Pieces0310

取证须让证物说话,莫妄以自我心证来给案情下定论.切忌画靶射箭,为找而找. 取证的根基仰赖经验与判断,在IT各领域的经验愈丰富,愈能看出端倪. 取证须善用工具,但不过度依赖工具.工具只能帮你缩小可能范围,但无法告诉你答案,仍需靠人进行分析判断.

首页 新随笔 联系 订阅 管理

Line is getting more and more popular in recent years. Lots of peope use Line, so do "Suspects". That's why we have to keep an eye on it if any new features added. I just browse Line Engineers' Blog(http://developers.linecorp.com/blog/?p=3660) and find a interesting news - "Line 5.3 add new features - "True Delete" ".

 

They claim that the purpose is to protect privacy. I can't agree more, but what about mobile forensics... Self-deconstruct and encryption has been a very big challenge to forensic guys.."True Delete" is even worse...UFED/XRY used to recover Line deleted messages well, but now I can't imagine how difficult it will be.

 

posted on 2015-08-27 11:53  Pieces0310  阅读(421)  评论(0)    收藏  举报