headers
David Hansen | 1 Oct 2003 09:57
Picon

Re: The real police view of

On 30 Sep 2003 at 17:16, Adrian Midgley wrote:

> I'm referring to to dead weapons scientists

Who was not offered the chance to retire and save his bosses from 
embarrassment.

> and retired company directors.

I assume you are referring to the one who made a miraculous "recovery" 
from Alzheimer's disease. My memory is that he developed this after the 
trial. The disgrace is that he was not put back in prison after his 
"recovery".

> But it may indeed be the case that not every powerful 
> organisation deals entirely the same with its own members as others.

The police are reasonably well known for their differential approach to 
their employees and other people. Even the Home Office said that they 
were going to do something about it.

--
  David Hansen, Edinburgh | PGP email preferred-key number F566DA0E
 I will *always* explain why I revoke a key, unless the UK 
 government prevents me using the RIP Act 2000.
Permalink | Reply | 0 comments |
headers
David Hansen | 1 Oct 2003 10:38
Picon

Re: Fw: New UK evidence guidelines

On 30 Sep 2003 at 21:03, Nexus wrote:

> This was posted to a computer forensics list, thought it might be of
> interest to this list as well.

Another dammed Acrobat document in two columns, purpose designed to 
make referring to it as difficult as possible. I have read the first 
bit and there is much that is right. However:

>>Non-compliance with this guide should not necessarily be
>>considered as grounds to reject evidence.

I'm sure that is the case, for the government side. For the defence it 
will no doubt be excellent grounds for rejecting their points.

>>Crime Scenes

The police being the jury again. It's unlikely that if there is a 
computer at a place where it is likely that there has beena  crime, 
unless it has been used like a club.

>>Remove the battery from laptop computers

A laptop with only one battery. Fascinating.

>>Carefully remove the equipment and record unique identifiers

Do they mean move I wonder?

>>Remove all other connection cables leading from the computer
(Continue reading)

Permalink | Reply | 24 comments |
headers
Ian Miller | 1 Oct 2003 10:42
Picon

Re: Fw: New UK evidence guidelines

At 23:19 +0100 30/9/03, Derek Fawcus wrote:
>i.e. it's not necc. or proportional to seize the complete unit,  and one
>should be able to insist they dismantle the machine and only remove storage
>devices.

I think this may be a comment on the computer literacy of the people doing
the seizure.  I suspect that they were failing to seize iMacs and similar
everything-is-in-the-monitor machines.  If this is the case, then I don't
think any amount of 'guide-lines' are get such people to take everything
that is relevant or nothing that obviously isn't.  They certainly won't
notice even quite simple destroy-the-data booby-traps.

The tone of guide-lines is also odd.  Whereas it is title is "Good Practice
Guide for Computer based Electronic Evidence", it seems in fact to be
"Guide for Investigating Child Abuse Involving Computers".  There seems to
be an implicit assumption that data on the computer will be kiddie-porn,
rather than (for example) evidence of fraud.  The section on disclosing the
data to "the defence" does not have the slight recognition that discs may
also include information vital to the survival of a business (which in the
case of a fraud investigation is quite likely).

Ian

--
Singularis Ltd, 32 Stockwell St, Cambridge, CB1 3ND
Tel:  +44 1223 525088	            Mobile: +44 777 5536663
Fax:  +44 870 0514333	 (e-mail preferred to Fax)
Permalink | Reply | 0 comments |
headers
Peter Tomlinson | 1 Oct 2003 11:05
Picon

Re: Fw: New UK evidence guidelines

David Hansen wrote:
> Another dammed Acrobat document in two columns, purpose designed to
> make referring to it as difficult as possible.

There is software to eviscerate pdf files, you know. But I haven't tried it
on two-column documents.

Peter
Permalink | Reply | 0 comments |
headers
David Hansen | 1 Oct 2003 11:28
Picon

Re: Fw: New UK evidence guidelines

On 1 Oct 2003 at 9:42, Ian Miller wrote:

> The tone of guide-lines is also odd.  Whereas it is title is "Good Practice
> Guide for Computer based Electronic Evidence", it seems in fact to be
> "Guide for Investigating Child Abuse Involving Computers".  There seems to
> be an implicit assumption that data on the computer will be kiddie-porn,
> rather than (for example) evidence of fraud.

I think this is a very good observation and one that is highly 
accurate.

> The section on disclosing the
> data to "the defence" does not have the slight recognition that discs may
> also include information vital to the survival of a business (which in the
> case of a fraud investigation is quite likely).

No doubt companies put out of business by the activities of the police 
will think it a price well worth paying. After all if just one child is 
saved it will be worth it, as certain people would say.

I note that in the diagram on page 40 the Monitor, Keyboard and mouse,
All leads (including power cables) are marked as items that should be 
grabbed. There is none of the discussion that accompanies these items 
on page 11. Now I may be maligning police officers, but I think that 
they will follow the diagram on page 40 and not bother themselves with 
the words on page 11 (weak though they are). I'm fascinated by the 
concept of monitors, keyboards, mice and power leads that store 
information or are so non-standard that they are needed to re-construct 
the system. Perhaps someone could enlighten me?
(Continue reading)

Permalink | Reply | 113 comments |
headers
Nexus | 1 Oct 2003 11:50
Picon

Re: Fw: New UK evidence guidelines


----- Original Message ----- 
From: "David Hansen" <davidh@...>

[snip]

> >>Remove all other connection cables leading from the computer
> >>to other wall or floor sockets or devices
> >>computer may mean that a small amount of evidence
>
> The only cable mentioned earlier is the modem cable, so doing this will
> cause an uncontrolled shutdown.

From a forensics point of view, there are some very valid arguments that
systems should be shut down this way.   You have no way of knowing if the
machine has been set up to frag it's HDD if the "correct" shutdown sequence
is not invoked, antiforensic file systems may unmount and vanish, etc,
hence yanking the mains cable is a suitable action if you cannot image the
machine in situ.   The rest of the guide is a bit silly in places I agree,
probably because they have taken standard evidence gathering procedures and
just applied them carte blanch, without thought as to context.   This is
also odd as the NHTCU forensics guys are very well aware of such things, so
I am guessing that they were either not consulted, or were ignored.
Handling new technologies can also bring unforseen problems - a friend
recounted a story that for evidencial purposes, a device was required to
remain powered on for a considerable amount of time.   This resulted in a
hole being punched in the evidence bag to feed a mains cable in, as the
battery wouldn't last... IANAL so I don't know if this is an issue from the
chain of evidence perspective, but I would be surprised if it were not.
(Continue reading)

Permalink | Reply | 22 comments |
headers
Roland Perry | 1 Oct 2003 12:57
Picon
Picon

Re: Fw: New UK evidence guidelines

In article <3F7AAC59.22427.B589C9 <at> localhost>, David Hansen 
<davidh@...> writes

>>Whereas it is title is "Good Practice
>> Guide for Computer based Electronic Evidence", it seems in fact to be
>> "Guide for Investigating Child Abuse Involving Computers".  There seems to
>> be an implicit assumption that data on the computer will be kiddie-porn,
>> rather than (for example) evidence of fraud.

As far as I can see, one of the sections details the *extra* precautions 
required for paedophile images [notwithstanding the impending 
considerable changes in this area]. All of the rest of the booklet is 
generic.

>> The section on disclosing the
>> data to "the defence" does not have the slight recognition that discs may
>> also include information vital to the survival of a business (which in the
>> case of a fraud investigation is quite likely).

This is always the problem when computers are the crime scene. At least 
the BTP return the railways to their users within a few days. It's one 
of the main reasons that private industry is wary of reporting "white 
collar" computer crime, and is a significant hidden public policy issue. 
Perhaps more people should factor this into their disaster recovery 
plans (although that won't help much if the police also seize the backup 
tapes).

>I note that in the diagram on page 40 the Monitor, Keyboard and mouse,
>All leads (including power cables) are marked as items that should be
>grabbed. There is none of the discussion that accompanies these items
(Continue reading)

Permalink | Reply | 90 comments |
headers
Derek Fawcus | 1 Oct 2003 13:30
Picon
Favicon

Re: Fw: New UK evidence guidelines

On Wed, Oct 01, 2003 at 11:57:08AM +0100, Roland Perry wrote:
> In article <3F7AAC59.22427.B589C9 <at> localhost>, David Hansen 
> <davidh@...> writes
> 
> >I'm fascinated by the
> >concept of monitors, keyboards, mice and power leads that store
> >information or are so non-standard that they are needed to re-construct
> >the system. Perhaps someone could enlighten me?
> 
> The issue here is being able to operate the PC. Many computers have 
> "standard" keyboards and mice. But not all of them. And plod would 
> probably prefer that Windows didn't start installing a new screen driver 
> the moment it was switched on with a different monitor.

Surely this is bollocks.

It states one is to remove the power from a PC so that it can't perform a
controlled shutdown,  and one is not to switch on a switched off PC.

Similarly one wouldn't want to try and operate the PC when it's being
examined.  That has no forensic value (that I can see) and will contaminate
the data/evidence.

i.e. you should remove the disk's,  snapshot them (two copies I guess),
and examine one of the copies from within a controlled known environment
- certainly not from within the original PC.

The whole idea of needing to operate the seized PC seem spurious,  and
designed to deprive suspects of their equipment for reasons of spite.
(Continue reading)

Permalink | Reply | 12 comments |
headers
Dave Howe | 1 Oct 2003 13:56
Picon
Favicon

Re: Fw: New UK evidence guidelines

> S20 Extension of Powers of Seizure to Computerised
> Information
> Details the power for requiring information held on a computer
> to be produced in a form in which it can be taken away and in
> which it is visible and legible.
That could come in handy as leverage - when you consider that even at
flyspeck 4, the contents of a zip-archived text file the same size as a
floppy would cover a few hundred sheets of A4. Requiring a hex dump of
half a gig would be enough to bankrupt most businesses in printing costs
alone :)
Permalink | Reply | 3 comments |
headers
Roland Perry | 1 Oct 2003 14:01
Picon
Picon

Re: Fw: New UK evidence guidelines

In article <20031001123019.C12733@...>, Derek
Fawcus 
<dfawcus@...> writes
>you should remove the disk's,  snapshot them (two copies I guess),
>and examine one of the copies from within a controlled known environment
>- certainly not from within the original PC.

The guide says this is not possible "in a minority of cases".

>The whole idea of needing to operate the seized PC seem spurious,  and
>designed to deprive suspects of their equipment for reasons of spite.

Whatever the reason (and I don't accept "spite"), it is the norm to keep 
evidence sealed away for the duration of the trial. You are claming an 
exemption that's not far away from "tools of the trade". Perhaps a 
solicitor can offer an opinion on whether that's ever likely to result 
in computer evidence being returned early.
--

-- 
Roland Perry
Permalink | Reply | 10 comments |

Gmane