ExpertLaw.com Forums

Failure to Mirror a Hard Drive

Printable View

  • 12-13-2005, 07:07 PM
    bradte20
    Failure to Mirror a Hard Drive
    since I was on the topic of cybercrimes and stuff, thought i'd put a post up here about forensic investigators. Turns out, many HDD's evidence has been invalidated by the fact that investigators did not make a mirror image of the HDD before looking at the content. Also was reading about paranoid people fearing that even a destroyed disk, such as a shattered hard drive platter, could still have recoverable info on it. So if they had MP3 files or other illegally downloaded music on it, wold the HDD possibly be effective in retaining evidence? I don't see how anyone could make a mirror image of HDD pieces that were shattered, especially ones such as lap top hard drives made of glass. Yes, those fragments of the HDD can be read by microscope and so forth, but only the most elite gov agencies would have the technology to do so. And if it was evidence they were looking for, well, evidence tampering comes into question. Not to mention the HDD was not even in there possession. ( This is of course if they wanted to go to the trouble in the first place.) Just wondered if anyone had thoughts on the subject. Kind of a new thing out there that has come up advances in technology
  • 12-13-2005, 10:16 PM
    aaron
    Destruction of Evidence
    The problem with not mirroring (and ideally then performing the forensics on the mirror) is first that if you perform destructive testing the other side can't verify your data, and second that there is no way of establishing that even nondestructive testing didn't alter or destroy data from its original state.

    But if no mirroring was possible due to the deliberate acts of the party objecting to the test results, for example in an effort to destroy evidence in a potential civil or criminal case, I doubt that a judge would exclude the evidence on that basis alone.

    Some companies do amazing recovery work, even with severely damaged drives - Examples.
  • 12-13-2005, 10:43 PM
    bradte20
    interesting, what do you think about the possession aspect of it. If it was a HDD you threw away 5 years ago. There really isn't any way to prove the activity was yours. Again, this is assuming anyone wishes to dig dirt up on you and that he disk didn't make it to the landfill. Also, statute of limitations would begin as well after a certain amount of time
All times are GMT -7. The time now is 09:48 PM.
Powered by vBulletin® Version 4.2.4
Copyright © 2023 vBulletin Solutions, Inc. All rights reserved.
Copyright © 2004 - 2018 ExpertLaw.com, All Rights Reserved