Slashdot Mirror
New Anti-Forensics Tools Thwart Police
rabblerouzer writes "Antiforensic tools have slid down the technical food chain, from Unix to Windows, from something only elite users could master to something nontechnical users can operate. 'Five years ago, you could count on one hand the number of people who could do a lot of these things,' says one investigator. 'Now it's hobby level.' Take, for example, TimeStomp. Forensic investigators poring over compromised systems where Timestomp was used often find files that were created 10 years from now, accessed two years ago and never modified."
Simple! Just cut the disk open and count the rings.
What?
This has got to be old news. Over 112% of Slashdotters have been using these programs for years, since at least 3 months from now!
- RG>
Hey pal, this isn't a pleasantforest, so don't waste my time with pleasantries!
I always just keep a few magnets handy... just in case....
I prefer hardware solutions, rather than software ones.
thats really odd, i seem to remember seeing something similar on our domain controller a few minu
the modification date was'ntobe set the last time it shallhasbeen accessed...
Uhh - got to work on my future imperfect past continuous tense.
Excuse me, but please get off my Pennisetum Clandestinum, eh!
Well, alternatively one could just use Windows ME on a FAT file system. That screws things up all by itself - no need for fancy tools.
Excuse me, but please get off my Pennisetum Clandestinum, eh!
Don't knock it. Catching cheating spouses is a great way to get laid. You've already established that they've got no problem sleeping with people other than their husbands, which is 90% of the battle usually.
Fascism trolls keeping me up every night. When I starts a preachin', he HITS ME WITH HIS REICH!
>>> ...on one hand...
>
>Yes, yes.
>
>Five years ago (2002) there were five people (or less) that knew touch.
Er, assuming they're using 5 fingers (inc. thumb) then that should be *31* people or less...
>
>Lol. The guy is a moron.
*He's* a moron?
What's that strange gesture you're giving me with your hand? You trying to tell me '4' for some reason?? Hrm...odd.
Max.
You should use ROT-9 followed by ROT-8 followed by ROT-9 again. ROT-13 is pretty weak, but if you use different numbers, apply encryption multiple times, your data will be much safer. TripleROT (9,8,9) is a standard by which all other methods are measured. All without requiring some fancy scheme concocted by guys with foreign-sounding names. Would you trust your security to a foreigner? with a beard?
Oh, and IIRC, withholding the password would be obstruction of justice (assuming they obtained a warrant for the data protected by the password, as per the 4th amendment)
Can you be Even More Awesome?!
just do some petty theft on top of that and overflow it back to 0x01.
Non impediti ratione cogitationus.
withholding the password would be obstruction of justice
Couldn't you choose an incriminating password and plead the 5th?
This post written under Gentoo-linux with an SCO IP license.
> I didn't think encrpyting data twice or more over increased it's level of security.
Well, it usually does. Unless, of cousre, you're using ROT-13 for your original encryption.
Oy! Now none of my makefiles work properly!
Quidnam Latine loqui modo coepi?
Where's the .torrent?
Yes. Everyone knows that double ROT-13 gives you the original data. Don't be silly. That's why I quadruple it.
The DA just smiles at you and says... "I'd like to see the hidden container inside that TrueCrypt volume. My forensicist says oftentimes people do that with TrueCrypt."
You say "umm... there isn't a hidden container... there's nothing more there..."
The DA continues to smile. "Prove it to me."
You say "Actually, you have to prove to me that there's anything there to hide. You should know that I'm innocent until proven guilty."
Then you walk away scott free. The DA continues to smile for some reason, probably too much crack this morning.
Twinstiq, game news