Slashdot Log In
Vista Makes Forensic PC Exam Easier for Lawyers
Posted by
Zonk
on Sat Jul 14, 2007 07:07 AM
from the can-i-introduce-you-to-some-nice-encryption dept.
from the can-i-introduce-you-to-some-nice-encryption dept.
Katharine writes "Jason Krause, a legal affairs writer for the American Bar Association's 'ABA Journal' reports in the July issue that Windows Vista will be a boon for those looking for forensic evidence of wrongdoing on defendants' PC's and a nightmare for defendants who hoped their past computer activities would not be revealed. Krause quotes attorney R. Lee Barrett, 'From a [legal] defense perspective, [Vista] scares me to death. One of the things I have a hard time educating my clients on is the volume of data that's now discoverable.' This is primarily attributable to Shadow Copy, TxF and Instant Search."
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Another Use for VMWare (Score:4, Interesting)
Another reason I'm sticking with XP.
Re:Another Use for VMWare (Score:5, Funny)
Mwa aha hah.
Parent
Re:Another Use for VMWare (Score:5, Funny)
Parent
Re:Another Use for VMWare (Score:5, Funny)
Parent
Obligatory (Score:5, Funny)
Red bead attempting to slide right.
Cancel or Allow?
Parent
Re:Another Use for VMWare (Score:5, Insightful)
Parent
Re:Another Use for VMWare (Score:4, Informative)
Parent
Re:Another Use for VMWare (Score:4, Informative)
Parent
Re:Another Use for VMWare (Score:4, Interesting)
While they will not be able to prove they contain the suspect data, plausible deniability becomes less plausible.
Much of forensics is being able to correlate the existence of a known file on a filesystem against other evidence, such as another computer that did not employ the protective measures. The point of the article is that TrueCrypt is not enough (and really hasn't been due to the number of artifacts that XP already leaves)- you will have to take a number of measures to cover your tracks which can be quite time intensive.
TrueCrypt is a wonderful product. I use it myself to encrypt corporate data. However, every now and then I play with EnCase on my laptop to see what is left behind and it makes me even more paranoid when I have nothing to hide.
Parent
Re:Another Use for VMWare (Score:4, Informative)
Parent
Re:Another Use for VMWare (Score:5, Insightful)
Personally, if I had any really bad shit on my system I'd probably just have a buried NAS box somewhere on (or even off) the premises. Probably would be best if there were a hardwired connection to it: wouldn't want the Feds to use a sniffer and figure out you have the thing. Oh sure, if they really wanted to they could find it, but why make it easy? Hide the cabling and hide the point at which it attaches to the rest of your LAN. Probably want the box to run a watchdog task that will disable it completely if it detects that specific machines on the LAN have disappeared (as in "having been confiscated".) That way, even if someone performing forensics notices that there was another network drive mapped, by the time they get back to search for another machine it won't be detectable unless they start tearing down your walls.
Of course, you'd be a lot safer not having that bad shit in the first place.
Parent
Re:Another Use for VMWare (Score:5, Insightful)
Parent
It's not the function that's the problem (Score:5, Interesting)
All potentially damaging (ie, all) data should be written to an encrypted store in such a way that recovering it from a lost/stolen/seized machine is hard to impossible without assistance from the owner. That's just good design practice in an environment where there is more than enough computing power available.
I'm aware that there are places where you have to hand your keys over to law enforcement... with which I have no real problem provided the due process of law is followed. But at least properly managed/segmented encryption can prevent a fishing trip. And in the worst case if you were being falsely accused of something really awful then you might decide that the penalties for not handing over the keys were less severe than the penalties for having the data available. At least you would get the choice.
Re:It's not the function that's the problem (Score:5, Informative)
Parent
Re:It's not the function that's the problem (Score:4, Interesting)
Parent
Re:It's not the function that's the problem (Score:4, Funny)
In the US at least is the 5th Amendment still part of the constitution? If you tell the court that giving out the password is like testifying against yourself, does the 5th still protect the accused? Did it ever really work that way?
Parent
How is this possible? I reinstall Win every week (Score:5, Funny)
This habit was developed during Win95, WinSE, WinXP SP1, and WinVista Beta
What? There was evidence there? Ooops, sorry... my standard operating procedure wipes the disk once a week.
Message to criminals: Use Linux (Score:5, Funny)
Then: you are using Linux, what have you got to hide ?
The next step is: Only criminals use Linux
I have just realised: I am typing this at a Linux box. I had better go down and turn myself in at the cop shop.
Re:Just some more... (Score:4, Informative)
Because there aren't any. Seriously. I've been using Vista (Business) all summer; I should know. Yes, it has fancy GPU-accelerated graphics. But they don't do me any good because they suck my battery life (it's the difference between lasting through a lecture worth of note-taking in OneNote, or not). Yes, it has better support for Tablet PCs... but only ever so slightly better. Other than that, the only differences I notice between it and XP are all negative: shitty or missing drivers, annoying bugs, infuriating UAC (if it asked me to confirm an action once, it'd be okay. But it often asks me twice: once by the app, and once by the OS). It's so bad that -- even though Tablet PC users should have the most improved experience in Vista of any group -- I'm switching either back to XP or to Ubuntu once the semester is over.
Parent
Re:Just some more... (Score:5, Insightful)
Right, karma to burn. How the hell is this "Informative"? "+5 Groupthink", or "+5 Telling me what I want to hear", sure. But there is no information here at all - Vista does have some "good features", regardless of what some people think. Answering your points specifically
1) Eye Candy: If you don't like it, turn it off.
2) Missing or shitting drivers: I have not noticed, nor do I know anyone who has noticed, Vista not supporting hardware that XP supported. Shitty drivers, well, this is a more reasonable concern, but it applies in my experience only to graphics, and then only to people for whom a 5-10% drop in performance (until nVidia get their ass in gear) is a "shitty problem". It's *vastly* better than Linux in this regard.
3) UAC: You're doing it wrong. I have not seen a UAC prompt that wasn't because I launched an app that required admin priviledges for weeks. Sure, when you're setting up the system, you get them a lot - much like in Linux, where you prefix half the first weeks commands with "sudo". After that, if you're seeing it more than once or twice a week, you need to seriously look at what kinds of software you're running that constantly need "root" access.
As to a sample of "good points"
1) New graphics and sound stack is vastly superior - I can set sound volume on a per application basis, automatically, using an simple interface built right in. No more stupid Flash in Firefox blaring away at 80db when I'm listening to music via iTunes.
2) Integrated search - Works as well as Spotlight for me, and I thought Spotlight was the best thing since sliced bread.
3) UAC - Yes, in my eyes, this is a good thing (and the biggest step forward in Vista). Windows no longer uses an "Admin for everything" model, something most people have been crying out for it do have for years.
Does it add anything *huge* over OS X, or even XP? No. Since when has a new OS release added anything world changing? They have been, since OS X 10.0, Linux 2 and Windows 2000, incremental. Is the DRM stuff a bad route? Yes. Does Vista use too many resources? Well, the idle footprint over my OS X machine isn't significantly greater - I would say it *does* use a too much, but frankly, as my machine is fairly modern, I don't notice. In many operations, it's faster than XP.
Should we all move to desktop Ubuntu? I don't know - I use Linux on servers, but it's still not ready for desktops, in my eyes. A technically semi-literate friend installed it on his Laptop, as someone had preached too him, and it *mostly* worked - except sound, which was a huge pain in the ass, and even I (with years of Linux experience) couldn't make work. Mostly is not good enough (he bought an OS X laptop to replace it, and is very happy). When Linux sorts out these issues, and gets a decent suite of end user software (no, Openoffice is not good enough to be an Office replacement), I might consider putting friends and familiy onto it.
Is Vista the devil? No. It's no worse than XP, and has several significant features that make it better, much like XP over 2000.
Parent
Re:Just some more... (Score:5, Insightful)
As for privacy, to the extent that this sort of thing requires a legal order to hand over the information, I can't really see that it's an issue of privacy. If it is accepted that preserving the rule of law sometimes requires surrendering information that would otherwise be considered private, then that is the end of the matter: the information in such instances has ceased to be private.
If a PC is stolen, that is another matter, but in such cases, encryption can be used to prevent private data falling into the hands of thieves. This arguably makes a PC with appropriate encryption enabled safer than paper records.
Parent
Re:Just some more... (Score:5, Insightful)
The reality is that most users like the ability to index and search their data, and to recover previous versions of a file, as well as the better reliability offered by transactional file operations. In the general case of a non-criminal user, these features provide far greater benefits than the potential harm of having their activities more effectively analysed by law enforcement officials, in the highly improbable case of a legal order to hand over their data.
Parent
Re:Just some more... (Score:5, Informative)
The DRM only applies to (shock) DRM-enabled content that you buy. It was a choice between layering in the DRM or not allowing people to view that content on the PC at all, a choice enforced by the big media companies who own the content. Yes, Microsoft could have stood up and said no, and in doing so crippled Blu-ray and HD-DVD functionality in Vista. Surprisingly, despite Slashdot's wanton hatred of it (I don't particularly care for it either), very few consumers care about DRM, so they went ahead and gave people access to that content.
For security, two of your articles were published before Vista was even released to the public, and the only relevant link just explains that if an installer requests admin mode, you can give it admin mode and it can do what it likes, citing a 'malicious freeware Tetris installer'. The article fails to mention that this happens in the same way for both OS X and Linux, instead of trying to be useful and educate readers on using their common sense when downloading software.
Saying 'security has to be disabled for Vista to be useful' is just plain bullcrap. Turning off UAC merely stops giving you the choice to run programs as admin. UAC doesn't prevent any programs from running unless you say you don't want it to run. You may want to clarify that point.
Expense (as always) is in the eye of the beholder (I paid my £70 and have never regretted it), and considering hard drive costs are down to 30-40 cents a Gigabyte, then the extra space costs are inconsequential. As most people only get a new OS with a new computer they will probably never even concern themselves with this point.
You didn't provide links to prove 'clunky' or 'privacy-invading', which doesn't surprise me.
The article you linked to for 'insecure' says "Microsoft, Kaspersky and Sophos think that you don't need kernel access to keep it safe from viruses, but Symantec and McAfee don't agree. They're bigger than the other two vendors and Microsoft is biased so they must be right".
Your final link takes the cake because it links to a list of blogs and none of them mention Microsoft at all.
So, why would you want to use Vista? You wouldn't. Nothing to do with usability, or features, but because you obviously prefer using Linux to the extent that you're prepared to parrot the FSF line without actually understanding it.
My plus points with Vista include:
- Playing MP3s and DVDs without breaking the law (fair law or not, still a law)
- Being able to play the latest games without needing a degree in Computer Science
- Being able to perform 99% of my system tasks without referring to the CLI
Parent
Re:Not to worry (Score:4, Insightful)
Parent
Re:Computer OS (Score:5, Insightful)
Parent