RE: Two Windows questions

Harlan,

You bring up an interesting point...

"a definitive resource...something that, say, a customer could use if
any of that customer's employees had to go to court and testify."

When I go to court and testify, I typically rely on 3 things:

1. Results of my test
2. Sworm affadavits
3. Generally accepted industry practices/knowledge

I would not necessarily consider a vendor, web page, book, etc. as a
definitive source that I would base my testimony on unless it falls into
one of the 3 categories above.

I think you might be forced to create an application with which you can
access the structure in question and test your results.

Greg Kelley, EnCE
Vestige Digital Investigations
Computer Forensics | Electronic Discovery | Corporate Surety
46 Public Square, Ste 220
Medina, OH 44256
(330)721-1205 x5432
(330)721-1206 Fax
http://www.vestigeltd.com


-----Original Message-----
From: Harlan Carvey [mailto:keydet89@yahoo.com] 
Sent: Wednesday, October 05, 2005 1:18 PM
To: Thomas Jones; forensics@securityfocus.com
Subject: Re: Two Windows questions


Thomas,

Thanks for your response.

However, I was specifically asking for a definitive resource...something
that, say, a customer could use if any of that customer's employees had
to go to court and testify.

While I greatly appreciate your response, and the
validation you've provided to other sources I've read,
it doesn't really provide what I'm looking for...

thanks again,

Harlan



------------------------------------------
Harlan Carvey, CISSP
"Windows Forensics and Incident Recovery" http://www.windows-ir.com
http://windowsir.blogspot.com
------------------------------------------