Search
Advertisement
Categories
Links:

Archive for the ‘Uncategorized’ Category

Comment on 3rd iPhone botnet malware making zombies in the wild

That is most certainly an accurate statement. Except it hasn’t been done so much in a widespread way so far.

Source: Steve Burgess

Comment on What’s the Future of Computer Forensics?

Monique, thanks for your thoughtful comments!

Regarding people having more data:
It doesn’t make that much sense that people would have more data just because they have bigger hard drives, it’s true. However, I’ve been doing data recoveries for 25 years and it seems that it is true. The average hard drive I see has gone from 10MB to 100GB, and over all that time, they seem to usually be from 1/2 to 2/3 full. Like people’s spending seems to expand to fit their incomes, people’s data seems to expand to fit their storage. A lot of it’s photos & music. A lot of the photos could be actionable evidence. Not so much the music unless your are the RIAA or its ilk.

I agree with you that a million images don’t need to be closely examined when a couple hundred will do. My concern is how effective antiforensics (or privacy) tools may become with ridding a person’s computer of them.

Whether computer forensics firms and e-discovery firms merge is a question of great personal interest to me. I suppose it depends on how a company looks at its business model. A company may decide that its core competency is storage and documentation vs investigation. From this perspective, they’re two very different business models and we’d expect to see more collaborations than mergers.
On the other hand, if a firm looks at the model as litigation support, it might be more likely to want to do both. I know e-discovery companies that dabble with computer forensics, and of course computer forensics involves more than a little e-discovery. I think we’ll have a mix of both types of firms – one-stop shops and collaborating but divergent companies in each field.

Source: Steve Burgess

Comment on Still more Sarah Palin “Hacker” news

Indeed, Mr. Munin’s Fire! Reminds me of the old phrase, “beyond the 7th wave.”

Source: Steve Burgess

Comment on Health Net loses medical records of 1.5 million customers

I can see that you would be upset! Connecticut’s attorney general and its Insurance Commissioner Thomas Sullivan are both planning investigations into the incident and why it took so long for Health Net to come forth with the information. WIll they force Health Net as an organization or individuals within it to take responsibility and will their action s allow individuals to be paid back? I do not know. Furthermore, these agencies’ actions may be only on behalf of citizens of the Nutmeg State. Those in other states may have to get their own agencies to look into it as well.

Source: Steve Burgess

Comment on Spyware, Viruses and now…RansomWare!

Good question Monique. And the answer is an unequivocal “maybe.”
As I haven’t personally dealt with either of these pieces of malware, I’m going from the reports I have read. 
The first piece of malware discussed (Win32/RansomSMS.AH) blocks Internet access, through what process I do not know. Not knowing what file, files, registry entries or whatever else have been modified, I do not know that the given data would have been backed up. 
So seems to me that there’s a good chance a restoral from backup might not solve the problem. 
If it is a complete disk image taken from just before the infection, I’d expect it to work, but the existence of such an image for the average user (or even the advanced forensic guru) seems unlikely.
As for the earlier GPcode.ak, I’d say restoring from a backup of the affected files would probably work fine…as long as the old files weren’t erased by a new backup. Fortunately the new, encrypted files have a different name so as long as old files aren’t deleted with a new backup, the old files with their original names ought to still be available to be restored.
Thanks for the thoughtful question. Btw – I’m impressed with how fast your site loads.
Cheers,  Steve

Source: Steve B