<?xml version="1.0" encoding="UTF-8"?><rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
		>
<channel>
	<title>Comments on: Beyond Hard Drive Forensics</title>
	<atom:link href="http://philosecurity.org/2009/03/16/beyond-hard-drive-forensics/feed" rel="self" type="application/rss+xml" />
	<link>http://philosecurity.org/2009/03/16/beyond-hard-drive-forensics</link>
	<description></description>
	<lastBuildDate>Mon, 13 Feb 2012 22:08:27 +0000</lastBuildDate>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
	<generator>http://wordpress.org/?v=3.3.1</generator>
	<item>
		<title>By: JP</title>
		<link>http://philosecurity.org/2009/03/16/beyond-hard-drive-forensics/comment-page-1#comment-4505</link>
		<dc:creator>JP</dc:creator>
		<pubDate>Sat, 21 Mar 2009 05:49:51 +0000</pubDate>
		<guid isPermaLink="false">http://philosecurity.org/?p=1139#comment-4505</guid>
		<description>&quot;If someone purposefully changed their MAC address, that would make it harder to link network activity to their specific network card.&quot;

Time to link the IP with the user, and have a firewall for &quot;inside&quot;
Solutions start to emerge, like http://www.edenwall.com/-Presentation,2-.html (based on nufw)</description>
		<content:encoded><![CDATA[<p>&#8220;If someone purposefully changed their MAC address, that would make it harder to link network activity to their specific network card.&#8221;</p>
<p>Time to link the IP with the user, and have a firewall for &#8220;inside&#8221;<br />
Solutions start to emerge, like <a href="http://www.edenwall.com/-Presentation,2-.html" rel="nofollow">http://www.edenwall.com/-Presentation,2-.html</a> (based on nufw)</p>
]]></content:encoded>
	</item>
</channel>
</rss>

