3 ms·
> Forensic analysis of the hard drive would exonerate you though. No. Anything an analyst could feasibly look at can be spoofed with root access. The only thin
by wyager 10y ago
> Forensic analysis of the hard drive would exonerate you though.
No. Anything an analyst could feasibly look at can be spoofed with root access. The only thing that could potentially approximate the actual age of a hard drive write is thermal annealing of the storage medium, but this isn't really true anymore with SSDs (and was never practical even for HDDs).
- openasocket 10y agoYeah, but it's not that simple. You'd have to install the Tor Browser Bundle, make it look like it was installed long before. You'd have to change the MAC times on the CP files to indicate a consistent pattern, and make sure the victim doesn't have an alibi for any of the times you're putting down. But you can't backdate the download time to before the image was produced, so you have to do your research on that. And of course you'd have to get your hands on a bunch of CP without getting caught yourself. I'm not saying it's impossible, but it sounds pretty difficult to me. Maybe I'm wrong though.