Richard Bejtlich has a
post about a court case that a friend (Dave!) will probably find interesting. It's about a court case that the prosecution lost because they didn't understand current theory about MD5 collisions. In other words, they couldn't prove that a picture
hadn't been tampered with after it had been taken.
In the same post, Richard points out a project by Harlan Carvey, who visits here now and then: the Forensic Server Project. His book also has a supporting site: http://www.windows-ir.com. I highly recommend visiting all three.
No comments:
Post a Comment