Las Vegas Shooter’s Laptop Missing Its Hard Drive

[Fishrrman]

roamer wrote:
"And it is not hard to alternatively boot windows. But it is hard to alternatively boot windows as a mini and run software that connects to the camera, and the networking (VPN tunnel through an onion) to send an encrypted and diffused data stream."

Not on the Mac.
I can produce a boot volume on nearly ANY storage device, that will be the equal of any OS installed on an internal drive, HDD or SSD.

A Mac doesn't care from where it's booted -- only that the boot volume have "what's necessary".

Again, I never touch PCs/Windows. Have no idea what's possible there.
But I know the Mac (30 years' experience).
This is easy-peasey on the Mac side of things.
(An academic point, since Paddock was probably using Windows...)

[roamer_1]

Maybe. Let me toss this out as a possible scenario. GF or her family member kidnapped by Abu Sayef in PI, demands shooting event in addition to cash for ransom and requires proof. He has to destroy evidence of that connection (cover that track to PI). Failure to do so will result in execution of hostage(s). To cover tracks he pulls thumb drive, tosses it out the window and suicides after shooting.
That would assume he acted alone. There is a lot here that would make more sense if he did not.

I know, bad thriller novel material, but one possible scenario.

Yeah, I have had similar thoughts. It's a crazy reach... but plausible as anything. Normally folks who do this kind of thing have an itch to scratch, and want to tell you about it. Or they're nucking futz - which, as your initial observations declared, puts any sort of behavior on the table...

But setting that aside, one must ask, what's the point?

Quick question, If he had streamed video would there still have been temporary files on his computer unless he disposed of the HDD?

Depends on the software, but yeah. Much easier to set the temp directory inside of an encrypted container, and when complete, reformat that container and change the access password that is the key to the encryption. if the former and latter keys are well constructed, and you have a fair buttload of files to dump into it after the fact, no one will figger that spaghetti out. Barring a handy coal fire, that's how I would do it... And it would be about as fast as pulling the hdd out and finding some means of disposal.

[Smokin Joe]

Yeah, I have had similar thoughts. It's a crazy reach... but plausible as anything. Normally folks who do this kind of thing have an itch to scratch, and want to tell you about it. Or they're nucking futz - which, as your initial observations declared, puts any sort of behavior on the table...

But setting that aside, one must ask, what's the point?

Depends on the software, but yeah. Much easier to set the temp directory inside of an encrypted container, and when complete, reformat that container and change the access password that is the key to the encryption. if the former and latter keys are well constructed, and you have a fair buttload of files to dump into it after the fact, no one will figger that spaghetti out. Barring a handy coal fire, that's how I would do it... And it would be about as fast as pulling the hdd out and finding some means of disposal.

Wouldn't that leave an IP to trace to, though? Near as I can figure, he just wanted an easy way to make sure no one could read where the video was going. If that's the case (and the HDD wasn't removed by someone else, either before the police got there, or afterwards), that would be a sure way for someone who isn't well versed in the possibilities to get the job done quickly. Likely, if he did it, it went out the window.

That reeks of something to hide, not some great 'cause', in which self-disclosure would be hampered, not enhanced by the drive being removed. It just doesn't fit the 'lone warrior for a cause/nutcase' profile. Smells more like either he was performing under duress, had a cohort who removed the drive to conceal information, or it was subsequently removed to cover something like a sting gone bad. (Not discarding, but not endorsing any of those possibilities).

[roamer_1]

Wouldn't that leave an IP to trace to, though?

Generally, no. At least not if there's an onion router involved.

[roamer_1]

Likely, if he did it, it went out the window.

Or down the drain. yep.

That reeks of something to hide, not some great 'cause', in which self-disclosure would be hampered, not enhanced by the drive being removed. It just doesn't fit the 'lone warrior for a cause/nutcase' profile. Smells more like either he was performing under duress, had a cohort who removed the drive to conceal information, or it was subsequently removed to cover something like a sting gone bad. (Not discarding, but not endorsing any of those possibilities).

Yeah, it smells. I can't put my finger on it either, but I agree with you.

[edpc]

Wouldn't that leave an IP to trace to, though?

Perhaps.  Maybe that's how police found this...........

http://www.gopbriefingroom.com/index.php?topic=287986.new#new

[roamer_1]

Again, I never touch PCs/Windows. Have no idea what's possible there.
But I know the Mac (30 years' experience).
This is easy-peasey on the Mac side of things.
(An academic point, since Paddock was probably using Windows...)

Yes, it is likely academic - If he is a hacker (in the real sense), he'd likely use Linux. I sure would. If he was forced, or someone made it for him, or if he was doing it for himself with normal knowledge, likely it was Windows.

And to be fair to the academic point, I would imagine Win can run from about anything now too - A full version, I mean. I have yet to come to grips with the size of thumb drives nowadays. It is an interesting idea though, and a fun project to find out this winter. Anymore, that might actually be easier than hacking a mini down. I will probably be pursuing that angle, once the snow flies and I sit back down at my dev box...

 

[Smokin Joe]

Perhaps.  Maybe that's how police found this...........

http://www.gopbriefingroom.com/index.php?topic=287986.new#new

Okay, I'm gonna ask a question. How would they know his search history if the hard drive was gone?

Wouldn't all those files be on the Hard drive?

It seems to me, and correct me if I am wrong, please, that the only other way would be to be already monitoring his activity on the web, which would mean they were already watching the guy for whatever reason, whether part of an investigation or part of a sting, and monitoring his web activity.

Either way, if the shooter was being monitored, someone should have had some sort of idea of what he was up to?
That article spent a lot of column inches saying how much they were spending, how many people they were talking to, they were working overtime, etc--all of which reminded me of the FBI recap of the Flight 800 investigation, (which despite all they did, failed to interview ANY of the 140+ people who saw something going up, before the plane came down.)

Call me cynical, but I don't expect to see many, if any, answers out of this, and I won't likely have a lot of faith in the ones I see.

[roamer_1]

Okay, I'm gonna ask a question. How would they know his search history if the hard drive was gone?

Wouldn't all those files be on the Hard drive?

No, and you were adequately answered in the link to the other article.
Your ISP is required by law to retain some giant amount of your habits (I think 7 years)

It seems to me, and correct me if I am wrong, please, that the only other way would be to be already monitoring his activity on the web, which would mean they were already watching the guy for whatever reason, whether part of an investigation or part of a sting, and monitoring his web activity.

The ISP keeps history, all the major search engines keep history (if you sign into them, or if you don't clean your cookies regularly), and I am getting toward being certain that MS is keeping history - all on their servers, not your machine.

But, that all might be false too - someone else could have signed into his accounts and built this history over a long period of time (for instance if his girlfriend were actually an activist and using him).

One thing it does show is that he, himself, is not a hacker.

If ouy are doing something you shouldn't on the web, you do it from a laptop with a Linux OS, mac address spoofer, and an onion router, and absolutely *NO* identifying info onboard... Some folks keep a spare drive just for such purposes. Flip out your normal drive, flip in the war drive, go find a hotel, coffee shop, or unprotected wifi down in town somewhere, and assume your fully aliased ID.

Never EVER from home, and never using your normal aliases and logins.

He is likely not a geek.

and don;t ask me how I know.

[Smokin Joe]

Thanks for clearing that up.

The flip side is: If you aren't a hacker you have no privacy on line, but we  assume that part.

[roamer_1]

Thanks for clearing that up.

The flip side is: If you aren't a hacker you have no privacy on line, but we  assume that part.

That's right. But there are things you can do... Use an anonimizer page as your home page and surf from there... or at least StartPage, which so far, claims it isn't tracking (everyone should be doing this anyway)...

Don't use 'signed on' services for email and searching, and clean your machine with CCleaner (to remove temp files and cookies) a couple times a week. (everyone should be doing this anyway)

and no messaging or email should be considered any safer for info than a post card.
If you have sensitive info to impart, let your friends and loved ones know ahead of time by other means of a password you will use... And then create the info in a separate doc, compress it as an arj zip using the password you gave them, and attach it to a standard email... Or PGP or OpenPGP encryption is fine (encrypted email provision) is fine, except the key has to be transmitted differently than email - normally by eyeball as I said (and both ends need the capability).

There are ways... but, yeah.

[Victoria33]

Thanks for clearing that up.
The flip side is: If you aren't a hacker you have no privacy on line, but we  assume that part.

@roamer_1
@Smokin Joe

I just said on another thread, perhaps he had more than one computer, that I have FOUR.  With the money he had, he could have as many as he wants, plus pads, plus stuff on his phone.