81–83 of 83 posts
Earlier quoted context omitted.
> Then when the cops would seize the machines and cut power to save as much evidence as they could, they'd actually be doing the opposite. Let's for a second assume that forensic computer technicians aren't completely incompetent and actually understand that you do not pull the plug on a system that potentially contains evidence the first thing you do. While this has been known to happen in the past, I can almost gua…
Lol, forensic technicians are pretty incompetent overall. Like I remember a peer reviewed article on PS3 forensics where they explicitly have a section on trying to run a PS3 disk image in VMWare and didn't understand why they couldn't get it to work. And this piratebay mitigation was in the early 2000s. At that point most of the anti forensic mitigations were booby traps on input channels (keyboard, console, etc) an…
Why? Are you saying there were no measures to make data inaccessible in case of power failure?
I wonder whether this achieves anything performance-wise that just cat'ing every file to /dev/null to warm up the buffer cache wouldn't achieve. In theory, the kernel uses a buffer cache that will hold on to disk pages until they're invalidated by writes. It'll evict the cache if there's memory pressure. But this setup will presumably just crash if there's memory pressure, so that doesn't seem like a win for the RAM…
I can't hard-core prove anything, but I've read the theory on how if I'm accessing warm disk cache, putting things into a RAM disk shouldn't speed them up, and every time I've done it and tested it, putting things in a RAM disk is faster than having it on disk, even when the very act of copying the stuff into RAM should definitely have just warmed everything up just before the test. I've not done it very often, but e…