Slashdot Mirror

← Back to Stories (view on slashdot.org)

Vista Makes Forensic PC Exam Easier for Lawyers

Posted by Zonk on from the can-i-introduce-you-to-some-nice-encryption dept.

Katharine writes "Jason Krause, a legal affairs writer for the American Bar Association's 'ABA Journal' reports in the July issue that Windows Vista will be a boon for those looking for forensic evidence of wrongdoing on defendants' PC's and a nightmare for defendants who hoped their past computer activities would not be revealed. Krause quotes attorney R. Lee Barrett, 'From a [legal] defense perspective, [Vista] scares me to death. One of the things I have a hard time educating my clients on is the volume of data that's now discoverable.' This is primarily attributable to Shadow Copy, TxF and Instant Search."

2 of 343 comments (clear)

  1. Re:Another Use for VMWare by ls671 · · Score: 5, Insightful

    How are you going to wipe out the virtual computer once the computer is into ennemy hands ? ;-)

    --
    Everything I write is lies, read between the lines.
  2. Re:Just some more... by Ravnen · · Score: 5, Insightful
    I'm afraid you're mistaken in suggesting that other systems do not use similar methods. Mac OS X, for example, includes Spotlight, which has similar implications to Windows Search, and the upcoming 10.5 version will include a feature called Time Machine, with similar implications to Shadow Copy in Windows. The use of ZFS might too introduce issues similar to those inherent in Transactional NTFS.

    The reality is that most users like the ability to index and search their data, and to recover previous versions of a file, as well as the better reliability offered by transactional file operations. In the general case of a non-criminal user, these features provide far greater benefits than the potential harm of having their activities more effectively analysed by law enforcement officials, in the highly improbable case of a legal order to hand over their data.