Results 1 to 3 of 3

Hybrid View

  1. #1
    Join Date
    Dec 2005
    Location
    Indianapolis
    Posts
    14

    Default Failure to Mirror a Hard Drive

    since I was on the topic of cybercrimes and stuff, thought i'd put a post up here about forensic investigators. Turns out, many HDD's evidence has been invalidated by the fact that investigators did not make a mirror image of the HDD before looking at the content. Also was reading about paranoid people fearing that even a destroyed disk, such as a shattered hard drive platter, could still have recoverable info on it. So if they had MP3 files or other illegally downloaded music on it, wold the HDD possibly be effective in retaining evidence? I don't see how anyone could make a mirror image of HDD pieces that were shattered, especially ones such as lap top hard drives made of glass. Yes, those fragments of the HDD can be read by microscope and so forth, but only the most elite gov agencies would have the technology to do so. And if it was evidence they were looking for, well, evidence tampering comes into question. Not to mention the HDD was not even in there possession. ( This is of course if they wanted to go to the trouble in the first place.) Just wondered if anyone had thoughts on the subject. Kind of a new thing out there that has come up advances in technology

  2. #2
    Join Date
    Mar 2005
    Location
    Michigan
    Posts
    28,906

    Default Destruction of Evidence

    The problem with not mirroring (and ideally then performing the forensics on the mirror) is first that if you perform destructive testing the other side can't verify your data, and second that there is no way of establishing that even nondestructive testing didn't alter or destroy data from its original state.

    But if no mirroring was possible due to the deliberate acts of the party objecting to the test results, for example in an effort to destroy evidence in a potential civil or criminal case, I doubt that a judge would exclude the evidence on that basis alone.

    Some companies do amazing recovery work, even with severely damaged drives - Examples.

  3. #3
    Join Date
    Dec 2005
    Location
    Indianapolis
    Posts
    14

    Default

    interesting, what do you think about the possession aspect of it. If it was a HDD you threw away 5 years ago. There really isn't any way to prove the activity was yours. Again, this is assuming anyone wishes to dig dirt up on you and that he disk didn't make it to the landfill. Also, statute of limitations would begin as well after a certain amount of time

    1. Sponsored Links
       

Similar Threads

  1. Search and Seizure: Federal Investigation - Mirror Image of Hard Drive
    By lawinquiry in forum Criminal Procedure
    Replies: 5
    Last Post: 07-13-2010, 04:56 PM
  2. Privacy: My Employer Took My External Hard Drive
    By Foggs in forum Employment and Labor
    Replies: 8
    Last Post: 08-04-2008, 06:35 AM
  3. Service Providers: Can Dell Erase My Hard Drive During Repairs
    By Ricardee in forum Consumer Law
    Replies: 1
    Last Post: 01-16-2008, 12:01 PM
  4. Divorce: Can I Distribute Pictures Found On My Hard Drive
    By silvrtoe in forum Divorce, Annulment and Separation
    Replies: 16
    Last Post: 07-12-2007, 02:25 PM
  5. Divorce: Copy of Hard Drive
    By anderbud in forum Divorce, Annulment and Separation
    Replies: 2
    Last Post: 01-20-2006, 07:20 AM
 
 
Sponsored Links

Legal Help, Information and Resources