Forensic Analysis Of Geohot's Hard Drives In Dispute

[The Central Scrutinizer]

In the latest round of Sony vs. Geohot legal wrangling, court documents obtained by PSX-SCENE reveal that there is now a dispute as to how Geohot's hard drives are being handled by TIG, the third-party company designated to analyze them.

The original court order only called for the drive(s) to be delivered to a third party "for the purpose of isolating, segregating and/or removing the information on those devices related to Defendant Hotz's circumvention of the TPMs in the PS3 system."

Now the company doing the analysis wants to create TWO FULL IMAGES of the drive(s), in both decrypted and encrypted form!!! According to Geohot's attorneys, "SCEA is not entitled to inspect the impounded drives under the impoundment order, nor is it allowed to create and preserve additional copies of the impounded drives, but this is precisely what it seeks to do."

SCEA, of course, is demanding that this fast one be allowed.

For the foregoing reasons, SCEA requests that the Court order that Mr. Hotz comply with TIG‟s recommended impoundment protocols and that those protocols be supplemented to ensure that preservation requirements are met as follows:

(1) TIG create and preserve two forensically sound images (e.g., bit stream images) of each impounded storage device in its encrypted form: One to be maintained by TIG in a secure vault for preservation purposes and the second to be used for decryption and/or any other necessary analysis by TIG;

(2) TIG create and preserve two forensically sound images (e.g., bit stream images) of each impounded storage device in its un-encrypted form. One to be maintained by TIG in a secure vault for preservation
purposes and the second to be used for TIG‟s necessary analysis; and

(3) TIG maintain and preserve all of the forensically created images for the duration of the lawsuit.

SCEA further requests that the Court order Mr. Hotz to: (a) provide TIG with the tools and keys necessary to decrypt the impounded storage devices and the keys and passwords necessary to decrypt or unlock any protected files contained on the impounded storage devices;

(b) identify for TIG all virtual machines or hard disks stored or at any time run on the impounded storage devices.3 Furthermore, to verify compliance with the impoundment order, SCEA requests that the Court order Mr. Hotz to provide a declaration setting forth: (i) verification that all storage devices on which any circumvention devices or any information relating to Mr. Hotz‟s circumvention of the technological protection measures in the PS3 System are stored have been delivered to TIG; (ii) why the storage device used by Mr. Hotz in the January 7, 2011 YouTube video entitled “Jailbroken PS3 3.55 with Homebrew” was not delivered to TIG for impoundment; and (iii) the identity of any remote storage of the circumvention devices or any information relating to Mr. Hotz‟s circumvention of the technological protection measures in the PS3 System.4 Finally, SCEA seeks fees and costs in relation to this motion.

[Mathematician]

That's pretty intense especially since they are asking for the fees and costs to do this motion. How much to do it can get pretty subjective with time and effort.

[racoonfrenzy]

Since when does a third party called in to do a job have the right to demand something in a case. They should do what they are asked and be done with it.

[th3joker]

Perhaps then Sony should provide Geohot with the "keys and passwords necessary to decrypt or unlock any protected files contained on the" PS3??? :-)

Or doesn't the very law they say has been broken apply to them.

[subcon959]

Since when does a third party called in to do a job have the right to demand something in a case. They should do what they are asked and be done with it.

Yeah, I doubt the third party is being influenced in anyway by anyone.. yep no chance of that.

[chesh]

LOL, who is doing the crab artwork for these posts?

[xiaNaix]

LOL, who is doing the crab artwork for these posts?

holypuma's girlfriend. I don't know her name but, when I get it, I'll add it to the news.

[JNABK]

I think Sony found out that geohot possibly has the answer to how they can make the PS3 more secure and they want that info!! I suspect TIG has been in contact with Sony, although TIG is supposed to be a neutral 3rd party in this and comply with the Court Order to simply remove anything related to "circumvention of the TPMs".

Now the company doing the analysis wants to create TWO FULL IMAGES of the drive(s), in both decrypted and encrypted form!!!

The company is The Intelligence Group (TIG), so if they haven't told Sony what they found, then why would they or Sony now want copies of what was found?


Hope geohot's laywers move for some violation of the court order here,as it would seem theres something going on 'behind the scenes'.

[E.coli]

meh its gg if the court orders geohot to give up his harddrive decryption keys

here's hoping that judge illston doesn't make him give them up

[shhximxhiding]

I think Sony found out that geohot possibly has the answer to how they can make the PS3 more secure and they want that info!! I suspect TIG has been in contact with Sony, although TIG is supposed to be a neutral 3rd party in this and comply with the Court Order to simply remove anything related to "circumvention of the TPMs".

The company is The Intelligence Group (TIG), so if they haven't told Sony what they found, then why would they or Sony now want copies of what was found?


Hope geohot's laywers move for some violation of the court order here,as it would seem theres something going on 'behind the scenes'.

The article did say


For the foregoing reasons, SCEA requests that the Court order that Mr. Hotz comply with TIG‟s recommended impoundment protocols


So I am assuming these are just what TIG recommends, and since it is what Sony wants they are going to push the recommendation.