3 ms·

For what it's worth, it's very common for forensics teams to get memory dumps before the computers are turned off or moved.

by trotsky 15y ago

X-Istence 15y ago
Why dump memory when you can do this instead: http://www.youtube.com/watch?v=erq4TO_a3z8 http://www.youtube.com/watch?v=erq4TO_a3z8
- trotsky 15y ago
  For chain of custody etc. you always need to make a master copy and sign/hash it and then work off of a copy. If you tried to do forensics on the actual computer as seized you'd be busy destroying disk & memory evidence as you worked.
  - X-Istence 15y ago
    That is fine for working on it (and having taken computer forensics classes at college something I am intimately familiar with), however it no longer needs to be done on location. The device can safely be removed without requiring a tech to go out to the location.
IgorPartola 15y ago
No problem. With enough money you could set up a dead man switch to erase your laptop if you step more than 3 feet away from it which is bound to happen if the FBI drags you away. Or set up a voice recognition system that would listen for the words "Open up! Police!". My point is that with all these amateur lawyer "I can outsmart them on a technicality" schemes I think it needs to be said that you probably don't want to do any of that. Instead, if you do have something that you feel you don't want to expose, use whole disk encryption with hidden volumes, duress codes, etc. but keep your options open. The worst possible scenario to be in is where the only way to prove that you are innocent (or to enter into a plea bargain) is to decrypt your drive but some crazy scheme of yours now prevents you from ever recovering your passphrase. EDIT: Can someone please explain the downvotes?
- baddox 15y ago
  You can also just, you know, refuse to decrypt the drive. If they're going to torture you, you're pretty much screwed anyway so you probably don't care about the data (unless perhaps it contains crucial private information about friends and family, or business dealings).

For what it's worth, it's very common for forensics teams to get memory dumps before the computers are turned off or moved.

by trotsky 15y ago

For what it's worth, it's very common for forensics teams to get memory dumps before the computers are turned off or moved.

X-Istence 15y ago

Why dump memory when you can do this instead: http://www.youtube.com/watch?v=erq4TO_a3z8 http://www.youtube.com/watch?v=erq4TO_a3z8

trotsky 15y ago
For chain of custody etc. you always need to make a master copy and sign/hash it and then work off of a copy. If you tried to do forensics on the actual computer as seized you'd be busy destroying disk & memory evidence as you worked.
- X-Istence 15y ago
  That is fine for working on it (and having taken computer forensics classes at college something I am intimately familiar with), however it no longer needs to be done on location. The device can safely be removed without requiring a tech to go out to the location.

IgorPartola 15y ago

No problem. With enough money you could set up a dead man switch to erase your laptop if you step more than 3 feet away from it which is bound to happen if the FBI drags you away. Or set up a voice recognition system that would listen for the words "Open up! Police!". My point is that with all these amateur lawyer "I can outsmart them on a technicality" schemes I think it needs to be said that you probably don't want to do any of that. Instead, if you do have something that you feel you don't want to expose, use whole disk encryption with hidden volumes, duress codes, etc. but keep your options open. The worst possible scenario to be in is where the only way to prove that you are innocent (or to enter into a plea bargain) is to decrypt your drive but some crazy scheme of yours now prevents you from ever recovering your passphrase. EDIT: Can someone please explain the downvotes?

baddox 15y ago
You can also just, you know, refuse to decrypt the drive. If they're going to torture you, you're pretty much screwed anyway so you probably don't care about the data (unless perhaps it contains crucial private information about friends and family, or business dealings).