On Tuesday, Aug 5, 2003, at 13:23 US/Pacific, Ron DuFresne wrote:
On Tue, 5 Aug 2003, David Hayes wrote:
Our old standby, "dd", is perfectly acceptable for making an image of a hard drive to be used in court. It's even the #1 choice of the FBI, and accepted by U.S. federal courts. From the trial court order on admission of evidence in the case of Zacarias Moussaoui (the accused 20th hijacker of 9/11):
Interesting, I would have thought that the original was required for the
courts, and that forensics was conducted on the copy.
Thanks,
Ron DuFresne
I believe there are ways to recover data at the physical/magnetic level - magnetic remnants of previously-deleted data, for instance - which would require access to the original platters. I read an article about this somewhere - would have to be SciAm or /.
C
--- Craig Pratt Strongbox Network Services Inc. mailto:[EMAIL PROTECTED] dtmf:503.706.2933
-- This message checked for dangerous content by MailScanner on StrongBox.
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
