Submission + - Merely "cloaking" data may be incriminatin
n0g writes: In a recent submission to Bugtraq, Larry Gill of Guidance Software refutes (successfully or not, you decide) some bug reports for the forensic analysis product EnCase® Forensic Edition. The refutation is interesting, but one comment raises an important privacy issue: When talking about perps creating "loops" in NTFS directories to hide data, Gill says, "The purposeful hiding of data by the subject of an investigation is in itself important evidence and there are many scenarios where intentional data cloaking provides incriminating evidence, even if the perpetrator is successful in cloaking the data itself."
That begs the question, if one "cloaks" data by encrypting it, say, exactly what incriminating evidence does that provide? And how important is that evidence compared to the absence of anything else found that was incriminating? If you find an encrypted hard drive on my system, that doesn't mean there's pr0n in there, that's just to hold my bank records. No, seriously.
That begs the question, if one "cloaks" data by encrypting it, say, exactly what incriminating evidence does that provide? And how important is that evidence compared to the absence of anything else found that was incriminating? If you find an encrypted hard drive on my system, that doesn't mean there's pr0n in there, that's just to hold my bank records. No, seriously.
