Vista Makes Forensic PC Exam Easier for Lawyers

Katharine writes "Jason Krause, a legal affairs writer for the American Bar Association's 'ABA Journal' reports in the July issue that Windows Vista will be a boon for those looking for forensic evidence of wrongdoing on defendants' PC's and a nightmare for defendants who hoped their past computer activities would not be revealed. Krause quotes attorney R. Lee Barrett, 'From a [legal] defense perspective, [Vista] scares me to death. One of the things I have a hard time educating my clients on is the volume of data that's now discoverable.' This is primarily attributable to Shadow Copy, TxF and Instant Search."

Comments

Another Use for VMWare

[ScottyKUtah]

If one was stuck with Vista, I could see VMWare being quite popular. Just run all of your "other activities" under a VMware computer. If the computer ever falls into enemy hands, just wipe out the virtual computer and you're good to go.

Another reason I'm sticking with XP.

Re:Another Use for VMWare

[Hork_Monkey]

Still, Windows will create artifacts (lnk files, histories, etc) to the files on either Truecrypt volume. A skilled forensic person will be able to testify that volume you provided the password for does not have the correlating files that can be seen in the artifacts.

While they will not be able to prove they contain the suspect data, plausible deniability becomes less plausible.

Much of forensics is being able to correlate the existence of a known file on a filesystem against other evidence, such as another computer that did not employ the protective measures. The point of the article is that TrueCrypt is not enough (and really hasn't been due to the number of artifacts that XP already leaves)- you will have to take a number of measures to cover your tracks which can be quite time intensive.

TrueCrypt is a wonderful product. I use it myself to encrypt corporate data. However, every now and then I play with EnCase on my laptop to see what is left behind and it makes me even more paranoid when I have nothing to hide.

It's not the function that's the problem

[Anonymous Coward]

These are all legitimate, useful features. It's the implementation that's wrong.

All potentially damaging (ie, all) data should be written to an encrypted store in such a way that recovering it from a lost/stolen/seized machine is hard to impossible without assistance from the owner. That's just good design practice in an environment where there is more than enough computing power available.

I'm aware that there are places where you have to hand your keys over to law enforcement... with which I have no real problem provided the due process of law is followed. But at least properly managed/segmented encryption can prevent a fishing trip. And in the worst case if you were being falsely accused of something really awful then you might decide that the penalties for not handing over the keys were less severe than the penalties for having the data available. At least you would get the choice.

Re:It's not the function that's the problem

[Ravnen]

I would say that falls under permission. If there is a court order, you can refuse it, but you will face the legal consequences.

Re:Just some more...

[GotenXiao]

What good points? It has a resource intensive "shiny" interface. It has levels of DRM heretofore unseen in an operating system. It is claimed that it is secure, yet still has gaping security holes. It is claimed that it is safe, yet has to be made un-safe for users to be able to do anything with it. It is expensive, clunky, space consuming, privacy invading, insecure, unsafe, and is more interested in protecting the interests of major Hollywood distributors than its users.

Care to highlight why I'd want to use Vista?

Computer OS

[Skiron]

What is forgotten here is an OS really should be an OS - designed to run the computer and what not.

Now, when that OS has deliberate code to track and monitor a users 'usage', it really is no more a tool to run a computer, but rather a tool to watch a user. The main job of that code is absolute control of the computer taken away from the user.

MS have been trying to do this for years, and now it looks like they have succeeded ~ and the sheep follow and buy the crap.

It is pretty scary that this succeeds at all. I mean, nobody in their right mind would buy a car that recorded every single journey and 'phoned home' every time you exceeded a speed limit, or the car stopped at changing traffic lights, even though you didn't need to... the world would be in uproar and the car would most definitely not sell at all.

Yet the sheep still but this crap...