Hacker News new | past | comments | ask | show | jobs | submit login

The ACPO (Assoc. of UK Police dept's) doesn't ban live recovery, it just says you have to do it with an approved process and an approved tool, which rather validates the basic idea behind Cofee.

Suffice it to say, the US isn't as weird about live recovery. The idea that an untrained LEO should unplug a target computer from the wall is very 1990's-era guidance.




Yeh I know you have an easier time of it in the US.

ACPO guidelines are awkwardly worded at best; CPS asks us to steer clear of live work. This is the crucial line: In exceptional circumstances, where a person finds it necessary to access original data held on a computer or on storage media, what person must be competent to do so and be able to give evidence explaining the relevance and the implications of their actions. LEO's hate the idea of what exceptional circumstances could mean. And for the most part none of the police seizing machines have the competence to explain what they did and the implications.

Most of the hi-tech crime SOP for law enforcement here (which was co-written originally by my current boss) asks to avoid live acquisitions.

I obviously cant be specific but very few cases involve live data (of this type) and those that do usually never make it to court or are dismissed fairly quickly.

(the main problem are defence teams with no technical knowledge who hire "specialists"; they will nitpick at every process undertaken if they can't pick at the evidence. This happens a lot and live evidence would be a field day for them)




Consider applying for YC's Fall 2025 batch! Applications are open till Aug 4

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: