George, You raise some very good points! I firmly believe that more research needs to be done in analyzing all the mechanism being used for memory acquisition, not just firewire. This is the reason that we have started the Memory Forensics Tool Testing (MFTT) initiative. It is our hope that you will be willing to combine your experiences with ours to make this a valuable contribution to the community. On that note, did you ever do more research into the issue discussed on Boileau's website or would you care to provide more details about the discrepancies and the testing methods used? As we have discussed previously, I think the question of evidentiary value is a little more complicated. How would you recommend that evb acquire a sample of memory given his situation? Based on the possibility of the aforementioned discrepancies, is it better that he not collect a sample of memory? Do you think that this administrative action would be based solely on an artifact extracted from the memory sample? I typically try to acquire as many artifacts as possible using the "best" mechanisms available. While being cognizant of the evidential issues and appreciating their importance, I typically try to focus on the technical aspects since I'm not a lawyer. That is why I pay them the big bucks! Thanks again for your insightful email and we are greatful for your contributions to the list. AW On Tue, 8 Jul 2008, George M. Garner Jr. wrote:

evb, I am sorry for the confusion but I wasn't referring to a court case. Rather I was referring to a single firewire memory "image" that was sent to me for analysis. I was able to determine from some kernel variables that the operating system on the "suspect" computer would not have been able to run if the "image" was accurate. We simply don't know the reason why the firewire memory "image" was corrupt. Was it a bug in Boileau's python code, or a bug in the Linux firewire driver, or a bug in that particular firewire chipset? I haven't had time to research the acquisition method further. To my knowledge no one has bothered to follow up with the sort of basic research that would establish the parameters under which this acquisition method may be used reliably. Your problem is that the only published report is that firewire memory acquisition is unreliable, which may place you in a difficult position should you choose to rely on it. If the "prohibited pictures" are CP then you should turn the case over to your local law enforcement who may have capabilities that are not available to you. Sorry that I cannot be of more help. Regards, Rossetoecioccolato.