RE: Acqusition of time

[Tina Bird <tbird () precision-guesswork com>]

On Wed, 29 Jan 2003, dave wrote:

> Actually a good attorney could tear up any log system even with perfect time
> stamps.  All that need would need to be proved was the fact that it could
> have been faked.

> Actually<, current case law on the admissibility of computer log data in
court suggests that the possibility of tampering is not sufficient cause
to throw logs out.  Someone who wants to have log data thrown out because
it may have been tampered with has to show evidence that the data >has<
been tampered with.

See, for instance:
http://www.usdoj.gov/criminal/cybercrime/usamarch2001_4.htm

There was a >long< discussion of this issue on the LogAnalysis mailing
list.  If you want to read it, go to http://www.loganalysis.org, click on
"Library" in the nav bar, then "Frequently discussed topics".

tbird

-- 
I, on the other hand, do not work. I enjoy the slothful life of an artist,
and while away the hours in meaningless aesthetic pursuits punctuated by
bouts of hedonistic debauchery and an occasional nap.
                                              -- David Rinehart

http://www.shmoo.com/~tbird
Log Analysis http://www.loganalysis.org
VPN http://vpn.shmoo.com

_______________________________________________
firewall-wizards mailing list
firewall-wizards () honor icsalabs com
http://honor.icsalabs.com/mailman/listinfo/firewall-wizards