[clug] OT: Hard disk search

James james at heague.com.au
Thu May 15 13:03:29 EST 2003

> As this is a criminal activity I would be approaching that AFP immediately
AFP were involved, they got subpoened, that's why we need an independent
person to do the job. But otherwise you'd be very correct.

> If the disk was mounted in a computer and files open and closed, file date
> and time stamps may now have been altered ie the evidence has been
> compromised.....
Thanks. Definitly worth considering.
I'm still having troubble explaining the mechanics of dd, imaging,
filesystems etc. to the solicitors involved. Fun, fun! :~)


More information about the linux mailing list