3 ms·
I can absolutely confirm that standard procedure is to seize storage media as evidence, send them to a lab and clone the images as the very first step.
by dharmab 8y ago
I can absolutely confirm that standard procedure is to seize storage media as evidence, send them to a lab and clone the images as the very first step.
- codetrotter 8y agoAnother thing I came to think of as well is that they often employ write-blockers, don’t they? Pieces of hardware that go between the computer and the storage media. So by the time decryption is demanded, it will be done with the system in a read-only state right?
- dharmab 8y agoThey don't run forensics on the actual device if at all possible, only a read-only cloned image.