Hacker News Reader

Comment by curiousDog | Hacker News Reader

Haha. Even funnier is Levandowski attempting to delete his trash bin contents while in Stroz's offices for the interview.

View on HN

Does the report mention how they determined this? Was there monitoring software installed on the laptop, or is this part of standard macOS logs?

They mention a tool called Relativity being used. A google search turns up this website: https://www.relativity.com/

Though I am not sure if it is just collates data from MacOs logs or does some kind of deep analysis to pull data.

Google has a hardcore TPM-verified boot with monitoring software installed on all company computers. I believe a good chunk of the userspace log collector is open source: https://github.com/google/grr

Not sure any of this tech was used by or on behalf of the company creating this document though.

Alphabet's Waymo Alleges Uber Stole Self-Driving Secrets | https://news.ycombinator.com/item?id=13718586 (Feb 2017)

> tajen How does Google build such forsenics? | https://news.ycombinator.com/item?id=13718970

> bitL: Alphabet just [...] revealed what they track internally to all their employees | https://news.ycombinator.com/item?id=13719728

These aren't Google devices though, are they? Presumably all of those were returned to Google when they quit.

I believe you are correct. The monitoring of company equipment detected the exfiltration from Google. Metadata from this could have been used to pinpoint the data flow on personal equipment, but it sounds like this document was prepared on the non-Google side.

If his machine was not configured to secure erase files (unlikely; not the default) when emptying trash, they can be "trivially" recovered by firms like this (HFS+ makes it harder than it should be)

"Secure empty trash" was removed in 10.11.[1] But that can't be what they relied on here.

Here's what the report says: "Levandowski also attempted to empty the Trash bin on his MacBook Pro while he was at Stroz Friedberg's office... but our examination found no files were contained in his Trash at the time he attempted to empty it."

Is this even possible? You can't "attempt" to empty a trash with no files in it from the GUI. The menu item is disabled. So that would suggest a terminal command, but supposedly there's no command line equivalent for "empty the trash".[2] You can of course delete specific files or folders, but then they'd say he'd try to do that, not "empty the trash bin".

The only user action that I can think of that would constitute "attempt to empty an empty trash" is hitting the keyboard shortcut for it (shift-command-delete). But is that even logged on a standard macOS installation?

The report references "Exhibit 17" for more detailed forensic analysis. I would be very interested in reading that.

[1] There's still a command line option but it may not work correctly with Flash storage, which is why it was removed from the GUI. https://support.apple.com/en-us/HT205267

[2] https://www.imore.com/how-force-empty-trash-your-mac-using-t...

Reply on news.ycombinator.com