3 ms·
You'd hope in high profile cases (or really all cases), a hash of the entire drive could be taken upon seizure and given to a lawyer before any forensics starte
by ShorsHammer 9y ago
You'd hope in high profile cases (or really all cases), a hash of the entire drive could be taken upon seizure and given to a lawyer before any forensics started.
Don't know much about forensics and maybe this already happens, but is surely a good way for both sides to avoid unfounded accusations.
- psyc 9y agoThe evidence would have been planted by the civilian tech before seizure.
- triggercut 9y agoIIRC in law enforcement situations where a HDD has been obtained through slightly more conventional means, chain of custody is as important (as it is for all evidence) as ensuring the state is maintained. There are many forensic hardware providers that specifically sell 'read only' readers to ensure that whilst in possession of the drive, it's state is preserved (as much as practicably possible).