Message-ID: <BFE5269A054D1D41AD47E648B30D8CE501CF3882@VHAISWMSGA1.vha.med.va.gov>
Date: Tue Jul  5 13:48:03 2005
From: tobin.craig at va.gov (Craig, Tobin (OIG))
Subject: RE: Tools accepted by the courts

Jerry,

I have to disagree with Jason on this, I think you're on the right
track; Computer forensics needs to be regarded in the same light as
other forensics fields and held to the same standards to maintain any
credibility in the future.

Jason:

I apologize on behalf of the rest of the community who are trying to
find a way forward in this.  Obviously by the tone of your previous
contributions, you have the whole field sewn up.  Perhaps when you
publish your definitive work, we'll all be able to enjoy the view from
your vantage point.  But until then, I for one don't appreciate the
belligerence and the patronizing.

Perhaps in my 20 years of international forensic science in 8 different
disciplines I've missed something fundamental concerning forensic
investigation or evidence handling.  If so, then please be sure to
include a chapter, I'd love to see where I've been going wrong over the
last two decades.

If you are waiting for witnesses to paint a worst case scenario every
time they hit the stand, then don't hold your breath.  Our job is to
make this stuff understandable in an impartial way.  It doesn't matter
how much you know or how much you understand if you cannot impart that
information in a meaningful way to your audience, be it a judge, jury,
or your granny.

This is just my opinion folks.

Respectfully yours,

(unprejudiced, because that's how we are supposed to be professionally,
trying to find the correct answer in place of the easy answer, knowing
that yes there are those who would exploit this field like any other,
but also knowing the way to see the standards increased is by doing my
best to ensure that I've done my job to the best of my ability, -- I
would like to hope you are more interested in finding the right way
forward over promoting your own agenda, although sadly I'm seeing much
of the good you have to say get lost in overly aggressive verbage.....)

Please think twice about your delivery, you're only hurting yourself,

Tobin Craig
___________________________
Tobin Craig, MRSC, CISSP, SCERS, EnCE
IT Forensic Director, Computer Crimes and Forensics
Department of Veterans Affairs
Office of Inspector General
801 I Street NW
Washington DC 20001
 
Tel: 202 565 7702
Fax: 202 565 7630
___________________________
-----Original Message-----
From: Jason Coombs [mailto:jasonc@...ence.org] 
Sent: Tuesday, July 05, 2005 8:04 AM
To: Evidence Technology
Cc: Craig, Tobin (OIG); forensics@...urityfocus.com;
full-disclosure@...ts.grok.org.uk
Subject: Re: Tools accepted by the courts

Evidence Technology wrote:
> That era is quickly fading. Going forward, I think we'll see more
> and more digital evidence rendered inadmissible via failure to
> adhere to established evidentiary standards.

Jerry,

No way. What 'evidentiary standards' are you talking about here?

I'm sorry but that's just absurd. How will there ever be 'evidentiary 
standards' on the contents of my filing cabinet and my personal 
pornography collection?

The police find the data where they find it. That's called 
'circumstantial evidence' and digital evidence will always be treated 
exactly as such no matter who we successfully convince of the flaws 
inherent in the filing cabinet or printed document/glossy photograph 
analogy.

What I demand to hear spoken by law enforcement, and what I insist 
prosecutors compel law enforcement to speak if they don't volunteer 
these words out of their own common sense, is the following:

"Yes, that's what we found on the hard drive but there's little or no 
reason for us to believe that the defendant is responsible for placing 
it there just because the hard drive was in the defendant's possession. 
We often see cases where hard drives are installed second-hand and data 
from previous owners remains on the drive, we can't tell when the data 
in question was written so it's important to be aware that hundreds of 
other people could have placed it there. We also see cases where 
software such as spyware or Web pages full of javascript force a 
suspect's Web browser to take actions that result in the appearance that

the owner of the computer caused Internet content to be retrieved when 
in fact the owner of the computer may not have known what was happening,

malicious Web site programmers know how to use techniques such as 
pop-unders and frames to hide scripted behavior of Web pages. 
Furthermore, once the Web browser is closed and its temporary files are 
deleted, every bit of data that was saved 'temporarily' to a file by the

browser becomes a semi-permanent part of the hard drive's unallocated 
space and we have no way to tell the difference between data that was 
once part of a temporary file created automatically by a Web page being 
viewed or scripted inside a Web browser and the same data placed 
intentionally on the hard drive by its owner without the use of the 
Internet. Also ..."

Disrespectfully Yours,

  (with extreme prejudice born of intense frustration due to the fact 
that nobody cares about getting this stuff right when it's so much 
easier just to collect a forensic paycheck and move on to the next 
victim -- I would like to think you are part of the solution rather than

being part of the problem but you're talking nonsense and so is nearly 
everyone else in the computer forensics field, most especially the 
computer forensics vendors who need people to love them in order to make

their businesses grow. They do not deserve respect and they most 
certainly fail the 'lovable' test, but television shows like CSI and 
visions of fat bank accounts have deceived everyone temporarily...)

Please get a clue before you hurt somebody.

Jason Coombs
jasonc@...ence.org

Powered by blists - more mailing lists