I reviewed the declaration/report of Patrick Paige, Computer Forensic Examiner, Computer Forensics LLC, concerning the examination of computer image files belonging to Doe #16, case # 2:12-cv-02078, Malibu Media LLC v. John Does 1, 6, 13, 14, and 16. Doc 140-1_02078(PA) His findings are not the best for Doe #16, but we haven’t heard from the Doe either.
Examination
Mr. Paige first examined the a 3TB hard drive that contained the image files of three computer systems – Windows Desktop, Laptop, and an Apple Mac. Mr. Paige was unable to access the images files on the 3TB hard drive and believes the partition on it was corrupt. Troll Lipscomb was informed of the problem and was able to get another hard drive containing the image files to Mr. Paige. Mr. Paige noted that the hash file number he calculated for the first 3TB hard drive (and contents) was different from the second one he received. Note: The exact reason for the difference in hash values is not known, but it means there is a difference in data between the two. As the first 3TB hard drive had partition problems (corruption), I would expect a difference in hash values.
Problems Arise
Mr. Paige examined the image files via EnCase Forensic software and noted a problem with the 1TB image for the Windows desktop system of Doe #16. Mr. Paige reports that there is no Operating System on this image file. Without the OS, the computer would only boot up as far as to tell the user that no OS was found; and then just wait for action from the user.
I don’t know if Mr. Paige looked for any evidence that the system was commonly booted up via CD/DVD, or USB device. It isn’t too common, but it does happen. I did find it interesting that the 1 TB hard drive had a “C” & “D” drive. Also of note is the “Boot” folder under the “C” drive. I will have to do some research, but it is possible this computer had the ability to boot into different OSs. The problem is that without any knowledge of this, it looks like the OS(s) was removed from the file system/hard drive.
Mr. Paige notes that the core system files have a creation date of 11 Nov 2012.
Based upon the foregoing, I can state with 100% certainty : (a) the 1 Terabyte Hard drive was not in use prior to November 11, 2012; or (b) all of the data that had previously been on the 1 Terabyte Hard Drive had been erased prior to November 11, 2012. Put another way, the 1 Terabyte Hard Drive was either new or reconditioned to a like new state.
Note: On 8 Nov 2012, Troll Lipscomb made a request for documents and images of hard drives belonging to the Does. This is not good for Doe #16. This makes it look like he deleted or wiped the OS (and possibly other files) from the 1 TB system and then reinstalled and removed files on 11 Nov 2012. Reinstalling an OS is not usually an issue, but it appears to have occurred after the Troll said they wanted to do a forensic examination. Computer systems do crash from time to time, but to do a reinstall at that point is bad. As Plaintiff was not told of any systems issues, it makes it look as if the Doe possibly presented fabricated evidence. In some ways, Troll Lipscomb would actually prefer this possible spoliation development instead of trying to explain why no evidence could be found on a Doe’s system. The fact that the expert doesn’t mention the two other system images as having evidence shows what the findings were on these images – zip/nothing.
The report also states that for 99% of the unallocated space on the 1 TB drive, the only data found is ZEROs (Example). For a hard drive that has been in use for sometime, the unallocated space is going to normally have a variety of data, other than just Zeros (Example). The presence of only Zeros indicates the unallocated space of the hard drive was either freshly wiped (all data replaced with “0”) OR the existing data was placed onto a new hard drive (previously factory wiped). Mr. Paige states that the “other” 1% of the unallocated data appeared to only have data related to the “Steam” program. Here is an interesting article about “carving” data out of the unallocated space of a hard drive.
Troll Lipscomb is of the opinion the Doe destroyed/hid evidence of copyright infringement and states his intention to seek sanctions based on this apparent fabrication of evidence. Doc 140_02078(PA)
Bottom line
There is no direct evidence on the three hard drive images that show copyright infringement of Plaintiff’s movie(s). No movie(s) of Plaintiff, no BitTorrent program, and no related files indicating possible copyright infringement. BUT – It does appear that files/data has been removed from the 1 TB hard drive after the notice of forensic examination was made.
Not good. Of course Doe #16 will have the opportunity to explain why it appears he destroyed/hid possible evidence. He can of course chose not to OR if it comes down to it, invoke his 5th Amendment rights. This of course will likely have the same effect that it had for the Prenda crew in Judge Wright’s court.
I assume Troll Lipscomb will use this to further bolster his claim that he is nothing like the Prenda Law. His operation is not the same as Prenda’s, but it still stinks of legal extortion (my opinion). The fact of the matter is as of this posting, NO cases (From all the Trolls) have been fully judged on their merits. WHY? Because this business model was not designed for this. Success and profit is measured by the number and amount of settlements paid to the Troll, not on taking a case to trial. This particular case was forced by the judge and is going to cost Plaintiff/Troll far more than what they may likely recover from it. Even if they are successful in getting sanctions/win the case against Doe 16, there is always the possibility they will not be able to recover any funds – or very little. Their best outcome is likely to be that they can claim they actually do take people to trial (at least once) and they will conduct forensic examinations of Doe systems.
I will be interested to see what Doe #16 has to say about this report.
DieTrollDie
*** Here is a 20 May 13, filing from Plaintiff – PLAINTIFF’S NOTICE COMPLYING WITH
THIS COURT’S ORDER DATED MAY 8, 2013, [CM/ECF 134]. Doe #16 tells Plaintiff he will challenge the findings of Mr. Paige. ***









