(07-18-2018 03:09 PM)Owl 69/70/75 Wrote:  

(07-18-2018 02:37 PM)UCF08 Wrote:  So there seems to be a lot of people here saying the physical server is important, but I’m not seeing exactly why they think that matters.

It's not that the physical server itself is important, and that's where people are misunderstanding. A true and correct copy can certainly be made, and can certainly provide as much data as the original. The problem, is not proving that such a copy CAN BE made, it's proving that such a copy WAS made.

The normal procedure is either to have law enforcement take control of the server and make copies, or to have a disinterested third party come in and make the copy. For now, all we have is CrowdStrike's assertions, and there is a legitimate question whether CrowdStrike is sufficiently objective to meet evidentiary requirements.

The copy certainly could be, and might very well be, complete and accurate. But that's not the issue. Proving that to the standard required to authenticate for admissibility in court is another matter entirely. And that's where the problem lies. At worst, it could make the copy, and anything obtained from it, inadmissible in court. At best, it will certainly provide credible grounds for attacking any evidence flowing from the copy.

And the further problem is that with nearly two years gone by and no proper custody chain, even if you went back to the physical servers at this point that wouldn't solve the evidentiary problem.

As someone suggested earlier, when you have a breach the three steps in order of precedence are 1) contain the damage, 2) get back up and running, and 3) figure out who did it and take appropriate action. The DNC's approach to 1) and 2) was certainly reasonable in the circumstances, but it may well have precluded 3). The way to avoid having to make such choices is to take adequate security measures up front.

Information security has never been a strong point of the Clinton organization. From Sandy Berger to Hillary's server to this, there is a pattern of cavalier attitudes toward information security. This one bit them in the butt.

Server, copy, whatever. Doesn't matter if it isn't studied be smart cyber forensics SMEs.

Sent from my SM-G955U using Tapatalk