Great, then explain to the class why the brand matter when doing a byte-by-byte copy of one drive to another, assuming the storage capacity on the destination drive is at least as big as the source drive......
I said, ”Digital copies of the hard drives were provided to the FBI,” clearly speaking of the DNC’s servers, which had nothing at all to do with Hillary’s servers; to which you replied... ”yes, but those copies were missing over 30,000 emails, and were what Trump was suggesting the Russians might be able to find.”You’re thoroughly confused.
The hard drive copies were taken from the DNC’s servers. The 33,000 deleted emails were on Hillary’s servers. The two had nothing to do with each other.
“And digital copies are useless.
In order to find evidence of any hacking or illegal correspondence, you need the originals. When things are deleted, they are not wiped off the drive. They are just marked as being able for future writes to be able to write over. They are still there. But when you make a copy, you don't copy the parts that are marked as deleted.”
Too ******* stupid. <smh>
They didn’t create the copies with Windows Explorer, dragging files from one location to another — they did a byte-for-byte copy which duplicates every byte from the source drive onto a destination drive. that includes data from files marked for deletion as well as actually deleted files (except for such data that is overwritten).
The copy contains everything that can be found on the source drive. Which is why the FBI said this was an “appropriate substitute.”
I am not confused at all.
It was someone else who claimed Hillary's email server was hacked and I was the one trying to point out that was the DNC that was hacked, not Hillary.
And no, unless you use the exact same brand, size, and condition of drive, you can't really do a byte by byte copy and have it make any sense. You will be copying the file table as well as just raw data, so then will have extreme difficulty trying to even find files, much less read them.
But the point is it would be easy for people to avoid anything they wanted to delete when doing the copying.
If anyone at the FBI knew what was appropriate, they would be working for a computer company and not the FBI.
Yes, you are completely confused as “those copies” were not “missing over 30,000 email.” Again, those were copies of the DNC servers; while the 33,000 missing email were deleted from Hillary’s servers, not the DNC’s.
As far as your knowledge on hard drives, it really wasn’t necessary for you to exhibit sheer ignorance on the technology. You did get the size correct though, I’ll give you that. The destination drive must have at least as much storage capacity as the source drive, and ideally in this case, would be the same size, but that’s all you got right. And I expect a professional company as CrowdStrike, who are in that industry, know enough to know that.
It doesn’t mater what he was charged with. He could have been charged with milking a cow, which is not illegal. Being charged wouldn’t show it’s a crime. Being convicted does.LOLOL
I showed you the very law which convicted a man for hacking someone’s email account on Yahoo! and here you are, still trying to deny it’s a crime.
The article very clearly said that the charges were for mostly for destroying files.
He was also charged with identity theft.
And here’s the law again under which he was convicted...
18 U.S. Code § 1030. Fraud and related activity in connection with computers
(a) Whoever—
(2) intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains—
(c) information from any protected computer;
... you’ll note, hopefully, that destroying files is not a required element of the section of that law. Merely accessing information from a protected computer without authorization is.
Furthermore, where the article spoke of destroying files — it meant the destruction of his own files as he tried to destroy evidence of his guilt from his own computer. For which he was convicted of obstruction of justice.
So you got that wrong too.
Great, then explain to the class why the brand matter when doing a byte-by-byte copy of one drive to another, assuming the storage capacity on the destination drive is at least as big as the source drive......
And yet, despite your ignorance on the subject, the FBI found the copies an “acceptable substitute.” You’ve not convinced me you know more than they do. And yes, access to raw data is also vital in performing forensics on a hard drive as that is how to view data that was deleted after being sent to the “recycle bin.” Also, if you do a copy like that to a similar sized drive with the same cluster size on both and you plug that into the same OS as the source, the undeleted files and files marked for deletion can be read.I said, ”Digital copies of the hard drives were provided to the FBI,” clearly speaking of the DNC’s servers, which had nothing at all to do with Hillary’s servers; to which you replied... ”yes, but those copies were missing over 30,000 emails, and were what Trump was suggesting the Russians might be able to find.”You’re thoroughly confused.
The hard drive copies were taken from the DNC’s servers. The 33,000 deleted emails were on Hillary’s servers. The two had nothing to do with each other.
“And digital copies are useless.
In order to find evidence of any hacking or illegal correspondence, you need the originals. When things are deleted, they are not wiped off the drive. They are just marked as being able for future writes to be able to write over. They are still there. But when you make a copy, you don't copy the parts that are marked as deleted.”
Too ******* stupid. <smh>
They didn’t create the copies with Windows Explorer, dragging files from one location to another — they did a byte-for-byte copy which duplicates every byte from the source drive onto a destination drive. that includes data from files marked for deletion as well as actually deleted files (except for such data that is overwritten).
The copy contains everything that can be found on the source drive. Which is why the FBI said this was an “appropriate substitute.”
I am not confused at all.
It was someone else who claimed Hillary's email server was hacked and I was the one trying to point out that was the DNC that was hacked, not Hillary.
And no, unless you use the exact same brand, size, and condition of drive, you can't really do a byte by byte copy and have it make any sense. You will be copying the file table as well as just raw data, so then will have extreme difficulty trying to even find files, much less read them.
But the point is it would be easy for people to avoid anything they wanted to delete when doing the copying.
If anyone at the FBI knew what was appropriate, they would be working for a computer company and not the FBI.
Yes, you are completely confused as “those copies” were not “missing over 30,000 email.” Again, those were copies of the DNC servers; while the 33,000 missing email were deleted from Hillary’s servers, not the DNC’s.
As far as your knowledge on hard drives, it really wasn’t necessary for you to exhibit sheer ignorance on the technology. You did get the size correct though, I’ll give you that. The destination drive must have at least as much storage capacity as the source drive, and ideally in this case, would be the same size, but that’s all you got right. And I expect a professional company as CrowdStrike, who are in that industry, know enough to know that.
This is not a 2 person conversation. There are other people claiming it was Hillary's email server that was hacked. And it was Hillary that would not allow the FBI to check for the missing emails or evidence of hacking. Hillary did give the FBI a copy of the drives, but that did not at all help in supplying the missing 30,000 emails.
Of course I was unaware the DNC had also supplied copies of their drives because that makes no sense. If you actually want to find deleted files of evidence of hacking, you need the original drives in the machine they were in at the time. You don't want copies, and copies are not going to do any good.
You don't want RAW bytes because they you have to carefully find and interpret the file allocation tables, and then follow their entries to find the actual sectors. That is very difficult these days because all drives use a virtualization scheme for sectors, so that they can map out bad ones, and implement drive encryption. It is not as simple as just looking at RAW bytes. The interpretation is very difficult unless you perfectly shadow it onto the exact same media, in size, brand, embedded firmware, etc.
I see you’re back to making shit up. Admitting you’re wrong is beyond your character, is it?It doesn’t mater what he was charged with. He could have been charged with milking a cow, which is not illegal. Being charged wouldn’t show it’s a crime. Being convicted does.LOLOL
I showed you the very law which convicted a man for hacking someone’s email account on Yahoo! and here you are, still trying to deny it’s a crime.
The article very clearly said that the charges were for mostly for destroying files.
He was also charged with identity theft.
And here’s the law again under which he was convicted...
18 U.S. Code § 1030. Fraud and related activity in connection with computers
(a) Whoever—
(2) intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains—
(c) information from any protected computer;
... you’ll note, hopefully, that destroying files is not a required element of the section of that law. Merely accessing information from a protected computer without authorization is.
Furthermore, where the article spoke of destroying files — it meant the destruction of his own files as he tried to destroy evidence of his guilt from his own computer. For which he was convicted of obstruction of justice.
So you got that wrong too.
You still don't seem to understand English.
Access a private computer is one thing, but access email on a public server is something completely different.
As an example, consider employers monitoring employee emails.
{...
Answer:
There are two parts to your question: Is it possible for your employer to access your personal emails? And if so, is it legal for your employer to do so?
From a practical perspective, whether your employer has the ability to read your personal emails depends on how it monitors and tracks its computer system. However, chances are pretty good that your employer has the capability to access those messages. Even if you have to enter a personal password to get into your gmail account, it may well be captured by your employer's system.
From a legal perspective, though, the answer is less clear. Virtually every court to consider the issue has found that an employer may read emails employees send using the employer's company email system, even if the employee labels or considers those messages to be private. Many employers adopt written policies stating that work emails are not private and require employees to sign a form acknowledging their understanding of this state of affairs. Even without this extra step, however, courts have found in favor of the employer's right to monitor use of their own email systems.
...}
Can my employer read email from my personal account?
The principle is that emails leave copies on every computer they pass through, administrators need to be able to read these files, so the expectation of privacy on email does not or should not exist
and the drana queens are on ludes n mushrooms.In this bizarre Trump world these people have chosen, you do...
" crime is not a crime..."
We need a mass Exorcism... cuz Satan is winning.... evil is winning .....
“You can likely find the file allocation table and start looking for sectors, but they have not been real physical sectors in many decades.”Great, then explain to the class why the brand matter when doing a byte-by-byte copy of one drive to another, assuming the storage capacity on the destination drive is at least as big as the source drive......
The reason the brand and version of the drive matter is that the mapping of virtual to physical sectors of the drive are dependent upon the embedded firmware scheme. You can likely find the file allocation table and start looking for sectors, but they have not been real physical sectors in many decades. The reasons for this include the ability to map out bad sectors, allow encryption, to allow RAID sort of distribution of sectors so that you can read the next sector off a different platter at the same time you read the previous sector, etc. Sectors used to originally be physical and sequential, but now are virtual and can be distributed for faster access vertically instead of sequentially. It all depends on brand, version, etc. Harddrives have their own processors and complex cache schemes. You would have to reverse engineer the entire scheme in order to read from RAW bytes. You could do that 30 years ago, but not any more.
We have the best investigative cyber division in the world... next to maybe the Russians, who are well trained as well....
Nixon wasn't impeached.
FYI and as mentioned by a poster,
And that is what bothers me the MOST about him, his lies upon lies upon lies upon lies upon lies.... just unadulterated DECEITFULNESS.
And yet, despite your ignorance on the subject, the FBI found the copies an “acceptable substitute.” You’ve not convinced me you know more than they do. And yes, access to raw data is also vital in performing forensics on a hard drive as that is how to view data that was deleted after being sent to the “recycle bin.” Also, if you do a copy like that to a similar sized drive with the same cluster size on both and you plug that into the same OS as the source, the undeleted files and files marked for deletion can be read.I said, ”Digital copies of the hard drives were provided to the FBI,” clearly speaking of the DNC’s servers, which had nothing at all to do with Hillary’s servers; to which you replied... ”yes, but those copies were missing over 30,000 emails, and were what Trump was suggesting the Russians might be able to find.”You’re thoroughly confused.
The hard drive copies were taken from the DNC’s servers. The 33,000 deleted emails were on Hillary’s servers. The two had nothing to do with each other.
“And digital copies are useless.
In order to find evidence of any hacking or illegal correspondence, you need the originals. When things are deleted, they are not wiped off the drive. They are just marked as being able for future writes to be able to write over. They are still there. But when you make a copy, you don't copy the parts that are marked as deleted.”
Too ******* stupid. <smh>
They didn’t create the copies with Windows Explorer, dragging files from one location to another — they did a byte-for-byte copy which duplicates every byte from the source drive onto a destination drive. that includes data from files marked for deletion as well as actually deleted files (except for such data that is overwritten).
The copy contains everything that can be found on the source drive. Which is why the FBI said this was an “appropriate substitute.”
I am not confused at all.
It was someone else who claimed Hillary's email server was hacked and I was the one trying to point out that was the DNC that was hacked, not Hillary.
And no, unless you use the exact same brand, size, and condition of drive, you can't really do a byte by byte copy and have it make any sense. You will be copying the file table as well as just raw data, so then will have extreme difficulty trying to even find files, much less read them.
But the point is it would be easy for people to avoid anything they wanted to delete when doing the copying.
If anyone at the FBI knew what was appropriate, they would be working for a computer company and not the FBI.
Yes, you are completely confused as “those copies” were not “missing over 30,000 email.” Again, those were copies of the DNC servers; while the 33,000 missing email were deleted from Hillary’s servers, not the DNC’s.
As far as your knowledge on hard drives, it really wasn’t necessary for you to exhibit sheer ignorance on the technology. You did get the size correct though, I’ll give you that. The destination drive must have at least as much storage capacity as the source drive, and ideally in this case, would be the same size, but that’s all you got right. And I expect a professional company as CrowdStrike, who are in that industry, know enough to know that.
This is not a 2 person conversation. There are other people claiming it was Hillary's email server that was hacked. And it was Hillary that would not allow the FBI to check for the missing emails or evidence of hacking. Hillary did give the FBI a copy of the drives, but that did not at all help in supplying the missing 30,000 emails.
Of course I was unaware the DNC had also supplied copies of their drives because that makes no sense. If you actually want to find deleted files of evidence of hacking, you need the original drives in the machine they were in at the time. You don't want copies, and copies are not going to do any good.
You don't want RAW bytes because they you have to carefully find and interpret the file allocation tables, and then follow their entries to find the actual sectors. That is very difficult these days because all drives use a virtualization scheme for sectors, so that they can map out bad ones, and implement drive encryption. It is not as simple as just looking at RAW bytes. The interpretation is very difficult unless you perfectly shadow it onto the exact same media, in size, brand, embedded firmware, etc.
“You can likely find the file allocation table and start looking for sectors, but they have not been real physical sectors in many decades.”Great, then explain to the class why the brand matter when doing a byte-by-byte copy of one drive to another, assuming the storage capacity on the destination drive is at least as big as the source drive......
The reason the brand and version of the drive matter is that the mapping of virtual to physical sectors of the drive are dependent upon the embedded firmware scheme. You can likely find the file allocation table and start looking for sectors, but they have not been real physical sectors in many decades. The reasons for this include the ability to map out bad sectors, allow encryption, to allow RAID sort of distribution of sectors so that you can read the next sector off a different platter at the same time you read the previous sector, etc. Sectors used to originally be physical and sequential, but now are virtual and can be distributed for faster access vertically instead of sequentially. It all depends on brand, version, etc. Harddrives have their own processors and complex cache schemes. You would have to reverse engineer the entire scheme in order to read from RAW bytes. You could do that 30 years ago, but not any more.
Thanks again for demonstrating for the forum that you don’t know what the **** you’re talking about.
File allocation tables look at clusters, not sectors...
A sector is a fixed division of a track on a disk. And A cluster is a group of contiguous sectors and basic unit for FAT32 files. The FAT tables in FAT32 provide information about used clusters, reserved clusters, and free clusters. All clusters allocated for a file is organized by FAT tables in a linked list manner .
We have the best investigative cyber division in the world... next to maybe the Russians, who are well trained as well....
What are ya trying to do, impersonate Trump..telling us a bunch of grandiose crud about yourself? The BIGGEST, the Greatest.... the Bestest (sic)
and yes, they know a hell of a lot more than you.... and when they don't, they know who to go to in the private sector, that can help.
A copy of the servers affected is what they used and experts say, this is what is best to use, vs the original server.
Trump's Stupid ‘Where Is the DNC Server?’ Conspiracy Theory, Explained
Even so, what CrowdStrike gave the FBI is likely better than if it had seized and analyzed a physical box.
“To keep it simple, let’s say there’s only one server. CrowdStrike goes in, makes a complete image including a memory dump of everything that was in the memory of the server at the time, including traffic and connections at the time,” Rid said. “You have that image from the machine live in the network including its memory content, versus a server that someone physically carries into the FBI headquarters. It’s unplugged, so there’s no memory content because it’s powered down. That physical piece of hardware is less valuable for an investigation than the onsite image and data extraction from a machine that is up and running. The idea a physical server would add any value doesn’t make any sense.”
What Rid means is that after a hack, some of the evidence of who did it and how they did it may be fleeting. It could be in the server’s memory, the RAM, and not stored on its hard drive. (Hackers use “fileless” malware precisely for this reason.) To preserve evidence in cases like these, incident responders need to make an image—essentially a copy of the server in that exact same state at that exact same time—so they can look at it afterwards. Think about this like when investigators take pictures of the crime scene or victim.
Lesley Carhart, principal threat hunter at the cybersecurity firm Dragos, told Motherboard that physical servers are rarely seized in forensics investigations.
"For decades, it has been industry-standard forensic and digital evidence handling practice to conduct analysis on forensic images instead of original evidence," she said. "This decreases the risk of corruption or accidental modification of that evidence."
I asked Rid if he thought it was suspicious that the DNC did not hand over the actual server to the FBI, and he said “no, not at all.”
Also, the copy of the server hard drives is only step one in the process.... it doesn't tell you much, all the other legwork is where the prosecution/indictments come from....
“To really investigate a high profile intrusion like the DNC hack, you have to look beyond the victim network,” Rid said. “You have to look at the infrastructure—the command and control sites that were used to get in that are not going to be on any server ... looking at one server is just one isolated piece of infrastructure.”
And this is what they did to get this information on the Russian hacks
https://www.justice.gov/file/1080281/download
