3 ms·
Perhaps they had a ruling in the past that during accessing a computer, things got changed, like the logs. And so now they have to have that in the warrant so
by wccrawford 7y ago
Perhaps they had a ruling in the past that during accessing a computer, things got changed, like the logs. And so now they have to have that in the warrant so that they don't lose their case.
It sounds stupid, but I could see it happening.
- koenigdavidmj 7y agoOr the right to install spyware.
- gruez 7y ago>Perhaps they had a ruling in the past that during accessing a computer, things got changed, like the logs they don't have imaging tools and/or write blockers?
- chopin 7y agoBut this isn't a way to do a forensic analysis. You just clone the hard drive. Anything else should not be able to stand up in court. Afaik it is practice in rule-of-law countries to hand a clone to each party in the case.
- doomjunky 7y agoForensic analysts must use read-only adapters to clone hard drives.
- manicdee 7y agoThis wasn’t a forensic extraction of data from a recovered hard drive, it was a drag net across email server, file servers, content management systems, wikis, phone records, written notes … basically every form of communication that left any trace. The ABC staff literally copied all the stuff that might be interesting (found using keyword searches) into a folder, which the ABC legal and AFP investigators went through one by one to determine what was of interest to AFP. The items of interest was then copied to a “sealed” package which the AFP pinky swears nobody will look at for two weeks while the ABC seeks an injunction.