These are great points. Thanks!
Yes. So Cellebrite should be writing the data to write-once storage prior to performing any analysis of the content. In absence of write-once media, they are betting that the hashes they capture will be the same every…
This is a problem, but I don't think Moxie would do this as it could make him liable for evidence tampering. If the protection mechanism applies to the device being scanned, its a defensive measure, if it is applied to…
I'm not a lawyer, but my understanding is the best time to present exculpatory evidence is after the prosecutor has prepared their case. In theory, if the investigator doesn't notice the tainted data and the case is…
The modified content would be on the Cellebrite system. And the investigator may not notice until much later. The write blocker has no effect when the reader is exploited. You are correct that the source system would…
Imagine you opened the folder and made a Xerox copy of the documents, but the words or dates in the copies never match the original documents. The crazy thing about this attack, is the person making the copy may never…
claiming that porn on your device isn't yours is not the problem. the theoretical problem is if you received porn via Signal on 04/01/2020 2:23AM but Cellebrite says you received it on 04/26/2020 5:34PM (while in…
The reason for this is chain of custody. They should be able to prove that from the time that the person last had the device until the point when the evidence was collected, no one modified it. And from the point where…
These are great points. Thanks!
Yes. So Cellebrite should be writing the data to write-once storage prior to performing any analysis of the content. In absence of write-once media, they are betting that the hashes they capture will be the same every…
This is a problem, but I don't think Moxie would do this as it could make him liable for evidence tampering. If the protection mechanism applies to the device being scanned, its a defensive measure, if it is applied to…
I'm not a lawyer, but my understanding is the best time to present exculpatory evidence is after the prosecutor has prepared their case. In theory, if the investigator doesn't notice the tainted data and the case is…
The modified content would be on the Cellebrite system. And the investigator may not notice until much later. The write blocker has no effect when the reader is exploited. You are correct that the source system would…
Imagine you opened the folder and made a Xerox copy of the documents, but the words or dates in the copies never match the original documents. The crazy thing about this attack, is the person making the copy may never…
claiming that porn on your device isn't yours is not the problem. the theoretical problem is if you received porn via Signal on 04/01/2020 2:23AM but Cellebrite says you received it on 04/26/2020 5:34PM (while in…
The reason for this is chain of custody. They should be able to prove that from the time that the person last had the device until the point when the evidence was collected, no one modified it. And from the point where…