This is a very interesting paper. I understand that the paper is written
from the perspective of an investigator trying to track an attacker without
the attacker knowing, but how does this present a problem for forensics
analysis? How would this affect the admissibility of the evidence in court?
Can't the changing SMART values be explained to a court as necessary for the
device to power on? Also, since the values are read-only, is the integrity
of the evidence tainted by powering on the device and creating an image?

I'm not trying to be critical, I'm just trying to understand more about how
this will affect the forensics community. I really enjoyed reading this
paper.

Nick

-----Original Message-----
From: Steven McLeod [mailto:steven.mcleod (at) ozemail.com (dot) au [email concealed]]
Sent: Friday, May 27, 2005 7:22 AM
To: forensics (at) securityfocus (dot) com [email concealed]
Subject: Forensic disk duplication modifies the evidence hard disk

SMART Anti-Forensics

This paper highlights an oversight in the current industry best practice
procedure for forensically duplicating a hard disk. A discussion is
provided which demonstrates that although the forensic duplication process
may not directly modify data on the evidence hard disk, a hard disk will
usually modify itself during the forensic duplication process.

The paper highlights some consequences, for example that an attacker who has
compromised the computer containing the hard disk can programmatically
detect that the hard disk has been forensically duplicated, or otherwise
powered on and accessed via a mechanism other than via the operating system
installed on the hard disk.

Suggestions are provided to help minimise the changes made to the hard disk
during the forensic duplication process. These suggestions minimise the
likelihood that an attacker will notice the system administrator or forensic
analyst performing an investigation of the suspected compromised computer.

http://members.ozemail.com.au/~steven.mcleod/SMART_Anti_Forensics.pdf

-----------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management and tracking
system please see: http://aris.securityfocus.com

-----------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management
and tracking system please see: http://aris.securityfocus.com

[ reply ]