3 ms·

Honestly, even with the best computer forensics in the world I still have a hard time trusting anything found mostly because I find 0-days every week that the f

Honestly, even with the best computer forensics in the world I still have a hard time trusting anything found mostly because I find 0-days every week that the forensics community won't know about for years. It's pretty hard if not possible to say if something got a computer because of the user or because of the Internet.

shakna 10y ago
To be honest, most forensic cases are slam dunks. If it's a CP case, then, generally speaking, it's 500GB+. Usually enough so that the user has repeatedly deleted old files because their hard drive was getting full. The files are rarely encrypted, and gathered over years from sources like FTP, SMTP and the like - and those logs are the main evidence. A user is unlikely to not notice that 50GB of data is appearing once a week, and unlikely to not notice that the person they are conversing with has also been given similar charges, because their email has them talking about it, and when it comes to court, you find out that they were regularly seen with the other person.