Slashdot Mirror
Safeguards For RIAA Hard Drive Inspection
NewYorkCountryLawyer writes "In SONY v. Arellanes, an RIAA case in Sherman, Texas, the Court entered a protective order (PDF) that spells out the following procedure for the RIAA's examination of the defendant's hard drive: (1) RIAA imaging specialist makes mirror image of hard drive; (2) mutually acceptable computer forensics expert makes make two verified bit images, and creates an MD5 or equivalent hash code; (3) one mirror image is held in escrow by the expert, the other given to defendant's lawyer for a 'privilege review'; (4) defendant's lawyer provides plaintiffs' lawyer with a 'privilege log' (list of privileged files); (5) after privilege questions are resolved, the escrowed image — with privileged files deleted — will be turned over to RIAA lawyers, to be held for 'lawyers' eyes only.' The order differs from the earlier order (PDF) entered in the case, in that it (a) permits the RIAA's own imaging person to make the initial mirror image and (b) spells out the details of the method for safeguarding privilege and privacy."
Oops, article's at http://www.torontosun.com/News/Columnists/Bonokosk i_Mark/2007/04/20/4078973.html
I'm wrong - in fact I get the feeling that it's now important that MD5 is NOT used. NIST (an authority when it comes to forensic investigations) do *not* recommend the use of MD5 checksums. The grandparent was perfectly correct. A decent summary (sorry PDF) is here
Assuming you really do have something to hide, using an encrypted volume embedded within another encrypted volume could be very useful. TrueCrypt supports nested encrypted file systems and since TrueCrypt uses no headers to demarcate its volumes, it is not possible to determine if an additional volume is embedded within a TrueCrypt volume. In effect, it provides plausible deniability of the existence of a 2nd embedded volume if you're forced by court order to decrypt the main volume. (stick some Creative Commons licensed mp3 files in the main volume though, just to throw the RIAA the middle finger a little more.)
Better yet, support non-RIAA artists at sites like Magnitune. The quality of music I've found there is proof positive that the RIAA no longer has a legitimate purpose in the music industry.
My tips for installing TrueCrypt on Fedora Core 6.
Well, in one case they are demanding to image and search the hard drives and all MP3 players of the son of a defendant, who lives miles away, and claims to only have a desktop system at home that he uses for his job as a legal assistant (i.e. large amount of confidential files there). They're trying to do this because, having searched his mother's harddrive and found ABSOLUTELY NO EVIDENCE of illegal activity on it, and only assumed that they were given the wrong hard drive, and are now on the hunt for the correct one that they're sure exists.
In the RIAA's twisted logic, he has either taken his desktop (not notebook/laptop computer) to his mother's house miles away to do illegal filesharing on her Internet broadband account, and then taken it home again, or REMOVED HIS HARDDRIVE and transported it over and back to infringe on record company copyrights. This theory, they feel, allows them to now search his hard drive -- or, I would expect, anyone within 4 degrees of separation from the defendant -- and all music players as they wish. While I believe this was finally ruled unreasonable and unlikely to produce admissible evidence, they now are fighting their best to avoid paying his legal bills that he entailed explaining this bit of common sense to them.
So in answer to your question: Yes!
"It's the height of ridiculousness to say for those 9 lines you get hundreds of millions."
I think not telling him would be excellent grounds for a reckless endangerment charge even if he's not injured. If he's killed you could potentially be charged with manslaughter or even murder. A really aggressive DA might even be able to argue first-degree murder, saying that your decision not to tell him while leading him to the booby-trapped computer constituted premeditation.
So, yeah, there's a law against it.
Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.
I doubt that the amount of damage caused by such an incident would cause much damage.
First, there is a much lower chance of corrupted data when the drive heads are parked, as they would be as you hand the bare drive to someone.
Second, it would take several heard crashes to cause data loss, as there would have to be significant damage to the platters.
Third, professional date recovery companies can recover much of data from non-working drive, up until the point where a large majority of the physical platters are destroyed.
Hard drives are resilient units... my experience:
1. Running notebook dropped 1.5m onto concrete. Result = no data loss
2. 80gb SATA drive carried for two weeks in an external pocket of a messenger bag. Result = MD5 hash same as previous hash
3. Hard drive recovered from structure fire. Result = successful professional data recovery.
4. Running notebook with remote ignition trigger for Thermite. Result = 2204 degreeC fire, platters physically destroyed, no data recovered. (See it at The Broken
If anyone wants to look up that case it's UMG v. Lindor.
Ray Beckerman +5 Insightful
Preferably with a live CD that always mounts things read-only. Helix from e-fense.com is a well known one.
Be aware that some file systems have counts of how often they've been mounted that increment even when you mount read-only, which is all it takes to make a hash change. Hardware write blockers are not strictly necessary but are handy. Make sure the one you use has been through real testing, preferably your own.