RE: does anyone know? - evidence of MOS
posted on
Jun 01, 2006 01:37PM
SRT06,
I followed that discussion and was surprised nobody discussed this more indepth than they did. Here`s one take on it, and I`m guessing this is how an investigator from edig might begin.
One of the things touted about MOS is how it handles read/write functions in a manner that eliminates the need to move large chunks of data and something called ``erase blocks.`` It can apparently read/write/erase at the cell level, as opposed to manipulating complete sectors.
It seems to me that one can devise a very specific set of tasks to be executed on a device. These steps would probably include starting with an unformatted or freshly formatted card, to be followed by a succession of file manipulations. Load a particular set of files, erase some, load more, edit the file if the device does that. Probably there would not have to be a lot of steps involved, but they have to be done with a data set that has been tested precisely on a MOS device.
When the steps are done, one should be able to examine the flash storage module for evidence of MOS usage. This would be revealed in the way the data is laid out on the storage card. Somebody familiar with the MOS internals would know exactly what to look for. If they find it, then they could use that evidence to get legal involvement to gather more certain evidence.
Wolfy