back tracing

lol lol :lol: No, I really felt like it was hacking for a moment. But then who cares.

The real security guys (or hackers) are the ones who invented those brilliant tools. I just pretend that I know by saying it's there

"The one who talks doesn't know and the one who knows doesn't talk".

Jackei chan once said that.

If the hacker makes news headlines ...he has much to learn.

If the hacker goes unnoticed and sneaks away into the mist of the night ...he is l33t. I couldn't resist typing it out! :lol:

I think Sahirh will be able to contribute loads on this topic. From my limited experience the issue is not just about getting information out of the PC to prove what was done, it's about preserving the analysed system so that it is unaffected by your forensic activites and so can be used to provide evidence that will be admitted in court. If the defence can prove there's even a chance your investigations have altered the system or its contents then the whole thing becomes inadmissible as evidence. One of the first things they do therefore is simply yank the power cable - don't even let them log off and shut down. That way you still have the swap file, registry etc there on disk completely unaffected by the shutdown. Then they remove and image the disk without ever starting the machine up again. Then, and only then, can you begin to think about investigation

Smurf should also be able to contribute lots on this topic

My Security+ book touched some on this topic (of course I don't remember the details), and it basically said exactly what TheBishop mentions.

Because you'll eventually be taking the case to court to have the case examined by lawyers and other law officials, you'll have to approach and handle the case as if it were an official investigation (i.e.: gather and save evidence, examine evidence, record all activities done with the evidence, etc)

...Of course, if you have NO intentions on taking the case to court or pursuing any kind of legal activity, then I'd think that you could approach the issue as you would wish.

ah ha! now the lawyers and the judges take over and reduce all the bits and bytes into the desicated vanacular of their trade. These guys dont know the secret behind mathematics can they really comprehend?


Bishop
for your information, I have decleared sahir wanted a very long time ago.anyone who has any info about his whereabout should report to the closest post in www.firewall.cx dont attempt to apprehend , you all know about his deadly samurai sword :lol:

sose

If you have any intention of pursuing legal action against the person then I wouldn't touch the computer. Place it into a secure location and notify the authorities.

If that's not the purpose then have at it.