Turn on thread page Beta

Tech Society 2.0 watch

Announcements
    Offline

    16
    ReputationRep:
    (Original post by secretmessages)
    Why is comparing files such an important/crucial thing to do. How is it useful?
    To prove that the examiner hasn't done anything to change the evidence. If we didn't meticulously check the MD5 hashes, any lawyer worth their salt would just say... "Sorry, but how can you prove that you didn't plant that child pornography on my client's hard disk?"

    That's why we're so rigorous about chain of custody and procedures.
    • PS Helper
    • Wiki Support Team
    Offline

    14
    PS Helper
    Wiki Support Team
    (Original post by Mad Vlad)
    To prove that the examiner hasn't done anything to change the evidence. If we didn't meticulously check the MD5 hashes, any lawyer worth their salt would just say... "Sorry, but how can you prove that you didn't plant that child pornography on my client's hard disk?"

    That's why we're so rigorous about chain of custody and procedures.
    Ah :yep:

    What about hard drives that say "ooh, I'm going to automatically delete some data if I'm plugged into a device" or something like that so the hash would change? Or is that not possible? Maybe I'm not making sense :sigh:
    Offline

    16
    ReputationRep:
    (Original post by secretmessages)
    Ah :yep:

    What about hard drives that say "ooh, I'm going to automatically delete some data if I'm plugged into a device" or something like that so the hash would change? Or is that not possible? Maybe I'm not making sense :sigh:
    Not sure, actually... I don't think hard drives are sentient enough to be able to do that. Maybe possible... but I don't know. And yes, in that instance, the hash would be different as the data has changed.
    • TSR Group Staff
    Offline

    19
    ReputationRep:
    TSR Group Staff
    (Original post by secretmessages)
    Ah :yep:

    What about hard drives that say "ooh, I'm going to automatically delete some data if I'm plugged into a device" or something like that so the hash would change? Or is that not possible? Maybe I'm not making sense :sigh:
    To do so would require the co-operation of the OS it was being plugged into, basically the hard drive could request the OS delete files off it when it's plugged in, but there's nothing to say the OS should honour that request (or understand it at all, for that matter). I'd hope that forensic analysts would be smart enough to plug a drive into something that's not going to go through autorun.inf. :p:
    Offline

    16
    ReputationRep:
    (Original post by Dez)
    To do so would require the co-operation of the OS it was being plugged into, basically the hard drive could request the OS delete files off it when it's plugged in, but there's nothing to say the OS should honour that request (or understand it at all, for that matter). I'd hope that forensic analysts would be smart enough to plug a drive into something that's not going to go through autorun.inf. :p:
    We use hardware write blockers to prevent the OS writing to the drive.
    • PS Helper
    • Wiki Support Team
    Offline

    14
    PS Helper
    Wiki Support Team
    (Original post by Mad Vlad)
    Not sure, actually... I don't think hard drives are sentient enough to be able to do that. Maybe possible... but I don't know. And yes, in that instance, the hash would be different as the data has changed.
    (Original post by Dez)
    To do so would require the co-operation of the OS it was being plugged into, basically the hard drive could request the OS delete files off it when it's plugged in, but there's nothing to say the OS should honour that request (or understand it at all, for that matter). I'd hope that forensic analysts would be smart enough to plug a drive into something that's not going to go through autorun.inf. :p:
    Cool, thanks guys. I love tech soc :love:. I learn more in here than at university some days :dry:
    Offline

    2
    ReputationRep:
    (Original post by Mad Vlad)
    Not sure, actually... I don't think hard drives are sentient enough to be able to do that. Maybe possible... but I don't know. And yes, in that instance, the hash would be different as the data has changed.
    (Original post by Dez)
    To do so would require the co-operation of the OS it was being plugged into, basically the hard drive could request the OS delete files off it when it's plugged in, but there's nothing to say the OS should honour that request (or understand it at all, for that matter). I'd hope that forensic analysts would be smart enough to plug a drive into something that's not going to go through autorun.inf. :p:
    All of the below assumes you leave all the mechanisms together - extracting the platters and butting them into your own mechanism would defeat the approach below.

    Let us consider a hypothetical situation, in which a high profile figure (i.e. lots of money) has child porn on a drive. They have quite an interest in it not being discovered, as they are high profile.
    Let us now consider SMART - self diagnosis for hard drives. This involves a "signalling method between internal disk drive electromechanical sensors and the host computer" (from wiki). This is a mainly one way transfer (to the computer) to give information on the drive - BUT, as I will highlight later, signals can be sent back.
    Some SMART enabled devices can also perform a self-test, when prompted by a utility such as smartctl. The important thing to note about this is that the operating system does not perform the test - it simply tells the drive it wants a test performed (i.e. SMART related information sent to the drive).

    So, we have a lot of money, a method of drives performing operations on themselves and a way of telling them to do this. How about the money is invested in a hard drive that, at every power up it will start deleting files if not sent an abort message within (say) 5s.
    All of a sudden, hardware write disablers become irrelevant because it is the lack of response that causes a deletion.

    Not bad for 1am eh? :cool:
    Offline

    2
    ReputationRep:
    (Original post by secretmessages)
    Ah :yep:

    What about hard drives that say "ooh, I'm going to automatically delete some data if I'm plugged into a device" or something like that so the hash would change? Or is that not possible? Maybe I'm not making sense :sigh:
    Summoned.
    See my post above.
    • PS Helper
    • Wiki Support Team
    Offline

    14
    PS Helper
    Wiki Support Team
    (Original post by Chrosson)
    Summoned.
    See my post above.
    :holmes: Sounds complicated to me! Interesting though, if I can make sense of it :p:
    • PS Helper
    • Thread Starter
    Offline

    0
    ReputationRep:
    PS Helper
    I woke up because ideas for my coursework came to my mind in my sleep.
    • PS Helper
    • Wiki Support Team
    Offline

    14
    PS Helper
    Wiki Support Team
    (Original post by spikeymike)
    I woke up because ideas for my coursework came to my mind in my sleep.
    :lolwut: You dreamt about coursework?
    • PS Helper
    • Thread Starter
    Offline

    0
    ReputationRep:
    PS Helper
    (Original post by secretmessages)
    :lolwut: You dreamt about coursework?
    I had a dream, then kind of woke up from it, then ideas came to mind.
    • PS Helper
    • Wiki Support Team
    Offline

    14
    PS Helper
    Wiki Support Team
    (Original post by spikeymike)
    I had a dream, then kind of woke up from it, then ideas came to mind.
    :lol: Well, good I suppose. Tbh I would've just gone back to sleep and done it in the morning instead :sexface:. Perhaps written a note :holmes:
    • PS Helper
    • Wiki Support Team
    Offline

    14
    PS Helper
    Wiki Support Team
    Still haven't got the new Facebook :emo:
    • PS Helper
    • Thread Starter
    Offline

    0
    ReputationRep:
    PS Helper
    (Original post by secretmessages)
    Still haven't got the new Facebook :emo:
    Nor have I, tbh I want it stay as it is.

    I got excited over my new ideas. :sexface:

    I can't implement it just yet, I haven't got the folder/file permission set up quite right yet...
    • PS Helper
    • Wiki Support Team
    Offline

    14
    PS Helper
    Wiki Support Team
    (Original post by spikeymike)
    Nor have I, tbh I want it stay as it is.

    I got excited over my new ideas. :sexface:

    I can't implement it just yet, I haven't got the folder/file permission set up quite right yet...
    :rofl:

    chmod is probably the one thing I remember from my Unix lectures :beard:

    chmod 777 * :ahee:
    • PS Helper
    • Thread Starter
    Offline

    0
    ReputationRep:
    PS Helper
    (Original post by secretmessages)
    :rofl:

    chmod is probably the one thing I remember from my Unix lectures :beard:

    chmod 777 * :ahee:
    Yeah I have done to all files and folders, but it won't let me create the changelog from another user. :holmes:
    • PS Helper
    • Wiki Support Team
    Offline

    14
    PS Helper
    Wiki Support Team
    (Original post by spikeymike)
    Yeah I have done to all files and folders, but it won't let me create the changelog from another user. :holmes:
    :iiam:

    (I'm trying to increase my usage of that smiley :sexface:)
    • PS Helper
    • Thread Starter
    Offline

    0
    ReputationRep:
    PS Helper
    (Original post by secretmessages)
    :iiam:

    (I'm trying to increase my usage of that smiley :sexface:)
    Indeed :iiam: but I'd like the :ms:. :sexface:
    • PS Helper
    • Wiki Support Team
    Offline

    14
    PS Helper
    Wiki Support Team
    (Original post by spikeymike)
    Indeed :iiam: but I'd like the :ms:. :sexface:
    Have you changed the permissions on the directories too?
    That's what you mean by folders isn't it? Apologies
 
 
 
Poll
Do you think parents should charge rent?

The Student Room, Get Revising and Marked by Teachers are trading names of The Student Room Group Ltd.

Register Number: 04666380 (England and Wales), VAT No. 806 8067 22 Registered Office: International House, Queens Road, Brighton, BN1 3XE

Write a reply...
Reply
Hide
Reputation gems: You get these gems as you gain rep from other members for making good contributions and giving helpful advice.