Malibu Media Claims Fabrication Of Evidence And Seeks Sanctions, 2:12-cv-02078 (PA)

I reviewed the declaration/report of Patrick Paige, Computer Forensic Examiner, Computer Forensics LLC, concerning the examination of computer image files belonging to Doe #16, case # 2:12-cv-02078, Malibu Media LLC v. John Does 1, 6, 13, 14, and 16.   Doc 140-1_02078(PA)   His findings are not the best for Doe #16, but we haven’t heard from the Doe either.  


HD1Mr. Paige first examined the a 3TB hard drive that contained the image files of three computer systems – Windows Desktop, Laptop, and an Apple Mac. Mr. Paige was unable to access the images files on the 3TB hard drive and believes the partition on it was corrupt. Troll Lipscomb was informed of the problem and was able to get another hard drive containing the image files to Mr. Paige. Mr. Paige noted that the hash file number he calculated for the first 3TB hard drive (and contents) was different from the second one he received. Note: The exact reason for the difference in hash values is not known, but it means there is a difference in data between the two. As the first 3TB hard drive had partition problems (corruption), I would expect a difference in hash values.

Problems Arise

Mr. Paige examined the image files via EnCase Forensic software and noted a problem with the 1TB image for the Windows desktop system of Doe #16. Mr. Paige reports that there is no Operating System on this image file. Without the OS, the computer would only boot up as far as to tell the user that no OS was found; and then just wait for action from the user.

I don’t know if Mr. Paige looked for any evidence that the system was commonly booted up via CD/DVD, or USB device. It isn’t too common, but it does happen. I did find it interesting that the 1 TB hard drive had a “C” & “D” drive. Also of note is the “Boot” folder under the “C” drive. I will have to do some research, but it is possible this computer had the ability to boot into different OSs. The problem is that without any knowledge of this, it looks like the OS(s) was removed from the file system/hard drive.

Mr. Paige notes that the core system files have a creation date of 11 Nov 2012.

Based upon the foregoing, I can state with 100% certainty : (a) the 1 Terabyte Hard drive was not in use prior to November 11, 2012; or (b) all of the data that had previously been on the 1 Terabyte Hard Drive had been erased prior to November 11, 2012. Put another way, the 1 Terabyte Hard Drive was either new or reconditioned to a like new state.

Note: On 8 Nov 2012, Troll Lipscomb made a request for documents and images of hard drives belonging to the Does. This is not good for Doe #16. This makes it look like he deleted or wiped the OS (and possibly other files) from the 1 TB system and then reinstalled and removed files on 11 Nov 2012.  Reinstalling an OS is not usually an issue, but it appears to have occurred after the Troll said they wanted to do a forensic examination.  Computer systems do crash from time to time, but to do a reinstall at that point is bad.  As Plaintiff was not told of any systems issues, it makes it look as if the Doe possibly presented fabricated evidence.  In some ways, Troll Lipscomb would actually prefer this possible spoliation development instead of trying to explain why no evidence could be found on a Doe’s system. The fact that the expert  doesn’t mention the two other system images as having evidence shows what the findings were on these images – zip/nothing.

The report also states that for 99% of the unallocated space on the 1 TB drive, the only data found is ZEROs (Example). For a hard drive that has been in use for sometime, the unallocated space is going to normally have a variety of data, other than just Zeros (Example). The presence of only Zeros indicates the unallocated space of the hard drive was either freshly wiped (all data replaced with “0”) OR the existing data was placed onto a new hard drive (previously factory wiped). Mr. Paige states that the “other” 1% of the unallocated data appeared to only have data related to the “Steam” program.  Here is an interesting article about “carving” data out of the unallocated space of a hard drive.

Troll Lipscomb is of the opinion the Doe destroyed/hid evidence of copyright infringement and states his intention to seek sanctions based on this apparent fabrication of evidence.   Doc 140_02078(PA)

Bottom line

There is no direct evidence on the three hard drive images that show copyright infringement of Plaintiff’s movie(s).  No movie(s) of Plaintiff, no BitTorrent program, and no related files indicating possible copyright infringement.  BUT – It does appear that files/data has been removed from the 1 TB hard drive after the notice of forensic examination was made.

Not good. Of course Doe #16 will have the opportunity to explain why it appears he destroyed/hid possible evidence.  He can of course chose not to OR if it comes down to it, invoke his 5th Amendment rights.  This of course will likely have the same effect that it had for the Prenda crew in Judge Wright’s court.

I assume Troll Lipscomb will use this to further bolster his claim that he is nothing like the Prenda Law.  His operation is not the same as Prenda’s, but it still stinks of legal extortion (my opinion). The fact of the matter is as of this posting, NO cases (From all the Trolls) have been fully judged on their merits.  WHY?  Because this business model was not designed for this.  Success and profit is measured by the number and amount of settlements paid to the Troll, not on taking a case to trial. This particular case was forced by the judge and is going to cost Plaintiff/Troll far more than what they may likely recover from it.  Even if they are successful in getting sanctions/win the case against Doe 16, there is always the possibility they will not be able to recover any funds – or very little.  Their best outcome is likely to be that they can claim they actually do take people to trial (at least once) and they will conduct forensic examinations of Doe systems.

I will be interested to see what Doe #16 has to say about this report.

DieTrollDie 🙂

*** Here is a 20 May 13, filing from Plaintiff – PLAINTIFF’S NOTICE COMPLYING WITH
THIS COURT’S ORDER DATED MAY 8, 2013, [CM/ECF 134].  Doe #16 tells Plaintiff he will challenge the findings of Mr. Paige. ***

About DieTrollDie

I'm one of the many 'John Does' (200,000+ & growing in the US) who Copyright Trolls have threatened with a civil law suit unless they are paid off. What is a Copyright Troll? Check out the Electronic Frontier Foundation link -
This entry was posted in Keith Lipscomb and tagged , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , . Bookmark the permalink.

64 Responses to Malibu Media Claims Fabrication Of Evidence And Seeks Sanctions, 2:12-cv-02078 (PA)

  1. Johnny says:

    Look into the details for rsync back up commonly used on Macs and Linux.

    From my understanding:

    rsync allows the cloning of a hard drive, with an option for a bit by bit (copy still present but invisible to the OS, deleted files.) I would assume that a non bit by bit clone would not copy deleted files but instead replace the free space with 0s.

    Also, from my understanding, when cloning, rsync has the option to use the new file creation dates, or retain the old file dates.

    These two simple options in rsync can refute the forsesnic evidence against Doe 16, assuming he/she used an rsync backup/sync utility.

    • DieTrollDie says:

      I don’t know thew full details on how the image files were made, but IMO you are asking for trouble not getting someone experienced in making evidence grade copies. As the expert stated there was some unallocated space data on the 1TB drive, it appears a bit-for-bit copy of the drive was made. If it had only been a logical file copy, there would have been no data in the unallocated drive area – only the active files/folders would have been copied.

      As far as the thought that a small solid state hard drive contain the OS – OK, but where is the image of it. As it is missing (appears to be), we still have more questions.

      DTD 🙂

      • Andrew Tandrew says:

        Paragraph 27(a) of Lipscum’s expert’s filing states that the 240 gb image was provided and contains the file structure of what appears to be a functional operating system.

  2. doedohdough says:

    I have a question that’s unrelated to this topic but related to Malibu Media. While I was looking for new updates what their doing, I noticed that in all of their single-doe cases lately they’ve also included the exculpatory evidence documents as exhibits.

    So, that would mean they already had the information. So are these single doe cases actually them going after people they initially found through mass doe cases?

    And if that’s the case, why wouldn’t the first case count as a dismissal? How can they be joined for them to obtain their identity, but then separated to be sued later but not be joined for the damages?

  3. Andrew Tandrew says:

    The .trash-999 folder on the drive provided for investigation is a Ubuntu Live system file which suggests the backup images were at least copied and probably assembled under Ubuntu.

    The date of creation timestamps on the directory listing screenshot are very interesting.

    $RECYCLE.BIN and six folders are stamped as created well BEFORE the $MFT. The MFT is the Master File Table. You can’t create (or read or anything else) NTFS files or folders without a MFT.

    I believe you’re onto something that these dates were changed in the process of imaging.

  4. JoseDoe says:

    Imagine a user who is trying to get the maximum out of his PC? Not only does he have a SSD, with the OS on it, he uses a 1Tb disk for storage. Being anal about his performance measures, he regularly has a freeware disk defragmenter like MyDefrag, which compacts the data, leaving large swaths of contiguous unallocated space. Enter CCleaner, which can be set to wipe that contiguous space and fill it with zeros. Both of these programs have perfectly legitimate uses, and they can also be scheduled to run automatically.

    Pull the drive at the wrong time in this cycle, and it might very well look just like this one did.

  5. DieTrollDie says:

    Thanks Raul! Here is a new document from Troll Lipscomb –

    “Instead, John Doe 16’s counsel’s email states that his client will challenge the substance of Patrick Paige’s declaration.”

    Troll Lipscomb states he still plans to motion for sanctions at the earliest possible moment. I guess right now was a bit to early to file.

    DTD 🙂

    • Andrew Tandrew says:

      As well he ought to challenge it, Paige’s declaration is simply not competent. He doesn’t even seem to be aware that he’s analyzing the wrong drive. The timestamp on the MFT doesn’t make any sense. Defense’s expert witness does have that image and should be able to tear that declaration apart.

      I would have liked to see JD 16’s counsel just go quiet for a couple of days and let Lipscum embarrass himself with a ridiculous sanctions demand that would fall apart when Paige’s declaration is discredited.

  6. anon says:

    On page 6 of the document, the left screen shot is cut off. The picture provided does not show the entire contents of the drive…?

    • John balls says:

      Wow. What a pathetic loser you are. I think I saw a hair on the upper left-hand corner. Do you think that means something?

  7. OngChotwI says:

    There are aspects of Patrick’s report that seem out of place. He mentions that it took 15 hours to create a hash for the drive. But no mention of how long any other activity involved in this examination took. He mentions that at the end of April he discovered he couldn’t read the HD. And he mentions a date in May when he received the 2nd drive. He doesn’t mention the date he received the first drive; doesn’t mention the date he made the first forensic copy of the first drive. He doesn’t mention that the drive was being worked on by a colleague that passed away and thus when >he< started working on the drive. (This is that particular case, is it not?)
    And why not point out this looks to be part of a 64 bit installation? (I see lots of 32 bit oses still in use; even Win7)
    Or note that you can have a data drive.. (Remember the days when you could get a 330Meg hd, but the OS could only handle 32Meg partitions?)

  8. Drake says:

    Good catch on the Recycle being created before the boot record! But it’s still a poor imaging process if it ended up this way. Why didn’t the “expert” note the dates of the folders and files under Steam? Also, the talk of 0s seems rubbish to me. If the accusation is that stuff was erased and Doe was that smart, then Doe would have used an erase that filled with random data. 0s is from factory or maybe if you used an OEM disc wipe. Doesn’t add up yet but I’ll tell you this for sure:

    Anybody that says “I can state with 100% certainty” shouldn’t be in forensics or even help desk.

  9. Keystone Cops says:

    Probably computer boots off of solid state drive and the plaintiff only asked for the hard drive. Therefore they got what they asked for, nothing more, nothing less. Dummies!

  10. that anonymous coward says:

    Look over there its a vulture!!!!
    Pay no attention to anything else…

    We had such awesome evidence your honor, it got us this far… and now we can’t make a case so sanction him.

    After reading the laughable report by the 20something Pretenda found, I have serious reservations about the ability of any ‘forensics experts’ that trolls would retain. Given the statement that even DTD found confusing and ill-explained one is left to wonder about abilities and being able to explain clearly without making it look more confusing.

  11. Krono says:

    So let me get this straight. This expert gets a drive that’s supposed to have images for three computers on it. He gets a drive that has images for four hard disks on it, named desktop-240gb, desktop-1tb, sq-laptop, and work-mac.

    Three computers, so there should be three operating systems, and sure enough, three of the images are bootable. Yeah he’s claiming foul play in part because the fourth drive image is not bootable? I assume he’s raising this as a big deal because he was told that Doe 16 built a desktop with a 1 tb hard drive. Yet he never questions the existence of the fourth bootable drive.

    Anyone have a link to John Doe 16’s testimony about what sort of hardware setup he has?

    Because based on the comments above, I can make a good guess as to the Doe’s setup.

    He built a computer with a 1tb harddrive. eventually he upgraded to a 240gb solid state drive. He then cleared windows and most programs off the old drive to use it as more or less a pure data drive. Probably by the simply expedience of shift+delete. Steam he left because downloading steam games can consume lots of space if you’re installing a bunch of games through it. One of any number of file cleaners could easily wipe the free space then. As simple as a “Hey a wipe free space option! Sure, why not?”

    Leaving him with a desktop with a 240gb system drive, and a 1 tb data drive, which is exactly what his images appear to be off. If this is the case, and it matches John Doe’s testimony (thanks to say, the trolls being unaware of what an SSD is and failing to mention it to their expert), then the portion of the statement about the drive being unbootable ceases to be relevant.

  12. Krono says:

    Ah, I see. Upon closer inspection, Lipscomb does note in a footnote that the extra image is supposedly from a computer John Doe 16 purchased after the date of infringement. Which explains a bit more about why they’re crying foul, though it still doesn’t excuse the “expert” for failing to comment on there being four computer images when he was supposed to be getting three.

    It also makes the question of the Doe’s current set up all the more interesting, as “purchased after the date of infringement” could easily be “built a new system, moved the old drive over to serve as a data drive.

  13. JoseDoe says:

    Cross-posted from FCT…
    Here’s my $.02. I’ve been using and programming computers since 1972, so I think I know my way around, a bit. We’ll take this point by point.

    1. “I am a founding member” of an LLC. Whoopee. So’s Lutz. Doesn’t make you an expert.
    3. There is no date associated with the receipt of the First Hard Drive. How long did he sit on this? Or did Lipscum?
    5. “TD3 forensic devices are widely used by computer forensic experts” Using professional equipment does not make you a professional.
    7. See above. Using Encase does not make you a forensic expert.
    16. Wait…you calculated Hash Values on the bad hard drive AFTER you determined (para 15) that it was bad? Why? Just so you could bill for the fifteen hours it took?
    16-18. Also, you asserted in Para 6 that the Tableau TD-3 maked forensically sound copies. Why compare hash values?
    25 and 26 are in reverse order. 25 is a conclusion, 26 is the data that supports that conclusion. Other commenters have noted that the difference in hash values is to be expected, since the first could not be examined, and the second one could be. A single bit difference means the hash is different, and not by a little bit, either.
    27a. Typo. You meant Desktop-240.img, not .im There are two paragraphs labelled 27b. “of what appear to be a working computer systems based on their file structures.” How do you know they are ‘working’? A system throwing a ‘blue screen of death’ also looks like it has working file structures.
    28. The entire paragraph has served to poison the forensic investigation. A good FE should report just the facts. In this case, since Libscum told the FE that the computer was built with a ’1Tb Hard Drive’, the FE assumed that an image labelled as such must be the ONLY thing in that machine.
    30. This is a direct result of the faulty information in para 28. The FE has become so fixated on the ’1Tb HD’ that he has failed to consider other possible configurations.
    31. ‘Missing’ implies that the files were once there are are now no longer there, i.e. purposefully not copied over. A fair FE would state that ‘files and folders necessary for Windows to operate are not present on the disk image [xxxxx]‘
    33. “I know Windows was installed on the 1 Terabyte Hard Drive at some point because it has the core system files that correlate to Windows.” No. You. Don’t. The presence of ‘system Volume Information’ or ‘Program Files (x86)’ does NOT mean that Windows was once installed. It does mean that it was once attached to a windows machine, however.
    36. The MFT is created when a drive is formatted, not when Windows is installed.
    41. BINGO – he finally swerves into the most probably scenario: that the 1Tb drive was used as a Data Drive, not the OS Drive.
    42. “When data is deleted from a computer running a Windows operating system, the data remains on the hard drive until the operating system overwrites that area. The deleted data will then reside in an area of the hard drive commonly referred to as unallocated space.” False, false, false! The data does NOT move. The operating system deletes data by altering the allocation block in the MFT. This shows this ‘forensic expert’ does not understand the first thing about how the Windows operating system works.
    43. “…99% of the unallocated space on desktop-1tb.img contains zeros, i.e. no data.” Perfectly explicable by at least three different scenarios. 1) the files were copied to the image as files, instead of the entire drive as a bit-by-bit image, 2) All temporary files (including pagefiles) are housed on the SSD, and/or 3) a combination of disk defragmentation and free space wiping is carried out on a regular basis.
    44. See above. This should have given him a clue that he wasn’t lookng at the OS disc.
    45. Hey, Nimrod! What about the 240Gb image?

    This guy is as much of a ‘forensic expert’ as Lutz is CEO material. This is, of course, my opinion, though informed by forty years of work in the computer science field.

  14. Krono says:


    I’m pretty sure that he’s not claiming that files are moved to the unallocated space. Rather he’s doing a poor job of describing how once a file’s entry in the MFT is deleted, it remains in the same spot on the disc with the OS considering the spot to be unallocated space (which appears to be a computer forensics term for the free space on a drive.)

    Also, I’m pretty sure that making a big deal about the hash for the two drives being different is to support their claim that the original drive was corrupted an unreadable. Rather important for them given that they were catching heat for saying so close to trial date that the drive was corrupted and they needed to go and make a copy themselves.

    Looking over things again, the ‘expert’ fails to state the creation date of the images on the second drive. He states the creation date of the images on the first drive, but not the second drive. That’s rather important given Lipscomb’s footnote “Plaintiff could not tell if the images of the three computers on the first hard drive are copies of the images of those three computers on the second hard drive. But, the evidence suggests the images are the same.”

    While it’s certainly likely that is the case, none of their experts testimony establishes that. Which is also important because if the 240gb drive was made at the same time as the rest of the images, it raises the likelihood that it is not an “additional image”, but was present with the original drive, and lost to corruption. Really, I remain unconvinced that Lipscomb grasps the difference between a computer and a hard drive, something rather important given he is apparently the one relaying hardware configuration to the specialist.

  15. Jenny says:

    It is possible the defendant boots off of a high speed USB flash drive, perhaps for security or other unknown reason(s). If plaintiff only asked for hard drive images, then it is plaintiff’s discovery mistake. The defendant is not required to furnish more than plaintiff asks for.

    We need to see what defendants’ expert has to say before we pass any judgment. Taking anything Lipscomb or is experts say as fact is a big mistake.

    • Krono says:

      While I’m quite interested in what the defendant’s lawyers and expert have to say, at the moment I’m more interested in what John Doe 16 previously said about his system set up. Lipscomb’s “expert” seems to be relying entirely on Lipscomb for the description of how the system is set up, and I do not trust Lipscomb to be able to accurately relay that information.

      Furthermore the “expert” has apparently made no more than a cursory examination of the 240gb drive, when it should be pretty trivial for the expert to determine if that drive was the system drive for the 1tb drive. That would be a kind of important thing to determine.

      • DieTrollDie says:

        I don’t think Lipscomb had a good clue on how JD#16 system was set up. If you look at one of Plaintiff’s documents they filed, it has some excerpts from the deposition. According to Lipscomb, JD#16 built his system with 1TB of “memory.” I assume he didn’t understand JD#16 explanation of the 1TB hard drive verses the memory in the system. As the full deposition is not available, I can only guess. Doc 110

        “2. After taking the depositions, for myriad reasons, undersigned is convinced that John Doe 16’s husband committed the infringement. To explain, John Doe 16’s husband has an associate’s degree in electronics. He built his desktop computer with one terabyte of memory, and enjoys playing computer games. John Doe 16’s husband only watches television on his computer. Indeed, he does not have cable television. Although he denied committing the infringement, John Doe 16’s husband knew about BitTorrent and Pirate Bay, one of the most widely known torrent websites, prior to the applicable dates of infringement. Additionally, he admitted to watching similar content to that which Plaintiff alleges was infringed. Conversely, John Doe 16 is a XXXXXXXXXXXXXXXXXXXX (removed by DTD) and did not know about BitTorrent prior to this lawsuit, nor did she otherwise appear to be the infringer.

        DTD 🙂

      • Jenny says:

        This stuff is being inspected almost a year after the alleged infringement. It is like visiting a crime scene a year after an alleged crime took place. Of course the evidence is tainted and of course little is like it was. This would never be allowed in a criminal case. Even the police holding on to evidence without inspecting it for a month is mismanagement of evidence.

        I have a three year old computer, during the past year, I needed to replace motherboard, hard drive, and reinstall O/S. O/S new clean install was due to unrecoverable blue screen (likely malware, worn, virus).

        I suspect the defendant, his attorney and their expert, know exactly what they handed over to plaintiff. We will see!

      • Krono says:

        “He built his desktop computer with one terabyte of memory, and enjoys playing computer games.”

        Yeah, that’s a pretty big red flag that Lipscomb doesn’t know what he was talking about. It looks like there’s the common confusion in terminology going on where a computer with a 1tb hard drive is said to have 1tb of memory, despite the fact that memory in terms of computer hardware only gets used to refer to RAM. More specifically, while you might say that a hard drive has 1tbs of memory, you would not say a computer as a whole had 1tb of memory as in that context it would refer to the ram. It’s a fairly common mistake in terminology, but one I doubt someone with a degree in electronics building his own computer would make.

        “Built his own computer” is also rather at odds with “The second hard drive had one more image of a computer than the first hard drive. That additional computer was purchased by John Doe 16 after the date of infringement.”

        Most people once they build their own desktop computer continue to do so for future computers. It’s just much easier to get the hardware you want at a good price, and assembly has only gotten easier over time, as well as a variety of other reasons.

        So it sounds like the common error of “hard drive” = “computer” could be at play as well.

        JD 16: Then I bought a 240gb hard drive to use as my main hard drive.
        Lipscomb thinking: Ok, so he bought a new computer to replace his old one.

  16. that anonymous coward says:

    So knowledge of TPB and BT is evidence of a crime?!
    Someone arrest the **AA’s and their international subsidiaries, the lawyers, the Judges, and everyone who has this dangerous knowledge!!!!!
    While the burden of proof is more likely than not, this is akin to saying he read a 007 novel so he must be a spy. ‘Digital Natives’ aren’t all 15 yr olds, knowledge of a topic does not mean you make use of it.
    I know exactly how troll operations work, but that can’t be used to suggest I’ve ever run one without other evidence.
    Watches TV on his computer… did you think to ask if he has a TV tuner card, NetFlix Account, Hulu Account, iTunes, Google Play, Slingbox, etc… or would that interfere with making your case?
    We think its the husband, but we are still suing someone we now think is innocent.
    Watch as I make more compelling evidence!!
    A DEGREE IN ELECTRONICS!!!! So he can change a transistor, doesn’t mean he can operate a computer at a high level… I mean the Troll has a degree in the law… doesn’t mean he’s qualified to manage the ECF system.
    HE WATCHES PORN!!!!!! Him and a large number of men and women…

    While its cute to see all of these things piled up to shore up a case, even combined there is a long distance to proving he is the infringer. The fact the troll who is on the cutting edge of these cases bobbles simple computer terms and concepts is scary. I dunno what memory is in a computer, but I know he must of used BT!!!

    • doeknob says:

      If I was in a depo and they asked me if I knew about TPB, I swear I would walk out of the office, grab 20 people off the street, and ask each and every one of them if they’ve heard of TPB.

    • Krono says:

      I’m pretty sure that the comments about TPB and BT are there as support for their claim that it’s the John Doe’s husband not the John Doe herself. When ascribing blame to a given person, you don’t ascribe it to the person that’s never heard of TPB or BT, you ascribe it to the person that has. It’s kind of like saying “We have two likely suspects, A and B. Suspect A has a computer, and has heard of the internet. Suspect B does not have a computer, and thinks the internet is a series of tubes. Therefore we believe suspect A is the culprit.”

      In short, while it’s not evidence that he did it, it’s evidence that he’s more likely to have done it than the other immediately obvious person who could have done it.

      • Jenny says:

        There is no actual evidence A is more likely than B to be suspect. A could be lying and B just down right more honest. However a jury might believe a guy is more likely to be the villain and less honest due to societal prejudices.

        The evidence actually observed here is the Plaintiffs’ and their attorney’s sense of entitlement to likely innocent people’s money. Even a 5 year old can see these people manipulating a broken legal system. The Judge will hopefully close the clown show down.

      • that anonymous coward says:

        They are still in the process of suing Doe 16, not Doe 16’s husband.
        They feel she isn’t aware of these things, but are still suing HER.
        They have not substituted Doe 16’s spouse on the paperwork.
        (I’m not fully up to date on the docs and could be incorrect, someone correct me if I am indeed incorrect.)

      • DieTrollDie says:

        I believe you are correct. Doe #16 is now the husband; this followed the deposition. Still, they have not moved/motioned to officially name the husband as Doe #16. This may be due in part because of some protections required by the court, but I expect it is more gamesmanship for now. They will eventually have to name him at sometime as this progresses.

        DTD 🙂

  17. John balls says:

    You have no original content and yet you can’t update it more frequently? Dude, you have no original thought (“I steal porn! Looka me ! That judge sho dun got ang-ruh! Hyuk!) why can’t you post more frequently? Oh that’s right. You can look at hot chicks for free who think you are a disgusting stupid loser. Stay stupid and loser-ish my friend!

  18. Jenny says:

    Well there you go…. I meant A could be more honest and B could be lying. Point is that there is no real evidence and we shouldn’t pretend Lipscomb’s BS is reasonable and logically sound.

    • Krono says:

      I assume this information is taken from depositions or testimony that’s made under oath. Therefore it’s assumed no one is lying as that would be perjury.

      So based on the assumption that no one is committing perjury, yes it is evidence that person A is more likely to have done it than person B. It’s not very good evidence, but it is evidence and a necessary step in their chain of logic as to why it’s this person, and not that person.

  19. anonymouse says:

    It’s not correct to assume that Doe 16 is guilty in this post. There’s no evidence of the files- and Doe 16 could have just wanted to upgrade his OS and the 0s found in the other parts of the drive may be because he simply hasn’t “written” files to that part of the hard drive yet. I have a hard drive and do not utilize all my space, I also occasionally perform upgrades (Windows 8 just came out last year) and it’s perfectly reasonable for Doe 16 to use his computer as he pleases.

    Plus this continues to ignore the fact that someone other than the party in mind may have downloaded the film using his internet connection and seems to make an assumption that the film must have been downloaded on his PC. Many households have multiple PCs, and even more complicated, share domiciles can have multiple PCs and multiple users along with old devices. If no smoking gun is found, Lipscomb should have no right to assume that Doe 16 is guilty even then. There needs to be more adequate burden on Lipscomb to prove Doe 16 is actually the correctly identified culprit other than weak IP evidence.

  20. Pinochio says:

    The tracker program has already been proven to not work in court. So there is no way to know that anything was ever downloaded at any IP address based on Lipscomb’s part time student expert working on commission in a basement in Germany,.

    • DieTrollDie says:

      I think it may be fair to say that the monitoring software they use isn’t perfect. For a majority of instances, the IP address recorded is correct. That doesn’t change the fact that an IP address is not a person and it doesn’t mean the ISP subscriber did it. It also doesn’t mean another person in the ISP subscribers family did it either. Playing Deveil’s advocate – sometimes it does and some people have paid settlements because of this. I personally find the settlement tactics and the amounts they pressure people to pay to be excessive and akin to extortion.

      The results of the BT monitoring are just a start and should not be the only basis for a case. Judge Wright (and others) have made it clear that the Trolls do not do anything close to an adequate investigation to try and determine the actual infringer.

      Plaintiffs can only show that someone, using an IP address belonging to the subscriber, was seen online in a torrent swarm. But Plaintiffs did not conduct a sufficient investigation to determine whether that person actually downloaded enough data (or even anything at all) to produce a viewable video. Further, Plaintiffs cannot conclude whether that person spoofed the IP address, is the subscriber of that IP address, or is someone else using that subscriber’s Internet access. Without better technology, prosecuting illegal BitTorrent activity requires substantial effort in order to make a case. It is simply not economically viable to properly prosecute the illegal download of a single copyrighted video.

      We even had the Prenda expert state clearly in his declaration (Joshua Chin) that –

      … there is no legal method by which an investigator could with absolute certainty conclude that the identified subscriber was the only person in a residence or commercial building engaged in the downloading of copyright material at any one time.” (Pages 7-8 of 9, (16. i.))

      DTD 🙂

      • fluffalufagus says:

        “It is simply not economically viable to properly prosecute the illegal download of a single copyrighted video.”

        Which is why, and I think you pointed it out, they should just start going after the uploaders. They’re the supply line. Without them, piracy doesn’t happen.

        But then again, they really have no interest in protecting IP or stopping piracy as has been pointed out so often. Though I really do wish a judge would call them out on this issue.

      • Andrew Tandrew says:

        “It is simply not economically viable to properly prosecute the illegal download of a single copyrighted video.”

        Right, Prenda’s expert justifying why Steele and the other mass trollers would settle for 2-3K and move on to the next mark without litigating the first one. It isn’t viable and when their cheap mass discovery stopped working Steele went on to fraud in state court and the other trolls either shifted to other states or stopped filing entirely.

        What makes Lipscum so much more destructive is that it is economically viable to prosecute the download of many copyrighted videos. Malibu content is hundreds of titles.

        The courts asked for proper. Lipscum’s individual cases with 30 grand settlements are it.

      • DieTrollDie says:

        I still don’t buy that Lipscomb/Malibu Media/X-Art is doing it “proper.” They have the same type of monitoring set-up and the results are the same = IP address. They have added some more information as far as extended period of observed time period of BT activity, as well as other possible copyright protected material on the BT client using that public IP address. BUT, it still doesn’t get past the public IP address and that a real investigation has to be done. The amount of titles in Malibu Media catalog doesn’t mean squat in terms of actually showing who did this. They know this and that is why there is NO cases to date (including Malibu Media) that have been judged on it merits. The court had to force the PA Bellwether case.

        The Troll IMO has a business model that works with the lowest common denominator – the average ISP subscriber. The Porn Copyright Trolls know that if it comes down to it, it is a crap shoot. Playing Devils advocate (Don’t do this) – If an actual infringer denies the allegations and remove the involved/offending system (replaces it OR other systems are already present), there is not going to be any evidence. Unless Plaintiff can get the Defendant to admit to the activity or find someone else to testify that the Defendant did it, all they have is a public IP address and the “possibility” that the ISP subscriber did it. That is why they grasp to trying to show the Defendant has aspects that could indicate he is the infringer – Male, Porn Watcher, Plays video games, Computer knowledge/experience, Knowledge of what BT and Pirate Bay, etc. Remember these civil cases only need the preponderance of guilty (>50%) and not beyond a reasonable doubt.

        DTD 🙂

      • egregius says:

        Ok, so Malibu does extended surveillance of other bittorrent activity. One of the things they claim is that they *know* their downloading a copyrighted file because they compare it to their video.

        So…how do they know that the expanded torrent list really is the file that it is labeled? I mean, its not like fake stuff doesn’t get put on the internet. And they don’t own the copyrights to the other material. So they download it and check?

      • DieTrollDie says:

        They do not. It is only an assumption – plain and simple. They would have to verify each file (after downloading a copy they don’t have rights to – copyright infringement) and then compare it to a true copy. They don’t do that – just trying to paint a picture and hope the judge doesn’t get it.

        DTD 🙂

    • Andrew Tandrew says:

      I don’t consider it ethically proper. Owning an IP is not reasonable evidence in and of itself and granting the discovery power of the court to a civil party without reasonable evidence to support it is not just improper but wholly indefensible. If I were king that would end the downloading legal industry right there.

      But legally they don’t need reasonable evidence up front. All they need is plausibility. (What either of those words means let alone the difference between the two keeps a lot of attorneys in business.) Lipscum’s boilerplate bit torrent glossary and IP list have been accepted as plausible so far and unless that’s struck down (Twombly) he’s doing exactly what the courts have told him to.

      The number of titles isn’t important legally but is all important in practice. Investing hundreds of hours over 18-24 months in an infringement case to come away with a couple thousand bucks + fees, or nothing, or nothing and pay the defense’s fees too isn’t sustainable business. Malibu lends itself to dozens of supposed infringements. Following through could come away with six figures. That can invest $7-800 per IP just to find out how much the house is worth and who owns it. It can cover court losses. Just the threat of it is coming away with twenty thousand dollar settlements.

      Trolls haven’t gone anywhere on the merits without being forced but It’s an evolving business and I believe they’re going to get there. Lipscum’s individual cases aren’t even 6 months old.

      • Doubting Doe says:

        They haven’t won a single case yet. A person would need to be very foolish to pay them anything.

  21. Just and IT professional says:

    The biggest problem, in my opinion, is that there are these ‘experts’ who make claims as if they understand the OS and how things work and the judges probably have no idea if they are right or not. They have to assume that the person claiming to be an expert is telling the truth ‘because he declares himself as an expert’ while those of us who have ANY knowledge of how a computer works can see that they are full of crap. I certainly hope Doe#16 enters a response from a REAL professional that rapes this self proclaimed expert and puts an end to this latest round of time-wasting.

    • Krono says:

      The “expert” is not entirely full of crap, but his testimony is pretty empty. He’s theoretically supposed to be examining all these drive images for signs of infringement. You would expect his testimony to be something along the lines of “This is this computer’s set up, it does not show signs of infringement. This is an external storage drive, it does not show signs of infringement. This is this computer’s set up. Here are the problems with it that lead us to suspect deliberate tampering, instead of more innocuous explanations for the problems.”

      Instead, pretty much all he proves is that one drive that Lipscombs claims is the main hard drive, is currently being used as a data drive. No real attempt to rule out valid scenarios for the hard drive being the way it is. No attempt to dig deeper to figure out what might have taken place, or point out as many errors as possible. Just “The lawyer that hired me says this drive should have had an operating system on it and it doesn’t.” Very weak testimony.

  22. egregius says:

    Malibu is starting to file cases again in PAED, first time since Bellweather started I think.

  23. OngChotwI says:

    If that’s all that it takes to be guilty of downloading Prenda or Malibu porn via BT – (no use of BT for downloading Pr0n just knowledge of the subject..) then it seems like millions of us are instantly guilty. BitTorrent is in use for updates to the millions of (12m+ current subscribers) World of Warcraft users. If you have a capped ISP plan, disabling uploads on the update client starts making sense.

    If you point Steam on a Windows 64bit system – to a blank drive or blank partition, does it create the directory structure shown on the 1TB hd image? i.e. was Windows ever on the 1TB drive as the “Forensic Examiner” claims?

  24. Duff is Good Beer says:

    One Terabyte of Memory!!!!!!!!!

    Where does the guy sit? In the next room?

  25. Duff is Good Beer says:

    John Balls = Porn Troll ParaLegal

    “He has an Associates Degree in Civil Administration!”

  26. 1TB of “Memory” …just remember that a hard drive is “Memory”, just a little slower than the DRAM or Cache (or for me, SRAM!!!) that we normally think of…At the moment, you’d need quite a rack, maybe 16 or so computers at 64Gigabytes each for my 1TB of DRAM setup. Nice stuff for computational number theory, or a big database, but that’s not exactly a “normal” home user’s setup.

    Also, kindly remember, “Download”: != “Infringment”…to cite an example, somebody linked the image of an entire technical book to a web bulletin board I was using….I downloaded it, saw what it was, and promptly started asking whether the person making the link owned the copyright, as it seemed beyond fair use.

    So there’s a long way to go to prove anything…


  27. Drake says:

    Eric, Download = Infringement. The copyright owner has exclusive rights to distribute its works. Downloading = distributing and therefore is illegal without their permission.

    While YOU may have an excuse of not knowing what you clicked on (just like if I sent you a link to illegal porn and you clicked on it you would technically be possessing it) chances are the publisher isn’t monitoring the downloads in realtime. “Knowingly” isn’t part of the copyright law as far as I know but even if it was the fact you’re on a torrent site and looking for SOMETHING and then there’s the file name and description which I assume your book description didn’t have. If it did say the name of the book then you should have checked ahead of time or you were in violation too.

    The law can be rough and people don’t understand it.For instance, if you have LEGALLY downloaded music from say and back it up to another hard drive, you are probably in violation of the law since that wasn’t considered when the last round of copyright rules was implemented (you have the right to backup a computer program but not media unless you have a license).

    So from a technical standpoint the defenses seem to be thus:

    1) Prove the plaintiff isn’t the real copyright holder and therefore has no standing to sue.

    2) Convince the court that IP address isn’t enough to peg who did the download or that the IP identification was faulty.

    In this particular case they are claiming specific chapter violations. You can read those chapters by web searching “17 usc” and then a space and then add the chapter number one at a time: 101, 106, 501.

    For exceptions see around 107 through 117 and skip the boring parts. Basically the copyright law is broad and exceptions have to be carved out instead of the law being narrow and other exceptions count.

  28. Anonymous says:

    Interestingly in his response to the Judge’s order about appointing an independent expert, Lipscomb says:

    “Be advised, Mr. Paige just learned yesterday that John Doe 16 had two hard drives in his desktop. Accordingly, some of Mr. Paige’s conclusions will be modified as a result of this revelation.”

    Sounds like if he did in fact go off half-cock, Lipscomb is going to try and blame the victim for the “revelation”.

    • DieTrollDie says:

      I doubt he will say that it is our community that gave his expert a clue to look at. LMAO!

      DTD 🙂

      • Jess says:

        If his expert just figured out people put OS on a different drive than most other data, his expert needs a new line of work. I remember doing that back in the 90s

  29. Something's off says:

    So…while Prenda & friends use a large, loud and obnoxious backhoe to dig their hole – Lipscomb, Colette & Brig use a quiet, quaint and simple shovel to dig theirs. Is it safe to say Lipscomb’s big BT litigation lessons were learned in response to Prenda’s huge mistakes?

    We’d bet there is a lot to learn about Patrick Paige & Carter V. Conrad, Computer Forensic Examiner, Computer Forensics LLC and Delivereddata LLC – (Computer Forensics LLC filed as a Florida Limited Liability on Monday, February 06, 2012) (Delivereddata, LLC filed as a Florida Limited Liability on Wednesday, May 02, 2007)

    But how is
    CV Conrad and C4 Wellness related?

  30. DieTrollDie says:

    OK. Lots more to report, but I’m busy and will be taking off next week for a little fun. Wish I could share the location/event with you. 🙂 Here is the archive docket – I will try to post some analysis on the newest documents this weekend (or early next week).

    Doc 143 –

    Doc 145 –

    Doc 151 –

    Doc 152 –

    DTD 🙂

  31. Anonymous. says:

    You’re welcome, Butterball.

    But next time hire a real expert. Relying on a community of your critics and enemies to do your forensics work is pretty sad.

  32. Pingback: DTD on R&R – Four Item Posting | DieTrollDie

  33. Anonymous says:

    Just to point out for anyone interested, there’s a strong response from Smith on behalf of JD #16 stating their position that Lipscomb has libeled the defendant, lied to court, committed malpractice, is attempting to obtain additional discovery even after a previous extension due to his own incompetence, tamper with the court-appointed independent expert,…

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s