Given that the file in question was in the deleted free space, the technician didn't just stumble into it accidentally and then report it. He went looking for it to begin with. And he was searching for such files because he was paid to do so.
This is all before even getting into the topic of potential malware infections, running as a TOR exit node, being used for torrent hosting unbeknownst to the user, etc. There was a case many years ago and I wish I could find the reference to it in which the defense called in an expert witness who convinced the judge to have his machine inspected by a forensic analyst who found it clear of pictures of kittens. The expert witness then had the judge visit an 'innocuous' looking website which didn't have pictures of kittens visible, but loaded them in hidden iFrames. The system was then inspected again by the forensics analyst who then found pictures of kittens, the point being that when your computer is connected to the Internet it really isn't your computer anymore.
Maybe the physical handling of drive removal and putting it on a docking station for imaging is video'd and that video is also verifiable (mainly you'd want a system that ensures whole frames aren't deleted..i.e. oh hey I see 5 seconds were yanked here and over here, so conceivably the drive was removed and returned to the docking station and altered prior to imaging).
Also, as COW filesystems become more common (ReFS, AFS, ZFS, Btrfs) there will be a lot of stale metadata that is non-trivial to fake. Basically snapshots are constantly being taken, even if they are not preserved for very long. On an SSD ostensibly these unused blocks get trimmed and should immediately return zeros, but there might be modes were they return stale data instead if it's before erase block GC/erasure happens.
Edit: And now you have this copy of the customer's drive... itself a liablity for it to exist for very long, or deleted too soon. dm-verity at least does produce a read-only encrypted image so the liability is both access to the image and the security of that image's passphrase.
I worked in forensics until I lost all faith and humanity, and pivoted for sanity's sake.
The least flaw in the forensic process, which was always discussed in-court by lawyers who I suspect could barely use Outlook always resulted in the evidence being turfed.
That due process doesn't seem to be followed here, and if a search is to be used as evidence, it better damn well follow some decent practices!
If it's a CP case, then, generally speaking, it's 500GB+. Usually enough so that the user has repeatedly deleted old files because their hard drive was getting full.
The files are rarely encrypted, and gathered over years from sources like FTP, SMTP and the like - and those logs are the main evidence.
A user is unlikely to not notice that 50GB of data is appearing once a week, and unlikely to not notice that the person they are conversing with has also been given similar charges, because their email has them talking about it, and when it comes to court, you find out that they were regularly seen with the other person.
A little off-topic, but could you elaborate on that a bit?
73 were child pornography.
69 depicted rape.
65 also depicted some sort of effluence.
52 were depicting individuals I got to see in the court room.
Whereas, when I pivoted to web design, the worst I could say about someone was that they were annoying or didn't document things.
(For interest's sake, the other 3 cases were murder.)
I'm glad you were able to find something you like better.
But forensics, at least when you're working with the justice system, teaches you that people are capable of anything.
The money was awesome, and gave me a great start, but now I value everything else more. Good workplace, time for my family and clients who don't make me feel like a saint.
Less criminal forensics might be different.
And most importantly, was there some kind of support system in place to help you deal with the sort of things you were being exposed to?
When I hit university, they were looking for a entry level security jack-of-all-trades. Thanks to prior and doing well when interviewed by the sysadmin, which partially involved breaking in to a VM, they hired me.
The uni was a subcontractor for the police, and i got pushed to the forensics team by consistently bypassing encryption and recovering data faster than the team, with more information. Like three files were deleted at the same time, because they shared fragmentation with this page file. My age was constantly questioned in-court, but a good track record, and the ability to make a jury laugh were usually enough to get the lawyer to review my skill instead.
It isn't unusual for university's to be employed by government in Australia, and my university also had a partnership with IBM.
Support-wise, I had a team of business psychs at IBM and the uni, which was useless, and a trauma team through Victoria Police, and they were amazing.
Wouldn't have made two years without the trauma team. Many coffees, tears and angry rants.
Having someone you can talk to about an active case was always nice.
I was never meant to know who the defendant might be, but a profile photo, and video of the same person hitting a child who called them daddy... And I'd be ranting in the office.
The police team had the training and experience to get the anger down, and focus me on the task of ensuring that I scoured the machine for every tiny piece of information.
Let's end on a happy note: A man was accused of murdering his daughter. Instead, I found her emails about running away and framing him, and Missing Persons used that to find her. The guy got aquitted. That was a good day.
Yeah, I'm very surprised this didn't immediately get thrown out with a "They're FBI informants and they planted the information to get paid."
However, I suspect this is all a gambit to overturn the investigation results that followed so it probably isn't that clear cut.
Now it seems like law enforcement and politicians who serve their whims are outright pushing to remove the warrant requirements from as much as possible. But why now? Warrants aren't new and the landscape hasn't changed that much, why are law enforcement suddenly pushing so hard on this?
Is this just a general theme on the broader problem of police oversight (or lack thereof)? This is one of the few areas of actual oversight left (judicial) so they're trying to remove that too.
The state is beginning to recognise this and is taking steps to try to claw back some power.
My perception is opposite. Over the last 20 years we have gone from a fairly free country to what feels like a police state with the most effective surveillance in history.
Are you actually familiar with, for example, the extent of Snowden's revelations? What an erosion of liberty the Patriot act is? Or how unusual it used to be to see armed security guards in random office buildings?
My theory is that the state took advantage of the combination of panic over terrorism and falling costs of data storage to put their dreams into action. The threat that they purport to be protecting against isn't real. The threat that the state poses, sadly, is.
As evidence I can point to the fact that dramatic increases of power increased after 9/11. Much of which was spent in security theater and clear power grabs with proven ineffectiveness. (cough TSA *cough) Anyone who was around in tech knows about the dramatic drop in costs for data storage, and knows how it has driven big data in general.
- Individuals can communicate in secrecy, thanks to encryption and the internet, much more easily than before. This means that wiretapping as we used to know it is nearly impossible for some categories of conversations.
- Surveillance is nearly omnipresent, partly as a way to combat the above.
I don't like the erosions of liberty that you mention, or the militarization of police, but I can see why some of the things we take for granted (instant secret communications, encrypted volumes, thumb drives that can be hidden) and consider to be valuable can also frustrate law enforcement doing what we have told them is their mandate (catch bad actors).
My admittedly anecdotal evidence shows that individuals are feeling more impotent with voices washed out in a wave a noise and an inability to affect anything.
Add in the fact that information with which you might build a coherent argument was siloed and generally unavailable, that you had limited resources to gain any sort of expertise outside of your job, and individual "power" in previous ages appears more like the mirage of nostalgia than anything else.
This, of course, is assuming that you are a white male. If not then you had no individual power at all and were severely limited just in terms of your individual autonomy.
Back before there was social media and other online "new media" (which , together with the remaining "old media", is concentrated in fewer and larger vested interests than the media was a generation or two ago) people shared ideas person to person (the term "viral" that's been adopted in social media actually drew on a use that referred to non-media person-to-person information transmittal before the explosion of "new media").
People outside of the media establishment had voices before modern "new media".
I think your point that there is so much noise (aka "other people trying to be persuasive") that voices find it hard to get an audience is fair, but I don't see any evidence that it is harder to speak widely now and all evidence seems to point in the other direction.
Didn't say you couldn't, though for large segments of the population in-person direct communication has been to a significant extent replaced by communication mediated by (and potentially censored by) major centralized media firms.
The only cure for this practice is for a civil rights defense resource like ACLU or EFF to invite those prosecuted to take the case to trial and then appeal verdicts until the practice receives the official rebuff it so richly deserves.
http://www.economist.com/news/leaders/21679472-suspects-japa...
And the prisons are clean, well lit, dehumanizing psychological torture chambers.
http://www.economist.com/news/asia/21679483-why-you-might-pr...
Of course, this is just a single data point, and take it as you will. It only happened once during my service, but it did happen. As such, I'd find your 75% figure believable.
This was a local district court, and I guarantee nearly all of those were drug-related charges.
Coordination is hard to create, especially when stakes are high and you have a first-mover disadvantage - before the system overloads, the first few people to stand up will likely have the book thrown at them.
I dont know much about marketing, but the notion of "I demand a trial" would need a very simple catch phrase outlining an entire campaign. A clear, concise idea that is implanted in someone's mind even during the stressful process of being booked into jail. It would need to be slogan or motto (I think) to work en-masse.
1. Politicians can ensure voters are perpetually scared of "increasing crime" when in reality USA is safer than ever.
2. Narcissist DAs to feel good about themselves.
3. Cops to justify their existence and demand more resources
4. Prison Industrial Complex.
Minimum mandatory play a big role. Imagine your laptop which was given to repair miraculously had a porn clip where it may be argued that the model was 17 year old.
Would your rather spend 16 years in jail and in sex offenders registry or will you take the plea bargain where you spend 6 months in jail ?
BestBuy reports that they found child porn, but proceeds to give the computer back to the owner? Is that legal or are they trafficking?
Meanwhile the FBI goes and requests a warrant based upon what they heard from BestBuy? That seems almost more slippery to me, does the FBI just need to "hear something" from somebody to get a warrant to look around? Or is it even possible for them to get a warrant in a case like this, save for BestBuy involving them like they do?
This seems like the step that causes a warrant to be issued for more stuff. How I'd imagine it goes: 1) BestBuy worker finds child porn while doing normal work. 2) BestBuy worker does "extra work" to report child porn to FBI and does not return the machine, he files some paperwork, maybe makes a full backup, etc.. 3) BestBuy employee signs a deposition, BestBuy hands machine over to FBI with owner's information 4) BestBuy or BestBuy employee gets some money (I'd think BestBuy would want their cut but that's a detail, maybe they're cool to their people in that way) for doing "extra work" and reporting crime. 5) FBI and federal prosecutors look at evidence, seek warrant for other evidence, start planning case. Perhaps said warrant makes a big case or identifies nothing else. 6) BestBuy worker may potentially be called to testify. Sadly at the end of the day $500 isn't going to pay much for a personal lawyer and I think it would be ill-advised to show up to court in any capacity in a federal case without one. ...
What if the police go a step further and start offering money to criminals to allow searches. Soon, you'll see people choosing to get busted in order to get an FBI payday, while the FBI can tout their high closed case rate.
But there's still confusion in the courts about the difference between physical and virtual property and the peoples' rights to escape search (using radar through walls or taps on data feeds). This malign overreach of prosecutors relies on that.
But I think this practice clearly crosses the line since the property is physically in the hands of an untrusted party. It'd be trivial for Joe Schmo at Best Buy to plant evidence. Because that possibility is so plausible, this chain of evidence has been compromised. Any appeals court would toss this practice as unlawful, IMHO.
That's actually legal. The catch is they can only search the areas of the home the roommate "controls", meaning anything they find in a shared space like the bathroom or kitchen is legal, but your roommate can't consent to a search of your bedroom if that's understood to be your space.
I think it gets dicey if you left the bedroom door open and they can see evidence of a crime from the hallway.
If your wife or live-in girlfriend consents to a search the entire place is fair game, though if your wife is willing to sell you out for fifty bucks you have more than one set of problems.
That's not necessarily true:
> Prosecutors said that the Geek Squad technician who searched the unallocated space was merely trying to recover all the data Rettenmaier had asked to be restored.
So in this case it sounds like the reason Best Buy had the hard drive in the first place was to recover other (possibly deleted) files on the disk. In such a scenario it seems totally plausible that they might stumble across other, more incriminating deleted files as part of the recovery process.
There is a distinction to be made that a warrant often authorizes behavior that would otherwise be unlawful in the first place - which this doesn't really seem to be.
That's not to say that I think this is okay.
It's clearly illegal for private individual A to search the computer of private individual B without B's consent though
So what? If such illegally gained evidence is not excluded (and private illegality doesn't trigger the exclusionary rule), and the public prosecuting authority (who benefits from the illegality, as it serves the case they want to prosecute) declines to prosecute the illegality, it's at worst, for the perpetrator, a matter of civil tort liability.