I am quite certain that the inquiry will be satisfied so long as the data 
state of the drive remains unchanged.  It can, for example, come up to speed 
and revolve.  Bits can be read.  The imparative is that no bit be written or 
changed in any way.   Furthermore, the forensic expert needs to be certain 
that the data state of the drive is unchanged after any event or 
intervention.

(Ooooh.  This problem will be much more fun when we get storage media for 
qbits.) 

On Tuesday 2003-08-05 04:48, Mike Starke wrote:
> Somehow I think this thread does not understand the
> author's dilema. It is important NO CHANGES occur
> during any forensics....dd, cat, cp,  mount, unmount,
> another drive, etc, etc...it all does not matter
> in a forensics case.
>
> Maybe he may be facing the (I'll get this spelling wrong, I'm sure)
> Heisenburg Uncertainty Principle?
>
> v/r
> -mike
> ---------------------------------------------------
> PLUG-discuss mailing list - PLUG-discuss@lists.plug.phoenix.az.us
> To subscribe, unsubscribe, or to change  you mail settings:
> http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss