±Partners and Sponsors
New Today: 1
New Yesterday: 4
· Webmail Forensics – Digging deeper into Browsers and Mobile Applications
· Operation Endeavour: The Tip of the Iceberg?
· Forensic analysis of the ESE database in Internet Explorer 10
· WhatsApp – discovering timestamps of deleted messages
· Man In The Middle Attack: Forensics
· Extracting Evidence from Destroyed Skype Logs and Cleared SQLite Databases
· Windows 8 File History Analysis
· Understanding Rootkits: Using Memory Dump Analysis for Rootkit Detection
· Bitcoin Forensics Part II: The Secret Web Strikes Back
±Follow Forensic Focus
Consent Form to Wipe a hard drive
I am in law enforcement and I have a recently come upon a situation in which an evidence computer drive is being released back to its owner. The drive has some questionable material, but after a case review there will be no prosecution and the prosecutor has granted its return. I don’t want to return the drive with the material on it and the owner has asked me to wipe the drive. I am hesitant to just wipe the drive with the owner’s verbal permission and I would like some type of consent form for them to sign in this case as well as future cases. I have asked around including my local prosecutor, but there does not appear to be any such form around locally.
I am wondering if anyone else has come up on this problem and if there is a form that I can use as a template for the purpose.
Rockford Police Department
Larry E. Daniel DFCP, EnCE, BCE, ACE, CTNS
Guardian Digital Forensics - Firm
Ex Forensis - Blog
Digital Forensics for Legal Professionals - Book
- Senior Member
I would get BOTH the Prosecutor and the owner of the computer to sign it before you wipe it clean. I would keep my grubby lil fingers off that consent - if the Prosecutor decided not to prosecute and grant return - let HIM/HER sign the release and consent Also, if the owner has an Attorney, have him/her sign it too as a witness or someone who agrees/knows of the arrangement.
Just curious, how big/fast is this HD that the owner wants it back and that you want to wipe it. Would it not be cheaper/quicker/easier to purchase another HD for the owner??
- Senior Member
I would really be careful in wiping the drive and giving it back to the owner. This is because if more "questionable material" pops up in that same drive, that guy could say that you did not wipe it correctly. I have had cases that I was able to recover some data for a data recovery customer from a wiped drive. It's very hard, but sometimes you get lucky. I would take 4n6art advise even further and destroy that drive (specially if it's a old one) and explain to the owner that it's the safest route. Open the case and remove the platters. Once you removed the platters it's virtually impossible to line them up again. I'm in LE and I know you department has to have a destruction form for firearms. Use that one and change the wording. Of course like 4n6art said, have all parties sign off on it. Good Luck...