Safeguards For RIAA Hard Drive Inspection

NewYorkCountryLawyer writes "In SONY v. Arellanes, an RIAA case in Sherman, Texas, the Court entered a protective order (PDF) that spells out the following procedure for the RIAA's examination of the defendant's hard drive: (1) RIAA imaging specialist makes mirror image of hard drive; (2) mutually acceptable computer forensics expert makes make two verified bit images, and creates an MD5 or equivalent hash code; (3) one mirror image is held in escrow by the expert, the other given to defendant's lawyer for a 'privilege review'; (4) defendant's lawyer provides plaintiffs' lawyer with a 'privilege log' (list of privileged files); (5) after privilege questions are resolved, the escrowed image — with privileged files deleted — will be turned over to RIAA lawyers, to be held for 'lawyers' eyes only.' The order differs from the earlier order (PDF) entered in the case, in that it (a) permits the RIAA's own imaging person to make the initial mirror image and (b) spells out the details of the method for safeguarding privilege and privacy."

Comments

Digital Forensics - a tough issue

[mulhollandj]

Digital forensics is a very tough issue as laws are somewhat immature and judicial precedence over what is acceptable and what isn't, isn't set yet. What is considered in plain sight on a hard drive? These questions haven't been fully answered yet and it is going to take at least one high profile case before it is done. And always remember to use a write blocker when examining somebody else's hard drive. Even booting into Windows will change the timestamps on a lot of files which might allow the theory of the evidence being planted.

Safeguards I use

[hardburlyboogerman]

1.A loaded S&W .357 for use on the RIAA trolls trying to gain access to my house.(Under Ky Law I may defend my personal property using deadly force if I deem it necessary)
2.A good self destruct device (easy to built and arm) for the hard drive(renders it absolutely useless to any forensic expert,since it physically destroys the platters.)
3.I use an external drive to store the MP3 and other multimedia files on.Easily hidden,(like the old Varmit XL1000 CB Linear amps of decades past)
Anyone wanting to seize my machine will pay dearly for trying.I just don't give a damn anymore since I had the nervous breakdown last year.
That way,If the RIAA does get the machine,it will turn to scrap before they can get it 2 miles away.Paranoid? Sure,but with the corruption of the courts these days,these steps are needed.

Re:Initial image by agreed experts, not RIAA

[maxume]

TrueCrypt inside of TrueCrypt.

The inner volume can be hidden, and the creators believe that it is robust enough that it can not be identified if you don't know it is there.

http://www.truecrypt.org/