4 ms·
From what I understand, they have basically the logfile or other metadata from the program he used to download/manage these files, which contains the hashes. Th
by jo909 9y ago
From what I understand, they have basically the logfile or other metadata from the program he used to download/manage these files, which contains the hashes. The encrypted drives in question are external drives, not the OS drive.
- Arnt 9y agoReference?
- jo909 9y agohttp://www2.ca3.uscourts.gov/opinarch/153537p.pdf http://www2.ca3.uscourts.gov/opinarch/153537p.pdf Despite Doe’s refusal, f orensic analysts discovered the password to decrypt the Mac Pro Computer , but could not de crypt the external hard drives. [...] The Forensic examination also disclosed that Doe had downloaded thousands of files known by their “hash ” values to be child pornography. 3 The files, however, were not on the Mac Pro, but i nstead had been stored on the encrypted external hard drives. Accordingly, the files themselves could not be accessed.
- Arnt 9y agoThanks.
- cmiles74 9y agoIt sounds like they suspect the files were downloaded directly to the external drive, perhaps there's a pointer in a log file or something with the path. Clearly they haven't proven that, hence their wish to inspect the decrypted drive. IMHO, if they really wanted to charge him and take him to trial, they have plenty of evidence. I doubt a jury would be sympathetic to the "I forgot my password" argument and the logic would be that if the files _were not_ on the external drive then he would willingly decrypt it to prove as much.