3 ms·

He should absolutely assume that the data has been cloned, but there is about a 99% chance that it wasn't. If the data was cloned on-site, then we wouldn't hav

He should absolutely assume that the data has been cloned, but there is about a 99% chance that it wasn't. If the data was cloned on-site, then we wouldn't have heard about the search warrant (there'd have been a gag order). And as this happened yesterday, there's almost no chance that the server could have been taken to the lab, imaged, and then returned to be reconnected today. I would bet 100 dollars that the actual target server of the raid is still sitting on a dolly in the forensics cage while a tech is waiting for someone to tell him what he's supposed to be looking for.

Skroob 15y ago
You'd be surprised. I've worked with forensic law enforcement in the past, and they were equipped to clone drives quickly and easily. The idea is to create a clean image of the drive that they can use for evidence, and they don't boot the machine so if there's any trapdoors or whatever they won't hit them. And this was a local police force over 5 years ago, I can't imagine what the FBI would be capable of these days.
- m0nastic 15y ago
  The FBI has the capacity to clone drives quickly, absolutely (although amusingly, the process is actually slower now than it was then, as drives are larger). However, field cloning is absolutely not the desired procedure to use (for a lot of reasons). You only do field cloning if you are either: 1) Under a time crunch, or 2) Don't want the target to know that the clone has occurred. If at all possible, you just take the equipment and process it in the lab. I've done about 2 dozen of these for the FBI. We did field-cloning maybe three times.
- amorphid 15y ago
  Some should build a hard drive that logs being powered up and powered down!
  - m0nastic 15y ago
    I wouldn't be surprised if SSD's somehow had information like that stored in them (or at least the ability for it to be stored). Thankfully I got out of the Forensics racket before they were mainstream.
  - duskwuff 15y ago
    SMART power cycle count?
mike-cardwell 15y ago
99%? I'd assume that the first thing they do on seizing a machine is pull the hard drive out and drop it in a disk cloning machine?

Skroob 15y ago

You'd be surprised. I've worked with forensic law enforcement in the past, and they were equipped to clone drives quickly and easily. The idea is to create a clean image of the drive that they can use for evidence, and they don't boot the machine so if there's any trapdoors or whatever they won't hit them. And this was a local police force over 5 years ago, I can't imagine what the FBI would be capable of these days.

m0nastic 15y ago
The FBI has the capacity to clone drives quickly, absolutely (although amusingly, the process is actually slower now than it was then, as drives are larger). However, field cloning is absolutely not the desired procedure to use (for a lot of reasons). You only do field cloning if you are either: 1) Under a time crunch, or 2) Don't want the target to know that the clone has occurred. If at all possible, you just take the equipment and process it in the lab. I've done about 2 dozen of these for the FBI. We did field-cloning maybe three times.
amorphid 15y ago
Some should build a hard drive that logs being powered up and powered down!
- m0nastic 15y ago
  I wouldn't be surprised if SSD's somehow had information like that stored in them (or at least the ability for it to be stored). Thankfully I got out of the Forensics racket before they were mainstream.
- duskwuff 15y ago
  SMART power cycle count?

mike-cardwell 15y ago

99%? I'd assume that the first thing they do on seizing a machine is pull the hard drive out and drop it in a disk cloning machine?