Hacker News Reader

Maybe I have a selective memory as a former Zynga employee, but generally these "stolen documents" lawsuits in high profile tech companies have generally turned out to be pretty factual. Easy to prove, and hard to fake.

View on HN

And lawsuits like this generally don't get filed unless it's near slam-dunk considering the burden of proof is high on stolen electronic documents.

Considering even with logging off: journaling file systems, "user assist", device connection logs, pre-fetch (or your OS's equivalent)- these are all huge tranches of data if you are looking at a system shortly after an event. Ask me 6 months later- probably not. Give me a system that hasn't even rebooted, has a heap of ram and hasn't been used much since- 6 weeks is fine, not ideal, but doable.

Journaling filesystems don't "journal" all the activity in perpetuity. They typically just journal the changes until they're committed to disk, usually for less than a second.

See http://www.nobius.org/~dbg/practical-file-system-design.pdf, section 7.2 "How Does Journaling Work?".

Reply on news.ycombinator.com