Re: ACturd @Camberwick Green
Ah, I see you're sticking with your your usual level of offering and adding nothing to the conversation. This is my surprised face, honest.
It's no different to your contribution to the debate tbh, Matt. I see you unequivocally support the idea that deletion of data =: destruction of evidence, without stopping to ensure that the data in question has been properly classified as (or should be classifed as) "evidence" first.
In the absence of any warrants requesting that data, and in the absence of any arrest and/or charges, any data is not classifiable as "evidence", and thus can be freely destroyed without consequence. Imagine a file called "test.txt" containing the 4 characters "test" (created to ensure that SMB share permissions are functioning correctly). Is deleting that file a criminal offense? Since you have provided no clarification to your assertion that removal of any data is obviously destruction of evidence, I'll have to assume you think it is, even though the idea that deleting a test file is "destruction of evidence" will sound somewhat ludicrous to most people.
Unless you care to clarify your assertion, so that we can ensure that we are on the same page as regards which data is actually "evidence" (aka data which is legally definable as evidence with respect to the "destruction of evidence" offense), and which data is not and can be freely removed without fear of sanctions?
Note that blanket assumptions that all data is considered protected as evidence sounds just a little bit totalitarian. I'm hoping you've thought it through a little better than that :)
Biting the hand that feeds IT
