I don't think they can detect some highly advanced techniques like using Partition Magic to mirror the disk..
On Fri, 30 Jun 2006 10:07:46 -0400 Michael Holstein <[EMAIL PROTECTED]> wrote: MH> >The FBI, in a statement from its Baltimore field office, said a MH> >preliminary review of the equipment by its computer forensic teams MH> >"has determined that the data base remains intact and has not been MH> >accessed since it was stolen." More tests were planned, however. MH> MH> Didn't the original "wanted" notice for this hardware specifically MH> mention an external (USB) drive? MH> MH> Gee .. 'mount -t ntfs -o ro /dev/sda1 /mnt/goodies' MH> MH> How are their "forensic" people going to determine if *that* happened? MH> MH> Their argument about "a real crook wouldn't return the hardware" .. MH> well, why not? .. $50,000 to buy that fancy ID printer off eBay to get MH> yourself started. MH> MH> /mike. MH> MH> _______________________________________________ MH> Full-Disclosure - We believe in it. MH> Charter: http://lists.grok.org.uk/full-disclosure-charter.html MH> Hosted and sponsored by Secunia - http://secunia.com/ MH> year(now) + 1 serĂ¡ o ano do linux! Cardoso <[EMAIL PROTECTED]> - SkypeIn: (11) 3711-2466 / (41) 3941-5299 vida digital: http://www.contraditorium.com site pessoal e blog: http://www.carloscardoso.com _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/