Re: Hard drive images

[Craig Pratt <craig () strong-box net>]

On Tuesday, Aug 5, 2003, at 13:23 US/Pacific, Ron DuFresne wrote:
> On Tue, 5 Aug 2003, David Hayes wrote:
>
> > Our old standby, "dd", is perfectly acceptable for making an image of
> > a hard drive to be used in court.  It's even the #1 choice of the FBI,
> > and accepted by U.S. federal courts.  From the trial court order on
> > admission of evidence in the case of Zacarias Moussaoui (the accused
> > 20th hijacker of 9/11):
>
> Interesting, I would have thought that the original was required for 
> the
> courts, and that forensics was conducted on the copy.
>
> Thanks,
>
> Ron DuFresne

I believe there are ways to recover data at the physical/magnetic level 
- magnetic  remnants of previously-deleted data, for instance - which 
would require access to the original platters. I read an article about 
this somewhere - would have to be SciAm or /.

C

---
Craig Pratt
Strongbox Network Services Inc.
mailto:craig () strong-box net
dtmf:503.706.2933


--
This message checked for dangerous content by MailScanner on StrongBox.


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html