Forensic Analysis Of Geohot's Hard Drives In Dispute

[E.coli]

I think Sony found out that geohot possibly has the answer to how they can make the PS3 more secure and they want that info!! I suspect TIG has been in contact with Sony, although TIG is supposed to be a neutral 3rd party in this and comply with the Court Order to simply remove anything related to "circumvention of the TPMs".

The company is The Intelligence Group (TIG), so if they haven't told Sony what they found, then why would they or Sony now want copies of what was found?


Hope geohot's laywers move for some violation of the court order here,as it would seem theres something going on 'behind the scenes'.

they can't find anything..his harddrives are encrypted

[JNABK]

they can't find anything..his harddrives are encrypted

geohot is supposed to supply the TIG with the info it needs to decrypt it and examine it, under the Order, so if they still havent been able to examine his drives, then he is the one in violation of the Order, right?

The article did say


For the foregoing reasons, SCEA requests that the Court order that Mr. Hotz comply with TIG‟s recommended impoundment protocols


So I am assuming these are just what TIG recommends, and since it is what Sony wants they are going to push the recommendation.

But if they are Ordered to only remove the circumvention stuff, then why would they possibly need to make copies of what is supposed to be removed, as Sony isnt supposed to have any right to examine his HDds, so why would they be allowed any of its contents?

[8bitpenguin]

Wow, I think it can be established that Sony has a major alterier motive. Why do they want to see what's on those hard drives so bad? This obviously has nothing to do with piracy prevention. Unless they're trying to learn from Geohots finding - free security consultation.

[Sektor]

In this case, we have been provided with two hard drives and a calculator

Heh, why did he give them a calculator? I wonder if it was TI-84/89.

There are several typing, spelling and grammar errors in The "Intelligence" Group's document.

[Whinis]

geohot is supposed to supply the TIG with the info it needs to decrypt it and examine it, under the Order, so if they still havent been able to examine his drives, then he is the one in violation of the Order, right?

They did technically view the drive however It was encrypted so they viewed jibberish. Under US law only the judge can force him to give over the encryption key and thats only with a signature from the attorney general of the state Also only certified law enforcement can be involved so as it currently stands sony has little merit to ask him for his keys..

[JNABK]

Wow, I think it can be established that Sony has a major alterier motive. Why do they want to see what's on those hard drives so bad? This obviously has nothing to do with piracy prevention. Unless they're trying to learn from Geohots finding - free security consultation.

Thats what i suspect too, since they were so intent on saying he was trying to get hired. They probably just want to see how he does things and maybe it could shed some new light to their developers on a new approach.

[GigaGaia]

I bet there is nothing on this hardrive at all. I mean, anybody would have deleted the files before handing over the drive, especially since it took them a while to get the TRO.

It's pretty easy to delete the files and they wouldn't be able to do anything or prove you actually went against the TRO by deleting files.

Even if they're experts, no matter what tools they have, it's pretty easy to erase everything. Now I wonder why I call them experts, they can't even get around a small encryption on their own.

[ickyone]

They built the locked... They should know how to decryted it or have the key to the lock... It's just like at work... The manger knows how to run it but the worker know what's going on... And takes shortcuts...

[JNABK]

It's pretty easy to delete the files and they wouldn't be able to do anything or prove you actually went against the TRO by deleting files.

Date codes.......you can find out what went on on a HDD by dates. He would have had to format the drive and over write every single byte and then reformat it again, then put back all the data except the 'incriinating stuff' to pull that off, but that too would reveal when he last formatted the drive and the dates of when stuff was written to the drive. Unless he didnt give them the "real" hdds with the info he wants keep from them.

[E.coli]

I bet there is nothing on this hardrive at all. I mean, anybody would have deleted the files before handing over the drive, especially since it took them a while to get the TRO.

It's pretty easy to delete the files and they wouldn't be able to do anything or prove you actually went against the TRO by deleting files.

Even if they're experts, no matter what tools they have, it's pretty easy to erase everything. Now I wonder why I call them experts, they can't even get around a small encryption on their own.

good way to look guilty in front of the judge

no reason to delete anything...just encrypting it fine