Hacker News Reader

Comment by cloverich | Hacker News Reader

What is the reasoning for taking anything more than the Hard drives?

There's a lot of conversation in this thread about how they take the whole computer.

I can say that in 2006, in San Francisco, the police took just the hard drives out of a tower PC in my apartment. They left the tower itself. (They were after my roommate, but since I had hardware in the "shared spaces", it was impounded along with all of his stuff. It sucked.) They also took all of the laptops whole (including my girlfriend's).

The police held on to the equipment for months. We tried everything short of hiring a lawyer to get it back, but they would not release it until they actually finished the case against the guy and he got out of jail. Then, magically, our hardware was available to come pick up.

Given that they had been working the case for months, I imagine that they were just sitting on the hardware long after forensics was done with it. Punitively, I suppose. Luckily, my employer at the time was very gracious and loaned my girlfriend and I hardware so we weren't completely out of pocket.

When the hardware was returned to us, we had to go pick it up. The guy handing it back over made some asinine comment about "you shouldn't be copying music", and we were free to go. Everything was in bad shape. There was tape all over things, one power adapter never came back, and my girlfriend's external hard drive enclosure was cracked and clearly had been dropped.

Pro tip: if you share space with someone, make sure your hardware lives in your private space. Don't leave your computers in the living room, or they will become confiscated if the people you live with get in trouble.

Don't live with someone who is likely to get raided, either. I've seen the quality of training of local police; if they come in with guns drawn, it doesn't matter as much that you're not even listed on the warrant; you might get shot.

Encryption keys in a TPM? RAID configurations which depend on physical cabling setups? Storage that can't be physically removed? There are a thousand ways that taking the "hard drive" from a computer will end up losing information that would be recoverable with the whole device. It's not really reasonable to expect police departments to do IT foresics on site during a search.

That doesn't mean that the seizure is "justified", but there are no simple answers either.

Amusingly, the time police raided my stuff (well, they went after my roommate, and my stuff was in the living room and got taken along for the ride) -- they took the hard drives out of my media server. It was a software RAID-5 setup.

I imagine that they have the technology to rebuild the drives, but I have always smiled at the thought of some tech sitting there trying to rebuild this and wasting weeks of his time trying to figure out exactly how everything went. (It was actually a really terrible partitioning setup that was non-intuitive, with a "dead" partition that wasn't part of the RAID and used for reduced redundancy storage.)

I have no experience whatsoever in forensics, but here's why I would want all the hardware if someone asked me to analyze a system as a generally tech-savvy guy:

1) Some raids take PCs while they're still on, in order to preserve things like encryption keys in memory or cached passwords. It's possible to transfer a running PC over to a battery-powered outlet for transport, then to lab power for analysis. This would be very useful if the machine was using full-disk encryption.

2) Having a full disk image gives you the data, but the easiest way to see how the data behaves is to actually boot up the machine (after imaging the drives, obviously) and see it as the suspect would. There might be subtle differences in behavior if you use lab hardware rather than the actual hardware, and there's even a chance of something crazy like the suspect using a modified Linux kernel that wipes his drives if it detects different hardware.

3) It's a pain in the ass to remove hard drives in some guy's living room when you can just haul the whole thing back to the lab and do it there. I suspect that laziness generally wins over the inconvenience to a potential suspect.

What needs to be established, is government's requirement to have forensic experts do onsite justifications for what should be taken and then duplicate only relevant data (i.e., not pictures of your girlfriend's booty if not relevant to the case) and make an even stronger case for seizure of hardware based on deep relevance to the matter at hand, which should already have been thoroughly established beforehand (beyond "take anything that has operates on any kind of form of electricity).

But how do you determine what data would be considered relevant? It is possible for incriminating data to hide in plain sight, such as in an image file that looks like a picture of your girlfriend's booty.

The people doing the taking are not technical. Thus, "take anything" is safer than "take these things but don't bother with these other things".

Hopefully the irrelevant stuff can be returned quickly.

It'd be good if forensic images could be taken quickly and then all the equipment returned.

Actually they searched with an expert in my flat, so this would have been possible.

If I'm remembering correctly, when they 'investigate' they ensure that the setup is identical to it's original form - including the same mouse and keyboard.

Reply on news.ycombinator.com