[clug] OT: Hard disk search

[Antti.Roppola at brs.gov.au]

I think they meant that clicking on a thumbnail demonstrated that the
defendant intended to download the image and it wasn't an accident.

BTW, the comment elsewhere in this thread about not mounting the
disk and accidentally changing its contents such as by touching
date stamps (and therefore compromising the evidence) are the sorts
of integrity issues I was thinking about.

And; digging through a hard drive is no different to digging through
someone's trash. It's just that most jury members understand wheelie
bins more than they understand things like FAT32 and dd. :o)

Antti

-----Original Message-----
From: Martin Pool [mailto:mbp at samba.org]
Sent: Thursday, 15 May 2003 3:11 PM
To: linux at lists.samba.org
Subject: Re: [clug] OT: Hard disk search


On 14 May 2003, Antti.Roppola at brs.gov.au wrote:
> Here's a link that shows some of the care required:
>
> http://www.vogon-computer-evidence.com/forensic_bulletin-23/forensic_bulletin_23_5.htm

I suspect this is a misquote or out of context, because it sounds bizarre:

  The judge ruled that double clicking on a photographic thumbnail was
  making pornography 

I agree that it helps show intent but I can't see how it's "making
photographs", which most people do with a camera.

-- 
Martin