Indiana Court Rules Melted Down Hard Drive Not Destruction of Evidence

An anonymous reader writes An Indiana court has ruled that a hard drive that was sent to recycling was not destruction of evidence. The ruling stems from a BitTorrent file-sharing case filed by Malibu Media where a defendant claimed that his hard drive had failed thanks to heavy use. Malibu claimed that the act was destruction of evidence and filed a motion demanding a default judgement. The court denied this motion suggesting that because the hard drive failed, there was no evidence to destroy in the first place.

Comments

Hello microwave

[Anonymous Coward]

Hello microwave. I'd like you to meet hard drive.

Re:Hello microwave

[Anonymous Coward]

Hello microwave. I'd like you to meet hard drive.

Perhaps you intended your comment to be a joke, but in case anyone believes
a hard drive can be destroyed such that data cannot be recovered from it
by "cooking" the hard drive in a microwave, it should be explained that
a platter-type drive will NOT be destroyed by "cooking" it in a microwave.

The microwave, however, WILL be severely damaged.

Re:Hello microwave

[khallow]

Even if things worked that way, you'd still be acting in a suspicious manner. After all, most people don't throw their hard drives into the microwave for some reason. But recycling a hard drive that doesn't work anymore? What's suspicious about that?

Re:Hello microwave

[iamacat]

From what I understand, all it takes is one knock with a hammer to ensure platters are bent and can never be used again. And there is no known practical method to restore data after a single overwrite with 0s. Everything else is pure paranoia.

Re:Hello microwave

[ssufficool]

Actually a single overwrite with zero is recoverable on older non-PMR drives by simply realigning the heads a bit to catch the edge of the magnetic track only weakened by the zero wipe (and I mean a very small bit) and re-installing the drive. On PMR, there are actually weak bits left after a zero wipe that are recoverable by equipment capable of reading weak bits. A random wipe is usually effective in all cases. A hammer leaves nothing to chance.

I also don't understand how a drive can be ruled as evidence if nothing is yet discovered on the hard drive. I don't understand how the prosecution can ask for a default judgement without solid compelling evidence of a crime. Without a discovery of the drives contents I'm assuming they had other evidence.

Re:Hello microwave

[Immerman]

Depends on just how motivated someone is to recover the old data. The hard drive itself will almost certainly be unable to read the previous data after a single overwrite, but remove the platters and install them in a machine specifically designed to read the edge of the tracks, which as a rule *aren't* overwritten, and most of the data can generally be recovered easily enough. (Since head placement is imperfect, every recording of a track writes to a slightly different path, leaving the previous N recordings partially untouched)

Granted, there's going to need to be suspicion of some pretty important data on that hard drive for it to be worth the trouble, but if there has ever been data on a drive that may be of sufficient interest to someone with the resources to recover it, then you absolutely need to do multiple overwrites with random noise to ensure it can't be recovered. And/or physically destroy the platters by melting, not shattering (though that would probably have to be some *really* important data to be worth reconstructing a shattered platter)

Re:Hello microwave

[geoskd]

From what I understand, all it takes is one knock with a hammer to ensure platters are bent and can never be used again. And there is no known practical method to restore data after a single overwrite with 0s. Everything else is pure paranoia.

Overwriting with 0s will not perfectly overwrite the tracks. There is some slop on the read head positioning that will normally allow enough data to be recovered that the ECC can be used to rebuild the full data set. This can only be done by taking the platters out and putting them into a machine that is purpose built for the task of recovering such data. Having worked on part of the design of such a machine, I can tell you two things about it: First, it exists, and second, it is not cheap. I was told the cost of the one I worked on was $12M USD.

Physically deforming the platters will make the job much more difficult (expensive), but not impossible. A combination of clever chemistry and an electron microscope can usually recover data off a mangled platter. This process sucks because it has to be done by hand, but if its worth enough to you, there a couple of labs around the country that can handle that level of data recovery. A better way to ensure total destruction is to melt the platters outright. not only does the melting deform the platters, but sufficient heat will thoroughly destroy the data, even if the platter does not completely melt.

Re:Hello microwave

[Anonymous Coward]

What is good for IRS is also good in this case.
Lois Lerner emails were "lost" because disk crash. Nothing suspect here. Move along ...
http://www.politico.com/story/2014/06/irs-lois-lerner-emails-108044.html

Unfortunately they were so clumsy that forgot about disaster recovery backups :-)

Re:Hello microwave

[tibit]

older non-PMR drives

Those drives are now museum artifacts, so your concern is of no practical use. No mainstream 2.5/3.5 in. hard drive manufactured in the last 15 years is recoverable after a zero-out.

Re:Hello microwave

[tibit]

most of the data can generally be recovered easily enough

Nope. The drives manufactured in the last two decades, give-or-take, have the size of magnetic domains matched to the size of the field generated by the heads. The "edge" of the track is defined by where data from one track ceases to be, and the data from another track begins, and this is a binary thing. One domain here has data from this track, another domain there has data from that track.

What people constantly fail to realize is that if there was an area of disk, the mythical "inter-track gap", that was any good at storing any data, it'd be stupid for the manufacturer to not put the expensive platter real estate to good use. And they do precisely that: they use all of the platters to store your current data. There is no inter track gap.

Re:Hello microwave

[tibit]

That's not the case with modern hard drives, at least nothing made in the last decade. You worked on such a machine long time ago and/or you weren't told really what it was for. The machine you worked on, if it was done for recovery of drives made after 1998 or thereabouts, was simply made to read data that was not overwritten. It was to be used when one wished to read the drive's contents without using the drive's electromechanical system to do so. Such a machine makes life easier iff you have reverse-engineered enough of the drive to know the encoding used on the data, and the formatting of all the housekeeping information. It lets you skip having to do platter transplants, and generally having to use the drive's own firmware for data recovery - where the firmware wasn't designed for that.

Re:Hello microwave

[Anonymous Coward]

Perhaps this device would provide a more permanent way to erase a hard drive.

Re:Hello microwave

[Immerman]

If they could reliably position the heads in *exactly* the same place every time that would be the case. But they can't - mechanical devices and perfection are mutually incompatible. So assuming there's an error of +/- N um in head positioning, your track has to be at least 2*N um wider than the recording head to avoid partially overwriting adjacent tracks. You can cut that roughly in half by sharing the buffer zone between adjacent tracks - hence creating the " inter-track gap". Modern drive heads are are more precise than they used to be, but that only reduces the width of the necessary buffer zones, it doesn't eliminate them entirely.

Re:Hello microwave

[gweihir]

For "older" meaning >15 years old.

Re:Hello microwave

[Anonymous Coward]

What people constantly fail to realize is that if there was an area of disk, the mythical "inter-track gap", that was any good at storing any data, it'd be stupid for the manufacturer to not put the expensive platter real estate to good use.

What people like you fail to realize is that the limitations of a consumer grade read/write mechanism at 7200RPM could be different from the limitations of an NSA grade device reading at whatever speed deemed appropriate.

It's not like they have to read stuff at 100MB/sec. 2TB at 10MB/sec is about 2+ days. Read it 10 times at slightly different offsets = 23 days. Crunching through the very many resulting TBs to figure out the various possibilities of past data would probably take a fair bit of time too.

Whether the messy reconstructed stuff they recover would be fit as evidence for court is another matter. I doubt they'd waste the time and resources on most people too- if more people believe such recovery is possible, more of their targets might start using encryption. It'll be a lot harder to recover data from a wiped encrypted drive. With encryption stuff tends to become more "brittle".

Re: Hello microwave

[Anonymous Coward]

your track has to be at least 2*N um wider than the recording head to avoid partially overwriting adjacent tracks

I take it you don't know how Seagates shingled recording works? It actually does partially overwrite adjacent tracks so entire blocks of tracks need to be rewritten on a write operation.

Re:Hello microwave

[K. S. Kyosuke]

The question is how the encoding method copes with vastly increased uncertainty in the magnetic reversals in whatever residual analog information remains, considering that the drives are trying hard enough already. Somehow I find it difficult to believe that this is substantially better than divining from tea leaves.

Re:Hello microwave

[Jane Q. Public]

I don't understand how the prosecution can ask for a default judgement without solid compelling evidence of a crime. Without a discovery of the drives contents I'm assuming they had other evidence.

First, part of the reason you don't understand this is because you are under the impression that copyright infringement for personal use is a crime. It is NOT. This is a civil matter, not criminal.

Generally speaking, copyright infringement is only criminal if you are doing it in bulk for profit. Historically, that meant what has been known legally for about 100 years as copyright piracy, which again in general refers to making unauthorized copies of copyrighted works and selling them.

It is today's media industry which has deliberately attempted to confuse you by labeling downloads of copyrighted material for personal use piracy. It is not. Piracy is a legal term referring to PROFITING from unauthorized copying of copyrighted works.

Now, back to the case at hand: being a civil matter, and not criminal, the court need not require probable cause in order to demand that evidence be produced (although it probably can't be seized beforehand. However, because of this, people have been known to destroy evidence after being served notice of a lawsuit. If they do that for the purpose of hiding the evidence, and the plaintiff can show that, it may be ruled spoliation of evidence, and could result in a summary judgment in favor of the plaintiff.

But despite this not being a criminal matter, plaintiff still bears the burden of showing that spoliation happened, via genuine evidence. In this case, plaintiff's claim of spoliation was not backed by evidence; it was a claim without substance. Defendant had a reasonable explanation for the drive's demise, and plaintiff could not show otherwise.

I also don't understand how a drive can be ruled as evidence if nothing is yet discovered on the hard drive.

Remember that this is a civil matter. Standards of evidence are different. If a reasonable person would believe that the drive contained evidence, a judge might ask that it be produced. It very much depends on the circumstances.

Re:Hello microwave

[Anonymous Coward]

older non-PMR drives

Those drives are now museum artifacts, so your concern is of no practical use. No mainstream 2.5/3.5 in. hard drive manufactured in the last 15 years is recoverable after a zero-out.

Of course, an extra few words explaining that due to areal density on drives larger than 15 GB the chances of recovering a single 32-bit number from a zeroed drive is less than three percent would make you seem less like a dick spouting such an assertion. Residual magnetism used to be the way they recovered data from a zero out, but due to how tiny the bits are on the media these days it's not possible to do that, even after a single pass of zeroes.

Melting is a new one for me, but quite effective I am sure. Me, I still prefer a drill press, much more physically satisfying and environmentally friendly. And yes, I have applied power to the drive so the platters shatter and shred when I do it. Just make sure you clamp the drive down first. He he

Re:Hello microwave

[thegarbz]

When did you do this? Data densities have gotten so tight and tolerances so small that while I won't call bullshit on your statement I will call it out of date. It's impossible to recover data at this day and age. While you're right that the head doesn't perfectly write over the track, the gaps between the tracks are so small that the magnetic field is not sustainable when something is written. Heck one of the challenges the industry is facing is writing a track without having the tracks either side break down, and you're taking about a sustained field an order of magnitude smaller.

Re:Hello microwave

[Anonymous Coward]

Or, you know, a powerful magnet, like say the ones used in hard drives...

Re:Hello microwave

[JohnVanVliet]

" I also don't understand how a drive can be ruled as evidence if nothing is yet discovered on the hard drive. I don't understand how the prosecution can ask for a default judgement without solid compelling evidence of a crime. Without a discovery of the drives contents I'm assuming they had other evidence.
"

they DO
it is a IP address that anyone in the world could have spoofed
very very very week evidence

Re: Hello microwave

[Immerman]

Yes, let's bring an untested (in the real world) new technology with what may always be compromised performance into a generalized discussion of hard drives, that won't muddy the waters. Besides, even they have to have some sort of mechanism in place to deal with the imprecision of the head positioning, presumably they have some sort of a "slop zone" built in to the design as well, even if the particular mechanism is something different than traditional techniques: If the head positioning is precise enough to not need a slop zone, then you could shrink the track width to substantially increase data capacity. Unless we're pushing the limits of magentic resolution on that axis as well I suppose. That seems unlikely, but I haven't been paying *that* close of attention to the technology.

Re:Hello microwave

[Anonymous Coward]

If you're going to clean a drive, use the correct *nix tool.
dd, otherwise known as The Destroyer of Disks.
Bonus - it can target specific files and overwrite over 1GB/minute.

A great use for this is sanitizing disks so good drives don't have to be recycled.

Re:Hello microwave

[ToasterMonkey]

older non-PMR drives

Those drives are now museum artifacts, so your concern is of no practical use. No mainstream 2.5/3.5 in. hard drive manufactured in the last 15 years is recoverable after a zero-out.

If it does't severely impact your wiping throughput needs, at least use some crappy PRNG instead of zeroes.

A more likely problem than using a 15+ year old hard drive today is today's hard drive being read 5/10/15 years from now with THEIR technology.

I would like to say all information about my life more than X years old is worthless, but I know that is not generally a safe assumption. All sensitive information has its own lifespan, sometimes very long.

Re:Hello microwave

[citizenr]

From what I understand, all it takes is one knock with a hammer to

trip mems sensor on HDD and leave permanent SMART 'physical damage' record

Re:Hello microwave

[citizenr]

BULLSHIT, name ONE lab and ONE documented recovery from single overwrite

Re:Hello microwave

[Seng]

Much better than melting: I target shoot my old drives with a 5.56 62 grain steel core round. Pretty much shreds everything with one hit.

Re: Hello microwave

[Anonymous Coward]

You my friend no nothing about data recovery and no place speaking further on this thread.

Re:Hello microwave

[AmiMoJo]

The heads don't work like that any more. They pick up the magnetic field from multiple tracks, some stacked vertically or aligned at right angles to each other. The drive then has a DSP that sorts it all out and decodes just the track that was requested.

This both increases the density of tracks and means that the head doesn't need to be positioned as accurately. The head itself in fact has more than one pick-up, it doesn't rely on a single one being aligned and in fact must combine data from at least two to reconstruct a single track.

Seagate's latest 8TB drives take this even further, being only able to write multiple tracks at once.

Re:Hello microwave

[Anonymous Coward]

I'm old fashioned. I still disassemble and smash 'em with a hammer. Make a fine powder and then good luck on 'em to reconstruct it from scattered powder over a couple miles of dirt.

Re:Hello microwave

[rot26]

That works perfectly with CD's, DVD's, etc. I've never tried it with floppies, but it sounds promising. Hard drives might require getting the platters above the curie point, making a regular oven more reliable. I'm not sure if microwaves will penetrate a hard drive enclosure; all of mine have been made of metal but I'm sure this depends on dozens of other factors.

However, I think most people here are assuming that making any sort of media unreadable means altering its magnetic properties, and that's not true if the people investigating have deep pockets.

tl;dr
don't underestimate the capabilities of a forensics lab with an electron microscope made for examining disk platters.

Re:Hello microwave

[Anonymous Coward]

How do you actually download something using a spoofed IP address?
How do the packets get to you?

Re:Hello microwave

[Anonymous Coward]

Yes, with SMR (which is pretty new) there not only isn't space between the tracks, the tracks are actually stacked atop each other.

There do still exist top-shingle tracks that don't have a track atop them. This is so you don't have to write the whole drive every time you want to write something. So every few tracks you might have some small break between tracks, but the next track will be encroaching on this pretty close making any read of that space... difficult at best.

Re:Hello microwave

[Anonymous Coward]

In addition, just exposing the disks to air (with dust) will actually make them virtually unreadable.

Re:Hello microwave

[aurizon]

Well, if you take the magnetic surface above the curie temperature, on cooling it will assume a random domain pattern on cooling. Depending on the temperature, this can be far from the metal melt point.

I am not sure what magnetic coating is on the platters.
http://en.wikipedia.org/wiki/C...

http://en.wikipedia.org/wiki/H...

Note, temperatures on chart are in Kelvin, deduct 273 to bring to Celsius.

Re:Hello microwave

[stoatwblr]

The Peter Gutman paper which talks about data recovery on hard drives by reading track edges and relying on imprecise positioning was performed on 20Mb MFM and RLL stepper motor hard drives (the kind which needed to be "parked" before switching off. These _are_ serious museum pieces which always had a bit of mechanical "slop" in the gearing/steel band mechanisms which actually drove the head position.

All drives greater than 200Mb use variable sector geometry, so track layout is nowhere near as predictable and beyond that point the track density is such that it could take _years_ to recover one drive, if it's possible at all.

Voice coil hard drives use continuous feedback mechanisms to ensure the heads are centred, resulting in a much higher positioning accuracy than can ever be obtained from stepper-motor-based systems.

Gutmann himself wrote a followup several years later stating that the DoD overwrite procedure was largely irrelevant to voice-coil based drives and that a single security wipe was more than sufficient in any drive manufactured past about 1996. He was sick of it being used as some kind of voodoo when it didn't matter anymore.

Re:Hello microwave

[beastofburdon]

The navy used to sandblast the platters, I don't know what they do with them now. The DOE has them sent through what acts like a wood chipper, or if it is to be used again, a five pass write over with zeros and random bits.

Re:Hello microwave

[X0563511]

I see your 62-grain 5.56 and raise it a 180-grain 7.62 :P

Re:Hello microwave

[tibit]

The head positioning error is much smaller than the width of the track. There are no buffer zones.

Re:Hello microwave

[tibit]

There's two things in this picture that are very different than what you have, say, in an audio tape recorder. 1. A head producing very high magnetic field gradient. 2. A high-coercivity material that doesn't give shit about fields that aren't strong enough to remagnetize a domain. This adds up to a situation where domains at the boundary between tracks work in a binary fashion. Either they flip, and they contain data from the current track, or they don't and they contain data from the neighboring track. There's no situation where they'd have previous data from the same track, because the head positioning errors are smaller than the domain size!

Re:Hello microwave

[tibit]

I forgot to add that if, due to a very unlikely circumstance, a domain will be partially magnetized during one track writing, it'll very likely be partially magnetized during another writing of the same track as well. So yes, a poorly inter-track domain may contain noise, not data. That doesn't make it useful for data recovery, and such domains are relatively few.

I disagree...

[Anonymous Coward]

...without knowing how the drive "failed" the court cannot prove that there was no evidence to destroy. I guess he never heard of drive recovery places that can recover some information from a majority of drives that "fail"

Re: I disagree...

[Anonymous Coward]

There is more to this than you think, such as burden of proof and intent.

Re:I disagree...

[wiredlogic]

That requires the plaintiff to spend money to have the analysis done which isn't part of the copyright extortion business plan.

Re:I disagree...

[Anonymous Coward]

I don't know what this guy is playing at because I seriously doubt that this day and age he doesn't know about such services but ...

I guess he never heard of drive recovery places that can recover some information from a majority of drives that "fail"

I do not need a service like that because:

1. I back up important data.

2. Much of my important data becomes out of date and no longer is important, therefore allowing me to prune backups.

I think this guy wanted that drive and its data destroyed. But that is just speculation on my part.

Re:I disagree...

[Anonymous Coward]

without knowing how the drive "failed" the court cannot prove that there was no evidence to destroy

Wrong. Even if they know how it failed, that does not prove that evidence was actually destroyed. But, knowing how it failed could possibly change this from "no destruction of evidence" to "destruction of evidence". A "destruction of evidence" charge does not require that evidence was actually destroyed, it just requires the act to be a deliberate reaction to being asked to hand something over.

It is not clear to me from TFA whether the HDD in question was sent off for recycling before or after the request was made.

I guess he never heard of drive recovery places that can recover some information from a majority of drives that "fail".

Or he has, but recognizes that the average person isn't going to send off their dead HDDs to such places, that they will instead just write-off whatever data may have been on there as a lost cause.

Re:I disagree...

[Imrik]

The hard drive "failed" and was subsequently recycled, there would be nothing recoverable after it was melted.

Re: I disagree...

[MichaelMacDonald]

Pretty much. Of one of my drives die I know the data can be replaced easily enough, I just swap it under warrantee or toss it if it's not covered. No biggie. I plan to raid 6 because it savrs headaches, but this guy didn't do anything unusual. It's actually pretty responsible of him to recycle.

Re:I disagree...

[AchilleTalon]

You should have read the article. The argument is about what the defendant knows and the intention. The drive was sent to recycle BEFORE the defendant even knows a litigation is imminent. Hence, it is not possible to argue the defendant destroyed an evidence while he didn't know it was to become an evidence. The hard drive was destroyed in good faith by the defendant without an intention to interfere with legal procedures since there wasn't any at the time and he wasn't even aware any was eminent.

Re:I disagree...

[Anonymous Coward]

I agree, in this case the defendant had already been served notice of the lawsuit. This isn't a case like Jammie Thomas where the HDD failed and was destroyed prior to being served. In this case, the judge should really have found things more favorable to the plaintiff as the plaintiff should have had the opportunity to pay recovery specialists to see if they coudl recover anything off the disc.

Depending upon the nature of the damage, all the data might be there. I've had HDD where the spindle motor failed and in cases like that, the data is still there. It's a pain in the ass to get at, but I'm sure a recovery firm could have done it.

Re:I disagree...

[geoskd]

I don't know what this guy is playing at because I seriously doubt that this day and age he doesn't know about such services but ...

If you keep backups, like any sane person would, throwing away a failed drive is the normal option.

I had a drive fail once, and didn't have backups. The drive failed in such a way that I was quoted $2,000 for an attempt to recover the data, and no guarantee the procedure would work. I decided I didn't really have any valuable data on that drive after all... If I'd still been working at Kroll, I might've been tempted to try to get one of the lab techs to throw the platters into the test rig, and pull my data, but it just wasn't in the cards...

Re:I disagree...

[Scutter]

You should actually read the ruling. The issue was that the defendant destroyed the hard drive before he was notified that he was being sued. He had no reasonable expectation that he would have to produce it for evidence.

Re:I disagree...

[AmiMoJo]

The article says he destroyed the drive five months after being notified of the lawsuit. The length of time made the court think it unlikely he was destroyed evidence, or he would have done it sooner.

Re:I disagree...

[Anonymous Coward]

...without knowing how the drive "failed" the court cannot prove that there was no evidence to destroy. I guess he never heard of drive recovery places that can recover some information from a majority of drives that "fail"

How about proving there was evidence on the drive to begin with first? Especially when asking for a default judgement.

Re:I disagree...

[Anonymous Coward]

He wasn't notified that there was a lawsuit, he was notified by Comcast that they received a court order to turn over logs and customer information associated with an IP address on some specified date(s) and they would be co-operating with the order. He wasn't actually named in the lawsuit until Nov. and did not receive an official court summons until Apr. of the next year. He sent the drive to be recycled 2 months before he received an order to preserve it. Comcast's letter only covers a courtesy to their customer, it does not impose any legal restrictions on him.

Re:I disagree...

[sjames]

The court has no obligation to prove anything at all. Even though the bar is set much lower in a lawsuit than in a criminal trial, the burden of proof still lies with the plaintiff. They presented no evidence whatsoever to show that the destroyed drive contained any data at all, much less data damaging to the defendant.

The plaintiff tried to convince the court of the defendant's wrongdoing through circumstance. However, the defendant provided reasonable enough explanations for his actions so the court really had no basis to grant the plaintiff's motion.

Re:I disagree...

[sjames]

As best as I can piece together from the excerpts from the ruling, he knew there was a John Doe suit before the drive was destroyed but he wasn't notified that he had actually been named in the amended suit until a month after.

The judge found that his actions were consistent with someone who had no reason to expect to be named and so required to preserve evidence.

Re:I disagree...

[stoatwblr]

"I had a drive fail once, and didn't have backups. The drive failed in such a way that I was quoted $2,000 for an attempt to recover the data, and no guarantee the procedure would work. "

$2000 is the standard price. It happens semi-regularly here despite warnings to researchers that if they fail to allow backups to run, they're liable for recovery costs.

In most non-servo board failures, it's a case of loss of the servo track and recovery outfits get the drive working by tweaking arm position until it recaptures the track (there are a few videos on this as well as showing how cover screw torque can be critical to reading - in some cases simply retorquing the cover is apparently enough to get the drive running again)

Re:I disagree...

[Anonymous Coward]

You should have read the article.

What??? Read the article??? You must be new to Slashdot. ;)

Re:I disagree...

[Anonymous Coward]

You're getting the actors and their burdens confused.

1. "The Court" is not proving or disproving anything.

2. The complainant was upset about the loss of data (i.e., potential evidence).

3. The complainant must provide evidence of spoliation.

4. The drive had already been recycled, so the complainant had no way to impugn the owner's testimony that the drive had failed.

Wow - interesting

[xystren]

Lots of room for potential abuse, but an interesting judgement. I wonder if there will now be laws stating that dead hardware must be kept beyond the statute of limitation in case a lawsuit ensues. So what about all those "catastrophic failures" right before the suit if filed? A double edged sword none the less.

Re:Wow - interesting

[Anonymous Coward]

Only the IRS gets the use that excuse! They have it patented.

Re:Wow - interesting

[AchilleTalon]

There is no room for abuse. You haven't read the article or didn't take enough attention to the argument. If the defendant had destroyed the hard drive while the lawsuit was proceeding or even with the intention to destroy evidence knowing a lawsuit was imminent, the outcome would have been completely different. The defendant's ass was saved because the hard drive was destroyed or sent to recycle BEFORE any lawsuit and BEFORE he even knows a lawsuit is imminent.

Re:Wow - interesting

[Charliemopps]

lol... Come on man...

Plaintiff: I'm suing you for infringement! Turn over your hard drive as evidence!
Defendant: Um... oh, that failed 6 months ago, I threw it out.

No potential for abuse there at all... lol

But it seems fair to me. Businesses have retention policies for this very reason. A retention policy is not usually designed to retain data. It's there to make sure data doesn't stay around for decades waiting to be discovered by some random lawsuit. After I got into the industry and saw how they did things, I brought the same policy home. All the drives in my house get a low level format at least every 6 months. Everything important is backed up, everything else gets wiped and reinstalled.

Re:Wow - interesting

[nedlohs]

The drive was destroyed in February 2013. The defendant was notified of the lawsuit in October 2012.

Maybe you don't look at calendars often, but no it was not destroyed before he knew about the lawsuit.

Re:Wow - interesting

[Anonymous Coward]

It was destroyed before he knew that he was named as a defendant in the lawsuit. The only thing he knew from the Comcast letter was that they had received a court order arising from a lawsuit to hand over logs and customer information associated with an ip address on specified date(s). The letter did not say he was a party to the lawsuit (that happen Nov., but he had still not been officially notified) and only contained Comcast's notification to their customer that they would comply with the court order. It imposed no legal instructions on the guy, it was mostly just a CYA courtesy by Comcast. Only a legal instruction included in the official court summons to the defendant or a letter from the plaintiff's attorneys could have ordered him to preserve evidence by ceasing to use the drive and to remove it from his computer. The plaintiff didn't communicate with the defendant until he was served 7 months after he received the initial Comcast letter.

Re:Wow - interesting

[cgimusic]

It's fairly easy to prove the drive was destroyed. Almost any drive destruction facility will at minimum give you some kind of dated receipt and often give you a certificate of destruction too.

How is this supposed to work...?

[Anonymous Coward]

- person uses drive for illegal activity
- police raids and collects drive
- somehow drive gets destroyed by 'person'?

Or the other way around:
- person uses drive for illegal activity
- drive gets destroyed by 'person'
- police raids and collects broken drive

Does this imply that it is illegal to destroy any evidence while doing criminal activities? e.g., illegal to wear gloves to avoid finger-prints when murdering people?

Re:How is this supposed to work...?

[dreamchaser]

The police aren't even involved in copyright cases.

Re:How is this supposed to work...?

[Anonymous Coward]

Does this imply that it is illegal to destroy any evidence while doing criminal activities? e.g., illegal to wear gloves to avoid finger-prints when murdering people?

Wearing gloves, or even purchasing them, could be used as an inference in a criminal action, certainly. On the other hand, there are plenty of legitimate reasons to wear gloves, and purchase them, and there are times where you can easily lose your gloves.

So where to draw the line? Well, I can see making it an offense not to report a lost or stolen firearm, but a pair of gloves? Yeah, not going to freak on that.

Same with a HDD. They do break down. Turning one into a recycler? Not unreasonable on its face. It'd be one thing if this was an entity that HAD to keep records, but a private person?

Too much of a stretch.

Re:How is this supposed to work...?

[Anonymous Coward]

This was a civil case, not a criminal case. The police did not raid anything.

Re:How is this supposed to work...?

[Em Adespoton]

- person uses drive for illegal activity
- person receives DMCA notice
- person "catastrophically fails" their drive
- person receives subpoena
- person notifies court that sole evidence no longer exists due to drive failure.

Hence, your assumptions are flawed (for this case).

The ruling found that it was NOT illegal to destroy evidence before it is called for evidence. It is illegal to intentionally destroy evidence that has been called for by the court. There are also retention laws that cover certain situations. Setting data retention guidelines prior to the suit protects you from getting into this mess (if you can prove that you ALWAYS destroy your data after X days/ x failed writes/ etc. then you're not culpable if you do what you always do just prior to being served).

Re:How is this supposed to work...?

[Anonymous Coward]

Does this imply that it is illegal to destroy any evidence while doing criminal activities? e.g., illegal to wear gloves to avoid finger-prints when murdering people?

No, that's OK because you're not creating evidence to destroy in the first place. But if you realize you forgot to wear gloves and then go over the place with a rag after the act....

Re:How is this supposed to work...?

[Imrik]

It is illegal to destroy evidence of a crime if you know that it is required or likely to be required as evidence and you destroy it with the intention of preventing it from being used as evidence.

Re:How is this supposed to work...?

[misexistentialist]

Sentences are substantially increased for wearing a mask during a robbery or laundering money from a drug business, for example, they are only limited by their imaginations when bringing charges

Re:How is this supposed to work...?

[Anonymous Coward]

Splitting hairs, I'd certainly classify the FBI as a police agency.

Re:How is this supposed to work...?

[iamacat]

- person uses drive for copyright infringement, a civil offense
- a lawsuit is filed
- it's now a criminal offense to destroy evidence

For civil cases, police is not involved, but it's legal requirement for both parties to preserve evidence and testify truthfully. For criminal cases, you can lie/conceal all you want without additional penalty. But jury will consider how trustworthy you appear to be very heavily.

Re:How is this supposed to work...?

[SuricouRaven]

They aren't involved in this particular case, but they are involved in other copyright cases. In the US, internet copyright infringement has been a criminal matter since the NET act - which makes all online for-profit infringement criminal, and defines for-profit as including an expectation of access to additional infringing material. Here in the UK, PIPCU (A division of the CoLP) has made a name for itsself by routinely overstepping their authority in order to take action against torrent sites.

Re:How is this supposed to work...?

[Anonymous Coward]

Non sequitur. The FBI isn't involved either. Just some porn media company

Re:How is this supposed to work...?

[AchilleTalon]

An evidence qualifies as is when there is a lawsuit or it is known a lawsuit is imminent. When someone uses anything for illegal activities, they are not evidences until there is a lawsuit. An evidence is something you want to show during the proceedings of a lawsuit. Without a lawsuit, there is no such thing like evidences.

Re:How is this supposed to work...?

[Anonymous Coward]

People aren't generally charged with that if they're being charged with other things. However, if you commit a crime and I destroy evidence on your behalf, I would likely be prosecuted.

Civil cases work a bit differently, the usual penalty is that the court makes inferences that are favorable to the other party. So, destroying evidence is a great way to bolster just about any claim the other side cares to make.

Re:How is this supposed to work...?

[Attila Dimedici]

Actually, it does not matter that it was not called for. The key fact is that, without the hard drive, there is no evidence that there was a crime committed. Or to word it another way, the plaintiff was unable to prove that there was any evidence to destroy.

Re:How is this supposed to work...?

[Anonymous Coward]

It is illegal to destroy evidence of a crime if you know that it is required or likely to be required as evidence and you destroy it with the intention of preventing it from being used as evidence.

Unless you work at Arthur Andersen and believe there's a non-existent loophole in the law that lets you destroy evidence when you know you are about to be investigated. Just believing something is legal when it isn't is enough to protect you if you're connected. Look at when Rick Perry laundered money. He claimed to believe he had found a legal loophole, which didn't exist, so his buddies let it slide.

Re:How is this supposed to work...?

[Registered Coward v2]

There are also retention laws that cover certain situations. Setting data retention guidelines prior to the suit protects you from getting into this mess (if you can prove that you ALWAYS destroy your data after X days/ x failed writes/ etc. then you're not culpable if you do what you always do just prior to being served).

Excellant point. I have worked for several companies that had very clear and strict data retention and destruction guidelines; thus ensuring all of our working papers were destroyed and thus not subject to being part of discovery in a lawsuit. The only time we did not destroy the working papers was when we were informed we were about to served as part of a lawsuit against a client; we beat feet and got out Dodge before the server arrived and turned all the working papers over to our lawyer.

Re:How is this supposed to work...?

[rubycodez]

so his buddies didn't get in trouble right? no problem then.

IRS will now move to Indiana

[Anonymous Coward]

Who cares about the Federal Records Act....

Re:IRS will now move to Indiana

[Anonymous Coward]

Federal Records Act doesnt apply.
And the IRS computers are handled the same as everyone else's computers in government:
by an IT contractor, ie a private company that maintains their systems in exchange for money.

and they have one solution for almost all computer problems: "Here. Have a new computer."

Melted down hard drive

[rossdee]

Since when do they melt down hard drives?

I thought they had to be carefully taken apart and the toxic materials removed to the special areas so they don't contaminate the environment.

Re:Melted down hard drive

[Anonymous Coward]

They go through a shredder, and then toxic chemicals are used to extract gold, then it gets sorted in aluminium, steel, and copper. (I suppose everything not of value is dumped)

Uninformed court?

[drhamad]

That seems like a weird decision... I mean, even if the drive itself has failed it doesn't mean the platters have no data on them that could be recovered. Of course, the secondary question is whether the destruction was intentional or not, but as for the question at issue here, I don't see how a court could say that there is no evidence that was destroyed. The likelihood is completely opposite.

Re:Uninformed court?

[Anonymous Coward]

That seems like a weird decision... I mean, even if the drive itself has failed it doesn't mean the platters have no data on them that could be recovered.

Maybe, maybe not. It's up to the plaintiff to show it though...

Of course, the secondary question is whether the destruction was intentional or not,

How on earth could it be intentional if he at the time wasn't aware there was a case? I for one isn't in the habit of keeping stuff, hard drives included, around if I've concluded that it's irrevocably dead. I'd extract any potentially useful parts and toss the rest.

but as for the question at issue here, I don't see how a court could say that there is no evidence that was destroyed. The likelihood is completely opposite.

If the plaintiff can't show that there was (not say that there probably was) evidence on the drive, then the court should bloody well assume there wasn't (assumption of innocence and all that nonsense....)

Re: Uninformed court?

[MichaelMacDonald]

I think it was more that the person behaved normally when he recycled his drive. There was no reason for him not to.

Re:Uninformed court?

[Anonymous Coward]

This explains why the USA does not spell certain words like honor, color, flavor with a 'U'.

Re:Uninformed court?

[doubledown00]

If the plaintiff can't show that there was (not say that there probably was) evidence on the drive, then the court should bloody well assume there wasn't (assumption of innocence and all that nonsense....)

This is a civil case. "Innocent until proven guilty" does not apply. Instead the issue is one of "liable or not liable". Further it is not a binary yes / no but rather a percentage of fault scale. Subject to notable exceptions the Plaintiff must prove that the Defendant is liable via a preponderance of the evidence (51% or more).

Re: Uninformed court?

[Anonymous Coward]

We fought a war over not adding extra vowels to our words, and last I checked the redcoats lost.
How about you tell us how to spell after you fix your country's teeth?

Re: Uninformed court?

[drhamad]

I agree with that, if that's the reason. But the reason can't be "because there's no possibility of evidence" on it. Now, the article is a little different than the headline, I'm just being clear.

Re:Uninformed court?

[Hydian]

And the assumption is still that the defendant is not liable unless the plaintiff can show otherwise, so what is your point?

Presumption of innocence

[aepervius]

"without knowing how the drive "failed" the court cannot prove that there was no evidence to destroy."

correct me if I am wrong, but AFAIR the US justice system, It is up to the prosecution side to prove there was evidence on teh HD, not on the side of the defense there was not. Therefore from the court in absence of proof of existence of evidence, the assumption should be by default there was no evidence. IF the prosecution has proof tehre was evidence they are free to provide them. But until then by presumption of innocence, the court has to assume the recyclage was lawful. Otherwise if the presumption was it was destruction of evidence, then it amounts of a presumption of guiltiness.

Re:Presumption of innocence

[Anonymous Coward]

That was a poor choice of words, but the essence is correct: The hard drive was evidence to the claim that it had failed, which is relevant to the case. Evidence in favor of the defendant is still evidence.

Re:Presumption of innocence

[SuricouRaven]

Close. This was a civil case, so the plaintiff doesn't need to prove anything beyond a reasonable doubt, as the prosecution would in a criminal case. Only has to prove that he was probably infringing.

Re:Presumption of innocence

[Mostly a lurker]

In a US civil ,action there is no bias towards either side. The case is decided on a preponderance of the evidence. I am sympathetic towards file sharers. I believe they provide a valuable service that is usually legal. That said, I do not think the defendant in this case should just be allowed to get rid of potential evidence without court permission, regardless of whether he thinks it will be useful. My sense is that either the judge did not understand the technology, or he thought the infraction was limited and should not saddle the defendant with a huge default judgment. [I hope that this does not eventually get overturned on appeal.]

Re:Presumption of innocence

[Anonymous Coward]

correct me if I am wrong, but AFAIR the US justice system, It is up to the prosecution side to prove there was evidence on teh HD, not on the side of the defense there was not. Therefore from the court in absence of proof of existence of evidence, the assumption should be by default there was no evidence. IF the prosecution has proof tehre was evidence they are free to provide them. But until then by presumption of innocence, the court has to assume the recyclage was lawful. Otherwise if the presumption was it was destruction of evidence, then it amounts of a presumption of guiltiness.

This is rendered moot in the voir dire phase. If you are not a rubber stamp for the prosecution, they you are suspected of jury nullification and will NOT be empaneled. Remember, civil forfeiture can be used against jurors.

Re:Presumption of innocence

[PopeRatzo]

Only has to prove that he was probably infringing.

Well, it's a little more than "probably". They have to show a preponderance of evidence. It's not enough to say, "this guy's a big movie fan and had 200gig of downloads every month and never rented a movie or went to a theater, so he probably was pirating movies". There still has to be a pretty high level of evidence showing that there was piracy going on and that the guy was doing it. Not "beyond a reasonable doubt", and a step down from, "clear and convincing evidence" but still more than just "Yeah, he was prolly doing it."

Re:Presumption of innocence

[PopeRatzo]

That said, I do not think the defendant in this case should just be allowed to get rid of potential evidence

Do you think everyone should be responsible for preserving any evidence that may exist that they have committed a crime, before a crime is charged? Because I nicked a candy bar in the 4th grade and didn't save the wrapper, so...

Re:Presumption of innocence

[CaptainDork]

Not this.

The accused is not bound to preserve any and all possessions that might be discoverable in litigation at a later date after even a rumour that the accused will become a party in a suit.

Evidence does not exist before probable cause defines the scope of what will constitute evidence, only after a motion to preserve evidence is filed.

Re:Presumption of innocence

[doubledown00]

Well, it's a little more than "probably". They have to show a preponderance of evidence. It's not enough to say, "this guy's a big movie fan and had 200gig of downloads every month and never rented a movie or went to a theater, so he probably was pirating movies".

Preponderance of the evidence is a 51 percent standard......i.e. "more likely than not".
Barring any statutorily necessary elements of the Plaintiff's claims, if the jury finds that to be sufficient then the dude can be found liable. It's all circumstantial, certainly. But I have guys doing decades of prison time based on circumstantial evidence, and that was "beyond a reasonable doubt". With what you lay out above, I could *easily* see a jury making a few key inferences and finding liability in that.

Never try and predict what the 12 geniuses in the box will or will not do.

Re:Presumption of innocence

[doubledown00]

You speak of criminal sanctions, not civil. Very different burdens of proof.

Re:Presumption of innocence

[doubledown00]

Not this.

The accused is not bound to preserve any and all possessions that might be discoverable in litigation at a later date after even a rumour that the accused will become a party in a suit.

Evidence does not exist before probable cause defines the scope of what will constitute evidence, only after a motion to preserve evidence is filed.

1) When he received the notice to preserve evidence, the clock started running there and violations of civil rules became sanctionable.
2) Probable cause does not exist in civil cases.

Re:Presumption of innocence

[AmiMoJo]

I bothered to RTFA and you are both a little way off what actually happened.

The guy received notice of the lawsuit. Five months later, the drive failed and he threw it away. The court concluded that because five months had passed it was unlikely he was trying to destroy evidence; if that had been the goal he would have done it sooner.

Re:Presumption of innocence

[rtb61]

Pirating is copying or capturing ships on the high seas. You do not copy when downloading, someone else does that and thus makes the claim they are entitled to do so. You are just connecting to a source and downloading that copy that some one else produced, nothing illegal in that and until it is proven that the source was illegally copying content, quite legal to do, regardless of the bullshit claims of the pigopolists that some how you should be guilty of other people's actions.

Re:Presumption of innocence

[whoever57]

That said, I do not think the defendant in this case should just be allowed to get rid of potential evidence without court permission, regardless of whether he thinks it will be useful.

If you read TFA carefully, you will see that the defendant disposed of the hard drive before he knew that he was a defendant in a lawsuit. If people have to preserve all data just because they receive a letter stating that they might be sued, there would be havoc within every large company.

Re:Presumption of innocence

[Anonymous Coward]

That's not true. Not all civil actions are solely decided on preponderance - clear and convincing evidence is also possible for some forms particularly if the impact to the losing side would be disproportionate

Re:Presumption of innocence

[Anonymous Coward]

not quite. part of the collection of evidence is the seizure of equipment to evaluate whether there is evidence. you don't get to hide everything and say ner ner, can't prove I have got something. In this case he is in luck because it was ruled that because the drive had failed any evidence was deemed to have already been destroyed, had he just hidden the drive from them the ruling would have almost certainly gone the other way.

Re: Presumption of innocence

[Anonymous Coward]

Ah yes, the wonderful world of ridiculous but irrelevant technicalities.
I didn't kill him, the bullets and gravity did!
His door was open, therefore he must have wanted me to take his stuff!
Her vagina didn't close up when I had set with her, therefore it couldn't have been rape!

Re:Presumption of innocence

[Anonymous Coward]

The judge actually shows a pretty good understanding, the blurb above isn't a really good one.

The judge found that notice of the lawsuit happened in Oct 2012 but destruction of the drive happened in Feb 2013, he said its unlikely the defendant would have waited four months before destroying the drive if it actually contained any evidence.

Here is from the judges statement :
Defendant received notice of this lawsuit at the beginning of October 2012. [] Defendant, however, did not destroy the hard drive until “late February 2013.” [] Thus, almost five months passed between the time that Defendant learned of the lawsuit and Defendant’s destruction of the hard drive. Had Defendant truly wished to hide adverse information, the Court finds it unlikely that Defendant would have waited nearly five months to destroy such information. Instead, Defendant’s continued use of the hard drive for the months after he learned of the litigation suggests that the hard drive contained no information to hide at all, or that Defendant did not intend to hide any such information.

Re:Presumption of innocence

[sjames]

Point 1 is true but it happened a month after the drive was destroyed according to TFA.

Re:Presumption of innocence

[SuricouRaven]

Language changes. Words acquire new meanings.

Re:Presumption of innocence

[hackwrench]

The article said he received some sort of copyright notice from Comcast before the hard drive failed but only received notice that he was a party to a lawsuit after it failed.

Re:Presumption of innocence

[Anonymous Coward]

The redefinition of the word "piracy" is not natural evolution though, it's a deliberate attempt by copyright maximallists to prejudice courts and pressure Congress.
Yes, language changes. But corruption and manipulation should be resisted.

Re:Presumption of innocence

[westlake]

correct me if I am wrong, but AFAIR the US justice system, It is up to the prosecution side to prove there was evidence on teh HD, not on the side of the defense there was not.

In the real world of the courtroom, the burden of proof is constantly shifting back-and-forth.

The destruction or disappearance of records under circumstances which are wildly improbable, suspiciously well-timed, or very unusual, to say the least, raises questions that the defense cannot afford to ignore.

It's the defendant's behavior that jury is examining here, not the contents of his files.

The geek in court tends to think that he holds the jury spellbound by his intellectual superiority and technical genius. He'll spin a yarn that stretches probability to the breaking-point and beyond in the absolute certainty that they can't possibly vote to convict.

"Reasonable doubt" and all that.

Re:Presumption of innocence

[PopeRatzo]

Pirating is copying or capturing ships on the high seas. You do not copy when downloading

Hey, you don't have to convince me. I think the best producer in Hollywood is named "YIFI".

Re:Presumption of innocence

[PopeRatzo]

The redefinition of the word "piracy" is not natural evolution though, it's a deliberate attempt by copyright maximallists to prejudice courts and pressure Congress.

Ain't that the truth. I'm surprised they didn't start calling file-sharing, "babyrape" or something.

I actually think they missed the boat a little bit by calling it "piracy". I mean, who doesn't like Captain Jack Sparrow, eh?

Re:Presumption of innocence

[PopeRatzo]

But I have guys doing decades of prison time based on circumstantial evidence

When you say, "I have guys doing decades of prison time", that means you're either a mob boss, a pro football coach or a lawyer.

Or maybe a bishop.

Re:Presumption of innocence

[CaptainDork]

It's a fuzzy clock in this natter, as TFA makes clear.

Probable cause does exist in civil cases.

The probable cause standard is more important in Criminal Law than it is in Civil Law because it is used in criminal law as a basis for searching and arresting persons and depriving them of their liberty. Civil cases can deprive a person of property, but they cannot deprive a person of liberty. In civil court a plaintiff must possess probable cause to levy a claim against a defendant.

Re:Presumption of innocence

[CaptainDork]

Precisely.

I received a take down notice from Sony because a wedding I taped had one of their songs going in the background.

I did not tape-seal my refrigerator, impound my car, box up my computers and turn off my phone or secure anything else that MIGHT, at some future date, be listed in a discovery request.

Re:Presumption of innocence

[Anonymous Coward]

Just FYI, the use of the word "piracy" to mean "copyright infringement" predates the very existence of Congress.

Re:Presumption of innocence

[Hydian]

Pirating is copying or capturing ships on the high seas.

Nothing strikes terror in even the most hardened crew like seeing a giant Xerox machine sailing towards them flying the Jolly Roger.

Re:Presumption of innocence

[tlhIngan]

The redefinition of the word "piracy" is not natural evolution though, it's a deliberate attempt by copyright maximallists to prejudice courts and pressure Congress.
Yes, language changes. But corruption and manipulation should be resisted.

Except "piracy" to mean "copyright infringement" actually predates civil law. It was first used around the very early 17th century (1603-ish) - The Stationer's Company of London received in 1553 the right to hold monopoly on publication (what we would later know as copyright) and recorded in 1603 or so the first use of the term piracy to denote infringement of that monopoly.

This predates the formation of the US and the Constitution and the 14+14 copyright term by a couple of centuries (hence the English references)

Interestingly enough, according to the OED, the term pirate is from the 16th century, so the use of piracy to mean copyright infringement happened not too long after the word was adopted on the high seas.

No, it's not a modern evolution - it's an ancient one, and dates back to practically a few decades after pirate was used in a nautical sense. So complaining about piracy and misue of it, you're nearly half a millennia too late - that ship has long sailed and pirate/piracy has both meanings since basically their inception.

Oh, and copyright maximalists and such prefer the word "theft" to "pirate". Or "stealing". Piracy and copyright infringement (the latter is a more modern term since piracy predates copyright as a term) are less strong terms than "IP theft" or "stealing movies". Even "copying" is far less strong.

Re:Presumption of innocence

[Cramer]

Without the drive in question, we have only his word as to its "failure". The rules governing the preservation of evidence does not require the evidence be known. In the case of electronic storage, it is assumed to be evidence until inspected and found to be otherwise.

If we're talking about a drive he hadn't used for several years, then I'd have to side with him (as did the court.)

This sort of excuse ...

[Anonymous Coward]

... about a "failed" hard drive is valid for the government to use so as far as I'm concerned it's perfectly legit for the rest of us.

Did the court say that?

[91degrees]

The court denied this motion suggesting that because the hard drive failed, there was no evidence to destroy in the first place.

Okay I skimmed the article, but I couldn't find a comment suggesting that.

It seems more that there's no evidence that the defendant wilfully destroyed evidence. The plaintiff wanted the court to assume that there was harmful evidence on the hard drive, simply because the defendant had thrown it out. The defendant on the other hand threw it out simply because it was dying, and had no idea that it might be relevant in the litigation.

Kill-ur-drive contest?

[Blaskowicz]

while true ; do hdparm -y /dev/sda ; sleep 5 ; hdparm -z /dev/sda; done

I've not tested it but don't really want to.

Re:Kill-ur-drive contest?

[Bob9113]

If the goal is to kill a drive, there's a much faster way. Pull it out of the case, but keep the wires connected. Shut down the machine. Turn the machine back on. When the drive is just starting to spin up, slam it flat on the desktop.

Before the platters are up to speed, there is very little Bernoulli force holding the heads up. The above operation will crash the head and leave a nice big scratch.

Re:Kill-ur-drive contest?

[gnasher719]

Before the platters are up to speed, there is very little Bernoulli force holding the heads up. The above operation will crash the head and leave a nice big scratch.

And then your opponent finds an expert witness who examines the hard drive, finds the scratch, and explains to the court that it was most likely intentionally damaged. They don't need proof, just likelihood. And now you are stuck, because whatever your opponent claimed is on the drive, the court now assumes it was there before you destroyed it.

Re:Kill-ur-drive contest?

[SuricouRaven]

It can still be recovered forensically though.

You can pretty-much wipe a drive through software - not even the best equipment can recover overwritten data on a modern drive, though back in the drives of years ago it could be done. The only issue here is remapping - if the drive has transparently remapped bad clusters, some traces of data may remain in those.

Re:Kill-ur-drive contest?

[doubledown00]

Thank-you!
Spoken as someone who has actually been involved in litigation.

Re:Kill-ur-drive contest?

[Anonymous Coward]

The heads are parked until the drive is up to speed, you fucktard. Unless you're talking about an OLD drive that cannot park heads at all.

Re:Kill-ur-drive contest?

[Blaskowicz]

It was awesome to learn that dd if=/dev/zero is actually enough. I have no idea if the "secure erase" function does anything else than that.

If you used that drive with encryption, and then zero it out or overwrite with innocuous content I guess the bad clusters's contents look like useless garbage.

Re:Kill-ur-drive contest?

[SuricouRaven]

It used to be possible to use some very sensitive equipment to find overwritten data because the head didn't always align over the track, and could miss a little at the edge. But that hasn't worked in years - track density and drive precision got far too high.

Re:Kill-ur-drive contest?

[Richy_T]

Here's the thing. dd will overwrite all the available sectors. All the available sectors. If a sector has been moved due to errors detected, it could very well be sitting out there waiting for the right software, hardware or firmware modifications to allow it to be read again. There are also potentially several areas (cache memory, and other things I am not enough of a hard-drive tech wiz to recall) where your data could be stored.

Secure erase is supposed to erase all the available sectors, all sectors outside of the available sectors and those other places that some of your data could be stored. Best practice is probably to perform a secure erase and a dd (order likely doesn't matter much).

Pretty Fine Line There

[Greyfox]

Basically it works out that he'd recycled the drive prior to being aware that he personally was being sued for copyright infringement. He also didn't run out and recycle all his drives as soon as he got a letter from Comcast saying that some sort of lawsuit was in progress. I assume the guy had some evidence to back up the dates in his claims. There's no discussion about whether they asked him for the backups he had or anything. In a nutshell, I wouldn't want to have to bet my ass on the court coming to the conclusion it did in any particular case.

Re:Pretty Fine Line There

[Solandri]

Basically it works out that he'd recycled the drive prior to being aware that he personally was being sued for copyright infringement. He also didn't run out and recycle all his drives as soon as he got a letter from Comcast saying that some sort of lawsuit was in progress. I assume the guy had some evidence to back up the dates in his claims.

You have this backwards. The accused is presumed innocent until proven otherwise (the wishes of copyright holders notwithstanding). The burden of proof is thus upon Malibu Media to prove he knew about their intent to sue before he had the drive recycled.

Personally I would say a mailed notice from Comcast is insufficient - lots of us have gotten those, whether correctly or in error, and nothing has happened. So it's insufficient to act as a notice to preserve evidence. I'd say a certified notification letter which must be followed through with an actual lawsuit or settlement is the minimum. Another party should not have the power to compel me to modify my behavior (hang onto equipment I'd otherwise throw out) for the mere cost of a 49 cent stamp.

Re:Pretty Fine Line There

[Anonymous Coward]

RTFA, he had been notified in October 2012 that he was being sued and the drive failed in January 2013. So at the time, he should have known that discovery was coming. The correct ruling here would have been to rule in favor of the plaintiff as the defendant was under an obligation to preserve things of that nature.

Re:Pretty Fine Line There

[Greyfox]

Oh, I totally agree. Maybe I didn't make that clear. I'm pretty sure Comcast would send a mail to my Comcast E-mail address, which I never check. There could be a dozen such notices in there right now for all I know. I'm pretty sure the court must feel the same way -- the notice from Comcast is not sufficient notification of a lawsuit. If they felt otherwise, they might then have dinged this guy. He had the drive recycled a couple months before receiving what the court considered to be an official notification.

The reason I thought he probably had evidence backing up the dates is the court seemed to accept them without a whole lot of argument. *shrug*

Re:Pretty Fine Line There

[doubledown00]

You have this backwards. The accused is presumed innocent until proven otherwise (the wishes of copyright holders notwithstanding). The burden of proof is thus upon Malibu Media to prove he knew about their intent to sue before he had the drive recycled. Personally I would say a mailed notice from Comcast is insufficient - lots of us have gotten those, whether correctly or in error, and nothing has happened. So it's insufficient to act as a notice to preserve evidence. I'd say a certified notification letter which must be followed through with an actual lawsuit or settlement is the minimum. Another party should not have the power to compel me to modify my behavior (hang onto equipment I'd otherwise throw out) for the mere cost of a 49 cent stamp.

1) Civil court is not a case of "guilty or innocent". It is a manner of "liable or not liable" and to what degree.
2) It is not accurate that the Defendant had no burden. This was a discovery abuse motion. The initial burden is on Malibu to prove that a violation of evidence rules occurred (this is a low and easily met burden). *After* they have met that burden, the burden shifts to the Defendant to put on any defenses or to refute the assertion.
3) The rules of evidence state that one has committed discovery abuse if evidence is disposed of after someone "knew or should have known" that litigation was pending. Yes, attorneys many times make threats. Yes most of the time they are just talking noise. But don't kid yourself. A notice to preserve evidence *is* enforceable. The recipient ignores it at their own peril.

Re:Pretty Fine Line There

[bruce_the_loon]

Since the automated Comcast etc letters are polite, in legal terms, requests to take down the allegedly infringing media, you can argue that they are the entity requesting the destruction of evidence in their own case. Since they allege they own the media, they assume it is within their rights to do so. Until you actually get sued, acting on those legal requests is perfectly valid even if you delay the deleting of the media. It would only be once you were served with notice of intent to sue with instructions to preserve the evidence that you may become liable.

Re:Pretty Fine Line There

[Anonymous Coward]

Well, its not enough to RTFA, you also have to understand what your reading. What he received from Comcast in Oct. 2012 was a letter mentioning their compliance with a court order to turn over logs and information about their customer associated with an IP address on whatever specified date the alleged infringement occurred, and that information could be used in the lawsuit. That letter did not say the guy was a defendant (in fact he wasn't added to the lawsuit until Nov.), and did not specify that he was to "preserve evidence". A letter from Comcast notifying a customer of their legal obligation to co-operate with a court order is not the same as an official court summons that has to be served to the defendant. That didn't happen until 7 months later, and 2 months after he sent the drive in for recycling. It's the porn media legal troll that fucked up here, not the courts.

How is this supposed to work...?

[Anonymous Coward]

- person uses drive for illegal activity
- police raids and collects drive
- somehow drive gets destroyed by 'person'?

Or the other way around:
- person uses drive for illegal activity
- drive gets destroyed by 'person'
- police raids and collects broken drive

Does this imply that it is illegal to destroy any evidence while doing criminal activities? e.g., illegal to wear gloves to avoid finger-prints when murdering people?

The sequence of events is:
Person uses drive for illegal activity
Police tell the person he's under investigation
Person replaces drive and recycles old one
The prosecution says he destroyed evidence

The important part here is that once the police or the courts advise that there is an investigation, then you are not allowed to destroy evidence. Also there are provisions where if a person should reasonably know a police officer is planning to investigate something, the person can be held liable for destroying evidence. This would be where a person is being pulled over and throws drugs out of the car before they stop.

Court made the right decision

[Anonymous Coward]

I know this because I RTFA'd

Defendant received notice of this lawsuit at the beginning of October 2012. []Defendant, however, did not destroy the hard drive until “late February 2013.” [] Thus, almost five months passed between the time that Defendant learned of the lawsuit and Defendant’s destruction of the hard drive. Had Defendant truly wished to hide adverse information, the Court finds it unlikely that Defendant would have waited nearly five months to destroy such information. Instead, Defendant’s continued use of the hard drive for the months after he learned of the litigation suggests that the hard drive contained no information to hide at all, or that Defendant did not intend to hide any such information.

The timing of Plaintiff’s amendment and the service of its complaint also detract from an inference of bad faith. Plaintiff amended its complaint to add Harrison as a Defendant on November 9, 2012. [] Plaintiff, however, did not serve the amended complaint on Harrison until April 2013, [], after Defendant had arranged to order the replacement hard drive, [], and after the recycling of Defendant’s hard drive. [] Furthermore, Defendant testified that the service of the complaint was the first time that he became aware that he was personally being sued for copyright infringement. []

Re:Court made the right decision

[doubledown00]

Defendant received notice of this lawsuit at the beginning of October 2012. []Defendant, however, did not destroy the hard drive until “late February 2013.” [] Thus, almost five months passed between the time that Defendant learned of the lawsuit and Defendant’s destruction of the hard drive. Had Defendant truly wished to hide adverse information, the Court finds it unlikely that Defendant would have waited nearly five months to destroy such information. Instead, Defendant’s continued use of the hard drive for the months after he learned of the litigation suggests that the hard drive contained no information to hide at all, or that Defendant did not intend to hide any such information.

That's one interpretation. Another has been suggested earlier in this forum that he chalked it up to a scare tactic and didn't think anything had come of it. If this case goes to depositions then more will be revealed about that.

Re:Court made the right decision

[Anonymous Coward]

Getting a letter from Comcast notifying a customer about a potential lawsuit is not the same as being served an official court summons that lists him as a defendant in a lawsuit. He sent the drive in to be recycled in Feb, and didn't actually get served until April. He was under no obligation to preserve the drive until he got official notification. The fact that he kept the drive 5 months after he allegedly received the Comcast letter convinced the court that he did not destroy the drive in a bad faith "spoilation of evidence" move.

Re:Court made the right decision

[doubledown00]

The standard contained in the Federal Rules of evidence is that an individual who "knew or should have known" about pending litigation is obligated to preserve evidence to the extent they are able. Most states have adopted these rules as their own although I don't know for sure about this specific state.

The late 2012 letter, while Indeed a letter and not a summons, is still sufficient to trigger the rules of evidence.

Exactly what he knew, when, and what the sanctions if any should be are up to the judge. In this case it sounds like the judge may also have a history with the Plaintiffs. That helps too.

Re:Court made the right decision

[Anonymous Coward]

No, Comcast letter is not sufficient to trigger "the rules of evidence" given the court opinion and TFA. You're gonna to cite some evidence to back your assertion.

Re:Court made the right decision

[Anonymous Coward]

That's asinine. Under your interpretation, once the guy got Comcast's letter, he would have had to stop using his hard drive altogether and remove it from his machine in order to "preserve evidence" even though he didn't know he was party to the lawsuit until 7 months later. That's an unreasonable imposition that no court would uphold.

Re:Court made the right decision

[doubledown00]

Fuck off little AC fag. You want to have a conversation with the adults and maybe learn something, post under a real ID.

yep. Unless you know it is coming

[raymorris]

>. (if you can prove that you ALWAYS destroy your data after X days/ x failed writes/ etc. then you're not culpable if you do what you always do just prior to being served).

Yep, that's one reason to have a data retention policy. One footnote though - it is unlawful to destroy evidence if you have reason to believe it's about to be subpoenaed. See Rose law firm, Clinton et al.

Re:yep. Unless you know it is coming

[Anonymous Coward]

Nobody's pays attention to you raymorris after apk ate you alive yet again http://tech.slashdot.org/comme...

Which is how it has always worked

[Sycraft-fu]

Same deal with physical evidence. As an individual, you generally have no records retention requirements. You are welcome to destroy your stuff as pleases you. So you can shred bills, old receipts, etc as soon as you want. None of this is destruction of evidence if you get sued. When it changes is if you get sued, and you are told to keep things, and you then destroy it. Then you are in trouble. So if a court case happens, the court can, and will, say "You need to keep anything related to this around in case we want to see it." But just in your everyday life you can wipe drives, shred documents, etc as you please.

This can be a little difference if we are talking something related to a business, there are more records retention requirements for various businesses, but again it has to be something where there is a legal requirement to retain it.

The only other case would be if something goes against policy. If a business has a policy that all old harddrives are kept in storage for 10 years before being destroyed, that's not legally required but they can do it anyhow. However if a lawsuit happens and the one harddrive that was asked for just so happened to be sent off to be destroyed immediately, against the business' own policy, well then that could be trouble.

You don't have to retain everything for all time just in case someone wants it for a lawsuit. However if you have something, and a court says it is evidence, you then have to retain it until the court is done with it.

reasonable expectation

[Anonymous Coward]

Depends on the exact sequence of events.

If you receive a letter from a lawyer alleging a tort, and particularly if that letter mentions the possibility of a lawsuit, it might be argued that you have constructive notice that evidence *might* be subpoened, and a destruction of something after that, but before receiving the subpoena might be a problem.

Lots of mights and maybes, though.
The law is not black and white in these cases. A lot of it is "did you annoy the judge".

I've been involved in a suit where there was a lot of discovery, and there were things like "daily calendars" and "notebooks" subpoened, with deposition testimony "I don't recall", "here's your calendar to help refresh your memory", and "oh, that box of stuff got lost in a move", etc.

Malibu Media

[koan]

Magistrate Judge Stephen L. Crocker didn't like this tactic. He froze eleven of Malibu's cases in western Wisconsin, and ordered Malibu's lawyer to explain why she shouldn't be sanctioned for violating court rules. Filing paperwork with the Court with no purpose except to harass or embarrass an opponent is a big no-no. Judge Crocker wondered why Malibu would file a list of movies with embarrassing titles that Malibu doesn't own and can't sue over.

https://www.eff.org/cases/mali...

Re:Malibu Media

[Anonymous Coward]

Are these clowns still around? I thought Malibu Media was one of Prenda Law's phoney shell corporations.

Re:Malibu Media

[Anonymous Coward]

This article suggests that they were separate entities who behaved similarly.

Whew!

[doubledown00]

Thank goodness the judge doesn't understand technology or that defendant would have been screwed.
"Yes your honor, hard drives are merely mysterious magical containers of stuff with no alternative method of recovery."

From a tactical standpoint the defendant avoided default. Sure he may have saved himself from them seeing exactly what he had downloaded. However he isn't out of the woods yet as other sanctions are possible. For example the Plaintiff could secure jury instructions that the jury is to assume that there was pirated material on the drive. Or the judge could hand down discovery sanctions such as fines, limits on what discovery the Defendant can do, etc.

I would expect that the Plaintiffs will explore these avenues soon enough.

Disclaimer: IAAL.

Re: Whew!

[Anonymous Coward]

Translation: I didn't read the article.

Re: Whew!

[doubledown00]

Translation: You didn't read the opinion.

Re: Whew!

[Anonymous Coward]

Translation: I still have no idea what I'm talking about

Sarbanes-Oxley applies to fish

[RogueWarrior65]

This SCOTUS case might be relevant:
http://www.wsj.com/articles/bi...

presumption of guilt

[Anonymous Coward]

What I find interesting. Wait. This whole discussion is interesting and I am learning. But one thing I notice is that most responders seem to presume the the owner of the hard drive was in fact guilty of sharing this specific porn on torrent. Maybe he was, I don't know. But I certainly don't assume that he was because someone accused him off it. I know porn is a problem for many, and all that, but why do y'all assume Porn Media Group is right?

This touches a fear of mine, that I will be wrongly accused and found guilty of a crime. It's stupid, because as a white middle aged female I am the least likely to experience this.

Re:presumption of guilt

[Anonymous Coward]

Yeah, it's rather bizarre (well, not really since it rare that any Slashdotter actually RTFA) that most assume the guy is violating the copyrights of known porn troll media company that makes money by shaking down hapless torrent users by filing copyright lawsuits over material that includes embarrassing titles like, "Pretty Back Door Baby". Hell, most of the Malibu Media doesn't even own the copyrights to the porn, they just count on the suckers paying the extor-, err, settlement fee to keep from being added as a defendant. I chalk it up to more conservative, law and order types being on Slashdot during Sunday.

Just an FYI: who is Malibu Media:

[Kubla Kahhhn!]

Infamous porn copyright troll, using humiliation of public exposure as a tactic.

If it's good enough for the IRS...

[KermodeBear]

...then it is good enough for us. Right?

Re:If it's good enough for the IRS...

[Anonymous Coward]

Please stop spouting that Republican lie that all of the IRS failures were intentional. There is no proof of that just as there is no proof that the IRS hates you people and is screwing you over on purpose. There is on the appearance of that.

Re:If it's good enough for the IRS...

[KermodeBear]

One can have a little humor without making it into a political war, which I hadn't, nor was I intending to do so.

Breathe.

Smile.

Relax.

It's okay.

I hope the rest of your day goes well.

Re:Hello drill - meet hard drive

[Anonymous Coward]

STEP 1: Using steel bit, drill a hole completely thru hard drive case. There is no Step 2.

No drill? Use a hammer and a screwdriver to punch a hole. Punch a couple of them if it feels good.

Hard Drive Failure?

[Anonymous Coward]

Lois Lerner, call your office!

over write once and be done with it

[Anonymous Coward]

From what I understand, all it takes is one knock with a hammer to ensure platters are bent and can never be used again. And there is no known practical method to restore data after a single overwrite with 0s. Everything else is pure paranoia.

Overwriting with 0s will not perfectly overwrite the tracks.

NIST disagrees:

On the other hand, according to the 2006 NIST Special Publication 800-88 (p. 7): "Studies have shown that most of today’s media can be effectively cleared by one overwrite" and "for ATA disk drives manufactured after 2001 (over 15 GB) the terms clearing and purging have converged."[5] An analysis by Wright et al. of recovery techniques, including magnetic force microscopy, also concludes that a single wipe is all that is required for modern drives. They point out that the long time required for multiple wipes "has created a situation where many organisations ignore the issue all together – resulting in data leaks and loss."[6]

https://en.wikipedia.org/wiki/Data_remanence#Feasibility_of_recovering_overwritten_data

There is some slop on the read head positioning that will normally allow enough data to be recovered that the ECC can be used to rebuild the full data set.

This has been found not to been the case per Craig Wright, Dave Kleiman, Shyaam Sundhar R.S. in "Overwriting Hard Drive Data: The Great Wiping Controversy (doi:10.1007/978-3-540-89862-7_21 which is [6] above).

Do you have any studies that indicate otherwise, or are you just repeating something which you once heard, at some point in time (which may or may not be valid any longer)?

If you're really that paranoid and don't want to trust an overwrite (of which a single-pass should be sufficient), either go with thermite or an "NSA-rated" degausser:

https://www.google.com/search?q=NSA+rated+degausser

But seriously, a single overwrite is sufficient for us non-classified folks.

one word:

[swschrad]

bonfire.

Analog versus digital

[dbIII]

No mainstream 2.5/3.5 in. hard drive manufactured in the last 15 years is recoverable after a zero-out.

Only in a digital sense as being above or below a certain threshold. The relative amount above or below the theshold can indicate what the value used to be, but that's not something you are going to get from the existing disk controller board.