ycomnews2021

4 ms·

1.
by ycomnews2021 5y ago
These are great points. Thanks!
2.
by ycomnews2021 5y ago
Yes. So Cellebrite should be writing the data to write-once storage prior to performing any analysis of the content. In absence of write-once media, they are betting that the hashes they capture will be the same every time they image the de
3.
by ycomnews2021 5y ago
This is a problem, but I don't think Moxie would do this as it could make him liable for evidence tampering. If the protection mechanism applies to the device being scanned, its a defensive measure, if it is applied to unrelated devi
4.
by ycomnews2021 5y ago
I'm not a lawyer, but my understanding is the best time to present exculpatory evidence is after the prosecutor has prepared their case. In theory, if the investigator doesn't notice the tainted data and the case is built around t
5.
by ycomnews2021 5y ago
The modified content would be on the Cellebrite system. And the investigator may not notice until much later. The write blocker has no effect when the reader is exploited. You are correct that the source system would not be modified. But th
6.
by ycomnews2021 5y ago
Imagine you opened the folder and made a Xerox copy of the documents, but the words or dates in the copies never match the original documents. The crazy thing about this attack, is the person making the copy may never know until its present
7.
by ycomnews2021 5y ago
claiming that porn on your device isn't yours is not the problem. the theoretical problem is if you received porn via Signal on 04/01/2020 2:23AM but Cellebrite says you received it on 04/26/2020 5:34PM (while in cu
8.
by ycomnews2021 5y ago
The reason for this is chain of custody. They should be able to prove that from the time that the person last had the device until the point when the evidence was collected, no one modified it. And from the point where the evidence was coll