Hacker News new | past | comments | ask | show | jobs | submit login

You'd hope in high profile cases (or really all cases), a hash of the entire drive could be taken upon seizure and given to a lawyer before any forensics started.

Don't know much about forensics and maybe this already happens, but is surely a good way for both sides to avoid unfounded accusations.




The evidence would have been planted by the civilian tech before seizure.


IIRC in law enforcement situations where a HDD has been obtained through slightly more conventional means, chain of custody is as important (as it is for all evidence) as ensuring the state is maintained. There are many forensic hardware providers that specifically sell 'read only' readers to ensure that whilst in possession of the drive, it's state is preserved (as much as practicably possible).




Join us for AI Startup School this June 16-17 in San Francisco!

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: