Full Disclosure mailing list archives
Re: Hard drive images
From: Craig Pratt <craig () strong-box net>
Date: Tue, 5 Aug 2003 15:26:49 -0700
On Tuesday, Aug 5, 2003, at 13:23 US/Pacific, Ron DuFresne wrote:
On Tue, 5 Aug 2003, David Hayes wrote:Our old standby, "dd", is perfectly acceptable for making an image of a hard drive to be used in court. It's even the #1 choice of the FBI, and accepted by U.S. federal courts. From the trial court order on admission of evidence in the case of Zacarias Moussaoui (the accused 20th hijacker of 9/11):Interesting, I would have thought that the original was required for thecourts, and that forensics was conducted on the copy. Thanks, Ron DuFresne
I believe there are ways to recover data at the physical/magnetic level - magnetic remnants of previously-deleted data, for instance - which would require access to the original platters. I read an article about this somewhere - would have to be SciAm or /.
C --- Craig Pratt Strongbox Network Services Inc. mailto:craig () strong-box net dtmf:503.706.2933 -- This message checked for dangerous content by MailScanner on StrongBox. _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- Re: [inbox] Re: Reacting to a server compromise, (continued)
- Re: [inbox] Re: Reacting to a server compromise Peter Busser (Aug 04)
- Re: Reacting to a server compromise devnull (Aug 02)
- Re: Reacting to a server compromise SecuresDotComs (Aug 02)
- Re: Reacting to a server compromise madsaxon (Aug 02)
- RE: [inbox] Re: Reacting to a server compromise Curt Purdy (Aug 03)
- Re: [inbox] Re: Reacting to a server compromise Gaurav Kumar (Aug 03)
- Re: Reacting to a server compromise Alexandre Dulaunoy (Aug 03)
- RE: [inbox] Re: Reacting to a server compromise Curt Purdy (Aug 04)
- Re: Reacting to a server compromise David Hayes (Aug 05)
- Re: Reacting to a server compromise Ron DuFresne (Aug 05)
- Re: Hard drive images Craig Pratt (Aug 05)
- RE: [inbox] Re: Hard drive images Curt Purdy (Aug 05)
- Re: Hard drive images ldreamer (Aug 05)
- Re: Hard drive images madsaxon (Aug 05)
- Re: Reacting to a server compromise SecuresDotComs (Aug 02)
- Re: Re: Reacting to a server compromise morning_wood (Aug 03)
- Re: Re: Reacting to a server compromise manohar singh (Aug 03)
- Re: Reacting to a server compromise James A. Cox (Aug 03)
- Re: Re: Reacting to a server compromise Frank Bruzzaniti (Aug 04)