5 ms·

> After getting my drives back I checked one of my USB drives and it had a .docx file on it that didn't come from me. Booooo. Die BVT dropped the ball on pres

> After getting my drives back I checked one of my USB drives and it had a .docx file on it that didn't come from me. Booooo. Die BVT dropped the ball on preserving the chain of custody for this evidence. They should have used equipment that bars device writes.

biot 7y ago
Or leaving the .docx file was intentional and by opening it, the guy triggered a hidden payload which installs malware which the police use to monitor him.
- Timpy 7y ago
  If they had his hardware for a year I don't think they would need him to trigger a hidden payload.
  - voxic11 7y ago
    Its to allow them to continue monitoring his activities going forward, without the need for annoying warrants and physical searches.
    - marblar 7y ago
      I think the point is that they could have just installed the malware since they had physical possession for an entire year.
      - tjoff 7y ago
        And the counterpoint is that he'd obviously got a new computer and any further surveillance would benefit from access to that one.
        Timpy 7y ago
        That's a good point. I was assuming the old hard drive was loaded on old equipment but that's not necessarily the case.
- ohithereyou 7y ago
  Why would you ever spin those drives up again? I'd sledgehammer them just to make sure.
mattbk1 7y ago
Would it be possible to hide an exploit or test in a Word doc or image? I suppose they could have planted the image there with some steganographic encryption, and if the author was clever enough to find another link and click it, he would alert authorities to that fact? This sounds farfetched when I write it out.
- darkwater 7y ago
  I would reuse an already existing files on the hard drive to do that instead of adding a new one.
  - martin-adams 7y ago
    By adding a new file, it piques curiosity, or triggers communication to the person in the photo to let them know that they're on to them.
    - Shendare 7y ago
      Plausible line of thought.
    - darkwater 7y ago
      I was thinking about this too but, at least in my case, would make me doubt about it.
- chelmzy 7y ago
  Its common to use Word macros to install malware.
  - Shendare 7y ago
    Though in this case mitigated by the split between .docx (macro-less) documents and .docm (macro-enabled). Either file type can also be unzipped and have their contents inspected for anything suspicious.
deleted 7y ago
[deleted]

biot 7y ago

Or leaving the .docx file was intentional and by opening it, the guy triggered a hidden payload which installs malware which the police use to monitor him.

Timpy 7y ago
If they had his hardware for a year I don't think they would need him to trigger a hidden payload.
- voxic11 7y ago
  Its to allow them to continue monitoring his activities going forward, without the need for annoying warrants and physical searches.
  - marblar 7y ago
    I think the point is that they could have just installed the malware since they had physical possession for an entire year.
    - tjoff 7y ago
      And the counterpoint is that he'd obviously got a new computer and any further surveillance would benefit from access to that one.
      - Timpy 7y ago
        That's a good point. I was assuming the old hard drive was loaded on old equipment but that's not necessarily the case.
ohithereyou 7y ago
Why would you ever spin those drives up again? I'd sledgehammer them just to make sure.

mattbk1 7y ago

Would it be possible to hide an exploit or test in a Word doc or image? I suppose they could have planted the image there with some steganographic encryption, and if the author was clever enough to find another link and click it, he would alert authorities to that fact? This sounds farfetched when I write it out.

darkwater 7y ago
I would reuse an already existing files on the hard drive to do that instead of adding a new one.
- martin-adams 7y ago
  By adding a new file, it piques curiosity, or triggers communication to the person in the photo to let them know that they're on to them.
  - Shendare 7y ago
    Plausible line of thought.
  - darkwater 7y ago
    I was thinking about this too but, at least in my case, would make me doubt about it.
chelmzy 7y ago
Its common to use Word macros to install malware.
- Shendare 7y ago
  Though in this case mitigated by the split between .docx (macro-less) documents and .docm (macro-enabled). Either file type can also be unzipped and have their contents inspected for anything suspicious.

deleted 7y ago

[deleted]