Also hearsay personal experience but a friend of a friend had his house raided by the FBI and all his computer equipment impounded. When he got it all back they told him his hard drives were empty or unformatted. He had them all formatted as ZFS...
I'm unsure as to how to read this; are you saying because they were ZFS, the FBI couldn't read them and because of their lack of expertise, assumed they were empty?
Or that they formatted them before returning them?
I read it as his drives were formatted as ZFS and the FBI couldn't read them because of their incompetence (probably only thinking to try and read them with Windows as FAT32 or NTFS.
Judging by how Windows, when presented with an unknown FS, acts as if the disk were unformatted and immediately offers to format it, my guess would be both...
(And by "unknown" I mean of course "anything that is not FAT* or NTFS"...)
Johnny clubfingers 5-0 clicks Ok, and destroys "evidence" for being a total idiot... I take it he/she was hungover during that 2 hours of computer forensics in the academy. For crooks, this is good news; for stopping potential future victims, this isn't good, and misapplied to innocent/MPAA/RIAA enforcement, it's destructive and lowers LE credibility.
The moral of the story is for individuals, whom should implictly fear government overreach no matter whom is in office, one has to back their shit up and make it SWAT-proof, even if that means running several TahoeLAFS boxes in countries like Switzerland, because running a server (physical or Linode) or just replicating data to a friend's server just doesn't cut it and never did.
I wouldn't read too much into this. SOP for most police forces is a tiered approach to seized drives. They plug it into a windows machine and see what's what. If that doesn't get the immediate results they have to hand it to the professional data recovery people. Even a cursory forensic examination of a drive starts at 1,000$ and may yield nothing if encrypted. With a small pile of drives to look at, they probably didn't bother trying after spotting it wasn't going to be plug-and-play.
Why? It's people following a forensics script/program which looks for Windows partitions. There aren't a huge number of people who understand this kind of thing and most of them are able to work at places where they're paid much better than the FBI.
the forensics programs (EnCase, FTK) have a lot of problems but they don't assume that the drive is "windows partitions" though it's possible that they don't deal with ZFS.
you would think that national level stuff would have people take more care, but if you're dealing with state or local police, they will have someone who has taken an 8 hours Encase or FTK class driving a GUI to gather evidence and if the tool doesn't support it, there's effectively no evidence to gather.
Yeah, I once had to explain to an officer what a known_hosts file is so they could send MLAT requests and release me from jail without risking that I would wipe (the already automatically wiped) servers myself when I got out.
You're going to go through the trouble to get a warrant for a raid and then apply such gross incompetence to the seized evidence? When was the last time you pulled a hard drive out of a functioning machine, found it to be empty and didn't immediately think, "huh, that's odd" before throwing it in the trash.
I guess it depends on whether the hard drives were the target of the raid or just a collateral of "grab anything that may be useful" mindset. They could already have gathered enough evidence without needing to waste time/money on digital forensics. Hard to say without specifics.
The fact that they went out of their way to assure him that his own hard drives were empty reeks of manipulation.
Slightly off topic, but it really isn't hard to find partitions. Just run the various software to scan and that's it. I've done it at least twice when accidentally erasing a windows partition (once with fdisk when I misread the output, and at that time I didn't even know what a partition is).
> Also hearsay personal experience but a friend of a friend had his house raided by the FBI and all his computer equipment impounded. When he got it all back they told him his hard drives were empty or unformatted. He had them all formatted as ZFS...
I had imagined that computer forensics "experts" would make this mistake somewhere at some point, but I did not think I would actually hear that it had happened. Thanks for the affirmation, even if it is just hearsay.
It makes me curious about what goofs were made with the IRS hard drives that had "crashed" according to forensics "experts".
