Something interesting and figured I would see what everyone's opinion on this is.
A case where you (A FORENSIC PRACTITIONER) are forced to leave your exam PC at a police station (while it INDEXES a CLIENT of yours hard drive), There is a court order in place stating you cannot take the hard drive back to your office, you have to hook up your exam computer at this location to the suspect hard drive and look at it there. Upon leaving the person at the location looks around on your exam pc while it is indexing your client's hard drive.
What's your opinion on police deciding to just rummage around in your work pc (no reason, just to look around) and open documents, reports, etc. just for the fun of it, then saying they didn't do anything.
Not looking for replies about locking the PC, screen saver PW, etc. that is not an option. Just looking for opinions on people doing that.
What would you do?
As far as to answer the how would you know MRU as well as access times on only select documents, nothing else accessed no scans etc.. Other indicators as well.
If I were to leave a machine, it would be a sterile one, with nothing for nosey people to have a look around.
I believe you are missing the thread. I don't want to edit the thread to include every possible thing that could happen. Just say having a sterile machine is not possible.
Also, just think that they were just looking through the computer and didn't view reports, just looking around.
This is principle based……
Given the circumstances listed what would you do.
You mean leave a running machine processing something, or leaving a downed forensic workstation with LEOs?
I cannot see the second scenario.
In the first scenario, I would disable firewire, Bluetooth, WiFi, NIC port, unused USB ports, give high priority to the work process, then lock the machine.
I guess I can imagine someone mucking with it, but it would be highly detrimental for them. Why would they risk being fired for something dumb?
If you are talking about evidence machine, that is not my CoC problem if they did muck with it.
If you leave your computer with anyone, anywhere, for any reason, accept that it can be perused for any reason by anyone with physical access to it. Once any person has physical access to 'your' machine, it is now 'their' machine (without regard to any legal ownership issues, they practically own it)
No one can say without absolute certainty that violations of policy and/or law will not be broken by any government employee, be it law enforcement, other government, or even private computer repair shops. You just have to Google "TSA body scanners" and find that even though you have government employees entrusted with ensuring your safety in flight, have already begun to violate policies related to the body scanning images. People are people, and people are curious by nature.
And given forensic capability, you may never know that your hard drive was ever touched if it were imaged. Having your PC indexed is a curious statement, because I can't see any need to do that unless your PC is evidence, and in that case, probably all is fair game.
"Having your PC indexed is a curious statement"
Wow, let's try it this way.
A FORENSIC PRACTITIONER leaves a PC at a location to INDEX because the court has ordered that the FORENSIC PRACTITIONER must leave the PC there. While in the course of the pc indexing people at the location where the pc is INDEXING decide to look around on the FORENSIC PRACTITIONER's computer, there is no legal reason for this.
What's the question exactly? Is it what should you do beforehand, what would you do to check afterwards, how would you react if you discovered something or what's your opinion on this sort of thing happening (or all of the above)?
Jamie
Hi Jamie,
The basic question is what would you do. The what would you do is in regards to you finding out that a pc you left to index somewhere was gone through and looked at when you are not a suspect and there was no authority to go through said machine.
Thanks, that clarifies things.
If the examiner's machine is ordered to be indexed, therefore implying it will be searched (otherwise, why index it?), then there would have to be one or more reasons for it.
You have to trust your government or if you don't trust the government with your potentially personal, or private, or confidential, or embarrassing, or business data, you don't have any choice in the matter anyway but hope for the best with whomever is handling your data.
If by chance you could show that inappropriate actions were taken, then civil recourse along with a formal complaint to the agency sounds like your potential remedy. But as it's been said before, some things cannot be remedied, as once the arrow is flown, nothing will bring it back and make everything right again.
I'd say an attorney would be able to give you advice on what to do if you suspect that to have happened.
(and the curious statement is that I've not seen where the examiner's machine is ordered to be indexed, thereby prepped for searching unless someone is making allegations that the machine needs to be checked for some sort of information or data).