A Comprehensive Forensic Analysis of WINVote Voting

### Forensic Post-Mortem of the AVS WINVote At 00:00, Professor Carsten Schürmann presents an in-depth forensic investigation of the decommissioned AVS WINVote direct-recording electronic (DRE) touchscreen voting terminal at the Voting Village. Schürmann examines how flawed voting technologies persisted in American elections for over a decade.

### Deployment History and Decertification At 04:45, Schürmann reviews the history of WINVote deployments. Manufactured in the early 2000s, these paperless touchscreen machines were used in municipal, state, and presidential elections across multiple jurisdictions until state authorities decertified the hardware in 2015 following catastrophic security failures.

### Digital Forensics with Autopsy At 09:51, the presentation explores the forensic methodology used to examine extracted WINVote hard drives. Utilizing open-source forensic tools like Autopsy, Schürmann reconstructs partition tables, recovers deleted log files, and audits the system registry to evaluate the machine's operational history.

### Catastrophic Architectural Security Vulnerabilities At 14:12, Schürmann reveals the compounding security flaws discovered in the hardware and software stack. The machines ran an unpatched Windows XP Embedded operating system, utilized default hardcoded database passwords (`admin1`), stored votes in cleartext Microsoft Access databases (`vote.mdb`), and maintained unsecured ad-hoc Wi-Fi interfaces that allowed remote administrative compromise from parking lots outside polling stations.

### The Role of Paper Trails and Risk-Limiting Audits Concluding between 18:52 and 25:00, Schürmann emphasizes the vital importance of voter-verifiable paper audit trails (VVPAT) and post-election risk-limiting audits. He stresses that independent paper records are essential to verify election outcomes when electronic voting machines suffer hardware failures or malicious tampering.

(AI summary — Gemini Flash)