A lot of interesting answers here. First and foremost, if I could be so bold as to make a general suggestion - please hire a forensics specialist if you are going to present data to court. This isn't a "how to" game, there is a very specific requirement for a scientific approach and best practice to be followed by an established expert. Anything else is likely to be worthless, no matter how "equivalent" you may think something is.
I understand that the OP was just being asked to deliver something and therefore may not have cared so much about the above advice, but believe he has certainly done the best thing by just passing the evidence to them to process as desired. FAT was suggested because of dropping permissions, so let's not pretend FAT16 is relevant - 32GB partition limit and 8TB disk size are the key figures, as mentioned below. LFN support is also institutionalised so 8.3 names aren't relevant. However you're removing elements of the original file; you altering evidence. a -----Original Message----- From: Mike Leone [mailto:oozerd...@gmail.com] Sent: 23 June 2011 15:01 To: NT System Admin Issues Subject: Re: Seizing ownership changes modification date, and that is bad ... On 6/23/2011 9:55 AM, Kevin Lundy wrote: > FAT32 limit is 32 G. Right. But you said FAT, not FAT32, which is different ... > Individual files are >2G or just in total. > > If the total, it may be painful, but multiple FAT32 partitions might > work. Nobody said ediscovery was easy :) The total may be within 32G, tho I doubt it. But would that even help me? If I restore to a FAt32 drive, would I then be able to copy the files to their external drive? Or would the security restrictions just completely disappear, because the source is a FAT32 drive? > > On Thu, Jun 23, 2011 at 9:41 AM, Mike Leone <oozerd...@gmail.com > <mailto:oozerd...@gmail.com>> wrote: > > On 6/23/2011 9:31 AM, Kevin Lundy wrote: > > Restore it direct to a FAT partition? Not sure if that changes > the date > > or not. > > The files are too big - FAT is limited to 2G partitions, IIRC (been a > LOT of years since I had to think about FAT), and I have 10s of Gigs of > data. > > Interesting thought, tho - FAT not having any security ... > > ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ > ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~ > > --- > To manage subscriptions click here: > http://lyris.sunbelt-software.com/read/my_forums/ > or send an email to listmana...@lyris.sunbeltsoftware.com > <mailto:listmana...@lyris.sunbeltsoftware.com> > with the body: unsubscribe ntsysadmin > > > ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ > <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~ > > --- > To manage subscriptions click here: > http://lyris.sunbelt-software.com/read/my_forums/ > or send an email to listmana...@lyris.sunbeltsoftware.com > <mailto:listmana...@lyris.sunbeltsoftware.com> > with the body: unsubscribe ntsysadmin > ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe ntsysadmin ************************************************************************************ WARNING: The information in this email and any attachments is confidential and may be legally privileged. If you are not the named addressee, you must not use, copy or disclose this email (including any attachments) or the information in it save to the named addressee nor take any action in reliance on it. If you receive this email or any attachments in error, please notify the sender immediately and then delete the same and any copies. "CLS Services Ltd × Registered in England No 4132704 × Registered Office: Exchange Tower × One Harbour Exchange Square × London E14 9GE" ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe ntsysadmin
