5 ms·

The accused has to led the accuser inspect his data? Scary! I sure hope they use forensic standards such as not the actual hard drive but an image of it. Other

• sukuriant 16y ago
  I wonder if, for situations like this, you could have a neutral third party image your drive, keep one for themselves and push the image over to Sony.
  • m0nastic 16y ago
    You won't likely find such a party in cases like this. What is more likely is that each side will hire a forensics firm to image the drive, and as long as both their checksums match, than there isn't much disagreement.
    • Natsu 16y ago
      I remember one P2P case that was swiftly dropped because of smart lawyering by the defendant's lawyers. To deal with the "expedited discovery" bit, the lawyer himself took custody of their hard drives. As an officer of the court, he could take responsibility for preventing evidence from being destroyed. He then offered to make it available to third-party forensics experts for imaging, and they would be able to get a ruling from a judge concerning exactly which things those experts would be ordered to search for (rather than letting the plaintiff's lawyers trawl through everything at their leisure). I'm not quite clear on how much of that is happening here. One might hope this would be the ordinary procedure, but I have to worry about any judge who signs an order telling someone to retrieve information from the internet, period. I realize it was swiftly reconsidered and amended. For that, I give them due credit, even though I worry about any state of affairs wherein an absurd order could be issued in the first place.
• m0nastic 16y ago
  Sony won't be involved directly with any part of the forensics. Their attorneys will contract with a forensics firm who will make an image of the drives (using a write-blocked device like the ones made by Wiebetech or an Encase Fastbloc). Analysis will not be performed on the actual drive, but on the image. The defendant's attorney will also receive a copy of this image, ensuring that chain of custody was followed (or else they can sure to try and argue that the evidence has been tampered with). The images will be checksummed, and I would argue that the odds of evidence being tampered are pretty slim in this instance.
  • ErrantX 16y ago
    > I would argue that the odds of evidence being tampered are pretty slim in this instance. Very slim. Not least because if the defendant's legal team get wind of it that's it for any evidence from the drive, period. Too much risk.
• tptacek 16y ago
  Every geek in the world thinks and says this whenever any legal proceeding involves inspecting hard drives. In the real world, it's just not that big a deal. There are chain-of-custody rules that apply any time digital evidence is handled in court. The reality is that the penalty for deliberately planting evidence would be so severe, the likelihood of success so uncertain, that no major corporation (or their zillion-dollar law firm) would risk it over a small-ball case like this. (Like 'm0nastic points out, Sony can also pay a pittance relative to their legal fees to contract this out to Mandiant).