4 ms·
You wish. All they need to do is track which files they modify and not touch the other ones. I doubt it would be fruitful to explore that angle in court
by psd1 6y ago
You wish. All they need to do is track which files they modify and not touch the other ones. I doubt it would be fruitful to explore that angle in court
- not1ofU 6y agoI attended a conference back in the early 00's, where a member of GHCQ presented. He spoke about assisting on 911, obtaining forensic evidence from hard drives and the lengths that his team had to go to, to make sure that no files where changed while creating a clone of the drives. He stated that they can not just turn on a computer when they have seized it, as there would be about 800 files altered before Windows had even booted to the login screen. This, he stated, would destroy the chain of evidence. He might have been full of shit though.