0

Given the hypothetical, you have digital evidence that state actors want to delete. Assuming two scenarios

Scenario #1 - The state actors are not the agencies themselves, but bad actors within the agencies that have access to the tools. This eliminates the risk of warrants and a national security letter. Includes advanced spyware capabilities and arbitrary access to any online account.

Scenario #2 - This scenario includes a risk of warrants and a national security letter.

Adding some details.... Your adversary is vaguely US based. You are in China and able to move freely and buy any electronic equipment available in a normal electronics store. You also have funds and motivation to do so. New laptops, external hard drives, flash drives, cell phone, new sim cards, etc. The file was deleted from a linux laptop that is clearly infected with spyware, so you are certain that your former primary device is infected. You don't know the timeline for receiving the spyware, but you may have offline backups on 2TB external HDD in a few different formats. It is possible that the flash drives are also infected with the spyware. It is also possible to access an arbitrary wifi point in the city you are in. The files would be a 500MB video, 300 images, and several large xml files. Totaling less than 2GB.

How to move the file safely from an offline backup on potentially infected drives to an cloud based location that will guarantee the existence of the files for potentially bringing a legal case in American courts? Assuming that you may need to present some of the files as evidence to initialize the case, so it does need to make it somewhere you can show people remotely.

2 Answers 2

1

What about the good old DVD? Might have gone out of fashion nowadays but is has more than enough space to hold 2GB of data and it is downright impossible to delete data from it without physical access (a.k.a physically destroying the disc). Spread multiple discs over multiple locations to lower that risk.

Upload DVD content from any arbitrary PC to the cloud provider of choice. Ideally, the PC used should have no prior connection to you, e.g. public library (if they have DVD readers still).

The steps in your own answer won't stop nation-state actors in my opinion (and for Scenario #1 it is overkill)

E.g. step 2 "Find a computer technician and request to create a new bootable drive from one of the flash drives". This will likely not be done while you look but will be a 'come back tomorrow' scenario. Whether being in China is enough to prevent agency interference with that installation depends on how determined said agency is to remove the data.

Of course, if the determination is high enough you might just be 'convinced', e.g. during your step 6.

1
  • I like DVDs. It definitely solves the permanence problem nicely. As long as the disk isn't destroyed, the data will exist. I will try to find one. As for the technician thing, at this point in my life, I am less worried about China than the US based people that have already committed crimes and are seeking to cover it up. It is a fact of life that when you are in a country the state will seek to observe you
    – kjsnk
    Jan 22, 2023 at 1:45
0

Answering my own question as a starting point

  1. Buy a new laptop, 4 flash drives
  2. Find a computer technician and request to create a new bootable drive from one of the flash drives
  3. For the following steps, drive to a remote location without any wifi signal and keep computer fully offline.
  4. Install linux onto the new laptop
  5. Access the backups and look for files while staying offline
  6. When finding the files, move the files onto the multiple of the flash drives. Each drive can be an attempt to get the data online.

(I honestly can't think of a way to keep a file undeleted and accessible online. The process to upload 2GB on a public wifi could take hours. While you can move safely, you may be followed and found quickly when you go online.)

  1. Using the new laptop, attempt to upload. Record the computer with a phone while the upload is ongoing to establish evidence, and uploading to as many cloud providers as I can. Protonmail's drive and github are the primary choices.
  2. Give flash drive to computer technician and request they create a new account and upload the files.
3
  • Forensic data preservation usually require the original disk to remain unused as soon as a complete block level image has been dumped from it. - Both for data safety and to corroborate authenticity of the disk image. Every timestamp of every file helps alot with that. Never work on the originals! write protected disk images should be used. You could archive the files and have the archival software split the output into more manageable chunks so you could upload a few(or one) at any time.
    – svin83
    Jan 21, 2023 at 11:27
  • Starting from step 5, remove the original disk from the affected laptop. Attach it read-only to the new laptop and make a block-level copy of the disk. Put the original disk in a secure location and use only the copy for analysis. Looking at backups may be helpful but you should also consider them as comprised. If these are state actors, can you assume that cloud archives are invulnerable?
    – doneal24
    Jan 21, 2023 at 17:06
  • I think this is simply creating an image with dd? I had already done some work with the disk before realizing how many files had been deleted. I can create an image using a live disk. I assume that some cloud storage are more protected against certain actors than others.
    – kjsnk
    Jan 22, 2023 at 1:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .