Actually the prefered method is to dd one or more copies for forensics and use the orginal in court if you are able to immediately shut that box down afterward. However if it is a mission-critical that cannot immediately be brought down, it is preferrable to use that first copy for evidence and make multiple copies of it for forensics.
Curt Purdy CISSP, GSEC, MCSE+I, CNE, CCDA Information Security Engineer DP Solutions ---------------------------------------- If you spend more on coffee than on IT security, you will be hacked. What's more, you deserve to be hacked. -- White House cybersecurity adviser Richard Clarke -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Craig Pratt Sent: Tuesday, August 05, 2003 5:27 PM To: Ron DuFresne Cc: David Hayes; [EMAIL PROTECTED] Subject: [inbox] Re: [Full-Disclosure] Hard drive images On Tuesday, Aug 5, 2003, at 13:23 US/Pacific, Ron DuFresne wrote: > On Tue, 5 Aug 2003, David Hayes wrote: > >> Our old standby, "dd", is perfectly acceptable for making an image of >> a hard drive to be used in court. It's even the #1 choice of the FBI, >> and accepted by U.S. federal courts. From the trial court order on >> admission of evidence in the case of Zacarias Moussaoui (the accused >> 20th hijacker of 9/11): >> > > Interesting, I would have thought that the original was required for > the > courts, and that forensics was conducted on the copy. > > Thanks, > > Ron DuFresne I believe there are ways to recover data at the physical/magnetic level - magnetic remnants of previously-deleted data, for instance - which would require access to the original platters. I read an article about this somewhere - would have to be SciAm or /. C --- Craig Pratt Strongbox Network Services Inc. mailto:[EMAIL PROTECTED] dtmf:503.706.2933 -- This message checked for dangerous content by MailScanner on StrongBox. _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
