Search: Home Bugtraq Vulnerabilities Mailing Lists Jobs Tools Beta Programs
Forensics
Forensic disk duplication modifies the evidence hard disk May 27 2005 11:21AM
Steven McLeod (steven mcleod ozemail com au) (3 replies)
Re: Forensic disk duplication modifies the evidence hard disk May 28 2005 02:46AM
Clinton E. Troutman (troutman mesh net)
RE: Forensic disk duplication modifies the evidence hard disk May 27 2005 05:26PM
Nick Willey (nickwilley ashgate com) (1 replies)
Re: Forensic disk duplication modifies the evidence hard disk May 27 2005 06:18PM
Thierry Zoller (Thierry sniff-em com)
Dear Nick Willey,

Quoting the Paper :
"The value 64 was permanently recorded as the hard disks lifetime
maximum temperature, which is a sure sign that the hard disj has been
forensically duplicated."

I have 65C as max value, the HD was surely not "forensically
duplicated". A normal Scandisk or even a game is enough *.

* Yes I have a Fan on it now; no it's not 10.000rpm

--
Mit freundlichen Grüßen
Thierry Zoller
mailto:Thierry (at) sniff-em (dot) com [email concealed]

-----------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management
and tracking system please see: http://aris.securityfocus.com

[ reply ]
Re: Forensic disk duplication modifies the evidence hard disk May 27 2005 03:43PM
Brian Carrier (carrier cerias purdue edu)







 

Privacy Statement
Copyright 2009, SecurityFocus