Wrong. Evidence of making a copy will be found on the original hard drive.
-
-
- 2 more replies
New conversation -
-
-
Typically a forensics tech removes the target drive and copies it. All testing is done on the copy to prevent disturbing the target and creating log entries. If they switched the drives it either an accident, intrusion, or planting evidence.
Thanks. Twitter will use this to make your timeline better. UndoUndo
-
-
-
You’re so right Sharyl. They were up to no good, plain and simple. Loved your latest book, THE SMEAR.
Thanks. Twitter will use this to make your timeline better. UndoUndo
-
-
-
Why would DOJ risk analyzing the original hard drive. If they damage or accidentally delete evidence the defense will move for dismissal.
Thanks. Twitter will use this to make your timeline better. UndoUndo
-
-
-
That actually is the proper protocol: Create a forensic image of the original hard drive, which is a completely non-destructive process, then conduct all examination on the image. Sounds like that was not the approach here, however. Sigh.
Thanks. Twitter will use this to make your timeline better. UndoUndo
-
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.