Comment Re:Stupid? (Score 1) 813
You are absolutely correct.
If the defendant was going to destroy evidence without wiping the entire hard drive, she should be fully aware of all of the system artifacts left by the activity she was trying to deny, and then remove them. However, the risk that she would miss something is too great (Obviously). Does your "evidence deletion/wiping software" know about logs left by an application, .ini files with usernames and settings, registry entries with user names and settings or last visited IPs, etc.
If the defendant had wiped the entire hard drive, she could have claimed that she had done so before the court order to turn the drive over - because if an entire drive had been zero'd out, there would be no date/time stamps to indicate when that wipe had occurred. By leaving the file system intact, she left all of the NTFS or FAT32 modified/accessed/create times linked to any files that she did not know about and remove. Furthermore she left any date/time stamps that may have been in those files. This allowed the plaintiff's forensic expert to construct a timeline of some activity regardless of the deletions that did occur.
On one hand, this is another example of the RIAA having resources and knowledge that your average Joe does not (Computer forensics experts are expensive). Most defendants against RIAA lawsuits can't overcome the resources at the RIAA's disposal which they apparently sling at anybody who crosses their path, innocent or no. On the other hand, I respect the court's judgement. If she had wiped the entire drive to protect personal data, that would have been at least respectable. But she just tried to remove file sharing artifacts, she did a bad job of it, and she did it after the court order. That's just bad news. Trying to run after you've been busted just makes you look more guilty. She must have never watched Cops.
If the defendant was going to destroy evidence without wiping the entire hard drive, she should be fully aware of all of the system artifacts left by the activity she was trying to deny, and then remove them. However, the risk that she would miss something is too great (Obviously). Does your "evidence deletion/wiping software" know about logs left by an application,
If the defendant had wiped the entire hard drive, she could have claimed that she had done so before the court order to turn the drive over - because if an entire drive had been zero'd out, there would be no date/time stamps to indicate when that wipe had occurred. By leaving the file system intact, she left all of the NTFS or FAT32 modified/accessed/create times linked to any files that she did not know about and remove. Furthermore she left any date/time stamps that may have been in those files. This allowed the plaintiff's forensic expert to construct a timeline of some activity regardless of the deletions that did occur.
On one hand, this is another example of the RIAA having resources and knowledge that your average Joe does not (Computer forensics experts are expensive). Most defendants against RIAA lawsuits can't overcome the resources at the RIAA's disposal which they apparently sling at anybody who crosses their path, innocent or no. On the other hand, I respect the court's judgement. If she had wiped the entire drive to protect personal data, that would have been at least respectable. But she just tried to remove file sharing artifacts, she did a bad job of it, and she did it after the court order. That's just bad news. Trying to run after you've been busted just makes you look more guilty. She must have never watched Cops.
