Re: FBI Says Data on VA Laptop Not Accessed

[Michael Braun <nightfire () zero-fragger de>]

Cardoso schrieb:
> I don't think they can detect some highly advanced techniques like using
> Partition Magic to mirror the disk..
>
>
>   
As long as they didn't know the exact amount of hours the hdd was 
running before it got stolen, i don't see any way to determine if the 
data was copied away by some sector-by-sector copy-tool like Ghost or 
True Image. Afaik you can see very clearly how many hours a drive has 
run yet. If that data was the same as before the laptop was stolen, then 
the disk didn't run. If the data differs, the drive did run.
I am not sure if one could alter that data.
On the other hand... i don't think that anyone knows that data all the 
time, so they couldn't have known the running-time of the disk, unless 
they knew the hdd was about to be stolen.

(pardon my bad english)

Michael

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/