Copy of hard drive ...
 
Notifications
Clear all

Copy of hard drive for owner? In what format?

3 Posts
3 Users
0 Reactions
322 Views
(@yunus)
Estimable Member
Joined: 17 years ago
Posts: 178
Topic starter  

In my country, the law says "When the owner of a seized hard drive asks for a copy of his hard drive, he/she shall be provided a copy of his hard drive".

In terms of evidence integrity, the word 'copy' refers to forensic copy the seized hard drive. Normally, as a computer forensic examiner you make a forensic copy of suspect hard drive in E01, raw, etc formats, however if the owner of the hard drive asks for a copy his hard drive for practical reasons -such as he might need the copies of some files and folders for his business-, then an image file in forensic format like E01 will not be good for the owner, in other words, he has to buy Encase and learn how to use it.

So, how do you deal with this situation? Do you provide the owner one forensic copy and a non-forensic copy if he wants copies of some of his files for business?


   
Quote
Mark_Eskridge
(@mark_eskridge)
Trusted Member
Joined: 16 years ago
Posts: 50
 

A clone (copy) of the original is what most "non-forensic" requests generally refer to. It is of no use to give a forensic image to a lay person, unless they have indicated that they are hiring a forensic expert. Just make sure you document matching hash values between what you seized and what you returned.


   
ReplyQuote
CFEx
 CFEx
(@cfex)
Trusted Member
Joined: 16 years ago
Posts: 69
 

If I was the owner, I would expect a "physical" hard drive with a copy of my hard drive. That way I just plug the one you provide back into the PC.

Think about it. Even if you give me a Ghost or WIMS image (which are not considered forensic copies), I would need to buy additional software and a hard drive to get access to my data.

Laws are never clear, and are subject to interpretation.


   
ReplyQuote
Share: