On Monday 03 July 2006 18:33 [EMAIL PROTECTED] wrote: > hello list, > I have a question thats more of a cueriosity that came from the > recent case Ref [1] > > Situation: > Suppose a hard disk gets stolen & is recovered after a certain time. > The normal forensics reveal no hints of any foreign body atempting to > copy the data from the hdd. (PHYSICALLY) > > But from a "Digital Forensic Standpoint" what are the other things > that should be examined before concluding no data was ACTUALLY > STOLEN?
I think, you are a bit too "forensic", I would prefer to secure the data on disk from being read, for instance with crypto. -- Christoph Gruber "Ein Volk, das in der Lage ist, alles zu sagen, ist bald in der Lage, alles zu tun." Napoleon I. (Bonaparte, 1769-1821)
