RE: Tools accepted by the courts

I wouldn't be so hung up on the choice of tool as the means to validate
it for court.  Given the wide variety of carving tools that have already
witheld courtroom scrutiny, I'd question the choice to "roll your own"
tool instead of using an already courtroom-accepted one.  This stuff is
hard enough, why make it more difficult?

My 2 cents,

Tobin

___________________________
Tobin Craig, MRSC, CISSP, SCERS, EnCE
IT Forensic Director, Computer Crimes and Forensics
Department of Veterans Affairs
Office of Inspector General
801 I Street NW
Washington DC 20001
 
Tel: 202 565 7702
Fax: 202 565 7630
___________________________

-----Original Message-----
From: Robert Larson [mailto:robert.j.larson@gmail.com] 
Sent: Wednesday, June 15, 2005 5:15 PM
To: forensics@securityfocus.com
Subject: Tools accepted by the courts

I'm involved in a discussion with some co-workers concerning forensic
tools and the fact that evidence acquired with some tools is going to
be more accepted in court than others.

Has anyone encountered a situation where evidence extracted with a
particular tool was not accepted?

For example, an examiner using a "homemade" script to carve
information from unallocated space versus a commercial carving tool.

Robert