3441
posted ago by ChuckedBeef ago by ChuckedBeef +3441 / -0

This could be important in determining the timeline of events; to see if the physical state of the drives match up with the data on the machines. Hard drives degrade over time naturally. They lose their charge or otherwise break down over time. I'm thinking if you looked really closely (like down to the molecular level) you could tell if the data was written on election night or if it was written over with falsified data.

You can not do this with an image copy of the original drives.

Comments (78)
sorted by:
You're viewing a single comment thread. View all comments, or full comment thread.
14
Shit_tyrone 14 points ago +14 / -0

What I'm saying though is the accepted method for examining a hard drive, forensically, is to create a forensic image of the drive and examine that. You never examine the actual drive directly as it alters the evidence. It's quite easy to obtain deleted data off of a forensic image of a drive. I've done it a lot. Maybe I'm not understanding what he was saying though.

8
orc_lives_matter 8 points ago +9 / -1

Yeah, this person clearly didn't do forensics or eDiscovery themselves.