On Friday 27 May 2005 06:21, Steven McLeod wrote:
SMART Anti-Forensics
This paper highlights an oversight in the current industry best practice
procedure for forensically duplicating a hard disk. A discussion is
provided which demonstrates that although the forensic duplication process
may not directly modify data on the evidence hard disk, a hard disk will
usually modify itself during the forensic duplication process.
The paper highlights some consequences, for example that an attacker who
has compromised the computer containing the hard disk can programmatically
detect that the hard disk has been forensically duplicated, or otherwise
powered on and accessed via a mechanism other than via the operating system
installed on the hard disk.
Suggestions are provided to help minimise the changes made to the hard disk
during the forensic duplication process. These suggestions minimise the
likelihood that an attacker will notice the system administrator or
forensic analyst performing an investigation of the suspected compromised
computer.
http://members.ozemail.com.au/~steven.mcleod/SMART_Anti_Forensics.pdf
Interesting...
Heisenberg's Uncertainty Principle applied to hard disks.
("You cannot measure/observe something without changing that which you are
measuring/observing.")
Given that, the act of observing the disk changes the disk. The act of
observing the change changes the change. The act of observing _that_ changes
changes _that_ change. (ad infinitum...) Therefore, there is no method by
which you can observe a disk without leaving some trace.
Then, if the change(s) is/are mitigated sufficiently, is the final result
change measurable?
Yes, it's very interesting, but I'm starting to get a headache...
--
Clinton E. Troutman
CeTro
Independent Computer Consultant for Home,
Home Office, and Small Business in Fort Worth, Texas
http://cetro.dnsalias.org/
-----------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management
and tracking system please see: http://aris.securityfocus.com
