Slashdot Mirror

← Back to Stories (view on slashdot.org)

Indiana Court Rules Melted Down Hard Drive Not Destruction of Evidence

Posted by samzenpus on from the it's-getting-hot-in-here dept.

An anonymous reader writes An Indiana court has ruled that a hard drive that was sent to recycling was not destruction of evidence. The ruling stems from a BitTorrent file-sharing case filed by Malibu Media where a defendant claimed that his hard drive had failed thanks to heavy use. Malibu claimed that the act was destruction of evidence and filed a motion demanding a default judgement. The court denied this motion suggesting that because the hard drive failed, there was no evidence to destroy in the first place.

23 of 181 comments (clear)

  1. Hello microwave by Anonymous Coward · · Score: 4, Funny

    Hello microwave. I'd like you to meet hard drive.

    1. Re:Hello microwave by ssufficool · · Score: 3, Informative

      Actually a single overwrite with zero is recoverable on older non-PMR drives by simply realigning the heads a bit to catch the edge of the magnetic track only weakened by the zero wipe (and I mean a very small bit) and re-installing the drive. On PMR, there are actually weak bits left after a zero wipe that are recoverable by equipment capable of reading weak bits. A random wipe is usually effective in all cases. A hammer leaves nothing to chance.

      I also don't understand how a drive can be ruled as evidence if nothing is yet discovered on the hard drive. I don't understand how the prosecution can ask for a default judgement without solid compelling evidence of a crime. Without a discovery of the drives contents I'm assuming they had other evidence.

    2. Re:Hello microwave by geoskd · · Score: 5, Informative

      From what I understand, all it takes is one knock with a hammer to ensure platters are bent and can never be used again. And there is no known practical method to restore data after a single overwrite with 0s. Everything else is pure paranoia.

      Overwriting with 0s will not perfectly overwrite the tracks. There is some slop on the read head positioning that will normally allow enough data to be recovered that the ECC can be used to rebuild the full data set. This can only be done by taking the platters out and putting them into a machine that is purpose built for the task of recovering such data. Having worked on part of the design of such a machine, I can tell you two things about it: First, it exists, and second, it is not cheap. I was told the cost of the one I worked on was $12M USD.

      Physically deforming the platters will make the job much more difficult (expensive), but not impossible. A combination of clever chemistry and an electron microscope can usually recover data off a mangled platter. This process sucks because it has to be done by hand, but if its worth enough to you, there a couple of labs around the country that can handle that level of data recovery. A better way to ensure total destruction is to melt the platters outright. not only does the melting deform the platters, but sufficient heat will thoroughly destroy the data, even if the platter does not completely melt.

      --
      I wish I had a good sig, but all the good ones are copyrighted
    3. Re:Hello microwave by tibit · · Score: 4, Insightful

      older non-PMR drives

      Those drives are now museum artifacts, so your concern is of no practical use. No mainstream 2.5/3.5 in. hard drive manufactured in the last 15 years is recoverable after a zero-out.

      --
      A successful API design takes a mixture of software design and pedagogy.
    4. Re:Hello microwave by tibit · · Score: 4, Informative

      most of the data can generally be recovered easily enough

      Nope. The drives manufactured in the last two decades, give-or-take, have the size of magnetic domains matched to the size of the field generated by the heads. The "edge" of the track is defined by where data from one track ceases to be, and the data from another track begins, and this is a binary thing. One domain here has data from this track, another domain there has data from that track.

      What people constantly fail to realize is that if there was an area of disk, the mythical "inter-track gap", that was any good at storing any data, it'd be stupid for the manufacturer to not put the expensive platter real estate to good use. And they do precisely that: they use all of the platters to store your current data. There is no inter track gap.

      --
      A successful API design takes a mixture of software design and pedagogy.
    5. Re:Hello microwave by Immerman · · Score: 3, Informative

      If they could reliably position the heads in *exactly* the same place every time that would be the case. But they can't - mechanical devices and perfection are mutually incompatible. So assuming there's an error of +/- N um in head positioning, your track has to be at least 2*N um wider than the recording head to avoid partially overwriting adjacent tracks. You can cut that roughly in half by sharing the buffer zone between adjacent tracks - hence creating the " inter-track gap". Modern drive heads are are more precise than they used to be, but that only reduces the width of the necessary buffer zones, it doesn't eliminate them entirely.

      --
      --- Most topics have many sides worth arguing, allow me to take one opposite you.
    6. Re:Hello microwave by Jane+Q.+Public · · Score: 5, Informative

      I don't understand how the prosecution can ask for a default judgement without solid compelling evidence of a crime. Without a discovery of the drives contents I'm assuming they had other evidence.

      First, part of the reason you don't understand this is because you are under the impression that copyright infringement for personal use is a crime. It is NOT. This is a civil matter, not criminal.

      Generally speaking, copyright infringement is only criminal if you are doing it in bulk for profit. Historically, that meant what has been known legally for about 100 years as copyright piracy, which again in general refers to making unauthorized copies of copyrighted works and selling them.

      It is today's media industry which has deliberately attempted to confuse you by labeling downloads of copyrighted material for personal use piracy. It is not. Piracy is a legal term referring to PROFITING from unauthorized copying of copyrighted works.

      Now, back to the case at hand: being a civil matter, and not criminal, the court need not require probable cause in order to demand that evidence be produced (although it probably can't be seized beforehand. However, because of this, people have been known to destroy evidence after being served notice of a lawsuit. If they do that for the purpose of hiding the evidence, and the plaintiff can show that, it may be ruled spoliation of evidence, and could result in a summary judgment in favor of the plaintiff.

      But despite this not being a criminal matter, plaintiff still bears the burden of showing that spoliation happened, via genuine evidence. In this case, plaintiff's claim of spoliation was not backed by evidence; it was a claim without substance. Defendant had a reasonable explanation for the drive's demise, and plaintiff could not show otherwise.

      I also don't understand how a drive can be ruled as evidence if nothing is yet discovered on the hard drive.

      Remember that this is a civil matter. Standards of evidence are different. If a reasonable person would believe that the drive contained evidence, a judge might ask that it be produced. It very much depends on the circumstances.

    7. Re:Hello microwave by thegarbz · · Score: 4, Informative

      When did you do this? Data densities have gotten so tight and tolerances so small that while I won't call bullshit on your statement I will call it out of date. It's impossible to recover data at this day and age. While you're right that the head doesn't perfectly write over the track, the gaps between the tracks are so small that the magnetic field is not sustainable when something is written. Heck one of the challenges the industry is facing is writing a track without having the tracks either side break down, and you're taking about a sustained field an order of magnitude smaller.

  2. I disagree... by Anonymous Coward · · Score: 4, Insightful

    ...without knowing how the drive "failed" the court cannot prove that there was no evidence to destroy. I guess he never heard of drive recovery places that can recover some information from a majority of drives that "fail"

    1. Re:I disagree... by wiredlogic · · Score: 5, Interesting

      That requires the plaintiff to spend money to have the analysis done which isn't part of the copyright extortion business plan.

      --
      I am becoming gerund, destroyer of verbs.
    2. Re:I disagree... by AchilleTalon · · Score: 5, Informative

      You should have read the article. The argument is about what the defendant knows and the intention. The drive was sent to recycle BEFORE the defendant even knows a litigation is imminent. Hence, it is not possible to argue the defendant destroyed an evidence while he didn't know it was to become an evidence. The hard drive was destroyed in good faith by the defendant without an intention to interfere with legal procedures since there wasn't any at the time and he wasn't even aware any was eminent.

      --
      Achille Talon
      Hop!
  3. Wow - interesting by xystren · · Score: 4, Insightful

    Lots of room for potential abuse, but an interesting judgement. I wonder if there will now be laws stating that dead hardware must be kept beyond the statute of limitation in case a lawsuit ensues. So what about all those "catastrophic failures" right before the suit if filed? A double edged sword none the less.

  4. Presumption of innocence by aepervius · · Score: 4, Insightful

    "without knowing how the drive "failed" the court cannot prove that there was no evidence to destroy."

    correct me if I am wrong, but AFAIR the US justice system, It is up to the prosecution side to prove there was evidence on teh HD, not on the side of the defense there was not. Therefore from the court in absence of proof of existence of evidence, the assumption should be by default there was no evidence. IF the prosecution has proof tehre was evidence they are free to provide them. But until then by presumption of innocence, the court has to assume the recyclage was lawful. Otherwise if the presumption was it was destruction of evidence, then it amounts of a presumption of guiltiness.

    --
    C. Sagan : A demon haunted world:
    http://www.amazon.com/gp/product/0345409469/
    visit randi.org
    1. Re:Presumption of innocence by SuricouRaven · · Score: 3, Informative

      Close. This was a civil case, so the plaintiff doesn't need to prove anything beyond a reasonable doubt, as the prosecution would in a criminal case. Only has to prove that he was probably infringing.

    2. Re:Presumption of innocence by CaptainDork · · Score: 4, Informative

      Not this.

      The accused is not bound to preserve any and all possessions that might be discoverable in litigation at a later date after even a rumour that the accused will become a party in a suit.

      Evidence does not exist before probable cause defines the scope of what will constitute evidence, only after a motion to preserve evidence is filed.

      --
      It little behooves the best of us to comment on the rest of us.
    3. Re:Presumption of innocence by doubledown00 · · Score: 4, Insightful

      Well, it's a little more than "probably". They have to show a preponderance of evidence. It's not enough to say, "this guy's a big movie fan and had 200gig of downloads every month and never rented a movie or went to a theater, so he probably was pirating movies".

      Preponderance of the evidence is a 51 percent standard......i.e. "more likely than not".
      Barring any statutorily necessary elements of the Plaintiff's claims, if the jury finds that to be sufficient then the dude can be found liable. It's all circumstantial, certainly. But I have guys doing decades of prison time based on circumstantial evidence, and that was "beyond a reasonable doubt". With what you lay out above, I could *easily* see a jury making a few key inferences and finding liability in that.

      Never try and predict what the 12 geniuses in the box will or will not do.

    4. Re:Presumption of innocence by AmiMoJo · · Score: 4, Informative

      I bothered to RTFA and you are both a little way off what actually happened.

      The guy received notice of the lawsuit. Five months later, the drive failed and he threw it away. The court concluded that because five months had passed it was unlikely he was trying to destroy evidence; if that had been the goal he would have done it sooner.

      --
      const int one = 65536; (Silvermoon, Texture.cs)
      SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
  5. Re:How is this supposed to work...? by Em+Adespoton · · Score: 5, Informative

    - person uses drive for illegal activity
    - person receives DMCA notice
    - person "catastrophically fails" their drive
    - person receives subpoena
    - person notifies court that sole evidence no longer exists due to drive failure.

    Hence, your assumptions are flawed (for this case).

    The ruling found that it was NOT illegal to destroy evidence before it is called for evidence. It is illegal to intentionally destroy evidence that has been called for by the court. There are also retention laws that cover certain situations. Setting data retention guidelines prior to the suit protects you from getting into this mess (if you can prove that you ALWAYS destroy your data after X days/ x failed writes/ etc. then you're not culpable if you do what you always do just prior to being served).

  6. Pretty Fine Line There by Greyfox · · Score: 4, Informative

    Basically it works out that he'd recycled the drive prior to being aware that he personally was being sued for copyright infringement. He also didn't run out and recycle all his drives as soon as he got a letter from Comcast saying that some sort of lawsuit was in progress. I assume the guy had some evidence to back up the dates in his claims. There's no discussion about whether they asked him for the backups he had or anything. In a nutshell, I wouldn't want to have to bet my ass on the court coming to the conclusion it did in any particular case.

    --

    I'm trying to teach myself to set people on fire with my mind... Is it hot in here?

  7. Re:Kill-ur-drive contest? by gnasher719 · · Score: 3, Informative

    Before the platters are up to speed, there is very little Bernoulli force holding the heads up. The above operation will crash the head and leave a nice big scratch.

    And then your opponent finds an expert witness who examines the hard drive, finds the scratch, and explains to the court that it was most likely intentionally damaged. They don't need proof, just likelihood. And now you are stuck, because whatever your opponent claimed is on the drive, the court now assumes it was there before you destroyed it.

  8. Court made the right decision by Anonymous Coward · · Score: 5, Informative

    I know this because I RTFA'd

    Defendant received notice of this lawsuit at the beginning of October 2012. []Defendant, however, did not destroy the hard drive until “late February 2013.” [] Thus, almost five months passed between the time that Defendant learned of the lawsuit and Defendant’s destruction of the hard drive. Had Defendant truly wished to hide adverse information, the Court finds it unlikely that Defendant would have waited nearly five months to destroy such information. Instead, Defendant’s continued use of the hard drive for the months after he learned of the litigation suggests that the hard drive contained no information to hide at all, or that Defendant did not intend to hide any such information.

    The timing of Plaintiff’s amendment and the service of its complaint also detract from an inference of bad faith. Plaintiff amended its complaint to add Harrison as a Defendant on November 9, 2012. [] Plaintiff, however, did not serve the amended complaint on Harrison until April 2013, [], after Defendant had arranged to order the replacement hard drive, [], and after the recycling of Defendant’s hard drive. [] Furthermore, Defendant testified that the service of the complaint was the first time that he became aware that he was personally being sued for copyright infringement. []

  9. Malibu Media by koan · · Score: 5, Interesting

    Magistrate Judge Stephen L. Crocker didn't like this tactic. He froze eleven of Malibu's cases in western Wisconsin, and ordered Malibu's lawyer to explain why she shouldn't be sanctioned for violating court rules. Filing paperwork with the Court with no purpose except to harass or embarrass an opponent is a big no-no. Judge Crocker wondered why Malibu would file a list of movies with embarrassing titles that Malibu doesn't own and can't sue over.

    https://www.eff.org/cases/mali...

    --
    "If any question why we died, Tell them because our fathers lied."
  10. over write once and be done with it by Anonymous Coward · · Score: 3, Insightful

    From what I understand, all it takes is one knock with a hammer to ensure platters are bent and can never be used again. And there is no known practical method to restore data after a single overwrite with 0s. Everything else is pure paranoia.

    Overwriting with 0s will not perfectly overwrite the tracks.

    NIST disagrees:

    On the other hand, according to the 2006 NIST Special Publication 800-88 (p. 7): "Studies have shown that most of today’s media can be effectively cleared by one overwrite" and "for ATA disk drives manufactured after 2001 (over 15 GB) the terms clearing and purging have converged."[5] An analysis by Wright et al. of recovery techniques, including magnetic force microscopy, also concludes that a single wipe is all that is required for modern drives. They point out that the long time required for multiple wipes "has created a situation where many organisations ignore the issue all together – resulting in data leaks and loss."[6]

    https://en.wikipedia.org/wiki/Data_remanence#Feasibility_of_recovering_overwritten_data

    There is some slop on the read head positioning that will normally allow enough data to be recovered that the ECC can be used to rebuild the full data set.

    This has been found not to been the case per Craig Wright, Dave Kleiman, Shyaam Sundhar R.S. in "Overwriting Hard Drive Data: The Great Wiping Controversy (doi:10.1007/978-3-540-89862-7_21 which is [6] above).

    Do you have any studies that indicate otherwise, or are you just repeating something which you once heard, at some point in time (which may or may not be valid any longer)?

    If you're really that paranoid and don't want to trust an overwrite (of which a single-pass should be sufficient), either go with thermite or an "NSA-rated" degausser:

    https://www.google.com/search?q=NSA+rated+degausser

    But seriously, a single overwrite is sufficient for us non-classified folks.