1

Introduction

3 computers were sealed and taken from a persons apartment. Investigators invited him to unseal the PCs, they were intact and they started the cloning process, however the hashes were just photographed by an expert without putting them into a document and giving it to the one who's being investigated, saying that they will invite him the next day to finish the paperwork, but after 4 days, he still hasn't been invited, meaning that all the devices has remained unsealed all these days.

All hard-drives were cloned using a write-blocking device, looks like this one.

Software that was/is used in investigations is FTK if I am not mistaken.

Question

How can investigators prove that the data on all the hard-drives were not modified during these 4 days, when the devices were unsealed and they had full access to them without the consent of the person who's being investigated?

|improve this question
  • I would say that they can't. – r00t Jul 30 '15 at 8:59
  • Investigations are often conducted without the consent of the person being investigated, it's the nature of law enforcement. What does that have to do with the question? – GdD Jul 30 '15 at 9:43
  • @GdD why would they seal the computers when they take it to investigations? What's the point of sealing them before investigations and then leave the originals unsealed during the investigations for 4-5 days. – rmagnum2002 Jul 30 '15 at 9:56
  • The hash values would change if anything was modified. Edited to add: In the US the subject would have a right to review the forensic investigation report, which would include the hashes of the original drives as well as the images pre and post investigation. – Becca D Jul 30 '15 at 13:24
  • 3
    At this point, the person under investigation has zero assurance (and no means to assure) that the data has not been manipulated since they were not provided the hashes. However, a court of justice will more than likely accept the testimony of a sworn civil servant who says the hashes provided for evidence were the same that were calculated at the time the drives were initially collected. What legal recourse there is, to address the fact that nobody (without an eidetic memory, and without bias favoring investigators) can corroborate this, will probably depend on your jurisdiction. – Iszi Jul 30 '15 at 14:02
2

in all practicality, producing the photograph of the acquisition hash and showing the new and old hashes match will satisfy almost everyone that the drive hasn't been tampered with.

However...

The most accurate answer is that, depending on what hash algorithms the investigators used, they may not be able to prove the data was unchanged. If the hash calculated was only MD5, an attacker (the investigators in this case) could theoretically alter the drive to make the new data result in a hash collision with the old data.

To clarify, if an investigator wanted to tamper with the contents of the drive, they could make two changes: the intended malicious change, as well as a second set of specially crafted changes somewhere else in the image (i.e. unallocated space), resulting in the "new" drive's hash matching the old hash. This is a known weakness in the MD5 algorithm.

See https://en.wikipedia.org/wiki/MD5#Collision_vulnerabilities

If the hashes used were SHA2 family, this vulnerability is only vaguely theoretically possible.

I should note I'm assuming the clone is either being written to a new HDD directly or a DD image file. An E01 image would be virtually impossible to alter this way.

|improve this answer
  • A photo of the hash was done but it wasn't presented to the one who's being investigated, and devices were not sealed for 5 days, theoretically in 5 days you could make changes to originals, clone it again, make a new photo of the hash and put it into reports as being the one taken first time. See what I mean? Timestamps of the photo is not a problem as you can set the time/date and make that picture with the date you need and say it was done 5 days before. – rmagnum2002 Jul 31 '15 at 11:36
  • I do see what you mean. But in my practice, I've never provided hashes to another party for verification prior to performing an analysis, nor has anyone I've ever worked with, and I've never seen this practice questioned within the forensic industry. You're right to say that the assurance is not absolute, but this isn't an industry where absolutes are often achievable. (As a disclaimer, I've never worked on behalf of a law enforcement agency. Mostly civil cases, rarely criminal defense work.) – pezzonovante Aug 4 '15 at 14:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.