3441
posted ago by ChuckedBeef ago by ChuckedBeef +3441 / -0

This could be important in determining the timeline of events; to see if the physical state of the drives match up with the data on the machines. Hard drives degrade over time naturally. They lose their charge or otherwise break down over time. I'm thinking if you looked really closely (like down to the molecular level) you could tell if the data was written on election night or if it was written over with falsified data.

You can not do this with an image copy of the original drives.

Comments (78)
sorted by:
You're viewing a single comment thread. View all comments, or full comment thread.
27
Shit_tyrone 27 points ago +27 / -0

Technically, if you're looking for data, the original drives will be evidence. If you just dig through them you're altering the evidence and a defense attorney will have a field day. The correct way to do it is to make a forensic image of the drive and use that. This way your evidence doesn't get messed up (time stamps, etc). If it's imaged properly it is fine. I used to work with forensic computers.