Commodore 64 Confuses Austrian Police

toomanyairmiles writes, "It seems that Wolfgang Priklopil, the communications technician who kidnapped Austrian pre-teen Natascha Kampusch, relied on a Commodore 64 as his primary machine. Interestingly this is presenting some problems to the Austrian computer forensics people. Major General Gerhard Lang of the Federal Criminal Investigations Bureau told reporters it would 'complicate investigators' efforts' and would be difficult to transfer the files to modern computers 'without loss.' Could this be the latest in the criminal world's security strategy? Can we expect to see Spectrums, Archimedes, and Atari STs turning up in police investigations soon?"

Comments

This is retarded

[Cobralisk]

Seriously, I have a Commodore 64 sitting right next to me hooked up to a dos box as a hard drive. Data is data. You just need a x1541 cable. There are lots of free software tools to facilitate this, and the d64 and t64 formats are well supported. You can even use audio tapes and a soundcard to transfer files. Once you have the data on the PC, there are multitudes of C64 emulators to run the software directly. I've been doing this since the late '90s. Google is your friend.

Re:Why go that far?

[Morphine007]

Because in most forensic investigations, they remove the hard-drive from the PC and then perform the investigation using another operating system guaranteed to not have any nasty surprises built in. They're not going to run the risk that buddy has a small script that deletes his entire hard drive if he doesn't hit ctrl-a-s-d-f-enter within seconds of booting up.

There's likely more to it than that as well, but the point is they generally don't want to use the system they've confiscated...

reason to use it in one word:

[GeekyMike]

Zaxxon

C64 hardware

[Neo-Rio-101]

There are a myriad of other issues with this too. For one, the Commodore 64 uses PETSCII and not standard ASCII. To complicate matters more, he may have even used GEOS to store his data on floppy disks, and without the right conversaion tools, coverting that to plain text, muchless PC readable media, is going to be tricky without the right C64 hardware. If he had all that CMD hardware, or stored all his information on a hard disk or CMD formatted floppy disk, it will be harder again.

Re:Commodore 64 has an RS-232 interface.

[Dun Malg]

The back of the Commodore 64 has an RS-232 interface. Any schmuck with a bachelor's degree in electrical engineering can hook the Commodore 64's serial interface into the serial interface of any modern desktop.

No, actually it doesn't have an RS-232 interface. It has something called a User Port, using a male card-edge connector, which can transmit and receive serial data, but it only does so at TTL levels. But yeah, any schmuck with a soldering iron and a breadboard can slap together a true RS-232 interface using a 25 cent MAX232 chip and a few caps.

Computer Forensics - clear as mud

[gsobol]

Well, I can sum up the whole article like this:
Forensic investigators = not stupid
Article author/editor = selling a story / lack of facts
Court system = flaky justice

Being a computer forensic investigator, what I can tell you is that the problem is not with extracting individual files (being current, deleted, overwritten), or even hashing the contents or drive images themselves. Although this does present a certain technical challenge, this can be overcome. Any forensic investigator will tell you that, what he/she finds during his/hers investigation rarely comes under question or scrutiny. You just can not deny the fact that this "stuff" was found on the suspects media. What almost always comes under scrutiny is the technique used in obtaining the evidence. Where the police do have the tools and techniques that have been court tested for the relatively modern machines and OSes, there is no such tool or a battle tested procedure for capturing and processing data from the Commodore 64. That's what the challenge is all about. It's all about how do you get your evidence, and prevent the defence from shooting it down on a technicality that your approach was not forensically sound, because you have not used the court "approved" forensic tools and techniques. -- a side note: there are no court approved forensic tools, at least not in the USA. There are forensic tools that have gone through court scrutiny and been found to be acceptable, but only in conjunction with a proper forensic sound procedure. The tool is only a tool, like a hammer, it can be used to drive a nail into a wall, or crack someone's skull. Define a proper and sound use :) -- It's easy for technical people to understand the realities and limitations of the technology. It's easy to understand that when you copy the contents of the files from one OS to another the contents do not usually change. But for an average person on the jury, if one computer is old and the other computer is new, and they don't speak the same language, well that means that someone had to translate it, right? And if someone translated it, could they have made a mistake? Of course they could! Of course they DID! Again, the hard evidence - the files, the pictures, the notes, etc.. - do not come under scrutiny. It's the techniques, the procedure, the competence of the investigators that get's questioned, and thanks to our "well educated" and "intelligent" jury, sometimes the guilty go free.