Hard Drive Forensics Question



I'm trying to answer a question for a customer regarding historical file copying on his personal Mac computer. I'm not sure if this is the right list to post this to; please redirect me if I should be asking this elsewhere.

Equipment Details:
Powerbook G4 with a 75 GB hard drive - purchased 3 or 4 years ago.
Samsung Pleomax USB power drive.

Background:
His former employer believes that documents on this external device might have been copied to his personal Powerbook. They are demanding that he allow them to have the drive imaged so that they can determine prove whether he did or did not copy these files to his home computer.

The weekend before he left his former employer he opened several documents on this external device using MS Office and maneuvered others using Finder. According to my customer all files opened were on USB drive and then saved back to it.

He left the company six months ago. When he left his former employer six months ago he returned the Pleomax drive to them.

Question:
My opinion is that looking at an image of his personal computer's hard drive will not prove conclusively whether or not he saved files from the company's Pleomax to his personal computer. Can someone either validate that or indicate why the image would provide that information?

He is prepared to allow his personal computer's hard drive to be imaged. I am concerned that doing so will breach his own privacy since he stores personal finance, correspondence, etc. on it.

Thanks so much.

Matt



Relevant Pages

  • Re: Hard Drive Forensics Question
    ... Samsung Pleomax USB power drive. ... The weekend before he left his former employer he opened several documents ... on this external device using MS Office and maneuvered others using Finder. ... will not prove conclusively whether or not he saved files from the company's ...
    (Security-Basics)
  • Re: Hard Drive Forensics Question
    ... The weekend before he left his former employer he opened several documents on this external device using MS Office and maneuvered others using Finder. ... When he left his former employer six months ago he returned the Pleomax drive to them. ... My opinion is that looking at an image of his personal computer's hard drive will not prove conclusively whether or not he saved files from the company's Pleomax to his personal computer. ...
    (Security-Basics)
  • Re: Hard Drive Forensics Question
    ... Could it be definitively proved that he saved files from the external ... laptop present on the USB drive. ... former employer w/o a subpoena, warrant, or other court mandate. ... Samsung Pleomax USB power drive. ...
    (Security-Basics)
  • Re: OT: Any BCIT EET Grads Here?
    ... It's apparently largely the power of good communication/relationship with the customer that -- at least to date -- has prevented that: You get to a point of trust where the customer accepts that if you say something really was ill-defined and much harder than anticipated, it really was, and you're not just out digging for gold. ... It is perhaps a little ironic that government contracts are considered so "juicy" when, on the surface, with their fixed price/schedule, they would seem to be a turn-off for many consultants. ... Even in the case at a former employer that I mentioned to Jon, where the well-known multi-national company threatened to sue but finally chose not to, while arguably it counted as one bridge burned, the company did go on to much larger, more successful things. ...
    (sci.electronics.design)
  • Re: Hard Drive Forensics Question
    ... The premise for requesting an image of the laptop sounds very speculative indeed. ... former employer w/o a subpoena, warrant, or other court mandate. ... Samsung Pleomax USB power drive. ... will not prove conclusively whether or not he saved files from the company's ...
    (Security-Basics)