Hacker News new | past | comments | ask | show | jobs | submit login

Hashes of disk images are definitely recorded and stored as part of forensics evidence trail. Being able to prove that the files you got came from the hard drive of the suspect - essentially a physical chain of custody until the image is taken, recording what was taken, and a digital chain with hashes/signatures starting from the imaging.

The hash verification you describe happens (without independent oversight but enugh to protect against a single bribed/malicious officer) and it does protect from post-factum altering of any digital evidence; you try to do the early (physical) parts quickly, the majority of analysis work comes after you have the images and their hashes - but everything from that analysis can reproduced from the verified images if it's disputed.




Consider applying for YC's Spring batch! Applications are open till Feb 11.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: