I agree with you. OSX early on could be seen as being "SGI technologies at a price point and interface for consumers". A lot of the ideas in sound and video in things like quicktime and final cut were variants of where SGI had been going, or had gone.
By the time Apple was stable enough to buy SGI, SGI was gutted and there wasn't as much to buy. Still XFS would be a technology which Apple could use today.
Nowhere near 90% agree. Even the Microsoft commercials basically conceded that many of their users would take an Apple over their system if they weren't so price sensitive.
And the computing world is not just desktop / laptop systems it includes: servers, embedded, supercomputing, mainframes... where Windows is less of a player. And even on desktop its below 90% now.
but it really isn't, and we've been through two decades of training up older people.
No we haven't. There is very little training and very little focus on training. You see training at the low end, cashiers and hair dressers get training, but very little extensive training in offices.
What packages were having trouble during the PPC days? I would argue Fink was a lot richer then and much more up to date. How many packages have any assembly where you would notice PPC vs. X86?
The G5s were nice, but they weren't going to keep up with Intel for long
They were well ahead of Intel. As for the G5, the G6 is out: 4.2-4.7 ghz, Altivec is faster and now has a decimal high speed math unit. The chips have L2 (4m/8m) and L3 (32m) caches on board crushing even the Xeons. They also have a 4 core model. Ram is accessible ram is 2.7t (not a typo). The chips have built in support for running hypervisor functions. They are still well ahead of Intel.
the community of Mac app developers cares more about UI design, for whatever reason, than the community of Windows app developers (either because of the "Mac cult", or because the market for Mac apps is smaller and doesn't attract the, err, umm, less talented UI developers);
I think it comes down to core market. For windows the core market is corporate software designed in house. For Mac the core market is commercial shareware / low priced applications.
The first group cares a great deal more about a feature complete system that can be rolled out. The second group cares a great deal more about user experience.
Microsoft:.NET compiler with an intermediate form. For decades there had been a desire to create a "p-code" machine that could run a theoretical optimized assembly which came from higher level languages at the same speed as actual assembly on the same hardware. They built it. No one has a compiler that sophisticated.
If you mean hardware.... the invention of SSD and Intel's work on bringing down the price of multicore.
If you mean PC manufacturers.... you are right none of the rest do anything.
Actually I have used open office to create structured documents. Since you mentioned LyX let me just point out that OO has a great export to LaTeX feature which allows for very structured documents, and in fact makes it easy to import into LyX.
That being said I agree with your basic point that MS software is quite a bit ahead.
During appeal: "Mr Bolden you were cut off by the judge is that correct" JB: Yes DA: Does this answer accurately reflect your opinion at the time? JB: No DA: Could this answer have misled the jury JB: Yes.
Well what are the laws right now for servers? Mainframes/Minis/Servers for decades have had automated processes running on them. They have all sorts of custom data formats so you can't use standardized tools....
Also, how could a forensic investigator show a court that his image 'really' was the original version? There's no authoritative copy representing the data at time of capture to refer to any more, if the original was being modified as he took the copy.
There won't be, that was my point with the analogy to a biological specimen. The laws regarding hard drives will become much closer to the laws regarding biologicals which can alter themselves between collection and trial, and can be altered by the investigative process.
There is no more "original version". There is the version that was analyzed in the lab, and maybe a stable version that gets created several hours into the lab process. Much less can be known. This is why I agree your insight is really key, computers are having more and more daemons which are engaging in activities independent of humans. Desktop forensics is slowly becoming more like server forensics where there aren't standard procedures.
As an aside, I read your ending comments in the paper I agree with all except the issue of hybrids. I'm not so sure the hybrid presents a problem for you. The data in the SSD cache can be essentially ignored, as it will likely be a 1) read only copy of some of the data on the drive. optionally: 2) some short term writes
If it is just (1) then just look at the magnetic drive and ignore the SSD the same way you would ignore ram on the controller card. If (2) is present, do the analysis simply looks at the magnetic disk only after flushing the SSD back to magnetic.
So in short the forensic analyst is capable of reporting what was in the filesystem at the time of capture but not what was on the physical disk.
Well your honor, we know that those bastards at Enron cooked the books, and we have the data... but the MD5 fingerprint does not match, so all of that evidence is inadmissable."
That evidence doesn't have to be inadmissible. But Enron would get to argue the police changed the data and would get to call witnesses to that effect and the jury would have to decide.... Basically in allows for the evidence to be suspect.
What do you mean by "endorse"? Government don't endorse products. And we have lots of parts on our computers that erase data: ethernet cards, RAM, keyboards.... what's changed is that diagnostics on hard drives is getting harder as we move from magnetic to SSD.
Actually the courts right now are concerned with added or deleted. Often the question is was evidence deliberately destroyed. There is a crime called "spoliation of evidence" for deleting stuff you think law enforcement is likely going to want. Deleting files on computers are often how this sort of things is proven. But with garbage collection it might be very hard to prove whether the deletion occurred because the evidence of that got deleted. On a typical HDD a wipe would generally be pretty powerful evidence of an intent to spoil evidence.
Worse, the courts do need to be able to show that forensics lab didn't change the data. Taking a checksum of the disk and comparing that to the checksum if the image handed to the defense.... But now that's not possible, at least if you include any sort of "deleted" files.
That's not a problem. The issue is (ignoring all the details)
-- The courts currently assume drives stay in a static state once disconnected from a computer -- Forensic computers don't alter that static state for HDDs -- That static state doesn't exist for SSDs.
Actually that's too fast. You are better off running that to create 200 files each about a 1/2% of the disk and spacing the writes out after every 5% or so.
Your solution is more likely if stopped 1/2 way to end up not really erasing as much.
You are missing the point. The point is that the TRIM can change the state of what is on the disk without further intervention from the computer. So a hard drive that gets removed from a computer will continue to act on a TRIM command when powered back up.
What about, not answering yes or no with a yes or no. Also the attorney can't cut the witness off, he can just say, "I wan'st finished answering". They don't have the right to edit / truncate your answers.
Defendant's Attorney: "Yes or no?"
Expert Witness: I was using "billions" metaphorically not as an exact figure. There is about 3240 characters in that email so it would occur randomly about 2^3240 ~ 10^1080
So you can imagine... a forensic investigator takes an image, examines it, presents it to the court, and when the court verifies the original disk that the copy was taken from, nothing is there any more, and the forensic investigator seems to be making it all up....
Not if they submit raw data to the court. That image in raw data will show that the drive would have been garbage collecting as the image was being taken. Drives become more like biological specimens. There are multiple biological processes that occur in dead bodies, when an autopsy occurs can change what would have been found.
Partially the problem is that there are so many levels in computer systems and end users think at very high levels of abstraction.
Slashdot Mirror
I agree with you. OSX early on could be seen as being "SGI technologies at a price point and interface for consumers". A lot of the ideas in sound and video in things like quicktime and final cut were variants of where SGI had been going, or had gone.
By the time Apple was stable enough to buy SGI, SGI was gutted and there wasn't as much to buy. Still XFS would be a technology which Apple could use today.
Nowhere near 90% agree. Even the Microsoft commercials basically conceded that many of their users would take an Apple over their system if they weren't so price sensitive.
And the computing world is not just desktop / laptop systems it includes: servers, embedded, supercomputing, mainframes... where Windows is less of a player. And even on desktop its below 90% now.
but it really isn't, and we've been through two decades of training up older people.
No we haven't. There is very little training and very little focus on training. You see training at the low end, cashiers and hair dressers get training, but very little extensive training in offices.
What packages were having trouble during the PPC days? I would argue Fink was a lot richer then and much more up to date. How many packages have any assembly where you would notice PPC vs. X86?
The G5s were nice, but they weren't going to keep up with Intel for long
They were well ahead of Intel. As for the G5, the G6 is out: 4.2-4.7 ghz, Altivec is faster and now has a decimal high speed math unit. The chips have L2 (4m/8m) and L3 (32m) caches on board crushing even the Xeons. They also have a 4 core model. Ram is accessible ram is 2.7t (not a typo). The chips have built in support for running hypervisor functions. They are still well ahead of Intel.
the community of Mac app developers cares more about UI design, for whatever reason, than the community of Windows app developers (either because of the "Mac cult", or because the market for Mac apps is smaller and doesn't attract the, err, umm, less talented UI developers);
I think it comes down to core market. For windows the core market is corporate software designed in house. For Mac the core market is commercial shareware / low priced applications.
The first group cares a great deal more about a feature complete system that can be rolled out. The second group cares a great deal more about user experience.
Microsoft: .NET compiler with an intermediate form. For decades there had been a desire to create a "p-code" machine that could run a theoretical optimized assembly which came from higher level languages at the same speed as actual assembly on the same hardware. They built it. No one has a compiler that sophisticated.
If you mean hardware.... the invention of SSD and Intel's work on bringing down the price of multicore.
If you mean PC manufacturers.... you are right none of the rest do anything.
LaTeX isn't a word processor. Its a typesetting system. The word processor its closest to is Adobe Framemaker.
Actually I have used open office to create structured documents. Since you mentioned LyX let me just point out that OO has a great export to LaTeX feature which allows for very structured documents, and in fact makes it easy to import into LyX.
That being said I agree with your basic point that MS software is quite a bit ahead.
Governments have longer time frames than industry. And certainly longer than consumers. They aren't so bad on this criteria.
Well it was never my money at stake.
What judge would want:
During appeal: "Mr Bolden you were cut off by the judge is that correct"
JB: Yes
DA: Does this answer accurately reflect your opinion at the time?
JB: No
DA: Could this answer have misled the jury
JB: Yes.
etc...
Well what are the laws right now for servers? Mainframes/Minis/Servers for decades have had automated processes running on them. They have all sorts of custom data formats so you can't use standardized tools....
Yes I have, I've testified in multiple trials. And the "bewigged asshats" have never pulled anything remotely like that.
Also, how could a forensic investigator show a court that his image 'really' was the original version?
There's no authoritative copy representing the data at time of capture to refer to any more, if the original was being modified as he took the copy.
There won't be, that was my point with the analogy to a biological specimen. The laws regarding hard drives will become much closer to the laws regarding biologicals which can alter themselves between collection and trial, and can be altered by the investigative process.
There is no more "original version". There is the version that was analyzed in the lab, and maybe a stable version that gets created several hours into the lab process. Much less can be known. This is why I agree your insight is really key, computers are having more and more daemons which are engaging in activities independent of humans. Desktop forensics is slowly becoming more like server forensics where there aren't standard procedures.
As an aside, I read your ending comments in the paper I agree with all except the issue of hybrids. I'm not so sure the hybrid presents a problem for you. The data in the SSD cache can be essentially ignored, as it will likely be a
1) read only copy of some of the data on the drive.
optionally: 2) some short term writes
If it is just (1) then just look at the magnetic drive and ignore the SSD the same way you would ignore ram on the controller card. If (2) is present, do the analysis simply looks at the magnetic disk only after flushing the SSD back to magnetic.
So in short the forensic analyst is capable of reporting what was in the filesystem at the time of capture but not what was on the physical disk.
Well your honor, we know that those bastards at Enron cooked the books, and we have the data... but the MD5 fingerprint does not match, so all of that evidence is inadmissable."
That evidence doesn't have to be inadmissible. But Enron would get to argue the police changed the data and would get to call witnesses to that effect and the jury would have to decide.... Basically in allows for the evidence to be suspect.
What do you mean by "endorse"? Government don't endorse products. And we have lots of parts on our computers that erase data: ethernet cards, RAM, keyboards.... what's changed is that diagnostics on hard drives is getting harder as we move from magnetic to SSD.
Actually the courts right now are concerned with added or deleted. Often the question is was evidence deliberately destroyed. There is a crime called "spoliation of evidence" for deleting stuff you think law enforcement is likely going to want. Deleting files on computers are often how this sort of things is proven. But with garbage collection it might be very hard to prove whether the deletion occurred because the evidence of that got deleted. On a typical HDD a wipe would generally be pretty powerful evidence of an intent to spoil evidence.
Worse, the courts do need to be able to show that forensics lab didn't change the data. Taking a checksum of the disk and comparing that to the checksum if the image handed to the defense.... But now that's not possible, at least if you include any sort of "deleted" files.
That's not a problem. The issue is (ignoring all the details)
-- The courts currently assume drives stay in a static state once disconnected from a computer
-- Forensic computers don't alter that static state for HDDs
-- That static state doesn't exist for SSDs.
Actually that's too fast. You are better off running that to create 200 files each about a 1/2% of the disk and spacing the writes out after every 5% or so.
Your solution is more likely if stopped 1/2 way to end up not really erasing as much.
You are missing the point. The point is that the TRIM can change the state of what is on the disk without further intervention from the computer. So a hard drive that gets removed from a computer will continue to act on a TRIM command when powered back up.
Both. OS level command can't induce erases and erases can occur without OS level intervention. SSDs are more independent.
What about, not answering yes or no with a yes or no. Also the attorney can't cut the witness off, he can just say, "I wan'st finished answering". They don't have the right to edit / truncate your answers.
Defendant's Attorney: "Yes or no?"
Expert Witness: I was using "billions" metaphorically not as an exact figure. There is about 3240 characters in that email so it would occur randomly about 2^3240 ~ 10^1080
Do you think anyone is going to do that except for maybe terrorism investigations?
-
So you can imagine... a forensic investigator takes an image, examines it, presents it to the court, and when the court verifies the original disk that the copy was taken from, nothing is there any more, and the forensic investigator seems to be making it all up....
Not if they submit raw data to the court. That image in raw data will show that the drive would have been garbage collecting as the image was being taken. Drives become more like biological specimens. There are multiple biological processes that occur in dead bodies, when an autopsy occurs can change what would have been found.
Partially the problem is that there are so many levels in computer systems and end users think at very high levels of abstraction.
I agree though your finding is very important.
Welcome to /. and that makes perfect sense now. Hopefully you get moded up.