Re: [sleuthkit-users] Examining RAID-5 with only 1 drive

[Simson L. G. <si...@ac...>]

> The lawyer does not want to give us too many details.  She thinks it
> will damage our impartiality.
> What I have been told: source code files were copied from a remote
> site to the server this drive was on.
> The source code was sent to various other 3rd parties.
> The source code was deleted from the server.
>
> I have been asked: prove it or disprove it.

You can't do either, it turns out. However, you might be able to show that 
fragments of the source code are on the disk that you have.

>>
>> Honestly, I think that you're going to need to bring in somebody who
>> has more experience than you do at this sort of thing.
>>
>
> That's what my boss said, but another manager-type in my department
> assured the lawyers and law enforcement that we could do whatever they
> wanted before my boss even knew about the case or the work needed.

Ah, the real world...