Megapixal myth continued......
Another consideration is the size of the sensors in digital cameras. These new (non DSLR) 8 MP cameras have tiny sensors, with tiny photo cells. The older 4 MP Canon 1D with a sensor size 28.7mm x 19.1mm, with 1/2 the sensors but much larger photo cells nets much better images.
A good analogy is you have 8 million shot glasses filled with water and 4 million 5 gallon buckets filled with water. Which hold more water?
Tell that to the companies brought down by the slammer worm, either of the nachi worms or the effort trying to keep MS boxes patched in a large enterprise.... that is the road to hell not madness. Although madness is thrown in at no cost.
But there are not enough computer forensic experts that they can always take one along when they want to search someone's house.
Again I remind you, stick to what you know.There are enough to do planned house calls.
I'd be interested to know how you propose taking an image of a running disk on a machine controlled by your 'opponent', btw, as I have a server whose configuration is specifically designed to foil legal investigation, and it'd be nice to discover any more holes.
Well of course you do, and it is only running like this to hide your emails to grandma right? Some amazing contraption that foils all attempts to analyze it. Experts from around the world have tried and failed against this mighty, forensic expert, crushing machine. It is people that think like you that makes this job so much fun.8-> My first guess would be you have a root kit installed, so sneaky. No way around that, grab the sledgehammer Joe!
Same goes for a RAM dump - surely you aren't expecting the machine to cooperate with you? =)
The machine won't cooperate... well there goes my entire game plan right out the window.
...he was explicitly told that they took the computers just because it's common to find evidence against someone for all manner of things on their computer
I guess the police always show all their cards in an interview? If that is the story they gave and you still let them walk out and hold your stuff for that long you are all fools; or more likely guilty and too scared to raise a fuss.
I still say your friend was lucky, not innocent. This entire conversation is tiring now, this is likely my last reply on this topic unless you can conjure up something I haven't heard 50 times.
Stick to what you know. You don't do forensics... it shows. There are lots of ways to get an image of a drive... the method used would be dependant on the situation you encounter. You don't always have to take a PC apart to get a bit copy image of it's drive. Better if it's still running because you get a RAM dump too. The original discussion was about a companies servers being seized and held etc.... I was responding to that specific issue.
You brought the "my friend story" into it. You made the sensationalized statement about police smashing PC's and monitors. This is of course first hand experience too, right? Your quote follows:
If a computer has had kiddy porn on it, they typically destroy the computer. The whole thing. Maybe the monitor too for good measure. --- Yes of course let's destroy the evidence, and possibly open ourselves up for a civil lawsuit, have internal affairs investigate us... etc.
For the record I live just outside a large metro area, in the sunny south, it is a nice happy place.
Did this happen in the USA? Judging by your jargon I would suspect you are from the UK.If this happened outside the US I can't speak to that as I have no knowledge of jurisprudence outside the US.
Maybe he had done nothing wrong, but maybe there just wasn't enough evidence to convict and your friend was lucky.
There are no guilty people in prison... if you don't believe me, just ask them.
You don't need to take anything apart to analyze data. A forensic analysis of a dd image is absolutely admissible as evidence, and will be more than enough evidence to convict. This is first hand knowledge not something I heard or read.
If the police (FBI, OSI, local law enforcement) show up at your door with a warrant to investigate you, you are had. True, if there are multiple PC's in the house they won't know which PC is involved. They've already done forensics in the case. They have your IP, login used, ISP logs etc... When they show up at your house it's to gather the final bit of evidence for the prosecutor and jail time for you.
On the other hand they are NOT going to seize a companies servers to investigate an individual. A simple dd images (if needed) usually they just need logs as evidence. This is what the statement about police not doing seizures was speaking to.
Quote from original post:
"Just for the record, the servers were seized in January and no charges have yet been filed against Voicenet."
I have had involvement with different aspects of cases like these. From doing the forensic investigation to find out who it is, the knocking on the door part, and being the contact inside a company that the police needed information from.
The servers were seized part is just not done unless the investigation involved something like that companies business was involved in the kiddy porn distribution business.
Did you miss the part where I said "Police, FBI, and other law enforcement agencies don't seize computer equipment unless it is directly involved in a commision of the crime."
Storing child porn on your personal computer would be be a crime.
Did they arrive in black helicopters too? I'm surprised your friend still remember it since they usually use one of those brain eraser thingys on you after they take the entire network. I heard once they confiscated the entire internet.
Sorry I'll have to call BS on your story. This just isn't done.
Police, FBI, and other law enforcement agencies don't seize computer equipment unless it is directly involved in a commision of the crime (such as a hackers PC). If they need the data they take dd copies with them for analysis later. In teh case of Contraband such as child porn it would be eliminated before they left.
Now that the Web geeks solved the door to door encyclopedia salesmen problem, can they do something about the Jehovah's Witnesses next?
maybe video popups that won't go away, disable the keyboard / mouse, turn up the sound, electrify the power button and hijack your printer to print tracts about you going to hell.
Slashdot Mirror
Megapixal myth continued...... Another consideration is the size of the sensors in digital cameras. These new (non DSLR) 8 MP cameras have tiny sensors, with tiny photo cells. The older 4 MP Canon 1D with a sensor size 28.7mm x 19.1mm, with 1/2 the sensors but much larger photo cells nets much better images. A good analogy is you have 8 million shot glasses filled with water and 4 million 5 gallon buckets filled with water. Which hold more water?
All roads lead to madness with Linux?
Tell that to the companies brought down by the slammer worm, either of the nachi worms or the effort trying to keep MS boxes patched in a large enterprise.... that is the road to hell not madness. Although madness is thrown in at no cost.
I think that was 1.1 Jiga Watts... not Giga Watts.
Oh... give me a break.
Good luck!
But there are not enough computer forensic experts that they can always take one along when they want to search someone's house.
...he was explicitly told that they took the computers just because it's common to find evidence against someone for all manner of things on their computer
Again I remind you, stick to what you know.There are enough to do planned house calls.
I'd be interested to know how you propose taking an image of a running disk on a machine controlled by your 'opponent', btw, as I have a server whose configuration is specifically designed to foil legal investigation, and it'd be nice to discover any more holes.
Well of course you do, and it is only running like this to hide your emails to grandma right? Some amazing contraption that foils all attempts to analyze it. Experts from around the world have tried and failed against this mighty, forensic expert, crushing machine. It is people that think like you that makes this job so much fun.8-> My first guess would be you have a root kit installed, so sneaky. No way around that, grab the sledgehammer Joe!
Same goes for a RAM dump - surely you aren't expecting the machine to cooperate with you? =)
The machine won't cooperate... well there goes my entire game plan right out the window.
I guess the police always show all their cards in an interview? If that is the story they gave and you still let them walk out and hold your stuff for that long you are all fools; or more likely guilty and too scared to raise a fuss.
I still say your friend was lucky, not innocent. This entire conversation is tiring now, this is likely my last reply on this topic unless you can conjure up something I haven't heard 50 times.
If not, its been a pleasure speaking with you.
Stick to what you know. You don't do forensics... it shows. There are lots of ways to get an image of a drive... the method used would be dependant on the situation you encounter. You don't always have to take a PC apart to get a bit copy image of it's drive. Better if it's still running because you get a RAM dump too. The original discussion was about a companies servers being seized and held etc.... I was responding to that specific issue.
You brought the "my friend story" into it. You made the sensationalized statement about police smashing PC's and monitors. This is of course first hand experience too, right? Your quote follows:
If a computer has had kiddy porn on it, they typically destroy the computer. The whole thing. Maybe the monitor too for good measure. --- Yes of course let's destroy the evidence, and possibly open ourselves up for a civil lawsuit, have internal affairs investigate us... etc.
For the record I live just outside a large metro area, in the sunny south, it is a nice happy place.
Did this happen in the USA? Judging by your jargon I would suspect you are from the UK.If this happened outside the US I can't speak to that as I have no knowledge of jurisprudence outside the US.
Maybe he had done nothing wrong, but maybe there just wasn't enough evidence to convict and your friend was lucky.
There are no guilty people in prison... if you don't believe me, just ask them.
You don't need to take anything apart to analyze data. A forensic analysis of a dd image is absolutely admissible as evidence, and will be more than enough evidence to convict. This is first hand knowledge not something I heard or read.
If the police (FBI, OSI, local law enforcement) show up at your door with a warrant to investigate you, you are had. True, if there are multiple PC's in the house they won't know which PC is involved. They've already done forensics in the case. They have your IP, login used, ISP logs etc... When they show up at your house it's to gather the final bit of evidence for the prosecutor and jail time for you.
On the other hand they are NOT going to seize a companies servers to investigate an individual. A simple dd images (if needed) usually they just need logs as evidence. This is what the statement about police not doing seizures was speaking to.
Quote from original post:
"Just for the record, the servers were seized in January and no charges have yet been filed against Voicenet."
I have had involvement with different aspects of cases like these. From doing the forensic investigation to find out who it is, the knocking on the door part, and being the contact inside a company that the police needed information from.
The servers were seized part is just not done unless the investigation involved something like that companies business was involved in the kiddy porn distribution business.
Did you miss the part where I said "Police, FBI, and other law enforcement agencies don't seize computer equipment unless it is directly involved in a commision of the crime." Storing child porn on your personal computer would be be a crime.
Did they arrive in black helicopters too? I'm surprised your friend still remember it since they usually use one of those brain eraser thingys on you after they take the entire network. I heard once they confiscated the entire internet. Sorry I'll have to call BS on your story. This just isn't done.
Police, FBI, and other law enforcement agencies don't seize computer equipment unless it is directly involved in a commision of the crime (such as a hackers PC). If they need the data they take dd copies with them for analysis later. In teh case of Contraband such as child porn it would be eliminated before they left.
Now that the Web geeks solved the door to door encyclopedia salesmen problem, can they do something about the Jehovah's Witnesses next? maybe video popups that won't go away, disable the keyboard / mouse, turn up the sound, electrify the power button and hijack your printer to print tracts about you going to hell.
And when was the last EMP event. I'm not sure where you live but I try to avoid nuclear testing grounds.... the water tastes funny.
Tinfoil hats are for aliens..... maybe garlic or a crucifix.....
Windows 2006, Microsoft will be lucky to get Longhorn ready by 2007.
By then newborns will have Verisign certificates tattooed on at birth.
WARNING: You must renew yearly or your child will cease to function.