Professional Documents
Culture Documents
United States District Court For The Southern District of Indiana
United States District Court For The Southern District of Indiana
SOUTHERN DISTRICT OF INDIANA MALIBU MEDIA, LLC Plaintiff, Case No. 1:13-cv-0020 -!"L-M#D v. $ELLE% "A&'I() Defen*ants DECLA(A"I)N )+ DEL,AN NE,ILLE 1. 2. M- na.e is Delvan Neville. I a. ove/ t0e a1e of 21 an* co.2etent to e3ec4te t0is Decla/ation. I a. t0e o5ne/ of A.a/a10 Associates, LLC, a *i1ital fo/ensics co.2an- s2eciali6e* in Bit"o//ent investi1ation. I a. an ACE 7AccessData Ce/tifie* E3a.ine/8 as 5ell as t0e a4t0o/ of a Bit"o//ent .onito/in1 s4ite, EUP&C29. Befo/e ente/in1 t0e fiel*, I 0ave en1a1e* in f/eelance co.24te/ /e2ai/ an* t/o4:les0ootin1 since t0e late 1;;0s, incl4*in1 /ecove/in1 lost *ata f/o. sto/a1e *evices. )n Ma/c0 10t0, 201<, I /eceive* a !este/n Di1ital *is9 */ive, in a (oc9etfis0 e3te/nal U&B enclos4/e, s0i22e* to .e f/o. t0e Defen*ant :- UP& 7t/ac9in1 n4.:e/: 1=2!;>!2032?@3 <118. "0e se/ial n4.:e/ fo/ t0is 0a/* */ive is !MAD1< 2213@. I c/eate* a fo/ensicall- so4n* i.a1e of t0e 0a/* */ive 4sin1 a !ie:etec0 +o/ensic Ult/aDoc9 v 5/ite:loc9e/ an* AccessData +"$ I.a1e/ 3.1.<.?. I i.2o/te* t0is i.a1e into a ne5 case in +o/ensic "ool9it .2.1.2. I 0ave /ea* t0e *ecla/ation of Pat/ic9 Pai1e /e1a/*in1 t0e anal-sis of t0is 0a/* */ive. In it, 0e conten*s t0at AMali:4 Me*ia, LLCBs co2-/i10te* content co4l* 0ave :een *elete* f/o. t0e */ive *4/in1 Defen*antBs .ass e/as4/eC See Doc 76 at 28. I conc4/ 5it0 M/. Pai1eBs fin*in1 t0at t0e/e 5e/e .an- files an* fol*e/s *elete* on 22 Dece.:e/ 2013. &2ecificall-, one /oot *i/ecto/- 5as *elete*, AN.C."as0i/oC, an* s4:seD4entl- all ot0e/ c0il* fol*e/s an* files 5e/e *elete*. I *issent f/o. M/. Pai1eBs fin*in1s as to 50et0e/ an- of t0e *elete* files co4l* :e Mali:4 Me*ia, LLCBs co2-/i10te* content. "o e32lain t0e ca4se fo/ .- *issention, so.e :ac91/o4n* on 0o5 files a/e sto/e* an* /ecove/e* is necessa/- fi/st.
3.
<.
?.
Background >. "0e file-s-ste. 2/esent in t0e sole 2a/tition on t0is *is9 is t0e Ne5 "ec0nolo1- +ile &-ste. 7N"+&8. N"+& t/ac9s files an* *i/ecto/ies in a Maste/ +ile "a:le 7M+"8. "0e M+" contains t5o :asic va/ieties of /eco/*s: file /eco/*s an* *i/ecto/- /eco/*s. A *i/ecto/- /eco/* incl4*es att/i:4tes 7a.on1 ot0e/s not /elevant to t0is *isc4ssion8 s4c0 as a Exhibit A - P. 1
@.
Case 1:13-cv-00205-WTL-MJD Document 101-1 Filed 03/28/14 Page 2 of 5 PageID #: 826 2ointe/ to its 2a/ent *i/ecto/- 7i.e. t0e fol*e/ it is containe* 5it0in8, t0e ti.e an* *ate t0e *i/ecto/- 5as fi/st c/eate*, last .o*ifie*, last accesse* an* 50en t0e /eco/* itself 0as :een .o*ifie* last, as 5ell as a fla1 i*entif-in1 50et0e/ it 0as :een *elete*. If t0e *i/ecto/- contents a/e s.all1, a list of all files an* s4:-*i/ecto/ies t0at it contains 75it0 2ointe/s to t0e a22/o2/iate file E fol*e/ /eco/*s8 a/e locate* *i/ectl- in t0e M+". If it is la/1e, t0e list of contents a/e sto/e* else50e/e on t0e *is9 an* t0e M+" .e/el- incl4*es a 2ointe/ to t0at location. ;. +ile /eco/*s si.ila/l- contain a 2ointe/ :ac9 to t0e 2a/ent *i/ecto/- /eco/*, file c/eation, access, /eco/* an* .o*ification ti.es, an* a fla1 i*entif-in1 50et0e/ t0e file is *elete*. As a:ove, if t0e file is s.all, t0e contents of t0e file itself a/e sto/e* in t0e M+". If it is la/1e, t0e contents a/e sto/e* else50e/e on t0e *is9 an* t0e M+" .e/el- incl4*es a 2ointe/ to t0at location. !0en a 4se/ o/ an a4to.ate* 2/ocess *eletes2 a file: a. "0e file /eco/* in t0e M+" is fla11e* as *elete*. Note: the rest of the file record remain intact. :. If t0e file contents 5e/e sto/e* o4tsi*e of t0e M+" 7t-2icall- t0e- a/e8, t0e cl4ste/s t0at 0el* t0e *ata a/e fla11e* as availa:le. Note: The file contents are not over-written, merely marked as okay to overwrite with another file! c. "0e 2a/ent *i/ecto/- is 42*ate* :- /e.ovin1 t0e file f/o. its listin1 of contents. Deletion of a *i/ecto/- 2/ocee*s si.ila/l-: t0e *i/ecto/- /eco/* is .a/9e* as *elete* 7:4t is ot0e/5ise intact8, t0e cl4ste/s t0at 0el* t0e *i/ecto/- contents 7if sto/e* o4tsi*e t0e M+"8 a/e .a/9e* as availa:le, an* its 2a/ent *i/ecto/- is 42*ate* :- /e.ovin1 it f/o. t0e list. All files an* fol*e/s t0at 5e/e containe* in t0at fol*e/ a/e also *elete* in t0e sa.e .anne/. &o lon1 as t0e cl4ste/s3 t0at contain t0e file 0ave not :een ove/-5/itten :- ne5l- c/eate* files, *elete* files .a- still :e /ecove/e* f/o. a 0a/* */ive in a fe5 9e- 5a-s. a. Alt0o410 t0e file s-ste. i1no/es file /eco/*s .a/9e* as *elete* in t0e M+", soft5a/e *esi1ne* fo/ /ecove/- can /ea* t0ese file /eco/*s an* /ecove/ all att/i:4tes associate* 5it0 a file as 5ell as locate its location on *is9, 2/ovi*e* t0e file /eco/* 0as not -et :een ove/5/itten. :. Even if t0e/e is no lon1e/ a file /eco/* in t0e M+", t0e *ata .a- still :e /ecove/e* f/o. t0e *is9 :- Aca/vin1C: sea/c0in1 t0/o410 t0e 0a/* */ive fo/ s2ecific se/ies of :-tes t0at i*entift0e t-2e of file one see9s to /ecove/. +o/ instance, t0e sta/t of a F.avi file :e1ins 5it0 A(I++C. c. If t0e *i/ecto/- /eco/* is no lon1e/ 2/esent o/ t0e file is onl- /ecove/a:le :- ca/vin1, t0e file is an or"han: t0e file is /ecove/e* :4t it is 4n9no5n 50at *i/ecto/- na.e it 4se* to /esi*e in. Even 50en 2a/ts of t0e file 0as :een ove/5/itten, vi*eo files .a- still :e 2la-a:le to so.e e3tent. a. ,LC Me*ia Pla-e/ can often 2la- :/o9en o/ *a.a1e* A,I files so lon1 as eno410 of t0e :e1innin1 of t0e file /e.ains intact. :. ff.2e1 can e3t/act in*ivi*4al sc/een i.a1es f/o. .an- *a.a1e* vi*eo files t0at ,LC
10.
11.
12.
13.
1 B- *efa4lt, :ot0 t0e file /eco/* an* t0e file contents cannot total .o/e t0an 1,02< :-tes if t0e file contents a/e to :e sto/e* in t0e M+". 2 "0e *efa4lt action in !in*o5s afte/ a 4se/ c0ooses to *elete a file is act4all- to A.oveC t0e file to t0e (ec-cle Bin, a s2ecial *i/ecto/- .eant to 1ive an a**itional level of 2/otection a1ainst acci*ental *eletion. Unless t0e file is ve/- la/1e o/ t0e 4se/ ove//i*es t0is :e0avio/, t0e *eletion 2/ocess *oes not act4all- :e1in 4ntil t0e (ec-cle Bin is Ae.2tie*C. 3 "0e s.allest 4nit of s2ace to :e a**/esse* :- a 0a/* */ive is a secto/. 'o5eve/, to s2ee* 42 access ti.es, t0e s.allest 4nit of s2ace allocate* :- t0e file-s-ste. a/e cl4ste/s, 50ic0 a/e 1/o42s of secto/s.
Exhibit A - P. 2
Case 1:13-cv-00205-WTL-MJD Document 101-1 Filed 03/28/14 Page 3 of 5 PageID #: 827 cannot 2la-, t0o410 it 0an*les G4ic9ti.e 7F..ov8 files 2oo/l- an* *oes not s422o/t vi*eo 2/otecte* :- Di1ital (i10ts Mana1e.ent 7D(M8. c. Def/ase/ is a:le to /eco1ni6e an* e3t/act vi*eo an* a4*io f/a1.ents not onl- :ase* on file t-2e si1nat4/es 7li9e t0ose 4se* 50en Aca/vin1C8 :4t also :- t0e si1nat4/es of s2ecific vi*eo an* a4*io co*ecs 4se* 5it0in t0ose files. Analysis 1<. U2on .- e3a.ination of t0e i.a1e, I fo4n* t0at all of t0e files /eco/*e* in t0e M+" as *elete* 0a* c/eation *ates no /ecent t0an 2< )cto:e/ 2011. "0e .ost /ecent .o*ification *ate 5as 1; &e2te.:e/ 2012 fo/ a te.2o/a/- file 2/o*4ce* :- t0e o2e/atin1 s-ste.. "0e onl- files c/eate* .o/e /ecentl- 5e/e att/i:4te files< c/eate* :- t0e o2e/atin1 s-ste. as 2a/t of t0e act of *eletion on 22 Dece.:e/ 2013. &ince t0e 22 Dece.:e/ 2013 *eletion event, onl- a sin#le file 0as :een c/eate* o/ .o*ifie* in t0e inte/i.: a 12; :-te A*es9to2.iniC file, 50ic0 is a4to.aticall- c/eate* :- t0e !in*o5s o2e/atin1 s-ste. to sto/e 4se/ 2/efe/ences fo/ 0o5 to *is2la- a *i/ecto/-. a. Beca4se of its s.all si6e, t0is fileBs contents 5e/e sto/e* *i/ectl- in t0e M+". "04s, 50ile it is 2ossi:le it ove/-5/ote 2a/t of a sin1le *elete* file o/ *i/ecto/- /eco/* in t0e M+", no file contents on t0e *is9 5o4l* 0ave :een ove/5/itten. :. As t0is file 5as c/eate* on 1> +e:/4a/- 201<, t0e M+" /eco/* n4.:e/ no5 occ42ie* :- t0is file 5o4l* 0ave still containe* its 2/evio4s *ata 50en e3a.ine* :- M/. Pai1e. As t0e/e 0a* :een no ne5 5/ites to t0e 0a/* */ive follo5in1 t0e *eletion, an- co2-/i10te* .e*ia 2/esent on t0e */ive :efo/e t0e *eletion event 5o4l* 0ave /e.aine* intact 50en e3a.ine* :- M/. Pai1e. As no 5/ites o4tsi*e of t0e M+" 0ave occ4//e* in t0e inte/i. :et5een t0e *eletion an* .- o5n i.a1in1 of t0e 0a/* */ive, t0e file contents of an- co2-/i10te* .e*ia 2/esent at t0at ti.e 5o4l* /e.ain intact on t0e i.a1e I collecte*. +4/t0e/, t0e .to//ent? files associate* 5it0 t0e 1@ 5o/9s Defen*ant is alle1e* to 0ave *o5nloa*e* 5o4l* also /e.ain intact on t0is i.a1e 0a* t0e- :een *elete* on 22 Dece.:e/ 2013. I con*4cte* a sea/c0 fo/ co2-/i10te* Mali:4 Me*ia, LLC 5o/9s o/ files associate* 5it0 inf/in1e.ent on t0ose 5o/9s. a. I /ecove/e* t0e contents fo/ all file /eco/*s 7*elete* o/ intact8 associate* 5it0 .to//ent files an* vi*eo files :. I ca/ve* fo/ .to//ent files as 5ell as a 5i*e va/iet- of vi*eo fo/.ats locate* an-50e/e on t0e i.a1e: slac9 s2ace, 4n4se* s2ace, 4nallocate* s2ace as 5ell as insi*e e3istin1 files. c. I e32o/te* all 4n4se*H4nallocate* s2ace an* slac9 s2ace f/o. t0e i.a1e, an* anal-6e* t0ese fo/ a4*io an* vi*eo f/a1.ents 5it0 Def/ase/ ve/sion 1.3. 732-:it8 fo/ va/io4s containe/s an* co*ecs 4se* fo/ *i1ital vi*eo: 3IPPHG"HMP<, A&+H!M,, A,IH(I++, MPEI-1H2 &-ste.s,
1 .
1?.
1>.
1@.
< Att/i:4te files a/e 2a/t of t0e file s-ste. an* a/e not *i/ectl- accessi:le to t0e 4se/. Delete* att/i:4te files f/o. 22 Dece.:e/ 2013 a/e (ec-cle Bin files 4se* to /eco/* t0e o/i1inal location fo/ fo4/ .to//ent files t0at 5e/e *elete* t0at *a-. "0e act4al .to//ent files t0e.selves 0ave c/eation an* last access *ates of > #4ne 200;. If :- c0ance t0at sin1le file /eco/* ove/5/ote a /eco/* of evi*entia/- si1nificance, I 5o4l* still /ecove/ it *4/in1 ca/vin1, I 5o4l* .e/el- :e .issin1 .eta*ata li9e t0e file na.e an* t0e accessH.o*ificationHc/eation ti.es. ? A .to//ent file can in t0eo/- fit insi*e t0e M+", :4t onl- fo/ to//ents 5it0 a fe5 ve/- s.all files. A .to//ent 4ses a fe5 04n*/e* :-tes o/ .o/e to *esc/i:e t0e na.es of files an* t0e t/ac9e/s to contact, 2l4s 20 :-tes 2e/ 2iece. +o/ instance, t0e .to//ent file fo/ t0e 5o/9 A!ant %o4C, 5it0 an info0as0 of 0CE;2E+>@0 <1EB>B++D@;D;ED 2@>33B3D@3B1?, is ,<2; :-tes lon1
Exhibit A - P. 3
Case 1:13-cv-00205-WTL-MJD Document 101-1 Filed 03/28/14 Page 4 of 5 PageID #: 828 MPEI-1H2 ,i*eo, MPEI-< ,i*eoH'.2?3. I t0en e32o/te* all c0il* .e*ia o:Jects as in*e2en*ent files. I 4se* ff.2e1 ve/sion N- ;@ 2-1>@ *c1< to e3t/act sc/een i.a1es fo/ eve/- secon*s of vi*eo f/o. all 2otential .e*ia files collecte* in ste2s a, : an* c. I e3a.ine* all of t0e /es4ltin1 ca2t4/e* i.a1es fo/ stills f/o. Mali:4 Me*ia, LLCBs 5o/9s I 4se* ,LC .e*ia 2la-e/ ve/sion 1.1.11 to e3a.ine e3t/acte* .e*ia files fo/ 50ic0 ff.2e1 is not 100K /elia:le at anal-6in1 73IPPHG"HMP<8. None of t0e .to//ent files no/ vi*eo files /ecove/e* 5e/e fo/ Mali:4 Me*ia, LLCBs 5o/9s.
*. e. f. 1. 1;.
+4/t0e/, t0e .to//ent files t0at 0a* /eco/*s 2/esent in t0e M+" 7*elete* o/ intact8 0a* c/eation *ates /an1in1 f/o. 200? to 200; at t0e .ost /ecent, 2/e*atin1 all of t0e co2-/i10te* 5o/9s in D4estion. "o//ent files t0at 5e/e onl- /ecove/a:le :- ca/vin1 0ave, :- *efinition, no associate* M+" ent/2/esent an- lon1e/. 'o5eve/, .to//ent files often contain an inte/nal c/eation *ate fiel* t0at s2ecifies 50en t0e o/i1inal see*e/ c/eate* t0e to//ent. !0e/e 2/esent, t0ese c/eation *ates /an1e f/o. 200 to 200;, 50ic0 co//o:o/ates 5ell 5it0 t0e /an1e of to//ent activit- in*icate* :- t0e M+". )f t0e 111 Bit"o//ent files still liste* in t0e M+", 10> a/e o/20ans t0at 5e/e *elete* so.e ti.e a1o 7lon1 eno410 t0at ne5 files o/ fol*e/s 0a* :een c/eate* afte/ t0ei/ 2a/ent fol*e/s 5e/e *elete*8. "04s, onl- < of t0e Bit"o//ent files in D4estion 5e/e *elete* *4/in1 t0e 22 Dec 2013 *eletion. All fo4/ of t0ose files 5e/e 2/evio4sl- locate* in A$:LN.C."as0i/oLLocal &ettin1sL"e.2LC. +inall-, I *i* a case-insensitive te3t sea/c0 fo/ t0e title of eac0 of t0e 1@ 5o/9s in D4estion ac/oss t0e enti/e i.a1e, allo5in1 an- c0a/acte/ :et5een 5o/*s 7e.1. AA.Ii/ls.+antas-C o/ Aa-1I(l& fantas-C 5o4l* :ot0 /es4lts in a .atc08. I e32o/te* t0e conte3t s4//o4n*in1 eac0 /es4lt an* /evie5e* eac0 of t0e., confi/.in1 t0at eac0 /es4lt 5as 4n/elate* to Mali:4 Me*ia, LLCBs 5o/9s.> &atisfie* t0at t0e sea/c0 fo/ evi*ence of t0e co2-/i10te* 5o/9s 0a* :een e30a4ste*, I so410t t0e ca4se of t0e *eletion t0at occ4//e* on 22 Dece.:e/ 2013. Alt0o410 t0e/e a/e 2a/ts of a !in*o5s installation 2/esent on t0e *is9 i.a1e, e3a.ination of t0e .ost /ecent &AM /e1ist/file confi/.s no 4se/ 0as lo11e* into it since 12 #an4a/- 2011. !it0o4t con*4ctin1 an e3a.ination of an i.a1e of t0e .ac0ine f/o. 50ic0 t0e *eletion 5as sta/te*, I cannot sa- fo/ ce/tain 50o o/ 50at initiate* t0e *eletion. In s4..a/-, I fo4n* no evi*ence t0at an- of Mali:4 Me*ia, LLCBs 5o/9s no/ .to//ent files /elate* to t0e. 5e/e eve/ 2/esent on t0is 0a/* */ive. "0e .ost /ecent c/eation, .o*ification an* access *ates fo/ Bit"o//ent /elate* activit- on t0e 0a/* */ive 2/e*ate t0e ea/liest of t0e A0it*atesC /e2o/te* in t0e o/i1inal co.2laint. Alt0o410 .an- files an* fol*e/s 5e/e .a/9e* as *elete* on 22 Dec 2013, a t0o/o410 e3a.ination of t0e M+" an* t0e se/en*i2it- t0at no 4se/s c/eate* o/ .o*ifie* files follo5in1 t0at *eletion *e.onst/ates t0at 0a* an- /elevant vi*eos o/ .to//ent files :een 2/esent :efo/e t0e 22n*, t0e- 5o4l* 0ave /e.aine* 2/esent 50en t0e 0a/* */ive 5as i.a1e* t0e follo5in1 *a-@.
20.
21.
22.
23.
2<.
> Beca4se t0e 5o/9s incl4*e titles as 1ene/ic as ADa-*/ea.C an* A+a/e5ellC, eve/-*a- *oc4.ents t0at 0a22ene* to 4se t0e sa.e 5o/*s as t0e title also .atc0e* t0e sea/c0. @ P/es4.a:l-, M/. Pai1e 5o4l* 0ave /e2o/te* s4c0 evi*ence 0a* 0e fo4n* s4c0 *4/in1 0is anal-sis.
Exhibit A - P. 4
Exhibit A - P. 5