Re: How difficult is it to clone a HD?

On Sat, 26 May 2007 22:17:27 +0100, Palindr?me <me9@xxxxxxxxxxx>
wrote:

That would still be diverting staff from higher priority work.

No, it wouldn't. The cloning and a preliminary automated sector scan
to find obvious evidence of a crime and record the CMOS is usually
carried out by minimally trained people within a few weeks of the
seizure. Recording the accuracy of the RTC really *shouldn't* be
delayed for long. It's the full investigation (forensic data
analysis) that takes the time. Making two copies of a HDD doesn't
have to take any longer than making one copy.

Those "minimally trained personel" should still be employed on the
highest priority work - unless the place is over-staffed and
over-equipped at the tax-payers' expense.

The same argument tht is used to argue that police should not
prosecute speeding offences at all because there are more serious
crimes to solve. It doesn't wash. The person who clones the disks
would not be otherwise doing things that would make the processing of
the higher priority cases any quicker.

It would take very few man-hours, which is all that matters. Plug the
suspect's HDD and a clean HDD to a copying device and press the
button. Thereafter it can be left unattended. Sure the police would
need to have sufficient clean HDDs to temporarily replace the seized
ones, and sufficient copying machines to cope with the volume, but it
is insignificant manpower.

It isn't *all* that matters. Copying machines are expensive, have
limited life (especially as technology has moved on), need workshop
space, etc.

Their cost is trivial compared to other expenses, and so is the space
they take up. The hardware technology needed has only changed once
(in a way that is not backwards compatible) in the past 20 years
AFAIK, with the introduction of SATA drives.

Are you suggesting that resources be diverted to give an owner back his
access to his movie collection, as a priority over giving a small
businessman back his access to a 2Gbyte system containing his records
and accounts?

I am suggesting that resources be found so that *all* people (suspects
or not) who have had equipment seized are inconvinienced as little as
possible.

Define "as little as possible". Not taking the equipment at all?
Returning it within minutes? Within days? WIthin weeks? It has to be a
balance between cost and benefit.

Returning it within weeks would be what I would consider a reasonable
*and practical* goal.

Perhaps some sort of priority based on quantity? Up to 1Gbyte, you get
the machine back next day..but if you have a RAID array with half a
dozen 500Gbyte drives, you get it back in six months?

Like I said, the RAID array requires very little additional man-hours
to clone. 5 additional presses of the "copy" button.

That isn't the point - it is what the turn around time should be.. Which
does depend on there being an empty machine with a button to press.

As I said, sufficient machines should therefore be available. I'm not
sure how long it takes to complete the copying of the largest HDD
available after the button is pressed, but I'd be surprised if it was
as much as 24 hours.

The priority must surely depend on the impact of the loss.

And who decides how serious the impact of the loss is?

The police. They know what evidence they are expecting to find and how
urgently they need it and can estimate what the probability of it being
there is. They know, from the owner, what the effect of not having the
system will be. They and only they can prioritise the work.

Again, personally, I would not want to divert resources unless the lack
of that hardware was causing me significant difficulties.

Even if most of the equipment has absolutely no evidential value and
won't be looked at by the police again? Such as your monitor,
keyboard, mouse and the computer itself after a trivial copying of the
CMOS?

I could hide GBytes of storage device in a mouse, a keyboard or a
monitor - particularly if they were all USB. I'm sure that you could too..

A visual inspection *without* taking the unit apart could ascertain
whether most devices are *likely* to have hidden storage devices
inside. I admit that having a USB connector makes that more difficult
- though in this age of wireless networks there is no need to have any
external connectors at all. But where do you draw the line with such
possibilities? Does the fact that your living room furniture, fridge
and cooker also provide ample opportunity to hide storage devices
justify seizing them for over a year as well? Or ripping the walls
apart in case there are stroage devices hidden therein?

After all, a person who is sufficiently clued up and paranoid enough
to contemplate hiding storage in a mouse or monitor would probably
instead opt for something that s/he knows is not likely to be seized
as computer equipment at all.

Why? I have never understood why work should *always* be considered
more important than anything else. Is that really our main purpose
for living? How depressing if it is. If anything, I would expect a
business to have better contingency plans to get up & running after a
loss of equipment (whether by police or disaster) than the average
home user.

Because loss of work means loss of earnings, which can result in loss of
business, loss of house, etc. You might expect what you say - I don't.
Most small businesses that I know have zero contingency planning.

And most small businesses could recover from the loss by the owner
putting in a lot of extra effort to recover the data. The loss of
earnings will be insignificant. It will probably create a way to
fiddle the VAT a bit with plausible deniability.

So you'd be happy to forfeit £5000 of equipment for over a year
because nobody is willing to find 30 minutes to copy your CMOS and
return it?

I don't have 5000GBP worth of computer equipment. Most home users don't
either. Most one-person businesses don't either.

You'll be surprised. I'm talking about the replacement value. Most
people have built up their equipment over a period of time and don't
realise how high the total replacement cost has become. I'd guess
that the average home computer setup would cost over £2000 to replace
with a like-for-like, and a significant number would cost over £5000.

If they took all my computers, I could provide all the computer assets I
need for <100GBP. So, no, I wouldn't be too fussed about it. I'd be
very, very fussed if they stripped out my workshop of tools and plant.
It does affect my ability to work and earn and would cost many thousands
to replace. But general purpose computers are cheap as chips.

The majority of home users I know need something more than a £100 PC
to do what they need - because their main use is gaming or video
processing, both of which require a pretty decent spec of machine, and
they also use the latest MS operating systems and would be lost if
they had to revert to something that is capable of running on a £100
PC.

So you think it is more important for you to get your paper delivered
without having to re-register than a year of a person's recreation?

I think it more important that he doesn't go out of business, lose his
shop and home, yes. He wouldn't even be able to bill me, or his other
customers, for the papers and magazines we have had over the last month
or so, without his blasted computer.

Unlikely to have that drastic a consequence. He would be able to
determine the majority of people who owe him money by putting in a bit
of effort.

When you say they seize mouse, keyboard and monitor - they can be
temporarily replaced with second hand ones for very little and very
quickly.

But the police are not going to use them! The only reason they are
seized in the first place is because the officers searching the house
are not deemed to be sufficiently trained to discriminate, and are
instructed to take everything (in case an external drive is in the
monitor or disguised as a mouse, perhaps). And why should *I* have to
pay anything at all? Perhaps the police should stock loan
replacements if it is not possible for some strange reason to let you
have the originals back within a reasonable time.

The owner should provide a statement of the effect of being deprived of
the system. The police should provide an intended date for return, based
on the effect and their other priorities.

That would certainly be a step in the right direction. As the
situation stands, the equipment is effectively lost for good. The
police routinely keep it for over a year. Anyone who has managed
without replacing the equipment in that time can't have much use for
it.

I could also argue that evidence that can wait a year to be collected
cannot be associated with a particularly urgent case.

Centrally set targets for average and maximum delays are an option.
There could be a compensation scheme.

I'm not a fan of targets. I'd like to see a time limit set on the
holding of property without charge. As it is, we have "detention
without trial" for people's property.

The OP has already done so, IIUC. If they seized something
"irreplaceable", eg the suck/blow computer input device that one of my
tetraplaegic clients uses - that would be a different matter.

And why should a tetraplegic's ability to operate a computer be more
important than your newsagent's ability to retrieve his customer base?
Will the tetraplegic lose money, home or livlihood if deprived of
their computer? - you see I'm not sure how you are applying the
priorities. On the one hand you say that a work-related computer is
more important than something a person uses merely for their own
convenience, but now you appear to be saying that the convenience of a
person is more important if that person happens to be handicapped.

I am talking generally, and not just about the OP. You may not think
that me being without entertainment for a year is more important than
the local newsagent being unable to deliver papers for a few days, but
I certainly do.

If that source of entertainment was vital to the owner, then that would
be included in the statement of effect and would be taken into
consideration. Supporting documentation from his GP, etc could be
included. It may be that the police would have to fund loan machines in
exceptional cases.

Come off it! The fact is that the police *do not care* how much a
mere civilian is inconvenienced - and we even had a policeman on this
ng claim that they go out of their way to cause inconvenience for a
suspect.

No. In general the police should ensure that they obtain the
resources necessary to inconvenience *nobody* significantly. In this
case the resources to clone disks in a short time would be trivial. I
could clone a TB a day on the equipment I have at home, and doing so
would take about 10 minutes of my time in the morning for the first
500GB, and another 10 minutes in the evening for the second 500GB. A
single person with a small amount of training and a few thousand
pounds of equipment could easily clone over 100TB a day.

Define "significantly". Of course if there was significant impact, such
as the owner's health deteriorating or losing his business, then the
police should ensure that the delay is minimal. Those are the
priorities. For the rest, they can wait their turn, money spent on
additional cloning facilities are far better spent on other aspects of
policing.

I'm sure we could all survive if our house was stripped bare. Does
quality of life count for nothing?

I don't see what's so impractical at all. How many HDDs do you think
you could clone a day if you had several dedicated disk copying
machines at your disposal? I am certain that you could even build
such machines from very low-spec second-hand PCs without thinking
about it or spending more than you could afford as an individual.
Sure, it would cost to have a stock of HDDs to copy to, but they are
recyclable so it's a one-off bulk purchase.

You know and I know that the police cannot use home-built low-spec
second hand PCs for this purpose. Particularly if they need to clone
multiple copies simultaneously. COuld you produce a one to many cloning
machine from such bits and pieces?

I could build a device to clone 3 IDE HDDs from one using a 10 year
old motherboard.

It isn't that simple. Purpose built
cloning machines cost thousands and I do not want them sat idle at my
expense, in case the police one day may have a need for them...

The police routinely use software and hardware of dubious origin in
their investigations - it is one of the gripes of independent forensic
experts. The only thing that has to be shown wrt a cloning machine to
allow its use is that there is no chance that it made any changes to
the original drive. I am 100% certain that I could supply 3-way
cloning machines for IDE and SATA for £500 each and make a handsome
profit (so long as I had an order for 100 or more). A bit extra for
the small percentage of machines needed with SCSI drive capability.
30 such units could be stacked easily in a standard 19" rack. That
would give the capability to clone 60TB a day at the very least. if
the police are seizing more than that, I don't see how they could
possibly be close to getting through the investigations.

I donot accept that the police have a right to inconveniece people
beyond what is *absolutely* necessary.

Then you live in a strange World. My local police station is now closed
until Monday morning. It closed over lunch. That is inconveniencing
people. Inconvenience is determined by budgets and priorities, not
necessity. If there are a few tens of thousands going spare in the
police budget, I'd rather they kept the shop open lunchtimes than fill a
room full of duplicating equipment..

What I accept and what I have to put up with are two different things.

Whilst I do not regard a few days inconvenience of his to outweigh a
year of lost recreation for me (or you).

It wouldn't be a year of lost recreation for me, or, I suspect you. It
would be a minor inconvenience for me. If I was that fussed, I'd be in
the city market the following day and have a working machine at home by
noon - and a wallet 50GBP lighter. I'd rather spend that 50GBP that way
- than 50GBP on the rates to achieve what you want.

I would replace my equipment as well - but it would cost me quite a
bit of money because I want to do things with mine that require
something with a non-trivial specification. I could get up & running
on usenet within hours. Getting my home cinema back and my video
editing would take quite a bit longer.

--
Cynic

.