Case 1:13-cv-00205-WTL-MJD Document 101-1 Filed 03/28/14 Page 1 of 5 PageID #: 825 UNITED STATES DISTRICT COURT FOR THE

SOUTHERN DISTRICT OF INDIANA MALIBU MEDIA, LLC Plaintiff, Case No. 1:13-cv-0020 -!"L-M#D v. $ELLE% "A&'I() Defen*ants DECLA(A"I)N )+ DEL,AN NE,ILLE 1. 2. M- na.e is Delvan Neville. I a. ove/ t0e a1e of 21 an* co.2etent to e3ec4te t0is Decla/ation. I a. t0e o5ne/ of A.a/a10 Associates, LLC, a *i1ital fo/ensics co.2an- s2eciali6e* in Bit"o//ent investi1ation. I a. an ACE 7AccessData Ce/tifie* E3a.ine/8 as 5ell as t0e a4t0o/ of a Bit"o//ent .onito/in1 s4ite, EUP&C29. Befo/e ente/in1 t0e fiel*, I 0ave en1a1e* in f/eelance co.24te/ /e2ai/ an* t/o4:les0ootin1 since t0e late 1;;0s, incl4*in1 /ecove/in1 lost *ata f/o. sto/a1e *evices. )n Ma/c0 10t0, 201<, I /eceive* a !este/n Di1ital *is9 */ive, in a (oc9etfis0 e3te/nal U&B enclos4/e, s0i22e* to .e f/o. t0e Defen*ant :- UP& 7t/ac9in1 n4.:e/: 1=2!;>!2032?@3 <118. "0e se/ial n4.:e/ fo/ t0is 0a/* */ive is !MAD1< 2213@. I c/eate* a fo/ensicall- so4n* i.a1e of t0e 0a/* */ive 4sin1 a !ie:etec0 +o/ensic Ult/aDoc9 v 5/ite:loc9e/ an* AccessData +"$ I.a1e/ 3.1.<.?. I i.2o/te* t0is i.a1e into a ne5 case in +o/ensic "ool9it .2.1.2. I 0ave /ea* t0e *ecla/ation of Pat/ic9 Pai1e /e1a/*in1 t0e anal-sis of t0is 0a/* */ive. In it, 0e conten*s t0at AMali:4 Me*ia, LLCBs co2-/i10te* content co4l* 0ave :een *elete* f/o. t0e */ive *4/in1 Defen*antBs .ass e/as4/eC See Doc 76 at 28. I conc4/ 5it0 M/. Pai1eBs fin*in1 t0at t0e/e 5e/e .an- files an* fol*e/s *elete* on 22 Dece.:e/ 2013. &2ecificall-, one /oot *i/ecto/- 5as *elete*, AN.C."as0i/oC, an* s4:seD4entl- all ot0e/ c0il* fol*e/s an* files 5e/e *elete*. I *issent f/o. M/. Pai1eBs fin*in1s as to 50et0e/ an- of t0e *elete* files co4l* :e Mali:4 Me*ia, LLCBs co2-/i10te* content. "o e32lain t0e ca4se fo/ .- *issention, so.e :ac91/o4n* on 0o5 files a/e sto/e* an* /ecove/e* is necessa/- fi/st.

3.

<.

?.

Background >. "0e file-s-ste. 2/esent in t0e sole 2a/tition on t0is *is9 is t0e Ne5 "ec0nolo1- +ile &-ste. 7N"+&8. N"+& t/ac9s files an* *i/ecto/ies in a Maste/ +ile "a:le 7M+"8. "0e M+" contains t5o :asic va/ieties of /eco/*s: file /eco/*s an* *i/ecto/- /eco/*s. A *i/ecto/- /eco/* incl4*es att/i:4tes 7a.on1 ot0e/s not /elevant to t0is *isc4ssion8 s4c0 as a Exhibit A - P. 1

@.

Case 1:13-cv-00205-WTL-MJD Document 101-1 Filed 03/28/14 Page 2 of 5 PageID #: 826 2ointe/ to its 2a/ent *i/ecto/- 7i.e. t0e fol*e/ it is containe* 5it0in8, t0e ti.e an* *ate t0e *i/ecto/- 5as fi/st c/eate*, last .o*ifie*, last accesse* an* 50en t0e /eco/* itself 0as :een .o*ifie* last, as 5ell as a fla1 i*entif-in1 50et0e/ it 0as :een *elete*. If t0e *i/ecto/- contents a/e s.all1, a list of all files an* s4:-*i/ecto/ies t0at it contains 75it0 2ointe/s to t0e a22/o2/iate file E fol*e/ /eco/*s8 a/e locate* *i/ectl- in t0e M+". If it is la/1e, t0e list of contents a/e sto/e* else50e/e on t0e *is9 an* t0e M+" .e/el- incl4*es a 2ointe/ to t0at location. ;. +ile /eco/*s si.ila/l- contain a 2ointe/ :ac9 to t0e 2a/ent *i/ecto/- /eco/*, file c/eation, access, /eco/* an* .o*ification ti.es, an* a fla1 i*entif-in1 50et0e/ t0e file is *elete*. As a:ove, if t0e file is s.all, t0e contents of t0e file itself a/e sto/e* in t0e M+". If it is la/1e, t0e contents a/e sto/e* else50e/e on t0e *is9 an* t0e M+" .e/el- incl4*es a 2ointe/ to t0at location. !0en a 4se/ o/ an a4to.ate* 2/ocess *eletes2 a file: a. "0e file /eco/* in t0e M+" is fla11e* as *elete*. Note: the rest of the file record remain intact. :. If t0e file contents 5e/e sto/e* o4tsi*e of t0e M+" 7t-2icall- t0e- a/e8, t0e cl4ste/s t0at 0el* t0e *ata a/e fla11e* as availa:le. Note: The file contents are not over-written, merely marked as okay to overwrite with another file! c. "0e 2a/ent *i/ecto/- is 42*ate* :- /e.ovin1 t0e file f/o. its listin1 of contents. Deletion of a *i/ecto/- 2/ocee*s si.ila/l-: t0e *i/ecto/- /eco/* is .a/9e* as *elete* 7:4t is ot0e/5ise intact8, t0e cl4ste/s t0at 0el* t0e *i/ecto/- contents 7if sto/e* o4tsi*e t0e M+"8 a/e .a/9e* as availa:le, an* its 2a/ent *i/ecto/- is 42*ate* :- /e.ovin1 it f/o. t0e list. All files an* fol*e/s t0at 5e/e containe* in t0at fol*e/ a/e also *elete* in t0e sa.e .anne/. &o lon1 as t0e cl4ste/s3 t0at contain t0e file 0ave not :een ove/-5/itten :- ne5l- c/eate* files, *elete* files .a- still :e /ecove/e* f/o. a 0a/* */ive in a fe5 9e- 5a-s. a. Alt0o410 t0e file s-ste. i1no/es file /eco/*s .a/9e* as *elete* in t0e M+", soft5a/e *esi1ne* fo/ /ecove/- can /ea* t0ese file /eco/*s an* /ecove/ all att/i:4tes associate* 5it0 a file as 5ell as locate its location on *is9, 2/ovi*e* t0e file /eco/* 0as not -et :een ove/5/itten. :. Even if t0e/e is no lon1e/ a file /eco/* in t0e M+", t0e *ata .a- still :e /ecove/e* f/o. t0e *is9 :- Aca/vin1C: sea/c0in1 t0/o410 t0e 0a/* */ive fo/ s2ecific se/ies of :-tes t0at i*entift0e t-2e of file one see9s to /ecove/. +o/ instance, t0e sta/t of a F.avi file :e1ins 5it0 A(I++C. c. If t0e *i/ecto/- /eco/* is no lon1e/ 2/esent o/ t0e file is onl- /ecove/a:le :- ca/vin1, t0e file is an or"han: t0e file is /ecove/e* :4t it is 4n9no5n 50at *i/ecto/- na.e it 4se* to /esi*e in. Even 50en 2a/ts of t0e file 0as :een ove/5/itten, vi*eo files .a- still :e 2la-a:le to so.e e3tent. a. ,LC Me*ia Pla-e/ can often 2la- :/o9en o/ *a.a1e* A,I files so lon1 as eno410 of t0e :e1innin1 of t0e file /e.ains intact. :. ff.2e1 can e3t/act in*ivi*4al sc/een i.a1es f/o. .an- *a.a1e* vi*eo files t0at ,LC

10.

11.

12.

13.

1 B- *efa4lt, :ot0 t0e file /eco/* an* t0e file contents cannot total .o/e t0an 1,02< :-tes if t0e file contents a/e to :e sto/e* in t0e M+". 2 "0e *efa4lt action in !in*o5s afte/ a 4se/ c0ooses to *elete a file is act4all- to A.oveC t0e file to t0e (ec-cle Bin, a s2ecial *i/ecto/- .eant to 1ive an a**itional level of 2/otection a1ainst acci*ental *eletion. Unless t0e file is ve/- la/1e o/ t0e 4se/ ove//i*es t0is :e0avio/, t0e *eletion 2/ocess *oes not act4all- :e1in 4ntil t0e (ec-cle Bin is Ae.2tie*C. 3 "0e s.allest 4nit of s2ace to :e a**/esse* :- a 0a/* */ive is a secto/. 'o5eve/, to s2ee* 42 access ti.es, t0e s.allest 4nit of s2ace allocate* :- t0e file-s-ste. a/e cl4ste/s, 50ic0 a/e 1/o42s of secto/s.

Exhibit A - P. 2

Case 1:13-cv-00205-WTL-MJD Document 101-1 Filed 03/28/14 Page 3 of 5 PageID #: 827 cannot 2la-, t0o410 it 0an*les G4ic9ti.e 7F..ov8 files 2oo/l- an* *oes not s422o/t vi*eo 2/otecte* :- Di1ital (i10ts Mana1e.ent 7D(M8. c. Def/ase/ is a:le to /eco1ni6e an* e3t/act vi*eo an* a4*io f/a1.ents not onl- :ase* on file t-2e si1nat4/es 7li9e t0ose 4se* 50en Aca/vin1C8 :4t also :- t0e si1nat4/es of s2ecific vi*eo an* a4*io co*ecs 4se* 5it0in t0ose files. Analysis 1<. U2on .- e3a.ination of t0e i.a1e, I fo4n* t0at all of t0e files /eco/*e* in t0e M+" as *elete* 0a* c/eation *ates no /ecent t0an 2< )cto:e/ 2011. "0e .ost /ecent .o*ification *ate 5as 1; &e2te.:e/ 2012 fo/ a te.2o/a/- file 2/o*4ce* :- t0e o2e/atin1 s-ste.. "0e onl- files c/eate* .o/e /ecentl- 5e/e att/i:4te files< c/eate* :- t0e o2e/atin1 s-ste. as 2a/t of t0e act of *eletion on 22 Dece.:e/ 2013. &ince t0e 22 Dece.:e/ 2013 *eletion event, onl- a sin#le file 0as :een c/eate* o/ .o*ifie* in t0e inte/i.: a 12; :-te A*es9to2.iniC file, 50ic0 is a4to.aticall- c/eate* :- t0e !in*o5s o2e/atin1 s-ste. to sto/e 4se/ 2/efe/ences fo/ 0o5 to *is2la- a *i/ecto/-. a. Beca4se of its s.all si6e, t0is fileBs contents 5e/e sto/e* *i/ectl- in t0e M+". "04s, 50ile it is 2ossi:le it ove/-5/ote 2a/t of a sin1le *elete* file o/ *i/ecto/- /eco/* in t0e M+", no file contents on t0e *is9 5o4l* 0ave :een ove/5/itten. :. As t0is file 5as c/eate* on 1> +e:/4a/- 201<, t0e M+" /eco/* n4.:e/ no5 occ42ie* :- t0is file 5o4l* 0ave still containe* its 2/evio4s *ata 50en e3a.ine* :- M/. Pai1e. As t0e/e 0a* :een no ne5 5/ites to t0e 0a/* */ive follo5in1 t0e *eletion, an- co2-/i10te* .e*ia 2/esent on t0e */ive :efo/e t0e *eletion event 5o4l* 0ave /e.aine* intact 50en e3a.ine* :- M/. Pai1e. As no 5/ites o4tsi*e of t0e M+" 0ave occ4//e* in t0e inte/i. :et5een t0e *eletion an* .- o5n i.a1in1 of t0e 0a/* */ive, t0e file contents of an- co2-/i10te* .e*ia 2/esent at t0at ti.e 5o4l* /e.ain intact on t0e i.a1e I collecte*. +4/t0e/, t0e .to//ent? files associate* 5it0 t0e 1@ 5o/9s Defen*ant is alle1e* to 0ave *o5nloa*e* 5o4l* also /e.ain intact on t0is i.a1e 0a* t0e- :een *elete* on 22 Dece.:e/ 2013. I con*4cte* a sea/c0 fo/ co2-/i10te* Mali:4 Me*ia, LLC 5o/9s o/ files associate* 5it0 inf/in1e.ent on t0ose 5o/9s. a. I /ecove/e* t0e contents fo/ all file /eco/*s 7*elete* o/ intact8 associate* 5it0 .to//ent files an* vi*eo files :. I ca/ve* fo/ .to//ent files as 5ell as a 5i*e va/iet- of vi*eo fo/.ats locate* an-50e/e on t0e i.a1e: slac9 s2ace, 4n4se* s2ace, 4nallocate* s2ace as 5ell as insi*e e3istin1 files. c. I e32o/te* all 4n4se*H4nallocate* s2ace an* slac9 s2ace f/o. t0e i.a1e, an* anal-6e* t0ese fo/ a4*io an* vi*eo f/a1.ents 5it0 Def/ase/ ve/sion 1.3. 732-:it8 fo/ va/io4s containe/s an* co*ecs 4se* fo/ *i1ital vi*eo: 3IPPHG"HMP<, A&+H!M,, A,IH(I++, MPEI-1H2 &-ste.s,

1 .

1?.

1>.

1@.

< Att/i:4te files a/e 2a/t of t0e file s-ste. an* a/e not *i/ectl- accessi:le to t0e 4se/. Delete* att/i:4te files f/o. 22 Dece.:e/ 2013 a/e (ec-cle Bin files 4se* to /eco/* t0e o/i1inal location fo/ fo4/ .to//ent files t0at 5e/e *elete* t0at *a-. "0e act4al .to//ent files t0e.selves 0ave c/eation an* last access *ates of > #4ne 200;. If :- c0ance t0at sin1le file /eco/* ove/5/ote a /eco/* of evi*entia/- si1nificance, I 5o4l* still /ecove/ it *4/in1 ca/vin1, I 5o4l* .e/el- :e .issin1 .eta*ata li9e t0e file na.e an* t0e accessH.o*ificationHc/eation ti.es. ? A .to//ent file can in t0eo/- fit insi*e t0e M+", :4t onl- fo/ to//ents 5it0 a fe5 ve/- s.all files. A .to//ent 4ses a fe5 04n*/e* :-tes o/ .o/e to *esc/i:e t0e na.es of files an* t0e t/ac9e/s to contact, 2l4s 20 :-tes 2e/ 2iece. +o/ instance, t0e .to//ent file fo/ t0e 5o/9 A!ant %o4C, 5it0 an info0as0 of 0CE;2E+>@0 <1EB>B++D@;D;ED 2@>33B3D@3B1?, is ,<2; :-tes lon1

Exhibit A - P. 3

Case 1:13-cv-00205-WTL-MJD Document 101-1 Filed 03/28/14 Page 4 of 5 PageID #: 828 MPEI-1H2 ,i*eo, MPEI-< ,i*eoH'.2?3. I t0en e32o/te* all c0il* .e*ia o:Jects as in*e2en*ent files. I 4se* ff.2e1 ve/sion N- ;@ 2-1>@ *c1< to e3t/act sc/een i.a1es fo/ eve/- secon*s of vi*eo f/o. all 2otential .e*ia files collecte* in ste2s a, : an* c. I e3a.ine* all of t0e /es4ltin1 ca2t4/e* i.a1es fo/ stills f/o. Mali:4 Me*ia, LLCBs 5o/9s I 4se* ,LC .e*ia 2la-e/ ve/sion 1.1.11 to e3a.ine e3t/acte* .e*ia files fo/ 50ic0 ff.2e1 is not 100K /elia:le at anal-6in1 73IPPHG"HMP<8. None of t0e .to//ent files no/ vi*eo files /ecove/e* 5e/e fo/ Mali:4 Me*ia, LLCBs 5o/9s.

*. e. f. 1. 1;.

+4/t0e/, t0e .to//ent files t0at 0a* /eco/*s 2/esent in t0e M+" 7*elete* o/ intact8 0a* c/eation *ates /an1in1 f/o. 200? to 200; at t0e .ost /ecent, 2/e*atin1 all of t0e co2-/i10te* 5o/9s in D4estion. "o//ent files t0at 5e/e onl- /ecove/a:le :- ca/vin1 0ave, :- *efinition, no associate* M+" ent/2/esent an- lon1e/. 'o5eve/, .to//ent files often contain an inte/nal c/eation *ate fiel* t0at s2ecifies 50en t0e o/i1inal see*e/ c/eate* t0e to//ent. !0e/e 2/esent, t0ese c/eation *ates /an1e f/o. 200 to 200;, 50ic0 co//o:o/ates 5ell 5it0 t0e /an1e of to//ent activit- in*icate* :- t0e M+". )f t0e 111 Bit"o//ent files still liste* in t0e M+", 10> a/e o/20ans t0at 5e/e *elete* so.e ti.e a1o 7lon1 eno410 t0at ne5 files o/ fol*e/s 0a* :een c/eate* afte/ t0ei/ 2a/ent fol*e/s 5e/e *elete*8. "04s, onl- < of t0e Bit"o//ent files in D4estion 5e/e *elete* *4/in1 t0e 22 Dec 2013 *eletion. All fo4/ of t0ose files 5e/e 2/evio4sl- locate* in A$:LN.C."as0i/oLLocal &ettin1sL"e.2LC. +inall-, I *i* a case-insensitive te3t sea/c0 fo/ t0e title of eac0 of t0e 1@ 5o/9s in D4estion ac/oss t0e enti/e i.a1e, allo5in1 an- c0a/acte/ :et5een 5o/*s 7e.1. AA.Ii/ls.+antas-C o/ Aa-1I(l& fantas-C 5o4l* :ot0 /es4lts in a .atc08. I e32o/te* t0e conte3t s4//o4n*in1 eac0 /es4lt an* /evie5e* eac0 of t0e., confi/.in1 t0at eac0 /es4lt 5as 4n/elate* to Mali:4 Me*ia, LLCBs 5o/9s.> &atisfie* t0at t0e sea/c0 fo/ evi*ence of t0e co2-/i10te* 5o/9s 0a* :een e30a4ste*, I so410t t0e ca4se of t0e *eletion t0at occ4//e* on 22 Dece.:e/ 2013. Alt0o410 t0e/e a/e 2a/ts of a !in*o5s installation 2/esent on t0e *is9 i.a1e, e3a.ination of t0e .ost /ecent &AM /e1ist/file confi/.s no 4se/ 0as lo11e* into it since 12 #an4a/- 2011. !it0o4t con*4ctin1 an e3a.ination of an i.a1e of t0e .ac0ine f/o. 50ic0 t0e *eletion 5as sta/te*, I cannot sa- fo/ ce/tain 50o o/ 50at initiate* t0e *eletion. In s4..a/-, I fo4n* no evi*ence t0at an- of Mali:4 Me*ia, LLCBs 5o/9s no/ .to//ent files /elate* to t0e. 5e/e eve/ 2/esent on t0is 0a/* */ive. "0e .ost /ecent c/eation, .o*ification an* access *ates fo/ Bit"o//ent /elate* activit- on t0e 0a/* */ive 2/e*ate t0e ea/liest of t0e A0it*atesC /e2o/te* in t0e o/i1inal co.2laint. Alt0o410 .an- files an* fol*e/s 5e/e .a/9e* as *elete* on 22 Dec 2013, a t0o/o410 e3a.ination of t0e M+" an* t0e se/en*i2it- t0at no 4se/s c/eate* o/ .o*ifie* files follo5in1 t0at *eletion *e.onst/ates t0at 0a* an- /elevant vi*eos o/ .to//ent files :een 2/esent :efo/e t0e 22n*, t0e- 5o4l* 0ave /e.aine* 2/esent 50en t0e 0a/* */ive 5as i.a1e* t0e follo5in1 *a-@.

20.

21.

22.

23.

2<.

> Beca4se t0e 5o/9s incl4*e titles as 1ene/ic as ADa-*/ea.C an* A+a/e5ellC, eve/-*a- *oc4.ents t0at 0a22ene* to 4se t0e sa.e 5o/*s as t0e title also .atc0e* t0e sea/c0. @ P/es4.a:l-, M/. Pai1e 5o4l* 0ave /e2o/te* s4c0 evi*ence 0a* 0e fo4n* s4c0 *4/in1 0is anal-sis.

Exhibit A - P. 4

Case 1:13-cv-00205-WTL-MJD Document 101-1 Filed 03/28/14 Page 5 of 5 PageID #: 829

Exhibit A - P. 5