±Forensic Focus Partners
|New Today: 9||Overall: 29213|
|New Yesterday: 5||Visitors: 52|
· SADFE 2015 – Malaga 30th September – 2nd October
· Countering Anti-Forensic Efforts – Part 2
· Windows 8 Touch Keyboard Forensics
· Countering Anti-Forensic Efforts – Part 1
· Linux Timestamps, Oh boy!
· Standard Processes in Windows 10
· NAS Forensics Explained
· Project Spartan Forensics
· FT Cyber Security Summit Europe – London 22nd September
Consent Form to Wipe a hard drive
I am in law enforcement and I have a recently come upon a situation in which an evidence computer drive is being released back to its owner. The drive has some questionable material, but after a case review there will be no prosecution and the prosecutor has granted its return. I don’t want to return the drive with the material on it and the owner has asked me to wipe the drive. I am hesitant to just wipe the drive with the owner’s verbal permission and I would like some type of consent form for them to sign in this case as well as future cases. I have asked around including my local prosecutor, but there does not appear to be any such form around locally.
I am wondering if anyone else has come up on this problem and if there is a form that I can use as a template for the purpose.
Rockford Police Department
Larry E. Daniel DFCP, EnCE, BCE, ACE, CTNS
Guardian Digital Forensics - Firm
Ex Forensis - Blog
Digital Forensics for Legal Professionals - Book
- Senior Member
I would get BOTH the Prosecutor and the owner of the computer to sign it before you wipe it clean. I would keep my grubby lil fingers off that consent - if the Prosecutor decided not to prosecute and grant return - let HIM/HER sign the release and consent Also, if the owner has an Attorney, have him/her sign it too as a witness or someone who agrees/knows of the arrangement.
Just curious, how big/fast is this HD that the owner wants it back and that you want to wipe it. Would it not be cheaper/quicker/easier to purchase another HD for the owner??
- Senior Member
I would really be careful in wiping the drive and giving it back to the owner. This is because if more "questionable material" pops up in that same drive, that guy could say that you did not wipe it correctly. I have had cases that I was able to recover some data for a data recovery customer from a wiped drive. It's very hard, but sometimes you get lucky. I would take 4n6art advise even further and destroy that drive (specially if it's a old one) and explain to the owner that it's the safest route. Open the case and remove the platters. Once you removed the platters it's virtually impossible to line them up again. I'm in LE and I know you department has to have a destruction form for firearms. Use that one and change the wording. Of course like 4n6art said, have all parties sign off on it. Good Luck...