5 ms·
You can't make any modifications for it to be admissible in court. This includes logging into a live server to take an image, or 'fixing' errors introduced duri
by dsl 13y ago
You can't make any modifications for it to be admissible in court. This includes logging into a live server to take an image, or 'fixing' errors introduced during the copy.
Professional forensic investigators have what are called 'write blockers' that prevent all writes when drives are plugged in to be imaged.
- pyre 13y agoIt was in another country, and the image was provided by the other country. Not sure about the law/case-law around how that works with respect to chain-of-evidence.
- dublinben 13y agoI think a good defense lawyer should be able to get the server image thrown out. Fat lot that will do in light of everything else though.
- judk 13y agoThey can create a hernetic environment to fsck a copy to find what files are on the original, and then copy the target file content from the discovered addresses. Otherwise I could shred say some paper evidence, and the course would reject a taped-up copy that shows my original document. Which they wouldn't, of course.