are chances that it might have been mutated" by the rays.
the defendant wont having benefit of doubt.
regards,
gaurav
On 7/5/05, Jason Coombs <jasonc@xxxxxxxxxxx> wrote:
Evidence Technology wrote:
That era is quickly fading. Going forward, I think we'll see
more
and more digital evidence rendered inadmissible via failure to
adhere to established evidentiary standards.
Jerry,
No way. What 'evidentiary standards' are you talking about here?
I'm sorry but that's just absurd. How will there ever be
'evidentiary
standards' on the contents of my filing cabinet and my personal
pornography collection?
The police find the data where they find it. That's called
'circumstantial evidence' and digital evidence will always be
treated
exactly as such no matter who we successfully convince of the
flaws
inherent in the filing cabinet or printed document/glossy
photograph
analogy.
What I demand to hear spoken by law enforcement, and what I insist
prosecutors compel law enforcement to speak if they don't
volunteer
these words out of their own common sense, is the following:
"Yes, that's what we found on the hard drive but there's little or
no
reason for us to believe that the defendant is responsible for
placing
it there just because the hard drive was in the defendant's
possession.
We often see cases where hard drives are installed second-hand and
data
from previous owners remains on the drive, we can't tell when the
data
in question was written so it's important to be aware that
hundreds of
other people could have placed it there. We also see cases where
software such as spyware or Web pages full of javascript force a
suspect's Web browser to take actions that result in the
appearance that
the owner of the computer caused Internet content to be retrieved
when
in fact the owner of the computer may not have known what was
happening,
malicious Web site programmers know how to use techniques such as
pop-unders and frames to hide scripted behavior of Web pages.
Furthermore, once the Web browser is closed and its temporary
files are
deleted, every bit of data that was saved 'temporarily' to a file
by the
browser becomes a semi-permanent part of the hard drive's
unallocated
space and we have no way to tell the difference between data that
was
once part of a temporary file created automatically by a Web page
being
viewed or scripted inside a Web browser and the same data placed
intentionally on the hard drive by its owner without the use of
the
Internet. Also ..."
Disrespectfully Yours,
(with extreme prejudice born of intense frustration due to the
fact
that nobody cares about getting this stuff right when it's so much
easier just to collect a forensic paycheck and move on to the next
victim -- I would like to think you are part of the solution
rather than
being part of the problem but you're talking nonsense and so is
nearly
everyone else in the computer forensics field, most especially the
computer forensics vendors who need people to love them in order
to make
their businesses grow. They do not deserve respect and they most
certainly fail the 'lovable' test, but television shows like CSI
and
visions of fat bank accounts have deceived everyone
temporarily...)
Please get a clue before you hurt somebody.
Jason Coombs
jasonc@xxxxxxxxxxx
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/