Windows Vista: A Forensics Examiner's Dream Come True
- by Bill Lindner on 20070719 @ 10:38PM EST | google it | send to friends
- Filed under Security | (related terms: data, windows vista, shadow copy, information, forensic)
A report by the American Bar Association notes that from a litigator's perspective, Windows Vista makes it easy to uncover what's been performed on a particular PC. Quite simply, forensic evidence maintained by Vista makes it easier to find out what was done and when it was done.
What am I talking about?
Shadow copy is a new feature built into Vista that backs up all of your data and stores it on unused sectors of the hard drive. It was designed to prevent data loss but because the information it stores stays on there, it's easier for a forensic examiner to find deleted data.
Transactional NTFS, another new feature in Vista, keeps much more detailed user records. The records it keeps allow attorneys to construct more accurate time lines of events.
The new Search feature in Vista indexes almost everything the user has worked on.
"It's google desktop on steroids. It's an indexed database of more evidence stored right there on a computer," says John Simek, the co-founder of legal technology and computer forensics firm Sensei Enterprises. "Right now you can say information was accessed on a certain day, but that might not prove anything," he said.
Simek also believes that you can peer into Vista and see when something was accessed by going back through several months of data.
"From a defense perspective, it scares me to death. One of the things I have a hard time educating my clients on is the volume of data that's now discoverable," says R. Lee Barrett, associate attorney with Forshey & Prostok.
For tips on managing shadow copy, more information is available at zdnet.com.
Visit Bill's Links and More for more great tips, just like this one!
Related articles:
- 2008/03/24 Windows Vista SP1 Causing More Problems
- 2007/12/12 Wireless Keyboards Handy For Hackers, Too
- 2008/03/20 Vista Service Pack 1 Released
- 2008/04/17 Vista Security Update Bricks USB Devices
- 2008/03/18 Vista SP1 Shipping This Week
- 2008/02/27 Popular Encryption Methods May Be Flawed
- 2008/04/01 New, Scary Malware Attack Blamed for Supermarket Fiasco
- 2007/09/18 How Secure is the Vista Registry?
- 2008/02/26 First Vista Update Not Going Well
- 2007/12/20 What Privacy? Security Survey Pessimistic
Stay Informed: Subscribe Free to Infopackets, Today! Get your daily fix of Microsoft Windows news, reviews, tech tips, plus free software (freeware) goodies daily -- all absolutely free -- delivered straight to your email inbox! Bonus: join our website today and you'll also receive our highly coveted Top 10 Tech Reports, including: Top 10 PC Security Essentials, Windows Optimization Secrets, Top Freeware Antivirus, MS Office alternatives and more. Don't delay: subscribe today! Click here for more info.
Infopackets Game of the Week
Secrets of the Dark: Eclipse Mountain Collector's Edition
