Thanks James That was really my point in suggesting a *simple* tool. I get the feeling that the "forensics" community sometimes gets too bogged down in techniques and forgets that forensics is about legal issues. The legal process is notoriously influenced by *subjective human judgements*, which often overrides perfectly sound technical knowledge. Mike Barwise Computer Security Awareness "Addressing the Human Equation in Information Security" > Date sent: Fri, 29 Jun 2001 11:01:11 -0400 > From: "Meritt James" <meritt_jamesat_private> > Organization: BAH > And comprehensible to the jury... > > Opinion: THAT is the "number one" consideration if you are conducting > the investigation with legal action (involving a jury) in mind. As far > as I can tell, though, that seldom (if ever) happens. > > Bob Johnson wrote: > > > The evidence you present must be able to stand up to a defense > > attorney asking you > > [snip] > > -- > James W. Meritt, CISSP, CISA > Booz, Allen & Hamilton > phone: (410) 684-6566 > > ----------------------------------------------------------------- > > This list is provided by the SecurityFocus ARIS analyzer service. > For more information on this free incident handling, management > and tracking system please see: > > http://aris.securityfocus.com > ----------------------------------------------------------------- This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com
This archive was generated by hypermail 2b30 : Sat Jun 30 2001 - 09:56:10 PDT