Forensic Analysis Of Geohot's Hard Drives In Dispute

March 2nd, 2011, 03:04 Posted By: wraggster

News via http://psx-scene.com/forums/f6/foren...dispute-82276/

In the latest round of Sony vs. Geohot legal wrangling, court documents obtained by PSX-SCENE reveal that there is now a dispute as to how Geohot's hard drives are being handled by TIG, the third-party company designated to analyze them.

The original court order only called for the drive(s) to be delivered to a third party "for the purpose of isolating, segregating and/or removing the information on those devices related to Defendant Hotz's circumvention of the TPMs in the PS3 system."

Now the company doing the analysis wants to create TWO FULL IMAGES of the drive(s), in both decrypted and encrypted form!!! According to Geohot's attorneys, "SCEA is not entitled to inspect the impounded drives under the impoundment order, nor is it allowed to create and preserve additional copies of the impounded drives, but this is precisely what it seeks to do."

SCEA, of course, is demanding that this fast one be allowed.


Quote:
For the foregoing reasons, SCEA requests that the Court order that Mr. Hotz comply with TIG‟s recommended impoundment protocols and that those protocols be supplemented to ensure that preservation requirements are met as follows:

(1) TIG create and preserve two forensically sound images (e.g., bit stream images) of each impounded storage device in its encrypted form: One to be maintained by TIG in a secure vault for preservation purposes and the second to be used for decryption and/or any other necessary analysis by TIG;

(2) TIG create and preserve two forensically sound images (e.g., bit stream images) of each impounded storage device in its un-encrypted form. One to be maintained by TIG in a secure vault for preservation
purposes and the second to be used for TIG‟s necessary analysis; and

(3) TIG maintain and preserve all of the forensically created images for the duration of the lawsuit.

SCEA further requests that the Court order Mr. Hotz to: (a) provide TIG with the tools and keys necessary to decrypt the impounded storage devices and the keys and passwords necessary to decrypt or unlock any protected files contained on the impounded storage devices;

(b) identify for TIG all virtual machines or hard disks stored or at any time run on the impounded storage devices.3 Furthermore, to verify compliance with the impoundment order, SCEA requests that the Court order Mr. Hotz to provide a declaration setting forth: (i) verification that all storage devices on which any circumvention devices or any information relating to Mr. Hotz‟s circumvention of the technological protection measures in the PS3 System are stored have been delivered to TIG; (ii) why the storage device used by Mr. Hotz in the January 7, 2011 YouTube video entitled “Jailbroken PS3 3.55 with Homebrew” was not delivered to TIG for impoundment; and (iii) the identity of any remote storage of the circumvention devices or any information relating to Mr. Hotz‟s circumvention of the technological protection measures in the PS3 System.4 Finally, SCEA seeks fees and costs in relation to this motion.

There are 1 comments - Join In and Discuss Here