RE: [inbox] Re: Hard drive images

["Curt Purdy" <purdy () tecman com>]

Actually the prefered method is to dd one or more copies for forensics and
use the orginal in court if you are able to immediately shut that box down
afterward.  However if it is a mission-critical that cannot immediately be
brought down, it is preferrable to use that first copy for evidence and make
multiple copies of it for forensics.

Curt Purdy CISSP, GSEC, MCSE+I, CNE, CCDA
Information Security Engineer
DP Solutions

----------------------------------------

If you spend more on coffee than on IT security, you will be hacked.
What's more, you deserve to be hacked.
-- White House cybersecurity adviser Richard Clarke


-----Original Message-----
From: full-disclosure-admin () lists netsys com
[mailto:full-disclosure-admin () lists netsys com]On Behalf Of Craig Pratt
Sent: Tuesday, August 05, 2003 5:27 PM
To: Ron DuFresne
Cc: David Hayes; full-disclosure () lists netsys com
Subject: [inbox] Re: [Full-disclosure] Hard drive images



On Tuesday, Aug 5, 2003, at 13:23 US/Pacific, Ron DuFresne wrote:
> On Tue, 5 Aug 2003, David Hayes wrote:
>
> > Our old standby, "dd", is perfectly acceptable for making an image of
> > a hard drive to be used in court.  It's even the #1 choice of the FBI,
> > and accepted by U.S. federal courts.  From the trial court order on
> > admission of evidence in the case of Zacarias Moussaoui (the accused
> > 20th hijacker of 9/11):
>
> Interesting, I would have thought that the original was required for
> the
> courts, and that forensics was conducted on the copy.
>
> Thanks,
>
> Ron DuFresne

I believe there are ways to recover data at the physical/magnetic level
- magnetic  remnants of previously-deleted data, for instance - which
would require access to the original platters. I read an article about
this somewhere - would have to be SciAm or /.

C

---
Craig Pratt
Strongbox Network Services Inc.
mailto:craig () strong-box net
dtmf:503.706.2933


--
This message checked for dangerous content by MailScanner on StrongBox.


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html