[clug] OT: Hard disk search
james at heague.com.au
Thu May 15 13:03:29 EST 2003
> As this is a criminal activity I would be approaching that AFP immediately
AFP were involved, they got subpoened, that's why we need an independent
person to do the job. But otherwise you'd be very correct.
> If the disk was mounted in a computer and files open and closed, file date
> and time stamps may now have been altered ie the evidence has been
Thanks. Definitly worth considering.
I'm still having troubble explaining the mechanics of dd, imaging,
filesystems etc. to the solicitors involved. Fun, fun! :~)
More information about the linux