full-disclosure - [inbox] Re: Hard drive images

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

From: purdy at tecman.com (Curt Purdy)
Subject: [inbox] Re: Hard drive images

Actually the prefered method is to dd one or more copies for forensics and
use the orginal in court if you are able to immediately shut that box down
afterward.  However if it is a mission-critical that cannot immediately be
brought down, it is preferrable to use that first copy for evidence and make
multiple copies of it for forensics.

Curt Purdy CISSP, GSEC, MCSE+I, CNE, CCDA
Information Security Engineer
DP Solutions

----------------------------------------

If you spend more on coffee than on IT security, you will be hacked.
What's more, you deserve to be hacked.
-- White House cybersecurity adviser Richard Clarke


-----Original Message-----
From: full-disclosure-admin@...ts.netsys.com
[mailto:full-disclosure-admin@...ts.netsys.com]On Behalf Of Craig Pratt
Sent: Tuesday, August 05, 2003 5:27 PM
To: Ron DuFresne
Cc: David Hayes; full-disclosure@...ts.netsys.com
Subject: [inbox] Re: [Full-Disclosure] Hard drive images



On Tuesday, Aug 5, 2003, at 13:23 US/Pacific, Ron DuFresne wrote:
> On Tue, 5 Aug 2003, David Hayes wrote:
>
>> Our old standby, "dd", is perfectly acceptable for making an image of
>> a hard drive to be used in court.  It's even the #1 choice of the FBI,
>> and accepted by U.S. federal courts.  From the trial court order on
>> admission of evidence in the case of Zacarias Moussaoui (the accused
>> 20th hijacker of 9/11):
>>
>
> Interesting, I would have thought that the original was required for
> the
> courts, and that forensics was conducted on the copy.
>
> Thanks,
>
> Ron DuFresne

I believe there are ways to recover data at the physical/magnetic level
- magnetic  remnants of previously-deleted data, for instance - which
would require access to the original platters. I read an article about
this somewhere - would have to be SciAm or /.

C

---
Craig Pratt
Strongbox Network Services Inc.
mailto:craig@...ong-box.net
dtmf:503.706.2933


--
This message checked for dangerous content by MailScanner on StrongBox.


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html