Security disassembling equip to inspect HD

[Jay95]

Hi All,

Just wondering if anyone else has experienced airport security staff disassembling equipment and removing and checking hard drives from checked in luggage?

Not that I'm particularly concerned, except for the fact they didn't reinstall the hard drive correctly!!

I have a MediaGate MG25 that I take with me on work trips, loaded with XVid movies (and backed up pictures) I use it to ease the boredom if I'm stuck in the hotel for a night.

The last time I took it with me was a Canb-Bris-Gold Coast round trip last August and I haven't used it since. Today I grabbed it out to do another backup of my photos to it and it wouldn't work. I disassembled it to find that the hard drive had been removed and when they reinstalled the hard drive the pins weren't lined up correctly with the mount and it had jumped a set of pins - thus not working.

It was an easy fix to pull it out and install it correctly and no files were corrupted at all.

The device has a USB plug on the back (and a USB lead was in the bag with it) although instead of plugging it in via the USB they decided to disassemble it and manually remove the hard drive.

I have no problems at all that luggage is scanned and if needed opened and searched, it's just a process that needs to be done these days, although I'm a little surprised that they went to the effort of disassembling the unit to remove the hard drive to, I presume, inspect the contents of the drive.

Anyone else had an experience like this?

Oh, they must've been quick because my luggage wasn't late at all

 

[rwatts]

Whenever possible when doing forensic examinations of any HDD I remove it from the computer or external enclosure and directly connect it to a hardware write-blocker.

It is possible (at least with Win XP SP2+) to set a registry value that makes a USB device read-only but I've only verified it with flash drives and not HDDs. In any case its a lot easier to tell a jury that "this little box stops any information from changing the drive" than to convince them that it can be done through software settings.

Taking a copy of a HDD - especially modern drives of multiple 100s of GB - takes time and would have noticeably delayed your luggage. The drive however could be quickly "previewed" via the blocker and any sign of prohibited content would then result in confiscation and forensically sound copying.

It does seem strange though to have happened on a domestic trip and would not have thought airport security would have any reason to do anything like that. I've only heard of this sort of thing happening when passing through customs.

Sure you havnt attracted the attention of any police or other agencies ?

Richard.

 

[Commuter]

It might simply have looked on the x-ray like something other than what it actually was, so they wanted to have a look inside.

Or, it might have dislodged itself through rough handling by baggage handlers. I have had some bizarre damage happen to my things without external damage to bags, cases etc.

 

[Jay95]

Thanks for the replies guys,

Lol, naa I haven't had any problems or reason to attract attension from the police or anyone else in the past. I dare say it would've come up on the xray as a metal box so they've had a quick look, found nothing and packed it up and sent it on it's way.

The reason why they have removed the HDD makes sense now from what you've said Richard, given that if they find prohibited things of the drive they would need to ensure the evidence will hold up in court etc.. Next just time tell your work mates to reinstall the HDD correctly

 

[Mal]

Thanks for the replies guys

I can't see any reason whilst in Domestic Transit, a hard drive case would be opened.

Like rwatts, I know bits and pieces about this field, and agree with all of his comments.

I can only suspect that as Commuter says, the drive had been shaken around and dislodged. If this is not possible, then I assume *someone* somewhere has accessed the drive.

Whether that's ASIO, your employer or just someone playing with the drive (eg children) - cannot say.

 

[Jay95]

I was thinking about this last night, I did lend the unit to a friend to view some photos and even though she would have no interest in pulling the unit apart, I wouldn't put it past her son to 'see how it works' as he is a total IT geek freak and at that age.. lol

 

[rwatts]

I was thinking about this last night, I did lend the unit to a friend to view some photos and even though she would have no interest in pulling the unit apart, I wouldn't put it past her son to 'see how it works' as he is a total IT geek freak and at that age.. lol

That would certainly seem to be a very plausible and most likely explanation.

Richard.

 

[Commuter]

I was thinking about this last night, I did lend the unit to a friend to view some photos and even though she would have no interest in pulling the unit apart, I wouldn't put it past her son to 'see how it works' as he is a total IT geek freak and at that age.. lol

Ah, that sounds most plausible, and far more 'comfortable' explanation than some faceless government official rooting through your personal items.

 

[Jay95]

Yep, that be true. Given, as mentioned above, that it would be very unlikely that a HDD would be inspected on a domestic route I dare say that curiosity and temptation of my friends son has got the better of him and he's taken a look...

Next time I'll coughey trap it, or put a note in it saying "James - put it back together and don't touch it again" lol