Slashdot Mirror


User: dtfinch

dtfinch's activity in the archive.

Stories
0
Comments
2,513
First seen
Last seen
Profile
(view on slashdot.org)

Comments · 2,513

  1. "Something" accessed 3000 files in one hour on What is the Scope of Computer Forensics? · · Score: 1

    I suspect most antivirus programs are mature enough to not update the last access time on all the files they read, and Windows probably won't falsely update them either, but there are a lot of other programs that will. A homebrew backup script might do it. Technically, it's up to the app to decide to update the access date, but many library functions will do it without the programmer specifying that they should. It seemed to always happen automatically with the programs I've written.

    If there's a pattern to the files that were accessed, like only folders containing important documents, then it'll look bad for him. They won't have better than an hour resolution on NTFS though, so there's no way for them to establish a timeline for when the files were accessed.

    They might not be able to prove if he was at his computer when the files were accessed.

    On a Windows network, any admin could have read the files during that time. They may have decided to back stuff up from that system because they knew it was the person's last day and bad things could happen to the data (disgruntled deletions and such) but they didn't have permission to simply lock them out of anything. This is a long shot though.

    Technically, it's possible that he didn't copy any more than he admitted to. So far the evidence against him is weak, and the chain of evidence has been broken by a week of use. The evidence (that 3000 files were accessed by something during that hour) is probably all correct unless someone had the desire and expertise to frame him, but the judge may still deem it inadmissable if you're lucky. Proper steps weren't taken to preserve evidence. I doubt my boss has taken any forensics courses, but when someone is fired, they'll occasionally have the ex-employee's computer unplugged and locked in a safe until they're satisfied that it won't be needed as evidence.

    Evidence they might look for against him:

    If Roxio keeps logs. They can get a partial list of files burned if Roxio creates the CD image on the hard disk before burning, which most burners support, but not many by default.

    They can check the dates on the CDs if they are all on or before the expected burning date. I sometimes see programs preserve the file times, but not the folder times, so that the folders show the date they were recreated, rather than the original date. If the CD's he returned are fabrications, and the folder dates prove it, it's not going to look very good for him in court.

    They can look for any files modified around the same time. If he dragged 3000 files into a giant zip file, possibly to fit them more easily onto CD, that'd be a dead giveaway that he was up to something.

    If they're lucky they can get a search warrant, and seize and examine the hard disk on his home computer or laptop. If files are there that aren't supposed to be, with creation dates after the CD's were burned, then he'd be in a bit of trouble.

    He's already in a bit of trouble for having copied anything at all. Proving he took a lot more is icing on the cake. You can't prove what he didn't copy (you're not expected to prove a negative anyways), and they probably can't prove with much certainty that he copied everything that they think he copied, but there is some amount of copying that they'll be able to prove. He copied at least the CD's he returned, unless he flip flops and argues he never burned or returned anything, but you've already told slashdot that he did.

  2. Re:What is it? on Microsoft releases Windows Server 2003 R2 · · Score: 1

    That's terrible. It's comparable to being asked to pay $299 to upgrade from XP SP1 to XP SP2. People won't pay full non-upgrade retail price for the upgrade when the servers they already have work fine.

    Maybe there is some sort of discount or upgrade pricing that they've failed to mention, but I like to assume the worst case until I find more info or someone corrects me. It's the safest assumption, and in some cases it's a good way to get a more complete version of the truth out of marketing people.

  3. Re:Let me guess on Webhost Sues Google · · Score: 1

    172.x.x.x is America Online. They make heavy use of caching proxies.

  4. Let me guess on Webhost Sues Google · · Score: 1

    The IP addresses of many of the suspected click-fraudsters begin with 172, right?

  5. Almost a slashvertisement on The Top 10 Weirdest USB Drives Ever · · Score: 1

    At least 7 of those 10 drives are made by the same company. Cute though.

  6. Re:Both Sides Wrong on Kansas Anti-Creationism Professor Resigns · · Score: 1

    Here you can read the apology he made about a week before he was beat up and the full email here:
    http://telicthoughts.com/?p=397

  7. Re:Both Sides Wrong on Kansas Anti-Creationism Professor Resigns · · Score: 1

    It's ok to write whatever you want. It's not ok to beat up whoever you want.

  8. Re:Yes on USPTO Unable to Find Top Ten Patent Holders · · Score: 5, Interesting

    Until I find a better one, perhaps one of my favorite patents is #6,341,372, desribing a "Universal machine translator of arbitrary languages", able to make perfect translations in real time with zero knowledge of either language, like on Star Trek. It goes on to talk about such translaters being used by androids powered by perpetual motion. The rest is just chapters upon chapters full of philosophical ranting about existance, quantum physics, and the universe, maybe pasted from another source. Filed in 1997, granted in 2002. I came across this patent while searching to see how many "perpetual motion" patents the USPTO has granted so far.

  9. Often, but not always on Are Web Pages Getting Larger? · · Score: 3, Informative

    A website and all of its pages can be expected to grow over its lifetime, but a lot of newer sites are lot smaller than previous generations. The wide adoption of CSS, and all the user friendliness tech evangalism emphasizing simplicity over noise has been paying off those who listen. There are still a lot of sites, such as web forums, where the attitude seems to be to make have really complex themes with almost no CSS and let mod_gzip/deflate deal with the task of making it small.

  10. Re:layer of abstraction on Lack of 'Mirror Neurons' Linked to Autism · · Score: 2, Informative

    AFAIK, you can get away with making up just about anything on slashdot, so long as you precede it with IIRC or AFAIK.

  11. Re:The supreme solution... on Security's Shaky State · · Score: 2, Insightful

    That someone just had your credit card number whispered in their ear.

  12. Re:Engineers dont understand business on Security's Shaky State · · Score: 1

    Optimized is a better word for this. Underfunded seems to imply that the department could be more profitable if you gave them a little more money.

  13. Re:All the money in the world is not enough. on Security's Shaky State · · Score: 1

    Not many companies will simply give up all the software that's tying them to Windows and switch to another operating system. Most of our servers run Linux for obvious reasons, but we have all Windows desktops and some Windows servers for apps that need them. I can't really say we've had virus or worm problems since I arrived. IE and OE are banned of course, we install the latest patches, and we're all behind a NAT.

  14. Where's the problem? on Security's Shaky State · · Score: 1

    The article just said "security professionals are getting the job done". How could they be underfunded? If the potential gains will be marginal, how much more money could you throw at the problem before it becomes unprofitable? And the cost of increased (as in ultra paranoid) security is not just in staffing and purchases. It also puts a strain on all the systems and employees in the company. I'm not saying there aren't companies in dire need of better security, but like your accounting department, security is a zero profit area that you don't want to see growing year after year, unless you already have some big, costly security problems that need fixing.

    Good security isn't something you can easily achieve by spending a lot of money anyways. Just plan on having good security from the beginning so that you don't have a big security problem to patch up later, undoubtably at the cost of interruptions to your business. Try to do things right the first time.

  15. Re:FANCY gui? on Fedora Directory Server 1.0 Released! · · Score: 1

    The answer is probably that they don't care what it looks like so long as it works and it's easy to use. It's an administration tool, not a video game.

  16. Re:command line on Fedora Directory Server 1.0 Released! · · Score: 2, Insightful

    For some people, "absolute hideous unfriendliness" means you have to read documentation, as opposed to the program having a nice GUI interface that is comprehensive, intuitive, obvious, and familiar to a new user.

  17. Correction on Company Claims Development of True AI · · Score: 3, Interesting

    They probably mean True AI (tm). Often companies do this when they want their technology to sound like the real thing. They trademark a name that's like the real thing, assign it to technology, then claim that their product incorporates True AI (tm). Then it's technically not a lie, so they probably won't get busted, but it's really really dishonest.

  18. Re:True AI on Company Claims Development of True AI · · Score: 1

    If you don't want to sell it, they'll just take it by eminent domain. Then they could even classify it as a military secret so that it'd be treason to discuss your invention with others.

  19. The list seems rather arbitrary on PCWorld Dubs Firefox Best Product of 2005 · · Score: 3, Funny

    I could be wrong, but I think they just took a top 10 list and padded it with 90 sponsored links.

  20. They are sinister on Computer Rebates Not As Sinister As You Think · · Score: 1

    I read on the packing slip that came with one of my shipments from TigerDirect that applying for a rebate will prevent me from returning the product in the future. None of the products I purchased at the time had rebates attached, but I'll always remember their warning when I have to choose between items offered with and without rebates. There's a little more to it than profitting from people who forget or are not qualified for the rebate.

  21. Re:funny department on Vista To Be Updated Without Reboots · · Score: 1

    I guess I had copied a slight misquote.

    Here's the original quote:
    "Well, Microsoft stepped back and looked at that situation and said that the best thing for us might be to start from scratch: build a new system, focus on having a lot of the great things about Unix, a lot of the great things about Windows, and also being a file-sharing server that would have the same kind of performance that, up until that point, had been unique to Novell's Netware.

    And through Windows NT, you can see it throughout the design. In a weak sense, it is a form of Unix. There are so many of the design decisions that have been influenced by that environment. And that's no accident. I mean, we knew that Unix operability would be very important and we knew that the largest body of programmers that we'd want to draw on in building Windows NT applications would certainly come from the Unix base.
    " Source: http://www.microsoft.com/billgates/speeches/indust ry&tech/uexpo.asp

  22. Re:Spyware! on Going From Gator to Claria · · Score: 2, Informative

    And if it contacts their servers with your current url to deliver ads relevant to the site your visiting, it even meets the definition of spyware.

  23. Re:funny department on Vista To Be Updated Without Reboots · · Score: 4, Funny

    "In a small way, Windows NT is a Unix." -Bill Gates

  24. Alternate title on BellSouth Wants to Rig the Internet · · Score: 1

    BellSouth wants to prioritize network traffic over their own network in response to customer demand and willingness to pay more for better bandwidth consistency and latency, also allowing them to sell the remaining bandwidth at a lower, more competitive rate if necessary.

  25. Re:Prefer thunderbird on Linux Desktop Email Key to Success · · Score: 1

    Thunderbird deletes email by simply marking them as deleted. Deleting them from trash doesn't erase them. This has actually helped a great deal in helping those users who view deletion (followed immediately by emptying the trash) as a way to simply get they've already seen out of the way, as though they are confident that they'll never have to look at something twice.