3 ms·

Coffee is supposed to be run before you shut down the pc. To be honest I don't imagine it would see much uptake: too much risk of making evidence inadmissable i

by ErrantX 17y ago

Coffee is supposed to be run before you shut down the pc. To be honest I don't imagine it would see much uptake: too much risk of making evidence inadmissable in court (uk guidelines are quite heavy about that)

tptacek 17y ago
Coffee does pretty much the same thing every other LEO forensics toolset does. I don't think it has admissability problems.
- ErrantX 17y ago
  ACPO guidelines get very ratty about working on live machines. Especially if you can't demonstrate technical competance. In my experience the vast majority of police seizing machines can't do that. It would be a field day for the defence I imagine :-)
  - tptacek 17y ago
    The ACPO (Assoc. of UK Police dept's) doesn't ban live recovery, it just says you have to do it with an approved process and an approved tool, which rather validates the basic idea behind Cofee. Suffice it to say, the US isn't as weird about live recovery. The idea that an untrained LEO should unplug a target computer from the wall is very 1990's-era guidance.
    - ErrantX 17y ago
      Yeh I know you have an easier time of it in the US. ACPO guidelines are awkwardly worded at best; CPS asks us to steer clear of live work. This is the crucial line: In exceptional circumstances, where a person finds it necessary to access original data held on a computer or on storage media, what person must be competent to do so and be able to give evidence explaining the relevance and the implications of their actions. LEO's hate the idea of what exceptional circumstances could mean. And for the most part none of the police seizing machines have the competence to explain what they did and the implications. Most of the hi-tech crime SOP for law enforcement here (which was co-written originally by my current boss) asks to avoid live acquisitions. I obviously cant be specific but very few cases involve live data (of this type) and those that do usually never make it to court or are dismissed fairly quickly. (the main problem are defence teams with no technical knowledge who hire "specialists"; they will nitpick at every process undertaken if they can't pick at the evidence. This happens a lot and live evidence would be a field day for them)

by ErrantX 17y ago

tptacek 17y ago

Coffee does pretty much the same thing every other LEO forensics toolset does. I don't think it has admissability problems.

ErrantX 17y ago
ACPO guidelines get very ratty about working on live machines. Especially if you can't demonstrate technical competance. In my experience the vast majority of police seizing machines can't do that. It would be a field day for the defence I imagine :-)
- tptacek 17y ago
  The ACPO (Assoc. of UK Police dept's) doesn't ban live recovery, it just says you have to do it with an approved process and an approved tool, which rather validates the basic idea behind Cofee. Suffice it to say, the US isn't as weird about live recovery. The idea that an untrained LEO should unplug a target computer from the wall is very 1990's-era guidance.
  - ErrantX 17y ago
    Yeh I know you have an easier time of it in the US. ACPO guidelines are awkwardly worded at best; CPS asks us to steer clear of live work. This is the crucial line: In exceptional circumstances, where a person finds it necessary to access original data held on a computer or on storage media, what person must be competent to do so and be able to give evidence explaining the relevance and the implications of their actions. LEO's hate the idea of what exceptional circumstances could mean. And for the most part none of the police seizing machines have the competence to explain what they did and the implications. Most of the hi-tech crime SOP for law enforcement here (which was co-written originally by my current boss) asks to avoid live acquisitions. I obviously cant be specific but very few cases involve live data (of this type) and those that do usually never make it to court or are dismissed fairly quickly. (the main problem are defence teams with no technical knowledge who hire "specialists"; they will nitpick at every process undertaken if they can't pick at the evidence. This happens a lot and live evidence would be a field day for them)