Indiana Court Rules Melted Down Hard Drive Not Destruction of Evidence

An anonymous reader writes An Indiana court has ruled that a hard drive that was sent to recycling was not destruction of evidence. The ruling stems from a BitTorrent file-sharing case filed by Malibu Media where a defendant claimed that his hard drive had failed thanks to heavy use. Malibu claimed that the act was destruction of evidence and filed a motion demanding a default judgement. The court denied this motion suggesting that because the hard drive failed, there was no evidence to destroy in the first place.

Comments

I disagree...

[Anonymous Coward]

...without knowing how the drive "failed" the court cannot prove that there was no evidence to destroy. I guess he never heard of drive recovery places that can recover some information from a majority of drives that "fail"

Wow - interesting

[xystren]

Lots of room for potential abuse, but an interesting judgement. I wonder if there will now be laws stating that dead hardware must be kept beyond the statute of limitation in case a lawsuit ensues. So what about all those "catastrophic failures" right before the suit if filed? A double edged sword none the less.

Uninformed court?

[drhamad]

That seems like a weird decision... I mean, even if the drive itself has failed it doesn't mean the platters have no data on them that could be recovered. Of course, the secondary question is whether the destruction was intentional or not, but as for the question at issue here, I don't see how a court could say that there is no evidence that was destroyed. The likelihood is completely opposite.

Presumption of innocence

[aepervius]

"without knowing how the drive "failed" the court cannot prove that there was no evidence to destroy."

correct me if I am wrong, but AFAIR the US justice system, It is up to the prosecution side to prove there was evidence on teh HD, not on the side of the defense there was not. Therefore from the court in absence of proof of existence of evidence, the assumption should be by default there was no evidence. IF the prosecution has proof tehre was evidence they are free to provide them. But until then by presumption of innocence, the court has to assume the recyclage was lawful. Otherwise if the presumption was it was destruction of evidence, then it amounts of a presumption of guiltiness.

Re:Presumption of innocence

[doubledown00]

Well, it's a little more than "probably". They have to show a preponderance of evidence. It's not enough to say, "this guy's a big movie fan and had 200gig of downloads every month and never rented a movie or went to a theater, so he probably was pirating movies".

Preponderance of the evidence is a 51 percent standard......i.e. "more likely than not".
Barring any statutorily necessary elements of the Plaintiff's claims, if the jury finds that to be sufficient then the dude can be found liable. It's all circumstantial, certainly. But I have guys doing decades of prison time based on circumstantial evidence, and that was "beyond a reasonable doubt". With what you lay out above, I could *easily* see a jury making a few key inferences and finding liability in that.

Never try and predict what the 12 geniuses in the box will or will not do.

Re:Hello microwave

[tibit]

older non-PMR drives

Those drives are now museum artifacts, so your concern is of no practical use. No mainstream 2.5/3.5 in. hard drive manufactured in the last 15 years is recoverable after a zero-out.

over write once and be done with it

[Anonymous Coward]

From what I understand, all it takes is one knock with a hammer to ensure platters are bent and can never be used again. And there is no known practical method to restore data after a single overwrite with 0s. Everything else is pure paranoia.

Overwriting with 0s will not perfectly overwrite the tracks.

NIST disagrees:

On the other hand, according to the 2006 NIST Special Publication 800-88 (p. 7): "Studies have shown that most of today’s media can be effectively cleared by one overwrite" and "for ATA disk drives manufactured after 2001 (over 15 GB) the terms clearing and purging have converged."[5] An analysis by Wright et al. of recovery techniques, including magnetic force microscopy, also concludes that a single wipe is all that is required for modern drives. They point out that the long time required for multiple wipes "has created a situation where many organisations ignore the issue all together – resulting in data leaks and loss."[6]

https://en.wikipedia.org/wiki/Data_remanence#Feasibility_of_recovering_overwritten_data

There is some slop on the read head positioning that will normally allow enough data to be recovered that the ECC can be used to rebuild the full data set.

This has been found not to been the case per Craig Wright, Dave Kleiman, Shyaam Sundhar R.S. in "Overwriting Hard Drive Data: The Great Wiping Controversy (doi:10.1007/978-3-540-89862-7_21 which is [6] above).

Do you have any studies that indicate otherwise, or are you just repeating something which you once heard, at some point in time (which may or may not be valid any longer)?

If you're really that paranoid and don't want to trust an overwrite (of which a single-pass should be sufficient), either go with thermite or an "NSA-rated" degausser:

https://www.google.com/search?q=NSA+rated+degausser

But seriously, a single overwrite is sufficient for us non-classified folks.