2 Jan
2014
2 Jan
'14
2:45 p.m.
On 01/02/2014 12:30 PM, Robert P. J. Day wrote:
friend of mine many years ago used to do that -- while working full-time for a company, he created a separate filesystem on the company server for his own stuff that he would mount manually.
any forensic analyst that would be fooled by something like that would be a total incompetent.
No, you've got it backwards. Your friend put things on a separate file system that wasn't normally mounted. (Why isn't that partition mounted? Let's mount it and take a look.) I'm suggesting the exact opposite: unmount the partition with normal data on it to hide your data. Still, your second comment may well be true; that's why I'm asking.