I hope it’s okay to link to this forensic computer blog site?
http://whereismydata.wordpress.com/2009/06/27/forensic-encase-verification-md5-and-other-myths/
As a Thanksgiving Scrooge (but I LOVE Christmas!), I spent this afternoon trying to get a “feel” for what goofs COULD have happened when TA’s hard drive was first mirrored using EnCase (as asserted by Bryan Neumeister during the “porngate” evidentiary hearing). The article above is extremely informative.
An excerpt:
“If the hard drive is not working correctly, or the cables are damaged, or the pins are not aligned correctly, or any of a host of other reasons then the hard drive will not image correctly. 99% of the time this error will be a very obvious error, …
Sometimes, very rarely but sometimes, the drive will image, but it will be producing junk data, or “skewed” data. …
In the worst case scenario this means that data will be imaged, Encase will read it, write it, and then verify it. The person conducting the image will then leave the scene and state, without intending to lie, that they have a 100% accurate image of the data. When in actual fact they have junk. This can, and does lead to all sorts of problems.”
If you’re interested, go read the entire post. The author gives an example where accusations were made that a drive had been wiped to hide evidence. Turns out it was a bad “mirror.”
What caught my eye was, “
… or the pins are not aligned correctly.” IIRC, BN claimed the pins on TA’s HD were bent and he had to repair them. This article also says the EnCase ‘verification’ process does not verify the mirror against the original hard drive.
Hum. Heck if I know! It’s sad I’d rather research this than eat turkey and watch football, isn’t it?