- subscribe to this site
The Tale of the Tape
Posted by Mark on Sep 24, 2008
Well really the title should read, “The tale’s on the tape”
Computer forensic investigation stories tend to focus upon what has been found on so-and-so’s hard disk drive how, despite attempts to eradicate the incriminating data, the dastardly plot was foiled and we can all get back to the Malt bar and eat Scooby Snacks. But where else, other than the local hard drive, can the information you’re looking for be found.
Something that can be overlooked is the archive of backup tapes. OK, Gary Glitter probably did not have a StorageTek robotic library to which copies of his nasty collection were regularly archived, but in cases where the data involved is stored on business systems often part of the investigator’s job is being done each night by the IT department writing all data that exists on the system off to tape. It does not matter then how well any disk erasure technique is applied, the data is in the archive and there until the backup cycle comes round again.
For corporate internal investigations there is another great benefit from working through the archive. Often there are IT personnel who are part of the group being investigated, or whom you do not wish to put under the pressure of knowing that they have colleagues being investigated. The moment work begins to seize data from PC and Server systems the whole operation is blown wide open, everyone knows what is going on.
With a sensible backup procedure, data is archived each day and transported off-site so a whole wide ranging investigation can be undertaken without alerting or offending anyone, and without any disruption to the daily running of a business. The whole tape data recovery process can be undertaken off-site.
The data from hard disks is valuable, certainly the most up to date, and often all that is needed to secure a result. What the tape archive can give you though is an orderly chronological step back through the history of data, often with access to data that has been eradicated from the local systems, and that can be examined at your leisure without any disruption.
