Hacker News Reader

Comment by gregw2 | Hacker News Reader

It's kinda hard to square John's post-trial comments "I never tried to hide or wipe any evidence, and all of my data is accounted for, contrary to some stories being spread." with ZeniMax's post-trial comments at http://www.gameinformer.com/b/news/archive/2017/02/01/zenima... that " (vi) Carmack intentionally destroyed data on his computer after he got notice of this litigation and right after he researched on Google how to wipe a hard drive—and data on other Oculus computers and USB storage devices were similarly deleted (as determined by a court-appointed, independent expert in computer forensics); ... (viii) Carmack filed an affidavit which the court's expert said was false in denying the destruction of evidence; "

What is a reasonable explanation of this discrepancy? Varying notions of what consitutes "evidence"? Or differences in facts?

View on HN

I wouldn't trust the testimony of a paid expert witness. They always have strong convictions in favor of the side paying the bill, even if the evidence available clearly can't support such absolute conclusions.

Even if they aren't just liars, the lawyers can just keep trying different 'experts' untill they get one who tells the story they want to hear. It's just cover for making an argument from authority.

"As an expert, I can definitely tell you that the people paying me are correct."

I did an advanced forensics course a few years back that was geared towards preparing me for court cases for the company I was working for. I quickly realized how easily "expert" witnesses could and most likely were being abused in the system just as you say. Expert shop till you get what you want.

That's not even mentioning the epic level of incompetence I saw among others. I'm talking about "forensic experts" who didn't know any filesystem other than NTFS, and even then if the tool didn't do it for them they didn't see it... At least I know if I ever end up defending myself I have plenty of inside knowledge on how to undermine the prosecutors arguments.

> Carmack intentionally destroyed data on his computer after he got notice of this litigation and right after he researched on Google how to wipe a hard drive

Somehow I think John knows how to wipe a drive...

Every dev knows how to wipe a drive. Buy an identical drive. Throw old drive into the incinerator.

I didn't know this but I do now.

Lack of history is a clue system was wiped or reinstalled from scratch.

Its very difficult to make windows appear to be an old actively used install. Encase (or new software, I havent done forensic for >6 years now) will tell you everything about timestamps and what that means.

I was joking. But honestly, if you don't your secrets to be found, you do have to go for extreme measures.

This is not a valid assumption. Shredding a drive to the extent that data recovery is not possible requires knowledge that, often times, revolves around the architecture of the drive in question (see: wear leveling).

An unrelated, yet illustrative, counter example is the seemingly reasonable, yet false, assumption that RMS performs his own installs of GNU/Linux.

You mean the guy that once used thermite to break into a computer lab to impress boyhood friends? The guy that literally has a warehouse full of rocket fuel?

It looks like either someones lying or wrong

"right after he researched on Google how to wipe a hard drive"

I find it difficult to believe that Carmack needs to google how to wipe a hard drive ...

The ATA security erase implementations in SSDs frequently lie, and few people know off the top of their heads what tools/procedure use to get to that command in the first place. Nobody knows how to issue this command or knows if this command works on their drive off the top of their heads.

(OTOH I have researched this issue a few times a year despite rarely personally applying the information, so this Google trail is hardly evidence about anything)

"Nobody knows how to issue this command or knows if this command works on their drive off the top of their heads."

Sure they do.

You overwrite the drive with a known large file and then check the checksum of it.

It doesn't matter what kind of mumbo-jumbo the SSD is doing - it doesn't have phantom-double-capacity hiding in there ... if the (drive sized file) you wrote checksums out, you're done.

And if you're paranoid, do it a few times with different (drive-sized-files). Quick and easy and faster than googling anything.

No. See eg. https://www.usenix.org/legacy/events/fast11/tech/full_papers...

Is it possible he wanted to protect other proprietary code from being exposed in discovery? I guess he could have tried to explain that, but that might still have constituted an admission of guilt anyway.

New thought: maybe Carmack didn't wipe his own laptop, he let someone else do it? Both partys' statements would still be true if this were true.

Reply on news.ycombinator.com