Witness for the Prosecution

Computers are serious business tools, but sometimes they also support business delinquency. So, how do you go about questioning a computer? Authentec, a U.K. data-recovery company, now has an answer: Do it at the sector level of the BIOS, and don't change a single bit.

Authentec has developed a portable file server that allows investigating authorities to make a replica, or image, of a target computer system at the site of an alleged crime. Called FlightServer , the system runs NetWare 3.12 and copies a hard disk, sector by sector, without interfering with the target system. Once this image has been taken, it can then be investigated at the prosecutor's office using Authentec's forensic software package, which indexes all a hard disk's secto rs, including lost chains, and automatically sets up libraries of words relevant to the case.

The company says that the biggest problem for prosecutors of computer crime is not the technical reliability of the FlightServer system but the computer ignorance of most judges. Despite today's sophisticated digital image-manipulation techniques, judges still trust a photo more than a sector-by-sector image of a hard disk.

---

The Inspector at Work

photo_link (23 Kbytes)

Inspector FlightServer at work.