Re: P2V - Live Forensics

advising in general, alteration of data does not preclude the 
evidentiary use of the image.

perhaps this will be useful to both your ex ante and ex post strategies:
http://www.lawtechjournal.com/articles/2005/05_051201_Kenneally.pdf

interested to hear how events transpire.

/erin

-- 
Erin E. Kenneally, M.F.S., J.D.
CEO, Founder
eLCHEMY, Inc.
8677 Villa La Jolla Dr., #1133
La Jolla, CA  92037
www.elchemy.org



On 2/15/11 7:13 AM, [email protected] wrote:
> Ladies, Gentlemen, and otherwise:
>
> I have a situation whereby I need to obtain an image of an individual's laptop suitable for potential prosecution in a US court; however, I only have a limited window in which to grab the image, and was looking for alternatives in order to not "spook" the poor guy or his co-workers who would no doubt tell him about me, as I go into his office and randomly image his drive!
>
>
> I thought about using P2V (Physical to Virtual), but realize that such software does make some steps to alter the system and thus may have court challenges. Is there possibility such could be explained in court, or perhaps md5 hash of his files(not the disk image) taken while online and then compared to a virtual image of sorts.
>
> Please advise, and I'm thinking of sending the winning submission a beer or two or some other minor token of appreciation.
>
>
>
>
> -----------------------------------------------------------------
> Certify Software Integrity - thawte Code Signing Certificates
> This guide will show you how Code Signing Certificates are used to secure code that can be downloaded from the Internet. You will also learn how these certificates operate with different software platforms.
> http://www.dinclinx.com/Redirect.aspx?36;5000;25;1371;0;2;946;005be7f5c872ea1f
>


This email message is for the sole use of the intended recipient[s] and
may contain privileged information.  Any unauthorized review, use,
disclosure or distribution is prohibited.  If you are not the intended
recipient, please contact the sender by phone or reply email and destroy
all copies of the original message.



-----------------------------------------------------------------
Certify Software Integrity - thawte Code Signing Certificates
This guide will show you how Code Signing Certificates are used to secure code that can be downloaded from the Internet. You will also learn how these certificates operate with different software platforms.
http://www.dinclinx.com/Redirect.aspx?36;5000;25;1371;0;2;946;005be7f5c872ea1f