Forensics question

jaffy1229 · 04-17-2008, 05:32 PM

Here's a scenario. Lets say my computer is being examined by the police. If they tamper with any of the information on the hard drive, could they do so without leaving any evidence of what they have done?

For example, what if they changed a filename to read something else to make it look incriminating? How could you prove independently, that filename was changed? (or not)

Cheers,
jaffy

adarsh · 04-17-2008, 07:20 PM

You can check it yourself in the properties.
In the File Properties, it'll show when it was "Modified".

red onion · 04-17-2008, 07:37 PM

Quote:

Originally Posted by adarsh

You can check it yourself in the properties.
In the File Properties, it'll show when it was "Modified".

Not really...they could roll the calendar back 6 months...save the file...then change the calendar back.

tlarkin · 04-17-2008, 07:39 PM

Quote:

Originally Posted by jaffy1229

Here's a scenario. Lets say my computer is being examined by the police. If they tamper with any of the information on the hard drive, could they do so without leaving any evidence of what they have done?

For example, what if they changed a filename to read something else to make it look incriminating? How could you prove independently, that filename was changed? (or not)

Cheers,
jaffy

Stop doing illegal stuff with your computer and you have nothing to worry about.

adarsh · 04-17-2008, 07:59 PM

I agree.
But would you think about rolling back the calendar back 6 months after you rename a file?

tlarkin · 04-17-2008, 08:02 PM

Quote:

Originally Posted by adarsh

I agree.
But would you think about rolling back the calendar back 6 months after you rename a file?

You can't modify the meta data, and what the hell are you talking about rolling back? You mean like a system restore to a previous date?

There are tools to help you modify meta data, but that is not relevant at all. Illegal content is illegal content. If they put something on your computer it will have a creation date, that date technically can not be modified with out some tooling around.

The whole scenario is ridiculous, and there are so many cyber crimes to begin with, why in the hell would any LEO plant evidence on your computer unless it was personal? It creates more work for them.

adarsh · 04-17-2008, 08:05 PM

tlarkin, I'm not the one who suggested that.
Please read the post properly. It was red_onion who suggested that.

Daniels2386 · 04-17-2008, 10:43 PM

why are they "going" through your computer anyways? Save your stuff, reformat, and let them look all they want...tell them you caught a nasty virus if they ask lol

Sir Travis D · 04-18-2008, 11:51 PM

lol get one of those hard drive melt down kits.. Something about hitting certain keys and it ruins the HD... I would make backups to an external hdd and hide it somewhere underground.. Then press the button

04-17-2008, 05:32 PM	#1 (permalink)
jaffy1229 New Member Join Date: Apr 2008 Posts: 1	Forensics question Here's a scenario. Lets say my computer is being examined by the police. If they tamper with any of the information on the hard drive, could they do so without leaving any evidence of what they have done? For example, what if they changed a filename to read something else to make it look incriminating? How could you prove independently, that filename was changed? (or not) Cheers, jaffy

04-18-2008, 11:51 PM	#9 (permalink)
Sir Travis D Platinum Member Join Date: Apr 2008 Location: Michigan, USA Age: 14 Posts: 835	lol get one of those hard drive melt down kits.. Something about hitting certain keys and it ruins the HD... I would make backups to an external hdd and hide it somewhere underground.. Then press the button __________________ Alienware Area-51 M15x - Ordered 4/11/08 -$2092 2.4ghz/160gb/8700m gt/2gb Ram/AlienFX Lights

Thread Tools
Show Printable Version Email this Page
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
If you have a question about the forum administration	ian	Off Topic Chat	0	03-31-2008 08:51 AM
The Amazing Question > Question Game	ramodkk	Off Topic Chat	469	03-13-2008 10:14 AM
Question about quad-core processors.	heyman421	CPUs and Overclocking	4	01-15-2007 03:46 AM
Hopefully a simple question about RAM	bugs	Computer Memory and Hard Drives	2	01-11-2007 11:38 PM
Dual Monitor/ Temperature question	XprophX	Video Cards and Monitors	10	12-13-2006 09:49 PM

04-17-2008, 07:20 PM	#2 (permalink)
adarsh Platinum Member Join Date: Jul 2007 Location: Dubai Age: 16 Posts: 781	You can check it yourself in the properties. In the File Properties, it'll show when it was "Modified".

04-17-2008, 07:59 PM	#5 (permalink)
adarsh Platinum Member Join Date: Jul 2007 Location: Dubai Age: 16 Posts: 781	I agree. But would you think about rolling back the calendar back 6 months after you rename a file?

04-17-2008, 08:05 PM	#7 (permalink)
adarsh Platinum Member Join Date: Jul 2007 Location: Dubai Age: 16 Posts: 781	tlarkin, I'm not the one who suggested that. Please read the post properly. It was red_onion who suggested that.

04-17-2008, 10:43 PM	#8 (permalink)
Daniels2386 Bronze Member Join Date: Mar 2008 Posts: 55	why are they "going" through your computer anyways? Save your stuff, reformat, and let them look all they want...tell them you caught a nasty virus if they ask lol