Security Basics mailing list archives
Re: Hard Drive Forensics Question
From: "Razi Shaban" <razishaban () gmail com>
Date: Fri, 3 Oct 2008 20:27:45 +0400
On Fri, Oct 3, 2008 at 5:01 AM, Jon Gucinski <gucinski () gmail com> wrote:
Could it be definitively proved that he saved files from the external drive to the hard drive? Maybe. They could search for files on the laptop present on the USB drive. I don't know of any logging in MacOS or anything that would retain details of file transfer or direction. Sounds like they are on a fishing expedition. IANAL, but i'd recommend to him that he NOT grant access to his personal laptop to a former employer w/o a subpoena, warrant, or other court mandate. Why give them access when it can really do him no good but a world of hurt? The burden of proof is on the former employer to prove wrongdoing and he'd be supplying them with ammunition to do so. -Jon
However, disproving them (assuming that they cannot find anything) would be nothing but beneficial for him. -- Razi Shaban
Current thread:
- Hard Drive Forensics Question Matt Perry (Oct 02)
- Re: Hard Drive Forensics Question Jon Gucinski (Oct 03)
- Re: Hard Drive Forensics Question Razi Shaban (Oct 03)
- Re: Hard Drive Forensics Question Mike Hale (Oct 03)
- RE: Hard Drive Forensics Question Mike Staples (Oct 06)
- Re: Hard Drive Forensics Question B 650 (Oct 03)
- Re: Hard Drive Forensics Question Razi Shaban (Oct 03)
- Re: Hard Drive Forensics Question Larry Offley (Oct 03)
- Re: Hard Drive Forensics Question Razi Shaban (Oct 03)
- Re: Hard Drive Forensics Question J. Oquendo (Oct 03)
- RE: Hard Drive Forensics Question Murda Mcloud (Oct 06)
- Re: Hard Drive Forensics Question Razi Shaban (Oct 06)
- RE: Hard Drive Forensics Question Murda Mcloud (Oct 06)
- Re: Hard Drive Forensics Question Razi Shaban (Oct 06)
- Re: Hard Drive Forensics Question Razi Shaban (Oct 03)
- Re: Hard Drive Forensics Question Jon Gucinski (Oct 03)