While I applaud the judge in acknowledging the existence of the fourth amendment and it's intended purpose, I do feel she may have erred in this case. If the suspect truly did leave his computer behind when evicted, then he abandoned it. As such, it should no longer be protected by his fourth amendment right. Once he abandoned it (as opposed to accidentally leaving it behind or, more likely, not being allowed to retrieve it), it was no longer his possession, and as such, the person who did take possession of it had every right to turn it over to the police, who then had every right to examine it without a search warrant (since the new owner voluntarily, without being coerced or threatened, gave them permission).

I also think she erred in considering each platter a separate container. Using that mindset, the police would need to get a separate search warrant for every platter, which is unfeasable (they would first need to get a search warrant for the drive itself, then record the model number and look up it's specs to determine the number of platters, then get a warrant for each platter). Without examining the file allocation table, you don't even know what platters hold the file(s) you're interested in. And if the drive does not map logical sectors to physical sectors (for example, if they borrow that technology from new SSDs), then there is no way to determine which platters the data is on since the drive's controller board will likely only tell you the logical sector number. Simply put, the hard drive is one device, one container.

With all that in mind, the prosecutor is an absolute idiot and/or liar for saying that taking a hash of the drive's contents does not constitute a search. That would be like saying "well, we examined every book and every paper in his filing cabinets, but we didn't conduct a search". And while the prosecution personnel themselves may not have looked at the files' data, their program most certainly did, as it needed to in order to create the hashes. Therefore, there can be no doubt that a search did, in fact, occur. This still leaves open the question of whether it was a legitimate search or not (whether or not they needed a warrant).

A judge who understands technology...mostly. The fact that she knows that the little spinny silver disks inside hard drives are called platters is a shocking. She also seems to know what the word 'bit' means! Maybe there is hope for America's judicial system. Like other posters, the only thing that I think is odd is her definition of a "container".

This ruling is going to be appealed.

Settle down for a long show, folks.

Yeah, there's some strange stuff, but consider the instance of a RAID system. This is just the opening number.

Good start, ain't it.

"Without examining the file allocation table, you don't even know what platters hold the file(s) you're interested in."

Worse than that - unless there are very, very few files on the disk, the file allocation table itself (or the Master File Table, for machines using NTFS) will be spread across all the platters anyway! The platter aspect seems ridiculous, since even the operating system itself has no idea which platter it's putting a block of data: it appears as a single set of blocks of data these days.

I suspect she was confusing platters with disks, but even there I'd say she's stretching it a bit: a warrant specifying the computer as a whole should suffice. Does it really matter whether there's one disk, two or a whole big RAID array in the case?

Let me get this straight.

Someone not in law enforcement plays with someone elses machine for an unknow time and then finds a heap of stuff and this is considered valid evidence?

Changing timestamps of files (even down in raw NTFS blocks is noddy stuff with a live linux distro and UNDETECTABLE ON A DISK IMAGE. The only way to detect such tampering is removing the platters and looking for residual images with a TEM (expensive).

This is one reason why unless there is a chain of evidence (a list of handovers etc) AND you can prove that the item was authored by someone then tampering must be considered and the evidence be rejected.

I could *easily* plant files into a NTFS disk undetectable in a disk image copy with one of the three main live linux secuirty distros and a bit of C code - overwriting disk blocks in not exactly "rocket science".

Jacqui

So you need suspicion and a warrant to search people. Innocent people are protected by their right to privacy and a judge upheld this and refused the FBI reach-around.

Nowhere in the civilized world would any politician be so stupid and think so little of the people that vote for them, that they would permit random searches without cause or judicial check.

You'd have to be a f**king moron to create a random stop and search law. Some sort of fear ridden mental ill person with a power complex would be needed.

Thank god nobody is so stupid as to treat everyone as criminals and wonder why the people hate them. Yes nobody outside of tin pot dictatorships, with their censorship of words would be so hateful as to do that.

"I also think she erred in considering each platter a separate container. Using that mindset, the police would need to get a separate search warrant for every platter."

No. Similar to a warrant allowing police to search your house and any containers found therein, they could get a warrant to search your computer and any containers therein. In this case, the police did not have a warrant to search the computer AT ALL. Their argument was that computer had already been "breached" by the acquaintance, as if it were a container of alcohol. However, the judge in this case rightly concluded that viewing a few files on a computer does not constitute exposing the entire filesystem to the public.

The reference to the platters makes sense when you look at the method of search used in this case: the application hashed the drive sector-by-sector, not file-by-file. In that way, it was viewing the physical organization of the data, not the logical. If the police had browsed folder-by-folder, then a logical-based container argument would have made sense (and then the folders would be the separate containers.)

Don't save your porn pics as received but do a bit of editing, resizing, format changing etc.

I'm mega impressed, I can't honestly seeing any British Judge being able to understand computers to this level of depth!

"Thank god nobody is so stupid as to treat everyone as criminals and wonder why the people hate them."

Every company that uses DRM is treating their customers as criminals.

Also, note that he was being evicted and someone "took possession of his computer." Since he was forced out, rather than leaving voluntarily, it's probably not considered abandoned property. Suppose you go on vacation for a month and someone steals your car on day 26. Does that make him the rightful owner of it, as it wasn't being used and is now in his possession? No. Something can be considered abandoned only if the current owner clearly and unambiguously has no intention of retrieving or making use of that item again.

So legally, where does that put searches of biometric databases? Does that constitute an intrusive search?

FYI, any modern disk drive (anywhere in the last 7-8 years or so) does logical block mapping all the time. It's not just SSDs.

Getting capacities up has required tolerances to be so small in the magnetic domains and mechanical alignments that read errors crop up constantly. The drive starts out with thousands of spare sectors, and logically maps them in as read errors crop up.

In addition, the notion of a fixed "sectors per track" is also outdated. Outer tracks are physically much longer than inner tracks, so many more sectors are written there (this became feasible once the read channel became much faster than the linear platter speed).

The traditional cylinder/head/sector numbering is pure fiction nowadays, present only because of a certain OS and the BIOSes which support it.

As others, I thought the ruling quite sane.. until I got to that last quote and realized that the judge just didn't quite understand what the hell she was on about.

The rest of the ruling makes sense, but that last line could put the judgement in line for being overturned. Which is unfortunate.

The system was played with by someone who then gave it to the police saying "look what i've found on here"

The person giving it to the police was also the guy who was pissed off at the original owner for not paying his rent.

I wonder how this "Evidence" would stand up to any decent lawer? Legally obtained evidence or not, its still been tampered by a non-neutral party with a grudge to grind.

The police would do well to search HIS systems, 10 quid says hes hashed things up (hahaha)

and left soem of those files on his own computer when he copied them over

Since the drive was turned over to them by the landlord who was evicting a tenant for unpaid bills, no search warrant is necessary. Her technical analysis is even loonier. I will grant that if the hard drive had been seized directly from the defendant without a warrant that the search of the hashes would have constituted a search. However, as it was not taken directly from the defendant, it is not a warrantless search. This does allow for the defense to raise the possibility that someone else put the data on the hard drive, but the reasonableness of that claim is for the jury to determine. That's why we have juries here in The States.

Since the drive was turned over to them by the landlord who was evicting a tenant for unpaid bills, no search warrant is necessary. Her technical analysis is even loonier.

you said evicting, not evicted. if the person was still living there and had not been removed from the premise then the land lord had no right to use/ search his computer. Secondly the evidence would had to of been in plain sight with out a warrant.

> Someone (later defined as "the landlord's acquaintance") who took possession of his computer stumbled upon some of the forbidden files and reported them to police.

Or maybe the landlord's acquaintance decided to access some kiddie porn himself and then reported it?

And was it legal for that acquaintance to take possession of that computer anyway? I don't know how the US system works, but AIUI in the UK it is illegal for a landlord to take possession of a tenant's personal property, they must apply for a Court Order for Bailiffs to remove the tenant and/ or any property, not simply grab it themselves.