I was curious if anyone had thoughts about encrypting acquisition drives to protect evidence? We primarily image a drive to a file. After the image is complete use a hardware Encryptor to encrypt the evidence drive. Thus using a virtual lock and key to add an additional layer of security to the evidence before it is processed in the lab.

Please let me know your thoughts.


Tom  

If your lab is secure why bother. Encryption just slows everything down and adds little benefit unless you are sending data out of the lab. Or are working on something so sensitive that all possible precautions need to be taken - this is very rare in my experience.
_________________
Paul Sanderson
Reconnoitre, VSC processing made easy - www.sandersonforensics...oitre.html
www.twitter.com/sandersonforens 

Paul,

That is a good point. I was just toying with the notion. All evidence is locked in a secure evidence room.

Thanks,

Tom  

We typically encrypt our destination drives with TrueCrypt. We're shipping evidence cross country on a regular basis, though, so there is definitely a need.

Any insight into the discrepancy between transfer times using encrypted vs. non-encrypted destination media?  

- slamdek

We typically encrypt our destination drives with TrueCrypt. We're shipping evidence cross country on a regular basis, though, so there is definitely a need.?

My thoughts precisely, I only encrypt if the hard drive is being shipped by someone other than me, otherwise really no point.  

> If your lab is secure why bother.
Because disks have a tendency to leave the lab, sooner or later.

> Any insight into the discrepancy between transfer times using encrypted vs. non-encrypted destination media?

HIghly depends on the solution. Software based encryption can have a significant performance impact.

You can also use hardware encryption e.g. those of Addonics www.addonics.com/
which offer an encryption solution with little to none speed impact.  

We encrypt all acquisition drives with TrueCrypt as standard. There are two principal reasons for this:

[1] We sometimes have to ship disks. Sure, I could encrypt them when I need to ship them, but usually there's some kind of urgency at that stage, so I'd rather they were ready to go.

[2] Some of what we acquire is considered to be 'Personal Data' within the meaning of relevant Data Protection laws. Our Data Processing agreements with out clients typically require us to take 'technical and organizational measures' to protect such data: encrypting the data is one part of that.