7 ms·

Howdy, digital forensics software developer here. A few points: 1) yes, the police probably should have put the phone in a Faraday bag, but those aren’t perfect

Howdy, digital forensics software developer here. A few points: 1) yes, the police probably should have put the phone in a Faraday bag, but those aren’t perfect and municipal law enforcement generally doesn’t have the same equipment that state and federal police do. It doesn’t excuse the suspect allegedly taking action to destroy evidence; 2) this is probably about the boyfriend, who they suspect committed a shooting—-they charged the girlfriend with evidence tampering as a felony, and then the prosecutor has legal leverage to get her to testify against her boyfriend and take a gun off the street; 3) no amount of technical argumentation will save you from a prosecutor, judge, or jury if you do something that causes spoiliation of evidence—when your company is sued and your business systems are preserved/collected as a result, don’t even think about getting in the way.

chapium 8y ago
if police are collecting phones as evidence on the regular, having these bags should be standard
hobbescotch 8y ago
How do you get into digital forensics dev? Seems like an interesting field.
- SEJeff 8y ago
  It really depends. I have a friend that used to work for Kroll Ontrack under their forensics unit. She quit after a few years due to the disturbing amount of child porn she had to recover. She knew she was doing good stuff in putting those predators in prison, but it really eats away at you. She's now working on an internal infosec team at Verizon, a job she really loves. To answer your original question, she has a degree in computer forensics.
- jonstewart 8y ago
  I was laid off from a startup at the bitter, wretched end of the dotcom bust in the spring of 2003. Another company two blocks from my apartment in Pasadena, CA was hiring C++ engineers, and I was lucky enough to join Guidance Software to work on EnCase. It's a fun field: bits and bytes, a whole lot of 'em, and the requirement for perfection.
  - RufusJacksons 8y ago
    I trained with Encase at uni! Quite a tool.
empath75 8y ago
Seems like a tampering charge is better to take than a murder charge, though.
- sjg007 8y ago
  I think in those cases the judge can order the jury to consider the tampering as meaning there was evidence of the crime.
ams6110 8y ago
> no amount of technical argumentation will save you from a prosecutor, judge, or jury if you do something that causes spoiliation of evidence Powerful people seem to get away with this....
- danso 8y ago
  Such as?
  - lurkertroll 8y ago
    Could be referring to Hillary Clinton
  - turc1656 8y ago
    I suspect they were alluding to Hillary's email server scandal.
    - danso 8y ago
      From Wikipedia: https://en.wikipedia.org/wiki/Hillary_Clinton_email_controversy#Deletion_of_emails https://en.wikipedia.org/wiki/Hillary_Clinton_email_controve... > In 2014, months prior to public knowledge of the server's existence, Clinton chief of staff Cheryl Mills and two attorneys worked to identify work-related emails on the server to be archived and preserved for the State Department. Upon completion of this task in December 2014, Mills instructed Clinton's computer services provider, Platte River Networks (PRN), to change the server's retention period to 60 days, allowing 31,830 older personal emails to be automatically deleted from the server, as Clinton had decided she no longer needed them. However, the PRN technician assigned for this task failed to carry it out at that time I guess people of varying political viewpoints would differ on whether Clinton had gotten away with anything. But plenty of other cases in which powerful people did not get away with destroying evidence. Or rather, they had the ability to destroy email evidence and didn't, because they knew they wouldn't get away with it. Gen. David Petraeus [0], for example, and the officials currently under the Mueller probe. [0] https://www.washingtonpost.com/world/national-security/fbi-probe-of-petraeus-triggered-by-e-mail-threats-from-biographer-officials-say/2012/11/10/d2fc52de-2b68-11e2-bab2-eda299503684_story.html https://www.washingtonpost.com/world/national-security/fbi-p...
mbrookes 8y ago
Could they not simply have put it flight mode? I appreciate that may not be possible for all makes of phone, but this was an iPhone X.
- SamuelAdams 8y ago
  Probably not, otherwise the police could be tampering with evidence. Obviously you and I know that airplane mode != changing device data, but courts and juries may not see it that way. Or they will say "You put it in Airplane mode, what else did you do?"
0xb100db1ade 8y ago
How about the threat of a 3rd party _adding_ information to a device? That sounds like another threat if someone wants to frame a suspect (i.e. another reason why devices should be placed in Faraday bags)
- foxyv 8y ago
  Interesting, if I were an attorney I would try to argue that chain of custody is broken if the device is still accepting remote commands. I wonder if it would work in court?
asimpletune 8y ago
Do the police simply not turn the phone off bc then it can’t be hacked?
danmg 8y ago
They don't need a Farday cage. They can remove the SIM.

chapium 8y ago

if police are collecting phones as evidence on the regular, having these bags should be standard

hobbescotch 8y ago

How do you get into digital forensics dev? Seems like an interesting field.

SEJeff 8y ago
It really depends. I have a friend that used to work for Kroll Ontrack under their forensics unit. She quit after a few years due to the disturbing amount of child porn she had to recover. She knew she was doing good stuff in putting those predators in prison, but it really eats away at you. She's now working on an internal infosec team at Verizon, a job she really loves. To answer your original question, she has a degree in computer forensics.
jonstewart 8y ago
I was laid off from a startup at the bitter, wretched end of the dotcom bust in the spring of 2003. Another company two blocks from my apartment in Pasadena, CA was hiring C++ engineers, and I was lucky enough to join Guidance Software to work on EnCase. It's a fun field: bits and bytes, a whole lot of 'em, and the requirement for perfection.
- RufusJacksons 8y ago
  I trained with Encase at uni! Quite a tool.

empath75 8y ago

Seems like a tampering charge is better to take than a murder charge, though.

sjg007 8y ago
I think in those cases the judge can order the jury to consider the tampering as meaning there was evidence of the crime.

ams6110 8y ago

> no amount of technical argumentation will save you from a prosecutor, judge, or jury if you do something that causes spoiliation of evidence Powerful people seem to get away with this....

danso 8y ago
Such as?
- lurkertroll 8y ago
  Could be referring to Hillary Clinton
- turc1656 8y ago
  I suspect they were alluding to Hillary's email server scandal.
  - danso 8y ago
    From Wikipedia: https://en.wikipedia.org/wiki/Hillary_Clinton_email_controversy#Deletion_of_emails https://en.wikipedia.org/wiki/Hillary_Clinton_email_controve... > In 2014, months prior to public knowledge of the server's existence, Clinton chief of staff Cheryl Mills and two attorneys worked to identify work-related emails on the server to be archived and preserved for the State Department. Upon completion of this task in December 2014, Mills instructed Clinton's computer services provider, Platte River Networks (PRN), to change the server's retention period to 60 days, allowing 31,830 older personal emails to be automatically deleted from the server, as Clinton had decided she no longer needed them. However, the PRN technician assigned for this task failed to carry it out at that time I guess people of varying political viewpoints would differ on whether Clinton had gotten away with anything. But plenty of other cases in which powerful people did not get away with destroying evidence. Or rather, they had the ability to destroy email evidence and didn't, because they knew they wouldn't get away with it. Gen. David Petraeus [0], for example, and the officials currently under the Mueller probe. [0] https://www.washingtonpost.com/world/national-security/fbi-probe-of-petraeus-triggered-by-e-mail-threats-from-biographer-officials-say/2012/11/10/d2fc52de-2b68-11e2-bab2-eda299503684_story.html https://www.washingtonpost.com/world/national-security/fbi-p...

mbrookes 8y ago

Could they not simply have put it flight mode? I appreciate that may not be possible for all makes of phone, but this was an iPhone X.

SamuelAdams 8y ago
Probably not, otherwise the police could be tampering with evidence. Obviously you and I know that airplane mode != changing device data, but courts and juries may not see it that way. Or they will say "You put it in Airplane mode, what else did you do?"

0xb100db1ade 8y ago

How about the threat of a 3rd party _adding_ information to a device? That sounds like another threat if someone wants to frame a suspect (i.e. another reason why devices should be placed in Faraday bags)

foxyv 8y ago
Interesting, if I were an attorney I would try to argue that chain of custody is broken if the device is still accepting remote commands. I wonder if it would work in court?

asimpletune 8y ago

Do the police simply not turn the phone off bc then it can’t be hacked?

danmg 8y ago

They don't need a Farday cage. They can remove the SIM.