full-disclosure - Forensic evidence pros and cons

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Tue Jul  5 18:03:09 2005
From: daniels at Ponderosatel.com (Daniel Sichel)
Subject: Forensic evidence pros and cons

>The police find the data where they find it. That's called 
>'circumstantial evidence' and digital evidence will always be treated 
>exactly as such no matter who we successfully convince of the flaws 
>inherent in the filing cabinet or printed document/glossy photograph 
>analogy.

It is not circumstantial, it is physical evidence. I believe that what
you meant was that it's probitive value is uncertain because there is no
chain of custody solely from a defendant to a forensic expert. That is
to say that even though the device was in possession of the defendant,
persons unknown likely also had access. Therefore you cannot assume that
information found on the device was placed there by, or at the behest
of, the defendant.

No, I am not an attorney, but if you do LAN administration for five
years at a law firm that does criminal defense work, you learn a few
things.

BTW, if some of this type of information began showing up on the
computers used by judges, ADAs, district attorneys, and senior law
enforcement officers they might change their minds quickly as to the
probitive value of such finds. Surely, in our august ranks there are
some who, speaking hypothetically of course, could arrange such events.
It would nicely highlight the ambiguity of the situation. And I don't
even want to think of the bragging rights.... Just a conjecture. 

Dan Sichel
Network Engineer