8 ms·

Also hearsay personal experience but a friend of a friend had his house raided by the FBI and all his computer equipment impounded. When he got it all back they

by m3rc 11y ago

Also hearsay personal experience but a friend of a friend had his house raided by the FBI and all his computer equipment impounded. When he got it all back they told him his hard drives were empty or unformatted. He had them all formatted as ZFS...

rpgmaker 11y ago
> When he got it all back they told him his hard drives were empty or unformatted. Maybe that's what they wanted him to think. I refuse to believe the alternative...
- pjc50 11y ago
  Why? It's people following a forensics script/program which looks for Windows partitions. There aren't a huge number of people who understand this kind of thing and most of them are able to work at places where they're paid much better than the FBI.
  - leeoniya 11y ago
    You're going to go through the trouble to get a warrant for a raid and then apply such gross incompetence to the seized evidence? When was the last time you pulled a hard drive out of a functioning machine, found it to be empty and didn't immediately think, "huh, that's odd" before throwing it in the trash. I guess it depends on whether the hard drives were the target of the raid or just a collateral of "grab anything that may be useful" mindset. They could already have gathered enough evidence without needing to waste time/money on digital forensics. Hard to say without specifics. The fact that they went out of their way to assure him that his own hard drives were empty reeks of manipulation. Color me highly skeptical.
    - angrow 11y ago
      I'll color you trusting: you are choosing to be fixedly _un_-skeptical of the FBI's competence.
  - asgfoi 11y ago
    Slightly off topic, but it really isn't hard to find partitions. Just run the various software to scan and that's it. I've done it at least twice when accidentally erasing a windows partition (once with fdisk when I misread the output, and at that time I didn't even know what a partition is).
  - munin 11y ago
    the forensics programs (EnCase, FTK) have a lot of problems but they don't assume that the drive is "windows partitions" though it's possible that they don't deal with ZFS. you would think that national level stuff would have people take more care, but if you're dealing with state or local police, they will have someone who has taken an 8 hours Encase or FTK class driving a GUI to gather evidence and if the tool doesn't support it, there's effectively no evidence to gather.
    - ryanlol 11y ago
      Yeah, I once had to explain to an officer what a known_hosts file is so they could send MLAT requests and release me from jail without risking that I would wipe (the already automatically wiped) servers myself when I got out.
michaelcampbell 11y ago
I'm unsure as to how to read this; are you saying because they were ZFS, the FBI couldn't read them and because of their lack of expertise, assumed they were empty? Or that they formatted them before returning them?
- ptaipale 11y ago
  FBI assumed them to be empty, or wanted the owner to believe that they had assumed them empty...
- TazeTSchnitzel 11y ago
  If you plug in a non-FAT/exFat/NTFS drive to a Windows machine, Windows will act almost as if the drive is empty and needs formatting in My Computer.
- jrs235 11y ago
  I read it as his drives were formatted as ZFS and the FBI couldn't read them because of their incompetence (probably only thinking to try and read them with Windows as FAT32 or NTFS.
- xg15 11y ago
  Judging by how Windows, when presented with an unknown FS, acts as if the disk were unformatted and immediately offers to format it, my guess would be both... (And by "unknown" I mean of course "anything that is not FAT* or NTFS"...)
  - wantreprenr007 11y ago
    Johnny clubfingers 5-0 clicks Ok, and destroys "evidence" for being a total idiot... I take it he/she was hungover during that 2 hours of computer forensics in the academy. For crooks, this is good news; for stopping potential future victims, this isn't good, and misapplied to innocent/MPAA/RIAA enforcement, it's destructive and lowers LE credibility. The moral of the story is for individuals, whom should implictly fear government overreach no matter whom is in office, one has to back their shit up and make it SWAT-proof, even if that means running several TahoeLAFS boxes in countries like Switzerland, because running a server (physical or Linode) or just replicating data to a friend's server just doesn't cut it and never did.
qb45 11y ago
That's weird, it looks like they didn't even try something like photorec. I wonder how would they handle full disk encryption.
- vonklaus 11y ago
  Sounds like they call customer support and order a software modification for the entire system...
autoreleasepool 11y ago
> his house raided by the FBI and all his computer equipment impounded. Thanks for reminding me to set up Amazon glacier for my FreeNas today. Jesus Christ, the world is a messed up place.
- raverbashing 11y ago
  Just a note, read up on glacier pricing and issues. Standard S3 might be better
  - milesward 11y ago
    Or go GCS Nearline, same great price, no terrible gotchas. https://cloud.google.com/storage/docs/nearline https://cloud.google.com/storage/docs/nearline Disclaimer: I work on GCP
sandworm101 11y ago
I wouldn't read too much into this. SOP for most police forces is a tiered approach to seized drives. They plug it into a windows machine and see what's what. If that doesn't get the immediate results they have to hand it to the professional data recovery people. Even a cursory forensic examination of a drive starts at 1,000$ and may yield nothing if encrypted. With a small pile of drives to look at, they probably didn't bother trying after spotting it wasn't going to be plug-and-play.
ryao 11y ago
> Also hearsay personal experience but a friend of a friend had his house raided by the FBI and all his computer equipment impounded. When he got it all back they told him his hard drives were empty or unformatted. He had them all formatted as ZFS... I had imagined that computer forensics "experts" would make this mistake somewhere at some point, but I did not think I would actually hear that it had happened. Thanks for the affirmation, even if it is just hearsay. It makes me curious about what goofs were made with the IRS hard drives that had "crashed" according to forensics "experts".

by m3rc 11y ago

rpgmaker 11y ago

> When he got it all back they told him his hard drives were empty or unformatted. Maybe that's what they wanted him to think. I refuse to believe the alternative...

pjc50 11y ago
Why? It's people following a forensics script/program which looks for Windows partitions. There aren't a huge number of people who understand this kind of thing and most of them are able to work at places where they're paid much better than the FBI.
- leeoniya 11y ago
  You're going to go through the trouble to get a warrant for a raid and then apply such gross incompetence to the seized evidence? When was the last time you pulled a hard drive out of a functioning machine, found it to be empty and didn't immediately think, "huh, that's odd" before throwing it in the trash. I guess it depends on whether the hard drives were the target of the raid or just a collateral of "grab anything that may be useful" mindset. They could already have gathered enough evidence without needing to waste time/money on digital forensics. Hard to say without specifics. The fact that they went out of their way to assure him that his own hard drives were empty reeks of manipulation. Color me highly skeptical.
  - angrow 11y ago
    I'll color you trusting: you are choosing to be fixedly _un_-skeptical of the FBI's competence.
- asgfoi 11y ago
  Slightly off topic, but it really isn't hard to find partitions. Just run the various software to scan and that's it. I've done it at least twice when accidentally erasing a windows partition (once with fdisk when I misread the output, and at that time I didn't even know what a partition is).
- munin 11y ago
  the forensics programs (EnCase, FTK) have a lot of problems but they don't assume that the drive is "windows partitions" though it's possible that they don't deal with ZFS. you would think that national level stuff would have people take more care, but if you're dealing with state or local police, they will have someone who has taken an 8 hours Encase or FTK class driving a GUI to gather evidence and if the tool doesn't support it, there's effectively no evidence to gather.
  - ryanlol 11y ago
    Yeah, I once had to explain to an officer what a known_hosts file is so they could send MLAT requests and release me from jail without risking that I would wipe (the already automatically wiped) servers myself when I got out.

michaelcampbell 11y ago

I'm unsure as to how to read this; are you saying because they were ZFS, the FBI couldn't read them and because of their lack of expertise, assumed they were empty? Or that they formatted them before returning them?

ptaipale 11y ago
FBI assumed them to be empty, or wanted the owner to believe that they had assumed them empty...
TazeTSchnitzel 11y ago
If you plug in a non-FAT/exFat/NTFS drive to a Windows machine, Windows will act almost as if the drive is empty and needs formatting in My Computer.
jrs235 11y ago
I read it as his drives were formatted as ZFS and the FBI couldn't read them because of their incompetence (probably only thinking to try and read them with Windows as FAT32 or NTFS.
xg15 11y ago
Judging by how Windows, when presented with an unknown FS, acts as if the disk were unformatted and immediately offers to format it, my guess would be both... (And by "unknown" I mean of course "anything that is not FAT* or NTFS"...)
- wantreprenr007 11y ago
  Johnny clubfingers 5-0 clicks Ok, and destroys "evidence" for being a total idiot... I take it he/she was hungover during that 2 hours of computer forensics in the academy. For crooks, this is good news; for stopping potential future victims, this isn't good, and misapplied to innocent/MPAA/RIAA enforcement, it's destructive and lowers LE credibility. The moral of the story is for individuals, whom should implictly fear government overreach no matter whom is in office, one has to back their shit up and make it SWAT-proof, even if that means running several TahoeLAFS boxes in countries like Switzerland, because running a server (physical or Linode) or just replicating data to a friend's server just doesn't cut it and never did.

qb45 11y ago

That's weird, it looks like they didn't even try something like photorec. I wonder how would they handle full disk encryption.

vonklaus 11y ago
Sounds like they call customer support and order a software modification for the entire system...

autoreleasepool 11y ago

> his house raided by the FBI and all his computer equipment impounded. Thanks for reminding me to set up Amazon glacier for my FreeNas today. Jesus Christ, the world is a messed up place.

raverbashing 11y ago
Just a note, read up on glacier pricing and issues. Standard S3 might be better
- milesward 11y ago
  Or go GCS Nearline, same great price, no terrible gotchas. https://cloud.google.com/storage/docs/nearline https://cloud.google.com/storage/docs/nearline Disclaimer: I work on GCP

sandworm101 11y ago

I wouldn't read too much into this. SOP for most police forces is a tiered approach to seized drives. They plug it into a windows machine and see what's what. If that doesn't get the immediate results they have to hand it to the professional data recovery people. Even a cursory forensic examination of a drive starts at 1,000$ and may yield nothing if encrypted. With a small pile of drives to look at, they probably didn't bother trying after spotting it wasn't going to be plug-and-play.

ryao 11y ago

> Also hearsay personal experience but a friend of a friend had his house raided by the FBI and all his computer equipment impounded. When he got it all back they told him his hard drives were empty or unformatted. He had them all formatted as ZFS... I had imagined that computer forensics "experts" would make this mistake somewhere at some point, but I did not think I would actually hear that it had happened. Thanks for the affirmation, even if it is just hearsay. It makes me curious about what goofs were made with the IRS hard drives that had "crashed" according to forensics "experts".