Hi all. 100% of my work is done via EnCase Enterprise, so no need to leave my desk. However, I am faced with a machine at a smaller office where the bandwidth is horrid. So I am faced with shipping the drive to my office. My question is to thsoe folks who ship drives regulary. What company, service and precuations do you use to achieve this in a secure and safe manner? The obvious fear is that the HDD is lost or damaged during transit.
Im gonna send the fella a lock box and tag to place the drive in but beyond that I guess it up to FedEx not lose it.
Regards, Brian.
Bperk
I look at it on a case by case situation. How far is it from you ? would the company pay for you to go and sieze it ?
Better than losing it = not having anything ?
could you organise someone over there to image it for you ?
then send the image at least your not sending the original.
just my thoughts
Mitch
Encryption can help if you're worried about what happens to the data if it's lost.
You should however make sure you have 2 copies of your evidence (image files) before you ship. That way if the shipped copy is lost, you can re-dupe and re-send from your other copy. Once its received, redo the hashes and if they match the hashes on the COC report (which generally it's easiest to send via email) then you're golden and the extra copy can be destroyed (wiped).
I've shipped images via Fedex this way and haven't had issues thus far.
I've shipped via Fedex, UPS and DHL. I second Tony's response of having 2 copies and destroying one after you have verified and backed up the other copy.
If close, have the evidence shipped via courier.
Greetings,
I make two copies, encrypt both, send one, confirm shipment, and send the other. The people receiving the image often need two copies themselves so rather than duplicate the copying effort, just ship both of the existing copies.
-David
I am sometimes used as a sub for acquiring evidence so their client does not need to ship the original evidence to a lab or examiner (and risk losing or damaging the original). I always discuss and recommend keeping a second copy of the image with me prior to shipping. Once my client confirms receipt, confirms they've loaded the image and re-verified the hash, and that they've advised me it is ok to wipe my copy, I wipe the drive.
I usually ship in the hard drive box and packaging if I've purchased a new drive for the job. Else, I use foam/bubble wrap and an anti-static bag to ship.
Good point – David – on shipping the second copy. I'll be sure to ask about this next time.
Thank you all, much appreciated.