3 ms·

I'm not sure digital forensics is invalid, but it certainly needs a process of validating that the evidence wasn't tampered with due to the easier nature of tam

I'm not sure digital forensics is invalid, but it certainly needs a process of validating that the evidence wasn't tampered with due to the easier nature of tampering. Independent review/auditing is insufficient because it could be fooled by tampering. Independent oversight, though, perhaps could work. Imagine a scenario like FBI Bob and EFF Alice show up to image a suspect's hard drive. Both of them image it, Alice hashes it and throws away the image, Bob keeps the image, then if there's a dispute, Alice is called in and provides her hash and if Bob's image doesn't match it, the tampering alarms go off.

Natsu 6y ago
Usually they use things like write blockers to prevent accidental modification of the data, at least with hard drives.
- logifail 6y ago
  > they use things like write blockers Q: How could you verify that a write blocker was actually used, and that it functioned as described?
  - PeterisP 6y ago
    Just as with most things for physical evidence, paper trail documenting what was done by whom and when, plus the testimony of these people. Think the equivalence of "how do you verify that the fingerprints shown as exhibit A were actually taken off that gun?" - if it's disputed, the forensics expert testifies what they did and without very specific counterarguments the juries generally trust that it's true.
ganafagol 6y ago
For this to work, FBI Bob and EFF Alice need to trust each other. Otherwise, if FBI Bob gets to connect to the hard drive first, the imaging process could tamper with the contents before EFF Alice has a chance to do the hashing. And if instead EFF Alice connects first, she could be wiping the incriminating data before taking her hash and FBI Bob imaging anything. If course, if they already trust each other (including all the used tools), then the whole excercise is moot.
- jdiez17 6y ago
  Both parties could be connected to a bridge device that only allows read commands to pass through the actual drive. They would need to trust that the bridge is not malicious. And that is a whole other rabbit hole. But I think it is possible for them to attest the firmware/gateware running on it, through some convoluted cryptographic ceremony.
  - namibj 6y ago
    What you could do, theoretically, is optically isolate the drive from the bridge, and have an optical splitter on the reader-to-drive direction who's signal is recorded by both parties. They'd get a live notification of tampering, and could have independent signal blocksers that could physically block the command from actually arriving at the drive (assuming they use a few hundred meters of coiled fiber as a delay line). The receiver on the drive side could even be a single phtotodiode, which could be made to allow easy verification with, say, an electron microscope if you're really paranoid. There are probably ways to use field-suitable technology if you only need to ensure the photodiode has the same structure as what you expect. Cryptography won't help you with trusting hardware. Delays and intervention-ability would help, though.
    - ganafagol 6y ago
      Not sure how optics would help. If your wire has some kind of side channel, optics can have it too. If you want to detect stray mysterious photons then you could do the same with electrons. But in any case, this is not really the level of concern here. It's equipment that tampers with the device. The only way to be sure is to roll your own. Which holds for both sides. So the perfect systems needs to be created by two adverse parties, which means it's impossible to do. Qed. (In the real world with physical proof this is different since tampering is much harder and it's a problem worked on for centuries. It's not bullet proof either but much more mature.)
PeterisP 6y ago
Hashes of disk images are definitely recorded and stored as part of forensics evidence trail. Being able to prove that the files you got came from the hard drive of the suspect - essentially a physical chain of custody until the image is taken, recording what was taken, and a digital chain with hashes/signatures starting from the imaging. The hash verification you describe happens (without independent oversight but enugh to protect against a single bribed/malicious officer) and it does protect from post-factum altering of any digital evidence; you try to do the early (physical) parts quickly, the majority of analysis work comes after you have the images and their hashes - but everything from that analysis can reproduced from the verified images if it's disputed.

Natsu 6y ago

Usually they use things like write blockers to prevent accidental modification of the data, at least with hard drives.

logifail 6y ago
> they use things like write blockers Q: How could you verify that a write blocker was actually used, and that it functioned as described?
- PeterisP 6y ago
  Just as with most things for physical evidence, paper trail documenting what was done by whom and when, plus the testimony of these people. Think the equivalence of "how do you verify that the fingerprints shown as exhibit A were actually taken off that gun?" - if it's disputed, the forensics expert testifies what they did and without very specific counterarguments the juries generally trust that it's true.

ganafagol 6y ago

For this to work, FBI Bob and EFF Alice need to trust each other. Otherwise, if FBI Bob gets to connect to the hard drive first, the imaging process could tamper with the contents before EFF Alice has a chance to do the hashing. And if instead EFF Alice connects first, she could be wiping the incriminating data before taking her hash and FBI Bob imaging anything. If course, if they already trust each other (including all the used tools), then the whole excercise is moot.

jdiez17 6y ago
Both parties could be connected to a bridge device that only allows read commands to pass through the actual drive. They would need to trust that the bridge is not malicious. And that is a whole other rabbit hole. But I think it is possible for them to attest the firmware/gateware running on it, through some convoluted cryptographic ceremony.
- namibj 6y ago
  What you could do, theoretically, is optically isolate the drive from the bridge, and have an optical splitter on the reader-to-drive direction who's signal is recorded by both parties. They'd get a live notification of tampering, and could have independent signal blocksers that could physically block the command from actually arriving at the drive (assuming they use a few hundred meters of coiled fiber as a delay line). The receiver on the drive side could even be a single phtotodiode, which could be made to allow easy verification with, say, an electron microscope if you're really paranoid. There are probably ways to use field-suitable technology if you only need to ensure the photodiode has the same structure as what you expect. Cryptography won't help you with trusting hardware. Delays and intervention-ability would help, though.
  - ganafagol 6y ago
    Not sure how optics would help. If your wire has some kind of side channel, optics can have it too. If you want to detect stray mysterious photons then you could do the same with electrons. But in any case, this is not really the level of concern here. It's equipment that tampers with the device. The only way to be sure is to roll your own. Which holds for both sides. So the perfect systems needs to be created by two adverse parties, which means it's impossible to do. Qed. (In the real world with physical proof this is different since tampering is much harder and it's a problem worked on for centuries. It's not bullet proof either but much more mature.)

PeterisP 6y ago

Hashes of disk images are definitely recorded and stored as part of forensics evidence trail. Being able to prove that the files you got came from the hard drive of the suspect - essentially a physical chain of custody until the image is taken, recording what was taken, and a digital chain with hashes/signatures starting from the imaging. The hash verification you describe happens (without independent oversight but enugh to protect against a single bribed/malicious officer) and it does protect from post-factum altering of any digital evidence; you try to do the early (physical) parts quickly, the majority of analysis work comes after you have the images and their hashes - but everything from that analysis can reproduced from the verified images if it's disputed.