full-disclosure - Reacting to a server compromise

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <200308030906.h7396u1A016855@mailgate.mailbox.co.za>
From: jenbradley at webmail.co.za (Jennifer Bradley)
Subject: Reacting to a server compromise

On Sun, 3 Aug 2003 12:31:39 +1000  (devnull@...imus.com.au) wrote:

>On Sun, 3 Aug 2003 01:38 am, Jennifer Bradley wrote:
>
>> If this happens again, I would probably make a copy of the hard
drive,
>> or at the very least the log files since they can be entered as
>> evidence of a hacked box.
>
>Under most jurisdictions, an ordinary disk image produced by Norton
Ghost etc
>using standard hardware is completely inadmissible in court, as it is
>impossible to make one without possibly compromising the integrity of
the
>evidence. The police etc use specialised hardware for making such
copies,
>which ensures that the disk can't have been altered.

This is not true, at least in the US.  Log files can be entered into
evidence unless you can prove that the log files have been tampered
with.  The "possibility" of changing data does not make evidence
inadmissible, only proof that data has been changed.

I don't see why a Norton Ghost image is any different than a tape
backup, and backups have been regularly entered in as evidence in many
famous cases, such as the Microsoft anti-trust case.

jb
_______________________________________________________________________
LOOK GOOD, FEEL GOOD - WWW.HEALTHIEST.CO.ZA

Cool Connection, Cool Price, Internet Access for R59 monthly @ WebMail
http://www.webmail.co.za/dialup/