Court Sets Rules For RIAA Hard Drive Inspection

NewYorkCountryLawyer writes "In a Boston RIAA case, SONY BMG Music Entertainment v. Tenenbaum, the Court has issued a detailed protective order establishing strict protocols for the RIAA's requested inspection of the defendant's hard drive, in order to protect the defendant's privacy. The order (PDF) provides that the hard drive will be turned over to a computer forensics expert of the RIAA's choosing, for mirror imaging, but that only the forensics expert — and not the plaintiffs or their attorneys — will be able to examine the mirror image. The forensics expert will then issue a report which will describe (a) any music files found on the drive, (b) any file-sharing information associated with each file, and any other records of file-sharing activity, and (c) any evidence that the hard-drive has been 'wiped' or erased since the initiation of the litigation. The expert will be precluded from examining 'any non-relevant files or data, including ... emails, word-processing documents, PDF documents, spreadsheet documents, image files, video files, or stored web-pages.'"

Comments

Re:Wiping the Hard Drive After Litigation

[Todd Knarr]

They could, but it's easy to get tripped up. For instance, one of the default settings in Windows XP is to synchronize time to a network time server belonging to Microsoft. If you weren't careful to keep the machine isolated during the install and all patching, you'd end up with a big discrepancy in timestamps as the clock jumped forward to the correct time during the last part of the install process. It'd also show up in the timestamps on patches, they might show as having been installed before they were issued or they'd be all lumped together at the very end when they should've been installed in a steady stream starting at the claimed install date and getting progressively more recent as patches were applied automatically. It might be hard to prove exactly when the drive was wiped, but it'd be easy to show that the fingerprint of the timestamps doesn't match what it'd be if the drive was as old as it claimed to be and had aged at 1 second per second since then.

Re:You're wrong

[NewYorkCountryLawyer]

This makes way too much sense.

Nope. Letting the RIAA pick the "forensics expert" does absolutely nothing to ensure that a fair and impartial expert is chosen. I'd think all that would do is make it very easy for the RIAA to set up a forensics lab of their own that could potentially plant evidence on the mirror copy. Then what do you do? They could always claim that your copy, which is minus the planted evidence, was "tampered with". I see no good out of this, but if NewYorkCountyLawyer disagrees, I would welcome an opportunity to be educated out of my error here.

No, while I think the order otherwise "makes sense", I happen to agree with you 100% on your point that the RIAA should not be able to unilaterally pick the forensic examiner. I think that is a mistake on the judge's part. As I pointed out in TFA:

Unlike the protective order (pdf) in SONY BMG Music Entertainment v. Arellanes, this protective order permits the RIAA to unilaterally select whatever expert it chooses, rather than an independent, mutually agreeable, expert.

I think that is unfortunate. I'm hoping the judge comes to recognize that oversight.