Court Sets Rules For RIAA Hard Drive Inspection

NewYorkCountryLawyer writes "In a Boston RIAA case, SONY BMG Music Entertainment v. Tenenbaum, the Court has issued a detailed protective order establishing strict protocols for the RIAA's requested inspection of the defendant's hard drive, in order to protect the defendant's privacy. The order (PDF) provides that the hard drive will be turned over to a computer forensics expert of the RIAA's choosing, for mirror imaging, but that only the forensics expert — and not the plaintiffs or their attorneys — will be able to examine the mirror image. The forensics expert will then issue a report which will describe (a) any music files found on the drive, (b) any file-sharing information associated with each file, and any other records of file-sharing activity, and (c) any evidence that the hard-drive has been 'wiped' or erased since the initiation of the litigation. The expert will be precluded from examining 'any non-relevant files or data, including ... emails, word-processing documents, PDF documents, spreadsheet documents, image files, video files, or stored web-pages.'"

Comments

This can't be true...

[stephanruby]

This makes way too much sense.

Wiping the Hard Drive After Litigation

[Anonymous Drunkard]

(c) any evidence that the hard-drive has been 'wiped' or erased since the initiation of the litigation.

Just curious: Let's say someone wanted to do just that - wipe or erase the hard drive since the initiation of the litigation.

Theoretically, couldn't a person just set the BIOS clock to a date and time prior to the legislation, do multiple shreds and formats on the HDD, reinstall the OS with the BIOS clock still 'in the past', and have it seem as though nothing changed since the initiation of the litigation?

It would seem to me that if the BIOS clock was set to a prior point, that everything else on the HDD would follow. The BIOS clock has no intuitive knowledge of time, it only knows what it's told.

All theoretical, of course. No one would actually do such a thing, of course...

Re:Wiping the Hard Drive After Litigation

[Anonymous Coward]

Posting anonymously because, well, you'll see.

I have personally nailed people for trying such a thing. One guy had to pay my fees and the fees of the attorney, another I believe spent a month in jail (the destruction was just the straw that broke the camel's back). In civil matters, destroying evidence means that whatever was there was far worse and far more damaging than anything currently residing on the drive. Lawyers can get away with that because they can say whatever they like and you have no way of proving them wrong.

As for your question, a wiped drive is fairly obvious, unless you set your bios clock 100's of times and do stuff incrementally, create a range of files with chronological creation/modification/access times, populate the event logs with a smooth span of times, and not leave any smoking guns (windows xp pro on a dell?), you're probably gonna get nailed if the forensics expert is worth his paycheck. By the way, when you copy a file across a file system, from one drive to another, it gets a new creation time, so if all the files were "created" on a single day, that was when they were migrated over.

The forensics expert is allowed to look at file system data and registry data as long as he can justify that its to detect just the kind of scenario you've stated, and its within the domain of his orders. Hell, he theoretically can click through every picture, document, and file on the drive if he creates a new forensic case aside from the official one and doesn't tell anybody about it. (thats bad, don't do that).

By the way, if I was ever faced with such a situation, I'd plug my hard drive is as an external, scrub the offending files, blow away the registry, destroy the file system, and take a soldering iron to the circuit board so that they have to do a clean room recovery which will result in a partial image for analysis. I'd present that drive along with a new drive, repaired and what not to the court and say my hard drive crashed and that they can have at it if they like.

This makes my blood boil

[Smidge207]

While I admire people fighting the good fight, this is EXACTLY what makes court so dicey. If you get some judge with his head up the RIAA's ass and you are going to lose no matter how good your case is. The PROPER thing to do in a case like this is to have both parties agree on who examines the drive. One more thing, five days doesn't seem like a lot of time to examine a tech report for improprieties.

=Smidge=

Although it sounds plausible

[joeflies]

I would guess the penalties for the destruction of evidence and the manufacturing of new evidence would land you in significantly more trouble, no?

Re:Our laws are not even wrong

[earlymon]

Fuck me, I'm not done. Even Judge Judy knows better than this.

Plantiff: "You honor, she stole my CDs when she moved out. A friend saw her carrying out boxes plus who else would have done it?"
Judge Judy: "Ms. X, did you take his CDs?"
Defendant: "No, judge. I did not."
Judge Judy: "I'm sorry, Mr. Z, but you have no proof. Under the law, there's nothing that I can do."
Plaintiff: "Your honor, please - how about a warrant to search her home, business and all of her friends' and family's home - then I'll have proof."
Judge Judy looks at Bert, narrows her eyes, admonishes the idiot to get a life because he's clueless and the law doesn't exist for him to conduct witch hunts and we fade to commercial.

Tell me how my point isn't any simpler than that. How in the fuck did we come to this as a people? Why in the fuck are any of us laying down for this?

My anger may be getting the better of me, but maybe that anger helps fuel my weak brain. How did we condone Gitmo? How did we let the Patriot Act and Warrantless Wiretapping go on?

How does the fucking camel get into the tent? He sticks his nose in first. Civil warrants to search hard drives have existed for more years than I can recall. That could very well be the camel's fucking nose.

Now - how in fuck do we fix this?

Re:Maybe the courts are starting to get it

[bzzfzz]

Welcome to the courts. It's the same way with a DUI prosecution or an eviction proceeding or Walmart throwing the book at some store clerk for theft by conversion of a 99-cent tube of Chap Stick. In the RIAA cases as in every other there are ample opportunities for the defendant to do and say stupid things that create trouble for them later. That's why people need attorneys. Yes, it's expensive. Tough. And so it has always been, read through Moll Flanders (public domain edition available for free at Project Gutenberg) to get the idea.

With the RIAA cases, the other side of the coin is that, as long as the cases are handled fairly, they are too expensive for the plaintiffs to pursue. Last time I checked, the pockets of the corporate sponsors behind the RIAA not exactly of limitless depth. Absent the ability to bully people into $5000 out-of-court settlements with an hours' work by a nickel-ante paralegal and a penny-ante "investigator," a fair case with the court costs and attorney's fees will far exceed any civil penalties that the RIAA is likely, on the average, to collect. And absent the threat of an unwinnable case with six-figure damages, the PR battle moves from Pyrrhic to simply pointless.

Re:You're wrong

[NewYorkCountryLawyer]

They will do everything they can to bend the laws until they crack, but they won't plant evidence. NYCL can correct me....

You must be new here.

You're asking ME to back you up on your claim that the RIAA would not pick a forensics expert who would stoop to such a thing? The same RIAA which has employed MediaSentry to send out millions and millions of slightly corrupted mp3 files, and then sued tens of thousands of people for having those files on their computers?

You must have me confused with someone else.

Every time I think I've found a level to which even the RIAA would not stoop, I wind up being proved wrong.