I think that may be the wrong question to ask. A better one would be "Is this tool appropriate for use during an investigation, and does it complete it's task in a forensically sound manner?" To that, the answer is in the first paragraph of the very page that you quoted of the Knowledge Base for Ghost. This explains the "why" behind the mismatched checksums. "Normally, Ghost does not create an exact duplicate of a disk. Instead, Ghost recreates the partition information as needed and copies the contents of the files. " - Symantec Web Site (http://service2.symantec.com/SUPPORT/ghost.nsf/ c92aa8e61de62ad08825694a0011cf3b/ 42197b3bb06643dac1256b040044ef7f?OpenDocument) An investigator would not want to use Norton Ghost as a solution for forensic duplication, as it does not provide a true bit for bit copy of the original. That evidence, when presented in front on educated counsel, would likely get thrown out, as it does not adhere to the FRE 1003 exception for the requirement of originals. There, of course, is a chance that it will slip by, but hedging your bet on that chance would likely be disappointing in the end. To answer your question more directly, yes, there will likely be problems. Of course, your question could have been written after the fact, with you heading in to a courtroom 2 days from now. If so, good luck. I suggest getting a friend to pull the fire alarm when the topic is brought up. :) -- Matt > > > ********************* > "When copying a disk to another disk, a checksum of the destination > disk > will nearly always result in a different value than a checksum of the > original disk, even when using the -IR switch. This difference is due > to > differences in disk geometry between the source and destination > disks." > ******************** > > The information above came from Symantec's knowledge base. Has anyone > found this to be a problem in Court? > > TIA > Jeff > > > > > ----------------------------------------------------------------- > This list is provided by the SecurityFocus ARIS analyzer service. > For more information on this free incident handling, management > and tracking system please see: http://aris.securityfocus.com > > ----------------------------------------------------------------- This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com
This archive was generated by hypermail 2b30 : Thu May 16 2002 - 04:11:55 PDT