From: Harvey Newstrom (mail@HarveyNewstrom.com)
Date: Thu Apr 10 2003 - 11:36:18 MDT
Lee Corbin wrote,
> In other words, just as in operating systems and
> disk transfer operations, moving is often tantamount to copy
> plus erasure.
FYI. For legal purposes of evidence, a file that has been copied is NOT the
same as the original file. If a disk file is to be used as evidence in a
court of law, it must be frozen unchanging at the time of confiscation. The
files cannot be copied. The disk cannot be defragmented or moved around.
It cannot be repaired by a virus program to remove viruses. It cannot have
its last write date modified. It cannot be recovered with an undelete
program. In fact, it must be read by another device specially made for this
purpose. The operating system of the disk cannot be allowed to run or boot
off the disk. A digitally exact copy of the files is not the same as the
original file under the law.
This is not just a foible of legal rulings. A copy may or may not be
identical to the original. There may be errors introduced. It may have
been deliberately changed. It may be someone's claim of how the original
appeared to them, but it is not the original.
-- Harvey Newstrom, CISSP, IAM, GSEC <www.HarveyNewstrom.com>
This archive was generated by hypermail 2.1.5 : Thu Apr 10 2003 - 13:05:25 MDT