TomTom analysis with CAINE (English)
27/09/09 12:13
Clara noticed that TomTom navigation systems are not accessible with hardware write-blocker connected with the forensics workstation and MS Windows operating systems installed, so she developed and tested a methodology that would allow to acquire data stored on these devices without making any changes to them. Helix and CAINE implement the same secure mounting strategy, that mount devices with the options ro, noexec and noatime, making the use of a write-blocker mandatory for legal issue, but not so binding as the experiment required.
The experiment is summarized into a document of twenty-four pages, in which the forensic analyst operates with the confidence to keep the evidence extracted from the TomTom valid for the court.
Here the article by Denis Frati and the PDF with the results of the experiment (ENGLISH - UPDATE!).
