When being sued by the RIAA, DON'T ERASE your files

[adrian]

When discovery began, the RIAA asked the judge for a mirrored copy of Tschirhart's hard drive in order to look for evidence of copyright infringement. The judge agreed. The drive was turned over to computer forensics expert David Schroeder, who claimed (and the defendant's own expert did not dispute) that data was removed from the hard drive before it was turned over.

Source and full article

Remember boys and girls: If you do the crime, you gotta do the time.

[Hellbent]

Re: When being sued by the RIAA, DON'T ERASE your files

well, is a hard drive that had files missing (could be anything) worse then illegal files? i particularly dont like the RIAA's strongarm tactics. It makes them look bad in my opinion. Sue a 12 year old girl from the projects? Sure! Sue a grandma who let some neighborhood kids use her PC? Sure! Sue someone who doesnt have a PC, but the previous tenants did? Okay!
I am not advocating pirating music, but data deleted from the hard drive could be anything. pron, music, pictures, etc.

[Hellbent]

Re: When being sued by the RIAA, DON'T ERASE your files

Oh I see, its more a question of tampering with evidence.
The problem is that I have fixed many family computers where the parents have no idea whats installed on the computers by their kids. Add that with adware/spyware/trojans and it gets fun.
"Tallie wanted the declaratory judgment in order to clear her name, which she feels was unfairly smeared by the lawsuit. "Despite being placed on notice that Tallie did not download any songs," her statement reads, "the Plaintiffs filed this action against Tallie. Plaintiffs impugn Tallie's character and subject her to demands which are closely akin to extortion."
Sounds like the RIAA is going to be sued for defamation!

[Vanguard]

Re: When being sued by the RIAA, DON'T ERASE your files

I can't seem to access the article. Was the defendant allegedly a user of P2p?

[Hellbent]

Re: When being sued by the RIAA, DON'T ERASE your files

Two legal lessons from the RIAA: don't disobey the judge and don't sue innocent people
8/25/2006 12:26:32 PM, by Nate Anderson

An RIAA spokeperson tells Ars that the hard drive was a gold mine. "On her computer, we found a number of file deletion programs and their log files. According to those files, we determined that substantial deletions had been done over a period of time, including after the Court had ordered Ms. Tschirhart to turn the computer over for inspection. She denied having done any deleting or knowing anything about such programs."

Schroeder claims that data was deleted on at least two separate occasions using two different disk-cleaning utilities. Tschirhart's own expert, Wayne Marney, argued that the second round of deletions (January 26, 9:23am) were "consistent with defragmentation of the hard drive." The last recorded defragmentation came on January 30 at 1:53pm, and he speculates that the earlier deletions could have been caused by an automatic defragmenting program.

The judge didn't buy it. "The evidence is inconsistent with an automatic defragmentation program," he writes. "Such automatic programs are typically set up to run a daily, weekly, or monthly schedules—not every four days, four hours, and 30 minutes. If the defragmentation program was not run automatically, it indicates that someone intentionally ran the program at January 26, which would be consistent with an intent to destroy data."

[adrian]

Re: When being sued by the RIAA, DON'T ERASE your files

Hellbent, I posted part of the article because we've been getting warnings about posting full articles.

[beaker]

Re: When being sued by the RIAA, DON'T ERASE your files

Guilty or not, never ever ever tamper with evidence. Woo that makes the judge mad.

[Hellbent]

Re: When being sued by the RIAA, DON'T ERASE your files

oh sorry, didnt know about that rule. thought itd be helpful since he couldnt read it.

[Leo Lakio]

Re: When being sued by the RIAA, DON'T ERASE your files

Guilty or not, never ever ever tamper with evidence.

And if you aren't guilty of anything, how do you know that it is "evidence" when you erase files from your computer? Most people delete things all the time.

[pzarquon]

Re: When being sued by the RIAA, DON'T ERASE your files

And if you aren't guilty of anything, how do you know that it is "evidence" when you erase files from your computer? Most people delete things all the time.

Computer forensic folks, and most serious geeks, will be able to tell whether something was "deleted" merely as a matter of course, or deleted with the express purpose of destroying data. Because, of course, "deleting" a file leaves most of it in place and easily recoverable, unless the space is overwritten or the whole drive defragmented.

As the judge noted in the case, the suspect drive was repeatedly defragmented, and she didn't buy that it was just the usually scheduled disk maintenance utility doing its job. There also seemed to have been more than one tool at work.

It's actually pretty easy to destroy data and make it nearly impossible to recover these days. I use better-than-DOD-grade encryption and overwriting just 'cause I can. But such tools leave scorch marks, in a sense -- you can tell I didn't just drag stuff to the Recycle Bin, you know? That's how the defendent was caught. There were tell-tale signs of erasing utilities being used.

And hardcore data recovery experts can still come up with stuff even after you've done your worst. Look up some of these companies on line... they can get stuff off drives that were encrypted, three-pass data wiped, then run over by a truck and tossed into a swamp!

well, is a hard drive that had files missing (could be anything) worse then illegal files?

As is often the case, the crime itself is sometimes not half as bad as attempting to cover it up after the fact.