2 ms·
and then the forensic analyst would note that and hold a forensically-sound copy while a new warrant was issued, because every file's MAC data being set to 0 wo
by ratelimitsteve 1y ago
and then the forensic analyst would note that and hold a forensically-sound copy while a new warrant was issued, because every file's MAC data being set to 0 would provide articulable suspicion that evidence cannot be filtered by date. So now the search has expanded to include your entire device and, given your history of attempting to tamper with evidence, the entirety of any other seized device as well. Congratulations?
- sidewndr46 1y agoWhich would mean there are no restrictions on what they can search at that point? Right? You also seem to be operating from a standpoint that because I am subject to a search, there exists evidence of me committing a crime. That's a pretty slippery slope from where I'm standing.
- ratelimitsteve 1y agoI'm operating from the assumption that there would be evidence that the phone was tampered with, and it's a reasonable assumption because your premise explicitly states that you'd be altering MAC data. Whether there's evidence of a crime doesn't actually enter into it, once there is evidence that the warrant restrictions are being exploited to hide something there's articulable suspicion that the entire device is a valid place to look for evidence. Whether that search actually finds anything is irrelevant to the discussion entirely.
- sidewndr46 1y agoYou used the phrase "given your history of attempting to tamper with evidence". If I have a history of tampering with evidence, then I implicitly committed a crime of some kind. One cannot tamper with evidence without a crime.
- ratelimitsteve 1y agooh well then yeah I think we can assume that you committed the crime that you said you committed in the original comment and also that the evidence you explicitly said would be there would be there.