Re: Stolen laptop returned to Beaumont Hospital

[Chris Walsh <cwalsh () cwalsh org>]

Indeed, the ability to copy a disk w/out altering it is necessary in order for
evidence to hold up in court.  If the police change the disk by examining it,
then how could the defense independently examine the same body of evidence?

http://www.cftt.nist.gov/disk_imaging.htm  is a useful link, IMO.

Chris

On Thu, Aug 24, 2006 at 01:49:36PM -0700, George Toft wrote:
> In the wake of similar statements in the VA laptop case, I talked to a 
> computer forensics expert and he confirmed that as long as Windows was 
> not used to access the drive, then the markers used to indicate file 
> access will remain intact and indicate no access.
_______________________________________________
Dataloss Mailing List (dataloss () attrition org)
http://attrition.org/dataloss
Tracking more than 142 million compromised records in 315 incidents over 6 years.