Re: FBI Says Data on VA Laptop Not Accessed

[Cardoso <cardosolistas () contraditorium com>]

I don't think they can detect some highly advanced techniques like using
Partition Magic to mirror the disk..



On Fri, 30 Jun 2006 10:07:46 -0400
Michael Holstein <michael.holstein () csuohio edu> wrote:

MH> >The FBI, in a statement from its Baltimore field office, said a
MH> >preliminary review of the equipment by its computer forensic teams
MH> >"has determined that the data base remains intact and has not been
MH> >accessed since it was stolen." More tests were planned, however.
MH> 
MH> Didn't the original "wanted" notice for this hardware specifically 
MH> mention an external (USB) drive?
MH> 
MH> Gee .. 'mount -t ntfs -o ro /dev/sda1 /mnt/goodies'
MH> 
MH> How are their "forensic" people going to determine if *that* happened?
MH> 
MH> Their argument about "a real crook wouldn't return the hardware" .. 
MH> well, why not? .. $50,000 to buy that fancy ID printer off eBay to get 
MH> yourself started.
MH> 
MH> /mike.
MH> 
MH> _______________________________________________
MH> Full-Disclosure - We believe in it.
MH> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
MH> Hosted and sponsored by Secunia - http://secunia.com/
MH> 

year(now) + 1 será o ano do linux!
Cardoso <cardoso () pobox com> - SkypeIn: (11) 3711-2466 / (41) 3941-5299
vida digital: http://www.contraditorium.com site pessoal e blog: http://www.carloscardoso.com

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/