Date: Mon Oct  3 19:21:52 2005
From: Christopher.Cooper at ed.gov (Cooper, Christopher)
Subject: RE: Full-Disclosure Digest, Vol 8, Issue 3

* Jason Coombs:  /* There is simply no way for law enforcement to know the difference between innocent and guilty persons based on hard drive data
circumstantial evidence. */
Jason,

Are you stumping for work as a defense expert?  I hope so, because I know several Law Enforcement Officers who would love to challenge your positions in court.

You are over gerneralization an issue and group of people. It IS possible for law enforcement or anyone examining data to know the difference between innocent and guilty persons based on hard drive data.  One simply needs to look beyond the general information provided to them from the software tools. Can you give me an example of a trojan, worm, or another program which has added the last USB device installed in the Windows Registry, or how about a program, worm, trojan - which caused something to be added to the last typed URL?

Off of Subject: Do you plan to fix the links from your site at: http://www.science.org/jasonc/writing.html - most of the links no longer exist or don't have your name on the published line. Thanks and cheers.

-C...
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/ms-tnef
Size: 3239 bytes
Desc: not available
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20051003/7c6febf0/attachment.bin

Hosted by DataForce ISP - Powered by Openwall GNU/*/Linux