3 ms·
This unfortunately highlights a key forensics requirement: don't touch the computer. Don't turn it on, don't turn it off, don't login/logout. Ideally keep the
by angry_octet 4y ago
This unfortunately highlights a key forensics requirement: don't touch the computer.
Don't turn it on, don't turn it off, don't login/logout. Ideally keep the wifi router turned on, but disconnect it from upstream internet.
It's very hard to get people to follow this of course but it's critical, especially now FDE is becoming more common. In the extreme case you can leave it on until you can cause an exploit remotely or are ready to immerse it in liquid nitrogen and extract the FDE keys from RAM. There are tools (wiebetech.com) for moving plugged in computers onto battery power if you can't work in situ or can't risk a grid outage.
- DerekBickerton 4y agoThis. To be honest, I think it's a miracle that my machine boots at all. Most people take it for granted, but I cherish each day it boots and I don't have to do a clean install because something breaks (typically some bizarre edge case scenario unique to Windows that only breaks on my machine). There is the old saying: if it works, don't try to fix it.
- autoexec 4y ago> It's very hard to get people to follow this of course but it's critical We've spent decades telling users that the miracle fix for all their technology problems is turning your device off and on again. That's going to a long time to undo.
- discardedrefuse 4y agoYou can't ask people to treat every "user can't find file" situation as a forensic investigation.
- angry_octet 4y agoThis is easy to triage! Q1 - Would you be very very upset if all the data on your computer was lost Y/N Q2 - Do you have backups of this data? (The answer is invariably No.) Q3 - Is your computer behaving strangely? Do you have a spidey sense of doom which caused you to contact me? Y/N At which point it should be clear that further unqualified FA&FO is a bad idea.