3 ms·
The modified content would be on the Cellebrite system. And the investigator may not notice until much later. The write blocker has no effect when the reader is
by ycomnews2021 5y ago
The modified content would be on the Cellebrite system. And the investigator may not notice until much later. The write blocker has no effect when the reader is exploited.
You are correct that the source system would not be modified. But the content you are presenting and analyzing via Cellebrite would.
- _wldu 5y agoExactly, but it could be easily proven that the data was tampered with as you still have the original/clean image and the device itself. So if they are altering data, it can be shown.
- ycomnews2021 5y agoI'm not a lawyer, but my understanding is the best time to present exculpatory evidence is after the prosecutor has prepared their case. In theory, if the investigator doesn't notice the tainted data and the case is built around the tainted data they could argue that everything from that source (system/lab/department) should be thrown out and that the experts who collected it can't be trusted anymore due to incompetence. Sounds like a prosecutors worst nightmare.
- _wldu 5y agoRight and if they have a file or group of files that are central to the case, all the accused has to do is say, "those were not on my phone" and then the 'experts' go back and look at the read-only image to verify. If the phone could have been altered to add data before a forensic image was acquired in a way that looks like it was via normal use (reasonable timestamps, browser logs, etc.) then we'd have a real problem. Cellebrite potentially being used to do this as it reads the image is not that problem.