I am quite certain that the inquiry will be satisfied so long as the data
state of the drive remains unchanged. It can, for example, come up to speed
and revolve. Bits can be read. The imparative is that no bit be written or
changed in any way. Furthermore, the forensic expert needs to be certain
that the data state of the drive is unchanged after any event or
intervention.
(Ooooh. This problem will be much more fun when we get storage media for
qbits.)
On Tuesday 2003-08-05 04:48, Mike Starke wrote:
> Somehow I think this thread does not understand the
> author's dilema. It is important NO CHANGES occur
> during any forensics....dd, cat, cp, mount, unmount,
> another drive, etc, etc...it all does not matter
> in a forensics case.
>
> Maybe he may be facing the (I'll get this spelling wrong, I'm sure)
> Heisenburg Uncertainty Principle?
>
> v/r
> -mike
> ---------------------------------------------------
> PLUG-discuss mailing list - PLUG-discuss@lists.plug.phoenix.az.us
> To subscribe, unsubscribe, or to change you mail settings:
> http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss
(text/plain)