Live data from Hacker News

Rethinking Police Searches of Computers

freedom-to-tinker.com

21–28 of 28 posts

Re: Rethinking Police Searches of Computers

#21
post #19

If the police are going to confiscate, why would they confiscate the whole computers, and not just the drives? Furhter, why not provide the option for the guy being served to get some new drives and copy the data to them before the police confiscate the original?

Usually the answer is that police, generally, have no clue about computers - enough to seize machines but not to safely remove the drives. Clearly that's not the case in this specific incident. But there are other reasons. Firstly, when you remove drives from the machines you have to open it up, photograph them in situ, remove the drives, image and replace them. It's a reasonably time consuming job (and I doubt you'd…

Awesome detailed answer, thanks! My questions come from a basic concern for the suspect, and presumption of innocence before proven guilty. A confiscated computer not only may require extra care in "plain sight" restrictions as outlined in the article, but also extra care in "undue hardship". If I keep all my records on a computer, and that computer is confiscated, I am now without any way of doing basic stuff like paying bills. It would seem that being able to retain a copy of the data is relatively trivial, so such an option should be made available. Given that current practices seem to be "never see your stuff again", is there any reason not to allow it? (Perhaps not as its taken, but shortly thereafter).

Re: Rethinking Police Searches of Computers

#22
post #19

Earlier quoted context omitted.

Usually the answer is that police, generally, have no clue about computers - enough to seize machines but not to safely remove the drives. Clearly that's not the case in this specific incident. But there are other reasons. Firstly, when you remove drives from the machines you have to open it up, photograph them in situ, remove the drives, image and replace them. It's a reasonably time consuming job (and I doubt you'd…

Awesome detailed answer, thanks! My questions come from a basic concern for the suspect, and presumption of innocence before proven guilty. A confiscated computer not only may require extra care in "plain sight" restrictions as outlined in the article, but also extra care in "undue hardship". If I keep all my records on a computer, and that computer is confiscated, I am now without any way of doing basic stuff like p…

Yeh. You've touched on the inherent trade off of my job. If you have critical stuff on your computer then we will do our best to get a copy back to you asap (of course I can only talk for us).

The problem is not retaining the data. We work from images anyway. The issue is that if the drive contains evidence returning the original would probably kill the case in court. If a defence analyst questions the data - say accuses us of faking it - how do you prove that if it goes back to the suspect.

Re: Rethinking Police Searches of Computers

#23
post #11

> At the very least, the courts should forbid the police from looking at any file timestamped before March 18, 2010 Except that timestamps can be altered.

True, but if someone is ordered to turn over 'all documents pertaining to topic X', they still might withhold documents. We don't allow the police to search all documents, just in case. {edit} It would get messy if he was on a computer that had a faulty cmos battery (i.e. randomly your system clock is reset to the unix epoch). Trying to figure out the true date of files with timestamps of December 31, 1969 would be d…

The timestamps are before the epoch because you live in the western hemisphere, so your timezone is GMT-N.

Re: Rethinking Police Searches of Computers

#24
post #22

Earlier quoted context omitted.

Awesome detailed answer, thanks! My questions come from a basic concern for the suspect, and presumption of innocence before proven guilty. A confiscated computer not only may require extra care in "plain sight" restrictions as outlined in the article, but also extra care in "undue hardship". If I keep all my records on a computer, and that computer is confiscated, I am now without any way of doing basic stuff like p…

Yeh. You've touched on the inherent trade off of my job. If you have critical stuff on your computer then we will do our best to get a copy back to you asap (of course I can only talk for us). The problem is not retaining the data. We work from images anyway. The issue is that if the drive contains evidence returning the original would probably kill the case in court. If a defence analyst questions the data - say acc…

I totally understand that last part, about evidence custody stuff. I find it vaguely totemic, in that the "one true datathingy" must be preserved. (not on your part necessarily, on the whole court system in general). Good on you guys for getting data back to the suspect. I presume that if it all comes from Images anyway, it would be trivial for me to bring in a couple TB of NAS and say, "data please" and just get raw image dumps.

I think to clarify my above stuff: Rules of evidence should state that images of the computer files in custody should be made available to suspects in some short amount of time after they are processed, due to the easy copy aspect of digital media, and the critical nature some data on the drives.

Re: Rethinking Police Searches of Computers

#25
post #22

Earlier quoted context omitted.

Yeh. You've touched on the inherent trade off of my job. If you have critical stuff on your computer then we will do our best to get a copy back to you asap (of course I can only talk for us). The problem is not retaining the data. We work from images anyway. The issue is that if the drive contains evidence returning the original would probably kill the case in court. If a defence analyst questions the data - say acc…

I totally understand that last part, about evidence custody stuff. I find it vaguely totemic, in that the "one true datathingy" must be preserved. (not on your part necessarily, on the whole court system in general). Good on you guys for getting data back to the suspect. I presume that if it all comes from Images anyway, it would be trivial for me to bring in a couple TB of NAS and say, "data please" and just get raw…

Yes I wish that happened more to be honest.

Currently the issue is that it is a logistical nghtmare die to how large police forces work. Unfortunately we are on the outside so our suggestions mostly fall on deaf ears at management level :(

Re: Rethinking Police Searches of Computers

#26
Forensic guys want to take images of the storage devices. They use tools such as dcfldd or purpose-built devices (Tableu) to do this. They'll then analyze the images and probably never touch the guy's hardware again. It will sit in a evidence room for eons. They could return the hardware as soon as they've done the imaging, but I've never seen that happen. Use whole disk encryption everywhere :)

Re: Rethinking Police Searches of Computers

#28
post #11

> At the very least, the courts should forbid the police from looking at any file timestamped before March 18, 2010 Except that timestamps can be altered.

True, but if someone is ordered to turn over 'all documents pertaining to topic X', they still might withhold documents. We don't allow the police to search all documents, just in case. {edit} It would get messy if he was on a computer that had a faulty cmos battery (i.e. randomly your system clock is reset to the unix epoch). Trying to figure out the true date of files with timestamps of December 31, 1969 would be d…

[deleted]
Post reply on HN