RE: Preserving evidence

From: Bojan Zdravkovic (bzdravkoat_private)
Date: Wed May 08 2002 - 13:45:12 PDT

Next message: Hunter Ely: "Re: Server with RAID-5"

Previous message: Rohan, Daniel G.: "RE: Server with RAID-5"
Maybe in reply to: Meritt James: "Preserving evidence"
Next in thread: Matt Pepe: "RE: Preserving evidence"
Reply: Matt Pepe: "RE: Preserving evidence"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

Are we proving physical medium integrity or content validity?
Content can be on paper, punchcard, magnetic tape and some rare instances even
in molecular memory units.

Regards,

-Bojan



|--------+----------------------->
|        |          "Jeff        |
|        |          Truedson"    |
|        |          <jtruedson@hu|
|        |          bbell.com>   |
|        |                       |
|        |          05/06/2002   |
|        |          11:52 AM     |
|        |                       |
|--------+----------------------->
  >----------------------------------------------------------------------------|
  |                                                                            |
  |       To:     FORENSICSat_private                                  |
  |       cc:     (bcc: Bojan Zdravkovic/SIAC)                                 |
  |       Subject:     RE: Preserving evidence                                 |
  >----------------------------------------------------------------------------|






*********************
"When copying a disk to another disk, a checksum of the destination disk
will nearly always result in a different value than a checksum of the
original disk, even when using the -IR switch. This difference is due to
differences in disk geometry between the source and destination disks."
********************

The information above came from Symantec's knowledge base.  Has anyone
found this to be a problem in Court?

TIA
Jeff




-----------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com

Next message: Hunter Ely: "Re: Server with RAID-5"
Previous message: Rohan, Daniel G.: "RE: Server with RAID-5"
Maybe in reply to: Meritt James: "Preserving evidence"
Next in thread: Matt Pepe: "RE: Preserving evidence"
Reply: Matt Pepe: "RE: Preserving evidence"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Fri May 10 2002 - 10:22:34 PDT