Re: [Full-disclosure] FBI Says Data on VA Laptop Not Accessed

Cardoso schrieb:
I don't think they can detect some highly advanced techniques like using
Partition Magic to mirror the disk..


As long as they didn't know the exact amount of hours the hdd was running before it got stolen, i don't see any way to determine if the data was copied away by some sector-by-sector copy-tool like Ghost or True Image. Afaik you can see very clearly how many hours a drive has run yet. If that data was the same as before the laptop was stolen, then the disk didn't run. If the data differs, the drive did run.
I am not sure if one could alter that data.
On the other hand... i don't think that anyone knows that data all the time, so they couldn't have known the running-time of the disk, unless they knew the hdd was about to be stolen.

(pardon my bad english)

Michael

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Relevant Pages

  • Re: My miserable experiences in testing and "removing" the "Acronis [alleged] True Image 11 Home" Ba
    ... specific interest is with reference to a disk imaging program (as opposed to ... a disk cloning program), I would assume that your *basic* objective is ... source HDD so that if the recipient of the clone is an internal HDD, ... large-capacity hard drives we do not feel this advantage is of major import ...
    (microsoft.public.windowsxp.general)
  • Re: need a good backup method or program
    ... I have gone with the Casper 4.0 option, it is very user friendly and gives me exactly ... I'm assuming you've had little or no experience with disk imaging/disk ... that cloned HDD will be bootable and its data immediately accessible, ... Note, however, that should the recipient of the clone be a USB or Firewire ...
    (microsoft.public.windowsxp.general)
  • Re: OT-True Image Backup
    ... Make sure the USB drives file system is NTFS and not FAT32.. ... Jaymon is correct in that the disk image you create and save to the D: ... partition of your USB external HDD will have no effect on the other ... Step-by-Step Instructions for Using the Acronis True Image Program to Backup ...
    (microsoft.public.windowsxp.help_and_support)
  • Re: Sticky Computer Problem:
    ... I can't recommend any of the preassembled external drives. ... can take to back up the entire contents of one's day-to-day working HDD, ... Creating disk images ... can be either a USB or Firewire or SATA external HDD. ...
    (microsoft.public.windowsxp.general)
  • Re: need a good backup method or program
    ... I then scheduled a daily backup at midnight with the PC being turned offf ... I have gone with the Casper 4.0 option, it is very user friendly and gives ... I'm assuming you've had little or no experience with disk imaging/disk ... copy of the HDD so that if the recipient of the "clone" is an internal ...
    (microsoft.public.windowsxp.general)