Beta
×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

Vista For Forensic Investigators

kdawson posted more than 7 years ago | from the recovering-it dept.

Windows 125

Ant writes "SecurityFocus has a two-part article offering a high-level look at changes in Windows Vista that a computer forensic investigator needs to know about. Part 1 covers the different versions of Vista available and Vista's built-in encryption, backup, and system protection features. Part 2 continues with a look at typical user activities such as Web browser and email usage."

cancel ×

125 comments

Sorry! There are no comments related to the filter you selected.

Oh n0es (4, Interesting)

mboverload (657893) | more than 7 years ago | (#18774881)

The smart people already use drive encryption via TrueCrypt and other methods.

This may make it easier for the not so completely stupid criminals to protect themselves, but I doubt it will have any real effect.

People are stupid. Thats why they get caught.

Re:Oh n0es (3, Informative)

mboverload (657893) | more than 7 years ago | (#18774923)

If you didn't RTFA, which I don't blame you, it's short on any radical ideas or editorials, there is one thing I didn't know before:

Bitlocker (which encrypts the whole windows volume ala Truecrypt but bootable) requires a TPM 1.2 chip in it, which you'd be hard pressed to find in ANY computer.

Re:Oh n0es (2, Informative)

PitaBred (632671) | more than 7 years ago | (#18775257)

The notebook I bought last September has a TPM v1.2 chip in it... and I know many current other notebooks do. But TPM is primarily useful in the mobile space, anyway, not on the desktop space where most people keep their machines reasonably physically secure.

Re:Oh n0es (2, Interesting)

morgan_greywolf (835522) | more than 7 years ago | (#18775261)

Bitlocker (which encrypts the whole windows volume ala Truecrypt but bootable) requires a TPM 1.2 chip in it, which you'd be hard pressed to find in ANY computer.


At the risk of sounding like an overly-eager Apple fanboi (bleck!), recent Macs have an Infineon TPM 1.2 chip in them.

Re:Oh n0es (0)

Anonymous Coward | more than 7 years ago | (#18779079)

Since when does having a TPM hobble in your machine A GOOD THING?

Being proud of that really does make you an Apple fanboy. You does realise that a TPM is a hardware DRM chip -- it was design to cripple the machine and ensure that it never really belongs to the mug punter who paid money to buy it.

Re:Oh n0es (4, Informative)

THESuperShawn (764971) | more than 7 years ago | (#18775845)

Actually, that's not correct. Bitlocker does not "require" TPM 1.2, it CAN be used without it. You can boot from a USB drive, make a few edits in the local policy, or manually set the 48 digit recovery password just to name a few.

And just about any computer manufactured after January 2006 will have TPM 1.2.

Re:Oh n0es (-1, Offtopic)

Anonymous Coward | more than 7 years ago | (#18775201)

"Freedom is messy." [nytimes.com] &mdashDonald Rumsfeld

Violent mayhem is a sign of our nation's greatness. May law and order never rob us of our messy freedoms.

Re:Oh n0es (0, Troll)

stratjakt (596332) | more than 7 years ago | (#18775905)

If they have reasonable cause to suspect there's evidence on the HDD, but it's encrypted, they go get a judge to issue a warrant for your keys/passphrase.

Then when you refuse to give it up, you're burned for violating a direct court order, and impeding in an investigation, etc.. You may end up in deeper sh!t than where you started. Judges dont cotton to hiding/destroying evidence, and they really get pissed off when you directly defy their orders.

People are stupid - case in point - your idea is stupid.

Re:Oh n0es (4, Insightful)

Detritus (11846) | more than 7 years ago | (#18776249)

See the Fifth Amendment [wikipedia.org] .

The defendant has no obligation to provide the prosecution with incriminating information.

Re:Oh n0es (-1, Offtopic)

mboverload (657893) | more than 7 years ago | (#18776407)

>See the Fifth Amendment.
>
> The defendant has no obligation to provide the prosecution with incriminating information.


See List of countries - Now including People's Republic of Equatorial Guinea! [wikipedia.org]

Re:Oh n0es (3, Informative)

Beefysworld (1005767) | more than 7 years ago | (#18776937)

I can't believe this didn't get a bite. US citizens aside, this article relates to any other country that uses Vista, so it's a worthwhile topic. Just because one country's constitution states something, doesn't mean that all has been said and done.

Re:Oh n0es (1)

Ash-Fox (726320) | more than 7 years ago | (#18776425)

The defendant has no obligation to provide the prosecution with incriminating information.
But aren't they obligated to follow court orders (such as the one, the grand parent was speaking of)?

Re:Oh n0es (1)

Detritus (11846) | more than 7 years ago | (#18776515)

A court order doesn't override the defendant's constitutional rights. If the prosecutor really wants the information badly enough, the defendant can be granted immunity or "use immunity". Then the defendant could be held in contempt of court if he refused to testify, the grant of immunity having negated the possibility of self-incrimination.

Re:Oh n0es (1)

madcow_bg (969477) | more than 7 years ago | (#18778691)

A court order doesn't override the defendant's constitutional rights. If the prosecutor really wants the information badly enough, the defendant can be granted immunity or "use immunity". Then the defendant could be held in contempt of court if he refused to testify, the grant of immunity having negated the possibility of self-incrimination.
Even then I believe you can refuse. Imagine a child-obscene picture case, held before a grand jury. If I know there are pictures there that will compromise my image, I don't want to reveal them, even for immunity. The public outrage and the possibility of loosing my reputations is too big. Now, substitute that for your petty (pretty major for some) crime and then talk to me about honestly.

Besides, what is the point of the pictures if I am granted immunity? To incriminate others... so either persuade me or go f#ck yourself, that is.

Re:Oh n0es (1)

flosofl (626809) | more than 7 years ago | (#18776593)

I thought that part of the Fifth Amendment referred to self-incrimination during testimony (you know, that ...nor shall be compelled in any criminal case to be a witness against himself... part). I don't think it allows you to refuse to turn over evidence legally requested via a search warrant. If the police/DA have a warrant for the contents of your drive (plaintext/non-encrypted), I'm pretty sure you are legally obligated to give up the key/passphrase.

It would be similar to them naming the contents of your safe. You can't just hand over a locked safe sans combination and say "best of luck, guys." I'm thinking that would get you a contempt of court. I also think that courts treat the destruction/obfuscation of evidence as if the evidence would have shown whatever it is the prosecution was trying find.

I think you may be thinking of the Fourth Amendment which would cover which evidence is admissible and how evidence can be collected (i.e. warrants).

Disclaimer: I'm sure it's obvious by now, but just in case - IANAL

Re:Oh n0es (4, Interesting)

Detritus (11846) | more than 7 years ago | (#18776775)

There is a legal distinction between testimony and material objects like diaries and journals. From what I've read, a court can compel someone to hand over material objects, like a safe, but it can't compel someone to say the combination. This issue came up quite often during Prohibition. Many rum runners kept their business records in code. The government would often seize these records during a raid. The government used their own cryptanalysts to break the codes and testify in court as expert witnesses.

Re:Oh n0es (2, Informative)

Anonymous Coward | more than 7 years ago | (#18776871)

I'm sure it's obvious by now, but just in case - IANAL

Indeed, it is obvious. IANAL either and while there is some truth to your argument it is mostly false. The fifth amendment applies at any time. If the police go to your house and ask if you killed your wife, your refusal to answer can not be used as evidence of your guilt. If they ask for the combination to your safe, you can claim the fifth amendment and decline to answer.

You can even invoke the fifth amendment as a witness. For example, if the police ask for your safe in order to prosecute your neighbor you can decline to answer on the grounds that you may incriminate yourself. There is a catch however. The court can grant you immunity from prosecution for any statements you make. If you still refuse to answer you can be held in contempt. Furthermore, if your statements lead to other evidence the other evidence can be used against you even if your own statements can not. So while telling the court that the combination is "I did it" can't be used against you, any evidence discovered inside the safe could be.

Also note there is a huge difference between a search warrant and a subpoena. A search warrant is where a judge has granted the police the power to personally search your home and seize any evidence they find. A subpoena is where you are handed a document compelling you to present evidence.

Also note the fifth amendment protection against self-incrimination only applies to criminal cases. If you are sued and refuse to supply evidence, such as a password, the court can assume that the evidence you are hiding favors the other party.

Re:Oh n0es (1)

Opportunist (166417) | more than 7 years ago | (#18777047)

Pity that Alzheimer strikes me in such young years. Oh, the humanity...

Haven't you ever seen Law and Order? (1)

rah1420 (234198) | more than 7 years ago | (#18777961)

When Lenny finds a locked door or something with a padlock on it, he'll ask the owner once, nicely, to effect an entry. And if they want to be a prick and not cooperate, out comes the bolt cutters or the ram.

Re:Oh n0es (3, Informative)

ucblockhead (63650) | more than 7 years ago | (#18776837)

In the past, courts have rules that an encryption key is analogous to a physical key, and like a physical key, can be demanded with a warrant.

Re:Oh n0es (1)

etymxris (121288) | more than 7 years ago | (#18777111)

Really? Could you cite the precedents you're referring to?

Re:Oh n0es (1)

silas_moeckel (234313) | more than 7 years ago | (#18777433)

In the UK they can require you to give up your encryption keys. This is one of the reasons you have things like the multiple keys in truecrypt where you have one key with some tame stuff and a second key with your real system. I don't know the case law in the US but would think they can lock you up for contempt in a criminal case or just award the case to the other party in a civil case. Anyway if you really have something to hide the previous mentioned method should work fine or just use a server in another country an there are very very few things that can not be done via a text mode ssh session to some server in north korea, cuba, iran etc with plenty of strong crypto on the link and the far end.

Re:Oh n0es (1)

MoralHazard (447833) | more than 7 years ago | (#18777833)

(This should NOT be modded insightful. It should be modded 'Wrong'. Read the goddamn Wikipedia article before you start modding, especially if you don't know anything about the law.)

You misunderstand the use of the 5th Amendment. In its broadest form, it applies only to direct admissions by the defendant. A defendant cannot be ordered to confess, or punished for not doing so, or be forced to provide testimony that amounts to a confession.

HOWEVER... Defendants CAN be compelled by the court to provide:

    - fingerprints
    - DNA samples (blood/saliva/etc)
    - access codes for properties to be searched
    - encryption keys to enciphered data

Note the difference: None of these latter group are direct admissions of guilt. The information may lead to evidence that the defendant is guiltly, but that's not what the 5th Amendment protects against.

(Also note that this protection only applies in situations where the crimes that are actually prosecutable. If the prosecutor so chooses, he/she can grant someone immunity from prosecution for a particular act, and then have the judge compel that person to testify about the crime.)

In any case, someone who refuses to testify when asked a question in court can be held in contempt of court: The judge orders that the recalcitrant witness be fined or held in prison, possibly indefinitely, until they change their tune. There might even be an obstruction of justice charge. A general rule is that the actual penalty (fine or prison time) levied for contempt or for obstruction is roughly equal to the penalty for the crime for which you're being tried. The defendant has nothing to gain by clamming up and refusing the court's order.

The Law (2, Informative)

bussdriver (620565) | more than 7 years ago | (#18778265)

The past rulings indicate and its rather clear that the 5th amendment only applies if you hurt yourself with the information disclosed. There is a "Fisher Test" of requirements to get around the 5th:
1) evidence exists
2) the person has a key for getting/finding the evidence
3) producing the key does not link the evidence to the person (aka authentication)
Fisher v US

Its like you have evidence in your safe but so do other people, so they can force you to open the safe despite the 5th- is my understanding of the ruling. Where it gets really tricky is when they offer immunity to get around the 5th as a setup to tie the person into some other crime they trump up from that evidence.

Biometrics are another issue that I'm not sure they have rulings supporting. USA vs Dioniso has "The Fourth Amendment provides no protection for what "a person knowingly exposes to the public, even in his own home or office . . . ." 351?
They rule that publically available information can not be hidden later on is my understanding and the example given was a persons' face. To me this indicates its possible that biometrics being public (fingerprint) could be taken from you with no 5th amendment protection. Naturally, the police can attack your security any way their please without your help and can lift your biometrics in many ways without going threw the court and I suspect when that situation is raised they possibly will extend the line of thought started on this case.

I am not a lawyer.

Re:Oh n0es (1)

Ash Vince (602485) | more than 7 years ago | (#18778685)

Of course here in Britain we have the Regulation of Investigatory Powers Bill. (RIP)

One of the clauses states that if you fail to decrypt something at the courts request you get a 5 year statutory term in prison.

Re:Oh n0es (1)

Beryllium Sphere(tm) (193358) | more than 7 years ago | (#18777087)

I have yet to investigate a machine used by somebody smart.

Of course the smart ones may never come to my attention.

Also I haven't been looking at criminal cases, so the motivation level might be lower -- but don't overestimate the level of computer knowledge in the general population.

Bleh (1)

El Lobo (994537) | more than 7 years ago | (#18774901)

Pretty uninformative article if you ask me. And nothing to bash MS for here. This is not mesh for crapdot.

Vista is for criminals, it assists encryption (4, Funny)

Anonymous Coward | more than 7 years ago | (#18774937)

If someone uses encryption, then obviously they are trying to hide somthing illegal or unlawful.

In Linux, encryption is done with unusual and special commands in conjuction with mounting a "loop" device to a filesystem; requiring administrator privileges to try to encrypt data like that, and adding to the subversion of a system with evidence of a corrupt administrator.

What kind of administrator would allow encryption on a filesystem? Obviously, a criminal.

Information is meant to be free, and open source. Encryption is somthing we would expect Mycrow$oft to use to help criminals be found by the good god-fearing men and women of the DEA/FBI/CIA/GATT/IMF/IRS just to atone for their sins.

Good people use OSX.

Call me,
  Eve.

Re:Vista is for criminals, it assists encryption (1)

hkmarks (1080097) | more than 7 years ago | (#18775339)

...Or someone with sensitive financial or legal data. Customer profiles. Business plans. Credit card numbers.

Are you kidding me?

Re:Vista is for criminals, it assists encryption (1)

compro01 (777531) | more than 7 years ago | (#18775805)

Are you kidding me?

yes.

It's Funny! Laugh!

Re:Vista is for criminals, it assists encryption (1)

pipatron (966506) | more than 7 years ago | (#18775823)

Wooo...

...ooo...

...ooosh!

Re:Vista is for criminals, it assists encryption (1)

Checkmait (1062974) | more than 7 years ago | (#18775405)

That's not quite the case. Imagine your average information thief. He/she can steal information in one of two ways: online or physically. Now let's say some innocent government or corporate employee left a laptop with sensitive data on it (such as proprietary secrets). Our thief can pick up this laptop, and if it's not encrypted as you suggest because the employee and his/her company are innocent of any criminal activity, the criminal can read the entire contents of the disk.

An encrypted drive makes this harder and is in use by many large corporations, many of which are not tainted by corruption and/or criminal activity.

Quality (1)

cortana (588495) | more than 7 years ago | (#18775523)

10/10, would read again. ;)

Re:Vista is for criminals, it assists encryption (1)

session_start (1086203) | more than 7 years ago | (#18775663)

Taken directly from TechNet [microsoft.com]

Who should use BitLocker Drive Encryption?
This guide is intended for the following audiences:
-IT planners and analysts who are evaluating the product
-Security architects
So they do not even plan for criminals or anyone else for that matter to use it...nice...

nOhtign to ese hree (1)

EmbeddedJanitor (597831) | more than 7 years ago | (#18776423)

Move along please!

Gasp! (1)

Opportunist (166417) | more than 7 years ago | (#18777071)

You mean ... all those 3-letter-government-organisations are criminal organisations? Organized crime in the top echelons of the US government?

Now that I think of it... a lot starts to make sense, you know...

Wow. (4, Funny)

eviloverlordx (99809) | more than 7 years ago | (#18774939)

I would've figured that the investigators' computers would be too slow from running Vista to investigate much of anything.

They're ReadyBoosting! (1)

Mateo_LeFou (859634) | more than 7 years ago | (#18775505)

Sorry, I can't resist a dig at that stupid concept.

If your OS is *disgustingly, *alarmingly inefficient with resources, you can stick a thumbdrive in it and cross your fingers that the email you just spent half an hour typing on will go through.

In other news if your car gets 1.4 miles per gallon, you can drive around with a few 50-gallon drums of gasoline to get you through out of those tight spots.

Re:They're ReadyBoosting! (1)

drsmithy (35869) | more than 7 years ago | (#18777589)

Sorry, I can't resist a dig at that stupid concept.

What stupid concept ? Disk caching ? Because that's all ReadyBoost ultimately is - a disk cache.

Re:They're ReadyBoosting! (0)

Anonymous Coward | more than 7 years ago | (#18777723)

I think his sarcastic point was meant to be read more along the lines of ......

"Well a 128mb hard drive oughta be plenty, you'll never fill it up." ... or aiws 'Dammit Jim! Keep throwing RAM at it or we'll never make it!

YMMV

No encryption by default (4, Informative)

5, Troll (919133) | more than 7 years ago | (#18774949)

One misconception is that encryption in Vista is turned on "by default." Actually, it is not. In fact, it is not even available in most versions of Vista. Vista is available in five SKUs, only two of which support encryption (a feature known as "BitLocker", or "BitLocker Drive Encryption" - BDE). Vista Home Basic, Media Edition, and Business *do not* support BDE. Vista Enterprise and Ultimate - the two more expensive editions - do support BDE. Also, encryption is not turned on by default. An important step during encryption involves defining the encryption and decryption keys. This cannot be done by default by someone other than the owner of the system. If it could, then that someone else would be able to gain access to the secure data - exactly what is trying to be controlled.

Re:No encryption by default (4, Insightful)

RedElf (249078) | more than 7 years ago | (#18775011)

With Vista, the OS from MS that phones home more than any previous release, can we really trust it not to "Phone Home" the encryption keys of bitlocker once it's enabled?

Re:No encryption by default (1)

El Lobo (994537) | more than 7 years ago | (#18775137)

Are you stupid or just playing stupid?

Re:No encryption by default (0, Troll)

cortana (588495) | more than 7 years ago | (#18775541)

Do you really think it's beyond Microsoft to program in a covert channel that transmits sensitive data back to them or another party?

Re:No encryption by default (1, Funny)

mboverload (657893) | more than 7 years ago | (#18775687)

> Do you really think it's beyond Microsoft to program in a covert channel that transmits sensitive data back to them or another party?

Yes.

Re:No encryption by default (1)

x2A (858210) | more than 7 years ago | (#18776427)

Do you think it's beyond everyone else to not notice if they did? The amount of people paranoid about MS, who'll run it behind eg, a linux firewall, watching all the traffic that goes through during installation etc?

I don't think MS would be able to get away with doing anything like that now, too many eyes on packets comin from Windows.

Re:No encryption by default (1)

mboverload (657893) | more than 7 years ago | (#18775165)

While a great example of "Microsoft Gone Wild!" they would never risk something like that being exposed. It would kill them.

Yes, I am aware of the "NSA secret backdoor thing".

Re:No encryption by default (0)

Anonymous Coward | more than 7 years ago | (#18776903)

So... it would kill them like releasing the least secure operating system kills them?

Re:No encryption by default (0)

Anonymous Coward | more than 7 years ago | (#18775179)

> With Vista, the OS from MS that phones home more than any previous release, can we really trust it not to "Phone Home" the encryption keys of bitlocker once it's enabled?

Why would it phone home? There's a good reason many encryption technologies support "recovery" options -- the canonical example being that if you get run over by a bus, your boss or sysadmin can recover the data.

What makes you think there isn't a s00per-s33kr1t recovery key (in addition to any recovery keys the user may or may not have installed) available only to... but of course, there's no such agency that would ever ask to take part in such shenanigans. :)

Re:No encryption by default (1)

pipatron (966506) | more than 7 years ago | (#18775885)

There's a good reason many encryption technologies support "recovery" options

Sounds more like an obfuscation system than en encryption system. The point with encryption is that no one except those you give the key to, should be able to decrypt the information.

Re:No encryption by default (1)

jimicus (737525) | more than 7 years ago | (#18779227)

Sounds more like an obfuscation system than en encryption system. The point with encryption is that no one except those you give the key to, should be able to decrypt the information.

You're technically correct. But it hasn't stopped lots of things which claimed to offer "encryption" being sold on the open market.

For instance:

http://it.slashdot.org/article.pl?sid=07/04/13/123 0223 [slashdot.org]

Re:No encryption by default (1)

mordejai (702496) | more than 7 years ago | (#18775595)

No, we can't.

Next question...

Re:No encryption by default (1)

Cheapy (809643) | more than 7 years ago | (#18775629)

Why stop there?

They could be sending credit card numbers, or SSNs, or your personal files, or your porn, or even every single piece of data on your computer!

Re:No encryption by default (3, Funny)

sunwukong (412560) | more than 7 years ago | (#18777865)

They could be sending credit card numbers, or SSNs, or your personal files, or your porn, or even every single piece of data on your computer!

I've never read a more self-redundant sentence.

Re:No encryption by default (1)

Cow Jones (615566) | more than 7 years ago | (#18777041)

I used to be concerned about this, because in the end, you have to trust somebody. Trust Microsoft, trust the device driver programmers, trust your AV vendor, trust the TrueCrypt programmers. In the case of OSS, trust that enough eyes are watching, and that they're watching closely enough, and that they're even checking every single update and patch that you automatically install.

It simply is not possible to personally check and verify every piece of code that gets executed on your computer.

So yes, it's possible that Microsoft (or any of the other "trusted" parties) has built backdoors into Windows and into the Bitlocker component. But even if they could read your private encrypted data at will, they could *never* reveal it, because that would permanently destroy their credibility. I believe that most of our secrets simply aren't worth enough for MS to risk that.

Re:No encryption by default (1)

asninn (1071320) | more than 7 years ago | (#18779007)

Short answer: no.

Long answer: no, but which software *can* you trust? If you install, say, Mandriva, how do you know that it's not going to "phone home" any of your data? Oh, sure, there's no such functionality in the source code, but how do you know that the binaries you're running do correspond to the source code you're getting? And while you might think that simply recompiling everything will help, it's not actually going to - Ken Thompson demonstrated this nicely. If you're using the shipped compiler, you can't trust that it won't bug your binaries again; and recompiling the compiler won't help, either, since the compiler might also be bugged to bug itself. So unless you have a trusted compiler binary already, you're basically stuck.

But to an extent, all that is besides the point: the real question is not "can you trust Vista" (or "can you trust Linux") but rather "can you trust Microsoft" (or "can you trust Mandriva", to pick up the example from above again). For MS, I'd probably answer that question as "no, you can't"; for Mandriva, I'd say "I don't know - I have no evidence either way". Ultimately, though, even when you do trust someone, that doesn't automatically make them trustworthy, so there's always a chance something bad will happen.

If you really want to be sure that nothing gets sent to anyone, get a second computer that is not connected to any network (well, other than the power grid) and use that for sensitive documents.

Re:No encryption by default (1)

CCFreak2K (930973) | more than 7 years ago | (#18775403)

One misconception is that encryption in Vista is turned on "by default." Actually, it is not. In fact, it is not even available in most versions of Vista.
It also requires a TCPM chip. I tried it on my Pentium 4 box with Windows Vista RC1. No dice.

Re:No encryption by default (0)

Anonymous Coward | more than 7 years ago | (#18775487)

There is no "Media Edition". Vista is available in 5 SKUs: Home Basic, Home Premium, Business, Enterprise and Ultimate [microsoft.com] . Ultimate and Home Premium contain Media Center. Enterprise and Ultimate contain BitLocker.

BDE, a fitting name... (2, Insightful)

plasmacutter (901737) | more than 7 years ago | (#18776623)

if i remember correctly from 4-5 years ago.. BDE also stood for "borland database engine".. or in colloquial english, the spyware that kazza installed.

now microsoft has made it a feature in their new os, giving us greater spyware value by cutting out the middle man!

Very sceptical about this (0)

Anonymous Coward | more than 7 years ago | (#18774961)

I think this video walkthrough is prima facae evidence

http://www.youtube.com/watch?v=EPeUAF_CuR8 [youtube.com]

If they want to bust you, they will (3, Insightful)

heretic108 (454817) | more than 7 years ago | (#18774991)

I see from TFA that they're shitting themselves at the prospect of widespread drive-level encryption. They console themselves with the fact that only the high-end Vista versions support BitLocker.

But in the end, encryption offers only limited protection. If some well-resourced hostile authority wants to take you down, there's endless options for framing you up. For instance, they could mess with your ISP's logs to fabricate http hits to k1dd13 pr0n sites, or infect your box with a bot that hits such sites on your behalf, which will cause the hits without messing with the ISP's logs...

Re:If they want to bust you, they will (3, Informative)

mboverload (657893) | more than 7 years ago | (#18775127)

Criminals usually aren't smart enough to enable drive encryption or buy a $400 copy of Windows Vista. They are probably not smart enough to even install TrueCrypt, which is by far the most incredibly easy to use encryption product on the market.

And by the way, what kind of bozo puts incriminating evidence on a computer period? Unless they deal in child pornography they wouldn't even have that data on the computer. (Unless you're that one idiot that used Microsoft word to print off a fake suicide note)

Like I've said, "civilians with encryption" mean nothing. We've had strong encryption for over a decade and I don't see the average pimp encrypting his Microsoft Money 2007 databases that keep track of his hoes. Most people don't use encryption and never will until it's a box click away. Until they forget their password and realize that Uncle Jimmy with his magical computer toolkit can't save them.

Re:If they want to bust you, they will (3, Insightful)

nine-times (778537) | more than 7 years ago | (#18775185)

I see from TFA that they're shitting themselves at the prospect of widespread drive-level encryption.

Whenever it comes to these things, I find myself in a bit of a quandary. Of course I want various criminals to get busted, but these investigators are essentially relying on poor security to get their information. I generally want computers to have good security. I don't like the idea of people being able to see my personal info or browsing history, but I'm also not really hiding anything.

oh well...

Re:If they want to bust you, they will (2, Funny)

mboverload (657893) | more than 7 years ago | (#18775223)

IF YOU HAVE NOTHING TO HIDE THEN YOU WON'T MIND US LOOKING THROUGH YOUR BROWSER HISTORY, MR NINE

*mboverload is sad because he hears these arguments from people but doesn't know how to fight against it. Someone help.*

Re:If they want to bust you, they will (3, Insightful)

Qzukk (229616) | more than 7 years ago | (#18775631)

*mboverload is sad because he hears these arguments from people but doesn't know how to fight against it. Someone help.*

"If you have nothing to hide, then you won't mind taking out a newspaper ad with your SSN, your DOB, your credit card numbers, your mother's maiden name, and your driver's license number. Either you have something to hide, or you'll quickly learn that you had something you should have kept hidden."

Re:If they want to bust you, they will (2, Informative)

vux984 (928602) | more than 7 years ago | (#18776131)

If you look through my browser history then you don't respect and trust me.
If you don't respect and trust me, than there is something fundamentally wrong with our relationship.

If there is something fundamentally wrong with our relationship then I wish to end it. **OR**
If there is something fundamentally wrong with our relationship then we need to fix that.

As far as society, and police/government initiatives its the same baseic question of trust and respect. Do we want to live in a police state? What fundamentally separates a prisoner from a free citizen? Indeed what is freedom?

Anyone who seriously advocates living in a world where 'if you have nothing to hide then you won't mind us looking' is right about not needing to worry about being arrested - they're whole world is a prison. They will accept having their papers inspected at borders, building entrances, and street corners. They will accept random searches of their homes, car, computer, and person. They will not flinch when they are required to account for their whereabouts 24x7 and subject to being monitored the whole time, for they live a perfect life.

And when the state decides to finally reel them in the rest of the way and lock them in an even smaller cell, they'll have a perfectly rational explanation: people can't be trusted. We watch them all around the clock, but we only catch them after the damage is done.

Better to prevent the damage outright! Why take a chance?

And more importantly, the truly innocent will finally be safe.

Who could object to that!?

Re:If they want to bust you, they will (2, Interesting)

quanticle (843097) | more than 7 years ago | (#18777487)

I've found that the most effective counterargument is to point out that the whole "nothing to hide, nothing to fear" argument is based upon the presumption that the government is infallible and perfectly competent. Sure, I have nothing to hide. However, I do fear the government looking at bits and pieces of my personal data and then coming to an erroneous conclusion about my future behavior because they didn't get the whole picture.

Also, I don't like the thought of government being able to make arbitrary decisions restricting your freedoms without at least giving you the chance to address their concerns. Encrypting my data makes the government come to me for the decryption key (chance are, they'll do this at least see if I'm willing to cooperate). This is a chance for me to ask what's going on and why they need this data.

Re:If they want to bust you, they will (0)

Anonymous Coward | more than 7 years ago | (#18777831)

IF YOU HAVE NOTHING TO HIDE THEN YOU WON'T MIND US LOOKING THROUGH YOUR BROWSER HISTORY, MR NINE

If I'm living in a free society, then I should have the right to not be inspected, to not produce identity papers if I'm not doing anything obviously wrong. If it's a free country, I should be able to refuse to be searched or have my car or house searched, without refusal to submit to a search counting against me as "evidence of wrongdoing". Free people should be allowed to go about their activities without being searched, inspected, monitored, and identified. Not wanting to be searched or interrogated should not be a cause for suspicion.

If THE MAN believes somebody has done something illegal, then THE MAN should apply to a judge to get a search warrant, and if the warrant is granted, then THE MAN can perform their search. If THE MAN doesn't have a warrant, then THE MAN should allow people who aren't obviously doing something wrong to carry on with what they're doing, and leave them in peace to do it without being searched or harassed.

BitLocker is no impediment to police... (0)

Anonymous Coward | more than 7 years ago | (#18775037)

...since they'll get you to provide them your encryption key by using the same old fashioned methods they've always used to get information.

Re:BitLocker is no impediment to police... (3, Informative)

pipatron (966506) | more than 7 years ago | (#18775937)

This is why you should use TrueCrypt with the hidden volume feature. You can, after some extortion, give them your key to the main truecrypt volume, but there is no way to know if there is another volume inside the one you just gave them access to.

CSI-Redmond (1)

WwWonka (545303) | more than 7 years ago | (#18775091)

...the only time I see forensics being used in conjunction with Vista is when poor old Granny Millie takes her 4 year old PC to Best Buy and bashes poor young Timmy James(just working there to save up enough for prom) over the head with it (and thus killing him on the spot) after trying to install Windows Vista(the lifestyle simplifier) which she had recently been "coerced" into purchasing there on her last visit.

encypted backups? (5, Interesting)

RedElf (249078) | more than 7 years ago | (#18775095)

After reading the article (I know we're not supposed to do that) I'm a little confused on if you backup an encrypted volume if the backup is also encrypted. If not, doesn't that defeat the whole purpose of encrypting that data in the first place?

Re:encypted backups? (1)

rivaldufus (634820) | more than 7 years ago | (#18775371)

That's why you should always send your backups to /dev/null.

That way, they can't be stolen.

Re:encypted backups? (1)

RedElf (249078) | more than 7 years ago | (#18775559)

Since when did Microsoft add /dev/null to Windows Vista?

Re:encypted backups? (1)

x2A (858210) | more than 7 years ago | (#18777029)

It's existed in the NUL form going right back to early DOS days (and before, in CPM etc I think), which exists whatever directory you're in. Other device names include CON (console), AUX, PRN, COM1, LPT1 etc.

eg:
copy con lpt1 -- send anything you type to printer on lpt1
md newdir > nul -- redirect output to nul

Re:encypted backups? (1)

dotgain (630123) | more than 7 years ago | (#18777277)

It's existed in the NUL form going right back to early DOS days (and before, in CPM etc I think), which exists whatever directory you're in. Other device names include CON (console), AUX, PRN, COM1, LPT1 etc.
And to really rub your nose in it, Windows won't allow you to create a file or directory anywhere with any of those names. Just what I need from a filesystem: An historically bound list of arbitrary letter combinations that I can't use as a filename anywhere. Oh well, at least it's saved them the trouble of making any changes to command.com for 12 years.

Re:encypted backups? (0)

Anonymous Coward | more than 7 years ago | (#18775439)

After reading the article (I know we're not supposed to do that)...
I hope you make the hall of fame for that one ;)

Re:encypted backups? (1)

nine-times (778537) | more than 7 years ago | (#18775685)

It depends on why you're encrypting and how you're backing up. In this case, copying the files to an unencrypted disk will give you unencrypted files.

In short, the purpose of encrypting your hard drive in this way is to prevent hacking from someone who as physical access to the machine. For example, if you give me a standard XP system, I can use a boot CD to reset your passwords. I can boot to another OS and access your files directly. If your system is up and running, Windows will protect your files with its own permissions, but once I have physical access to the machine and can reboot into whatever OS I want, I have your files. By encrypting the disk, you close that security hole.

Do does an unencrypted backup void the purpose of encrypting the disk? Not if your backup is in a secure location.

So if I take my laptop out into the world, I can encrypt the disk and keep an unencrypted copy at home. If my laptop gets stolen, the thief can not boot into another OS, reset my passwords, or otherwise get my data. At most, he can overwrite the old disk and start over.

Also, if I want to secure data on desktop systems, I can backup to a server with restricted physical access. In order to get access to the backup, they'd need to break into my server room first, and then reset my server's passwords.

Re:encypted backups? (1)

x2A (858210) | more than 7 years ago | (#18777051)

Unless you backup the volume (take an image) rather than the files, then you get the raw encrypted data.

Re:encypted backups? (1)

nine-times (778537) | more than 7 years ago | (#18777713)

Are you telling me that if you use bitlocker and you copy files from your computer (running the installed version of Windows) to another drive or a network share, you'll get gibberish on the other end? I'll admit that I've never used bitlocker, but if that's true then it's going to be damn near useless for most uses.

Re:encypted backups? (1)

x2A (858210) | more than 7 years ago | (#18778869)

"and you copy files from your computer"

No, I said if you take an image of the volume instead of copying the files, ie, if you access the raw hdd data, before filesystem driver tries to translate it.

Re:encypted backups? (2, Interesting)

nwetters (93281) | more than 7 years ago | (#18778647)

You should worry more about the disk cache. Previously opened files are cached in RAM in an unencrypted state.

Firewire ports and PCMCIA slots have direct memory access, so can be used to copy an image of your computer's RAM even if no one is logged in. This can recover useful forensic material even after a reboot cycle, as modern BIOS's don't clear RAM.

It looks like Vista's disk encryption is useless if you switch on the PC and access files.

I find it funny. (3, Funny)

figleaf (672550) | more than 7 years ago | (#18775135)

that the article mentions Slashdot and Register as a reference for a Microsoft OS.

BitLocker Backdoor (-1, Troll)

session_start (1086203) | more than 7 years ago | (#18775603)

Surely windows has a "backdoor" in the encryption algorithm - whether intentional or in the form of a bug...

Re:BitLocker Backdoor (1)

Vash24601 (1001491) | more than 7 years ago | (#18775843)

it's not a bug, it's a feature!

Encryption use is low anyway... (3, Interesting)

Blittzed (657028) | more than 7 years ago | (#18775623)

Part of my job entails working with law enforcement officials in the field of digital forensics. They have told me that the use of any encryption system by criminals is very low, to the point of non-existent. This is fortunate for the Police, as it makes it easier for them to keep these scumbags off the streets (unfortunately a lot of the crime they deal with is child pornography). There are so many barriers to Bitlockers use (TPM, correct version of Vista, off by default etc etc), that its widespread use just doesn't seem likely. If the bad guys aren't using EFS and other encryption systems now, and these are easy to implement, why would they bother of going through the hassle to use Bitlocker? There are also laws being enacted in certain countries to force the bad guy to give up passwords/ keys etc (ie we are going to lock you up until you give it to use so you may as well do it now...).

force the bad guy to give up passwords (1)

nurb432 (527695) | more than 7 years ago | (#18775751)

"oops, that was the destroy all data password".. sorry about that i was so shaken up by being jailed when i am innocent that i was confused and gave you the wrong one.

No problem (1)

dereference (875531) | more than 7 years ago | (#18776401)

"oops, that was the destroy all data password".. sorry about that i was so shaken up by being jailed when i am innocent that i was confused and gave you the wrong one.
"Oh, we understand, that's fine. We only tried it on a copy of your drive; care to try again with another copy? We'll give you lots of time to calm down, relax, and think about it."

Re:No problem (1)

nurb432 (527695) | more than 7 years ago | (#18776615)

With full TPM enabled in hardware ( which is coming soon to a nightmare near you ) you wont be able to use a copy of the HD.

Re:No problem (1, Interesting)

Anonymous Coward | more than 7 years ago | (#18778455)

This is true, but with fully TPM enabled hardware, they will, because they will be able to get the hardware key from the manufacturer.

Re:force the bad guy to give up passwords (1)

x2A (858210) | more than 7 years ago | (#18777067)

"That's okay, we were working on an image we took directly off the drive... try again"

Re:Encryption use is low anyway... (1, Insightful)

Anonymous Coward | more than 7 years ago | (#18775821)

There are also laws being enacted in certain countries to force the bad guy to give up passwords/ keys etc (ie we are going to lock you up until you give it to use so you may as well do it now...).

That's awesome - as long as you have some way to tell who the "bad guys" are before you get their password. Otherwise what you are talking about is making the use of encryption a jailable offence.

Re:Encryption use is low anyway... (1)

Blittzed (657028) | more than 7 years ago | (#18778985)

Fair enough point, and I need to be a bit careful about what I say, but the guys I work with don't normally just grab people at random. If they show up at your door, then they usually already know what they are going to find. The seizure is so that a case can be made and put before a judge / court. They have more than enough work than they can handle now without doing random PC seizures.

Re:Encryption use is low anyway... (1)

Jugalator (259273) | more than 7 years ago | (#18779175)

There are also laws being enacted in certain countries to force the bad guy to give up passwords/ keys etc (ie we are going to lock you up until you give it to use so you may as well do it now...).

Wow...

Well, good some encryption tools implement plausible deniability then.

Thank God CSI Isn't Using Vista (1)

Skeetskeetskeet (906997) | more than 7 years ago | (#18775789)

I don't think I could endure a four-hour a week show.

Vista For Forensic Investigators (0)

Anonymous Coward | more than 7 years ago | (#18776135)

"Vista For Forensic Investigators"

Aren't there already too many versions of Visa to choose from?

How's the Vista from there? (2, Funny)

FMota91 (1050752) | more than 7 years ago | (#18776231)

How are they going to find anything looking through Windows?

Know what's interesting? (2, Insightful)

Opportunist (166417) | more than 7 years ago | (#18777189)

Reading those comments, more than the article itself.

Peruse them and you might notice something. Well? Right. A handful deals with the problem of having your notebook stolen, while the majority discusses the effects of it on a search. I.e. more people being concerned of the effects to a search than to having your computer stolen.

Makes me wonder... does it tell me something 'bout the people here or about the governments we live in?

Re:Know what's interesting? (1)

QCompson (675963) | more than 7 years ago | (#18777655)

Reading those comments, more than the article itself.

That's pretty obvious. The article is about Vista and computer forensic investigation. That would be why most of the comments are focusing on a search and seizure situation.
Load More Comments
Slashdot Login

Need an Account?

Forgot your password?

Submission Text Formatting Tips

We support a small subset of HTML, namely these tags:

  • b
  • i
  • p
  • br
  • a
  • ol
  • ul
  • li
  • dl
  • dt
  • dd
  • em
  • strong
  • tt
  • blockquote
  • div
  • quote
  • ecode

"ecode" can be used for code snippets, for example:

<ecode>    while(1) { do_something(); } </ecode>