4 ms·

Chain of custody should play a big factor here. Between the accused and the technician how many people had access to that system? Further, since the technicia

Chain of custody should play a big factor here. Between the accused and the technician how many people had access to that system? Further, since the technician is paid when something is found, what is the motivation for the technician to not plant evidence? It's trivial to plant evidence on a hard-drive to the point that if done properly it's impossible for a forensics investigator to come in after the fact and determine the tampering. This is all before even getting into the topic of potential malware infections, running as a TOR exit node, being used for torrent hosting unbeknownst to the user, etc. There was a case many years ago and I wish I could find the reference to it in which the defense called in an expert witness who convinced the judge to have his machine inspected by a forensic analyst who found it clear of pictures of kittens. The expert witness then had the judge visit an 'innocuous' looking website which didn't have pictures of kittens visible, but loaded them in hidden iFrames. The system was then inspected again by the forensics analyst who then found pictures of kittens, the point being that when your computer is connected to the Internet it really isn't your computer anymore.

cmurf 10y ago
The whole repair process is fraught with liability whether the customer is the target of a criminal investigation or not. In either case, you'd probably need to image the drive as a first step, and then date stamp, hash, and then sign the date and hash. Or use something like dm-verity. Maybe the physical handling of drive removal and putting it on a docking station for imaging is video'd and that video is also verifiable (mainly you'd want a system that ensures whole frames aren't deleted..i.e. oh hey I see 5 seconds were yanked here and over here, so conceivably the drive was removed and returned to the docking station and altered prior to imaging). Also, as COW filesystems become more common (ReFS, AFS, ZFS, Btrfs) there will be a lot of stale metadata that is non-trivial to fake. Basically snapshots are constantly being taken, even if they are not preserved for very long. On an SSD ostensibly these unused blocks get trimmed and should immediately return zeros, but there might be modes were they return stale data instead if it's before erase block GC/erasure happens. Edit: And now you have this copy of the customer's drive... itself a liablity for it to exist for very long, or deleted too soon. dm-verity at least does produce a read-only encrypted image so the liability is both access to the image and the security of that image's passphrase.
- shakna 10y ago
  Make sure you add a write blocker to that process, in fact, if you're doing anything like this, why not follow the forensic process?
  - patcheudor 10y ago
    Ultimately the Geek Squad does not follow any forensics process & that's why using them or anyone else in the computer repair space is dubious when it comes to collecting any evidence of a crime. They may be able to provide leads, but anything they uncover should not be usable in a court or alone be grounds for arrest.
    - shakna 10y ago
      I absolutely agree with that. I worked in forensics until I lost all faith and humanity, and pivoted for sanity's sake. The least flaw in the forensic process, which was always discussed in-court by lawyers who I suspect could barely use Outlook always resulted in the evidence being turfed. That due process doesn't seem to be followed here, and if a search is to be used as evidence, it better damn well follow some decent practices!
      - patcheudor 10y ago
        Honestly, even with the best computer forensics in the world I still have a hard time trusting anything found mostly because I find 0-days every week that the forensics community won't know about for years. It's pretty hard if not possible to say if something got a computer because of the user or because of the Internet.
        shakna 10y ago
        To be honest, most forensic cases are slam dunks. If it's a CP case, then, generally speaking, it's 500GB+. Usually enough so that the user has repeatedly deleted old files because their hard drive was getting full. The files are rarely encrypted, and gathered over years from sources like FTP, SMTP and the like - and those logs are the main evidence. A user is unlikely to not notice that 50GB of data is appearing once a week, and unlikely to not notice that the person they are conversing with has also been given similar charges, because their email has them talking about it, and when it comes to court, you find out that they were regularly seen with the other person.
bsder 10y ago
> Chain of custody should play a big factor here. Yeah, I'm very surprised this didn't immediately get thrown out with a "They're FBI informants and they planted the information to get paid." However, I suspect this is all a gambit to overturn the investigation results that followed so it probably isn't that clear cut.

cmurf 10y ago

The whole repair process is fraught with liability whether the customer is the target of a criminal investigation or not. In either case, you'd probably need to image the drive as a first step, and then date stamp, hash, and then sign the date and hash. Or use something like dm-verity. Maybe the physical handling of drive removal and putting it on a docking station for imaging is video'd and that video is also verifiable (mainly you'd want a system that ensures whole frames aren't deleted..i.e. oh hey I see 5 seconds were yanked here and over here, so conceivably the drive was removed and returned to the docking station and altered prior to imaging). Also, as COW filesystems become more common (ReFS, AFS, ZFS, Btrfs) there will be a lot of stale metadata that is non-trivial to fake. Basically snapshots are constantly being taken, even if they are not preserved for very long. On an SSD ostensibly these unused blocks get trimmed and should immediately return zeros, but there might be modes were they return stale data instead if it's before erase block GC/erasure happens. Edit: And now you have this copy of the customer's drive... itself a liablity for it to exist for very long, or deleted too soon. dm-verity at least does produce a read-only encrypted image so the liability is both access to the image and the security of that image's passphrase.

shakna 10y ago
Make sure you add a write blocker to that process, in fact, if you're doing anything like this, why not follow the forensic process?
- patcheudor 10y ago
  Ultimately the Geek Squad does not follow any forensics process & that's why using them or anyone else in the computer repair space is dubious when it comes to collecting any evidence of a crime. They may be able to provide leads, but anything they uncover should not be usable in a court or alone be grounds for arrest.
  - shakna 10y ago
    I absolutely agree with that. I worked in forensics until I lost all faith and humanity, and pivoted for sanity's sake. The least flaw in the forensic process, which was always discussed in-court by lawyers who I suspect could barely use Outlook always resulted in the evidence being turfed. That due process doesn't seem to be followed here, and if a search is to be used as evidence, it better damn well follow some decent practices!
    - patcheudor 10y ago
      Honestly, even with the best computer forensics in the world I still have a hard time trusting anything found mostly because I find 0-days every week that the forensics community won't know about for years. It's pretty hard if not possible to say if something got a computer because of the user or because of the Internet.
      - shakna 10y ago
        To be honest, most forensic cases are slam dunks. If it's a CP case, then, generally speaking, it's 500GB+. Usually enough so that the user has repeatedly deleted old files because their hard drive was getting full. The files are rarely encrypted, and gathered over years from sources like FTP, SMTP and the like - and those logs are the main evidence. A user is unlikely to not notice that 50GB of data is appearing once a week, and unlikely to not notice that the person they are conversing with has also been given similar charges, because their email has them talking about it, and when it comes to court, you find out that they were regularly seen with the other person.

bsder 10y ago

> Chain of custody should play a big factor here. Yeah, I'm very surprised this didn't immediately get thrown out with a "They're FBI informants and they planted the information to get paid." However, I suspect this is all a gambit to overturn the investigation results that followed so it probably isn't that clear cut.