United States News
See other United States News Articles
Title: Las Vegas shooter's laptop missing its hard drive
Source:
ABC News
URL Source: http://abcnews.go.com/US/las-vegas- ... g-hard-drive/story?id=50709285
Published: Oct 25, 2017
Author: Jack Date, Mike Levine, Pierre Thomas
Post Date: 2017-10-25 14:48:35 by nolu chan
Keywords: None
Views: 6342
Comments: 85
Las Vegas shooter's laptop missing its hard drive By Jack Date A laptop computer recovered from the Las Vegas hotel room where Stephen Paddock launched the deadliest mass shooting in U.S. history was missing its hard drive, depriving investigators of a potential key source of information on why he killed and maimed so many people, ABC News has learned. Paddock is believed to have removed the hard drive before fatally shooting himself, and the missing device has not yet been recovered, sources told ABC News. [snip]
Mike Levine
Pierre Thomas
ABC News
Oct 25, 2017, 12:15 PM ET
Post Comment Private Reply Ignore Thread
Top • Page Up • Full Thread • Page Down • Bottom/Latest
Begin Trace Mode for Comment # 43.
#2. To: nolu chan, Willie Green (#0)
The hard drive might have been removed well before the massacre. To monitor his video cameras and do casual web browsing, he could do it all with a Linux LiveCD or memory stick.
You've thought this one out, huh? Why connect dots that aren't there? Even you are stretching on this. Why would someone so supposely cold-blooded and unemotional give flying eff about his hard drive contents? "Embarrassment"? Why not also then consider David Copperfield's involvement? Penn and Teller? Or, how about THIS: Paddock is a patsy?... ...And this was and still is an Op. Or is that as impossible as 911 being an Op? Or JFK?
Paddock was locked in and alone in the room. If you aren't aware of it, disassembling laptops and removing their hard drives and reassembling them takes some time. Even someone who is fast would take at least a half hour, I think. Paddock was smart enough to know it is better to leave no tracks. With a LiveCD, you can be sure there are no cookies, not hidden supercookies, no viruses, no trojans or remote control botnet programs, etc. Lots of paranoid people use old laptops this way with a LiveCD. Or they use a USB memory stick, either locked (so nothing is saved) or unlocked and set up to function exactly as a hard drive would work. Paddock seems determined to leave behind no evidence and leave a lot of questions, to remain a man of mystery and murder. He was planning for post-massacre fame.
I'm guessing that you've never used a bump fire rifle to open up a laptop? It's not like he was trying to preserve the data for future generations. He could smash it an' bash it, whatever it takes. What with government incompetence and all, it took the FBI/Fusion Center team two weeks or so to "lose" the hard drive. The private sector is much more efficient. The Fusion Team has come up with so many tall tales, that it's difficult to believe their latest lone wolf stories anymore. Why bother to take out the HD, just lose the whole laptop?
It took the FBI very little time to find the hard drive. It took them weeks to decide it had to be "lost."
And you base this on what evidence (other than sheer conjecture)?
Evidence that I have not gone senile yet. The very first thing they do in computer forensics is mirror the hard drive and write block it. Then they work off the mirror image. Bill Nelson, Amelia Phillips, and Christopher Steuart, Guide to Computer Forensics and Investigations, Fourth Edition, Curse Technology, Cengage Learning, 2010, page 174,
And you think that proves that the FBI made the hard drive disappear deliberately. Whatever. If that's your position, we don't have much to discuss at all. The problem with subscribing to many different CTs to explain the world is that you quickly snowball into a requirement of tens of thousands or even millions of conspirators plotting to keep the truth from the public. It would include witnesses to the events, victims (crisis actors), relatives, police, EMTs, doctors/nurses/hospitabls, morticians/staff, coroners... the list is huge even for just one supposed false-flag event like Vegas. But if that is the case, why do you watch the news at all? If they can fake Vegas (and the JFK assassination and the moon landing and 9/11 and Newtown and aliens at Roswell, etc.), then they can just fake anything so nothing is newsworthy at all. Do you own that book or have access to a physical copy of it? How do you know it's not a fake book intended to deceive people like you trying to penetrate the veil of secrecy that apparently is the primary work of the entire federal government? If you just found that off the internet, you can't prove there is a book or that it was written by persons named Bill Nelson, Amelia Phillips, and Christopher Steuart.
It means they have known for about four weeks that they did not have the hard drive. Do you own that book or have access to a physical copy of it? How do you know it's not a fake book intended to deceive people like you trying to penetrate the veil of secrecy that apparently is the primary work of the entire federal government? If you just found that off the internet, you can't prove there is a book or that it was written by persons named Bill Nelson, Amelia Phillips, and Christopher Steuart. I own that book, physical copy, and more on the topic of computer forensics. I do not believe all my books are fake, or that they cannot be found at places like Amazon or Barnes & Noble. However, you are entitled to your conspiracy theory kookery that I have suddenly begun inventing sources. I also own a physical copy of the companion book, Lab Manual for Guide to Computer Forensics and Investigations, by Andrew Blitz, 2011. This covers use of the AccessData ProDiscover imaging tool, and states at page 46, Objectives During the process of seizing a storage device, investigators use imaging tools to create a forensic copy that can be safely analyzed without the danger of damaging or deleting potential evidence. The forensic image is an exact copy of the original evidence, including any unallocated space or bad clusters. In addition, the imaging process creates a hash signature of the original and the duplicated copy to validate the scientific imaging process and ensure that no file has been omitted or changed in any way. The two hash signatures are compared with each other, and if they match, the copy is considered legally identical to the original. The forensic copy maintains the chain of custody from the time the seized device was imaged until the end of the investigation. In addition, the information obtained by the various tools applied to the evidence will be listed in a report that can be examined during the trial by investigators and court personnel. I also own a physical copy of Eoghan Casey, Computer Evidence and Computer Crime, Forensic Science, Computers and the Internet, Third Edition, Elsevier, 2011. Chapter 6, section 3, para 6.3.4, page 210 states; I also own a physical copy of Steve Bunting, EnCE, The Official EnCase® Certified Examiner Study Guide, Second Edition, Sybex, 2008. At page 110 it states, EnCase® is used to create usable evidence files, commonly called images. This is the first step in the lab. If the computer is found in an on state, the first step is to photograph a clear copy the screen to document the on state. Other concerns, such as the on computer being networked, create some more to document before turning the computer offf and taking it to the lab. I also own a physical copy of EC-Council|Press, Computer Forensics, Investigation Procedures and Response, Volume 1 of 5 mapping to C|HFI™, Computer Hacking Forensic Investigator Certification, Course Technology, CENGAGE Learning, 2010, which states at page 3-17, For digital evidence, forensic principles are generally enforced. The National Institute of Justice (2004) describes these principles. Depending on the type of case and media, the corresponding examination methodologies are used. Proper training must be given to those who conduct examinations. For conducting examinations, examiners must: Analysis of recovered data involves interpreting the data and putting it into a logical and useful format (for example, determining how the evidence got there, what it means, and where it came from). Analysis is the phase in which acquired data turns to evidence. When conducting the evidence examination, the following steps should be taken into consideration: Proper forensic holds, (1) "examiners must use accepted procedures, and (2) avoid using the original evidence." They make a copy of the zeros and ones on the original media that is verified. One of the verifications is a hash analysis. I have said nothing of Las Vegas having been a false flag event.
Good. Then you aren't a full-blown kook. They did some major clampdown on releasing any info. Apparently, the mean comments on Twitter were making the Clark county sheriff cry too much or something. So given how any info has been reduced to a trickle, maybe it isn't a surprise that it took weeks for the missing hard drive to be mentioned to the public. We have no other info on whether the laptop was found powered on or not. If it was booted with a LiveCD or USB flash drive, then Paddock would have had to shut it off. Maybe he would but you have to wonder if his desire to be a Man Of Mystery was strong enough as he prepared to shoot himself in the head after shooting over 500 people.
#45. To: Tooconservative, nolu chan, Deckerd (#43)
Good. Then you aren't a full-blown kook. Lol@ The Erasure engaging in a Alinsky-ite blitzkrieg of "KOOOOK!!" Someone here counted the number of instances TC used the word "kook" since Vegas." I find it hard to believe, and haven't counted myself, but I hear it's near a hundred. And btw, this case has ALL the gravy and trimmings that make up a "False Flag." (It's not our fault The Mechanics make it obvious. And you connect Official Fairy Tale phantom dots.)
We don't have evidence that Paddock was using a LiveCD or USB flash drive. He did not have to shut it off, the computer could have been found in the on state. He could have wanted to be a Man of Mystery because he was an asset of the ATF/FBI/CIA or somesuch acting as an arms dealer. He seemed to do well for someone with no claim to employment. There is no compelling evidence that Paddock shot anyone, or that he shot himself. If it was Paddock's body, somebody shot him. So far, there is an official story with little evidence provided.
Top • Page Up • Full Thread • Page Down • Bottom/Latest
#5. To: Tooconservative (#2)
The hard drive might have been removed well before the massacre. To monitor his video cameras and do casual web browsing, he could do it all with a Linux LiveCD or memory stick.
#7. To: Liberator (#5)
#11. To: Tooconservative, Liberator (#7)
disassembling laptops and removing their hard drives and reassembling them takes some time. Even someone who is fast would take at least a half hour, I think.
#22. To: hondo68, Tooconservative, Liberator (#11)
What with government incompetence and all, it took the FBI/Fusion Center team two weeks or so to "lose" the hard drive.
#23. To: nolu chan (#22)
It took the FBI very little time to find the hard drive. It took them weeks to decide it had to be "lost."
#40. To: Tooconservative (#23)
(Edited)
And you base this on what evidence (other than sheer conjecture)?
Processing and Handling Digital Evidence You must maintain the integrity of digital evidence in the lab as you do when collecting it in the field. Your first task is to preserve the disk data. If you have a suspect computer that hasn't been copied with an imaging tool, you must crete a copy. When you do, be sure to make the suspect drive read only (typically by write-blocking device), and document this step.
#41. To: nolu chan (#40)
(Edited)
Then they work off the mirror image. Bill Nelson, Amelia Phillips, and Christopher Steuart, Guide to Computer Forensics and Investigations, Fourth Edition, Curse Technology, Cengage Learning, 2010, page 174,
#42. To: Tooconservative (#41)
And you think that proves that the FBI made the hard drive disappear deliberately.
Then they work off the mirror image. Bill Nelson, Amelia Phillips, and Christopher Steuart, Guide to Computer Forensics and Investigations, Fourth Edition, Curse Technology, Cengage Learning, 2010, page 174,
Lab 4.1 Data Acquisition in ProDiscover
To many practitioners in digital forensics, the preservation step is where digitla forensics begins. It is generally the first stage in the proces that employs commonly used tools of a particular type. The output of this state is usually a set of duplicate copies of all sources of digital data. This output provides investigators with two categories of exhibits. First, the original material is cataloged and stored in a proper environmentally controlled location, in an unmodified state. Second, an exact duplicate of the original material is created that will be srutiniz3ed as the investigation continues.
Following best forensics practices, I typically conduct examinations or analyses on copies of the original evidence. In this manner, I preserve the original, protecting it from alteration or corruption. The copy of the original evidence is more commonly called an image. For this image to be a copy and the legal equivalent of the original, it must represent a duplicate image of the original. This, every one and zero on the original must be replicated on the copy or image. In this chapter, I'll discuss the various methods of acquiring the original evidence and rendering from it an image upon which you can conduct your forensic examinations.
Evidence Examination
The problem with subscribing to many different CTs to explain the world is that you quickly snowball into a requirement of tens of thousands or even millions of conspirators plotting to keep the truth from the public. It would include witnesses to the events, victims (crisis actors), relatives, police, EMTs, doctors/nurses/hospitabls, morticians/staff, coroners... the list is huge even for just one supposed false-flag event like Vegas.
#43. To: nolu chan (#42)
(Edited)
I have said nothing of Las Vegas having been a false flag event.
It means they have known for about four weeks that they did not have the hard drive.
Replies to Comment # 43. ("I have said nothing of Las Vegas having been a false flag event.")
#46. To: Tooconservative (#43)
We have no other info on whether the laptop was found powered on or not. If it was booted with a LiveCD or USB flash drive, then Paddock would have had to shut it off. Maybe he would but you have to wonder if his desire to be a Man Of Mystery was strong enough as he prepared to shoot himself in the head after shooting over 500 people.
End Trace Mode for Comment # 43.
[Home] [Headlines] [Latest Articles] [Latest Comments] [Post] [Mail] [Sign-in] [Setup] [Help] [Register]