John Carmack on expert witnesses and 'non literal' copying

Re:John Carmack on expert witnesses and 'non literal' copying by gregw2 on Thursday February 02, 2017 @01:21PM (#13552982)

It's kinda hard to square John's post-trial comments "I never tried to hide or wipe any evidence, and all of my data is accounted for, contrary to some stories being spread." with ZeniMax's post-trial comments at http://www.gameinformer.com/b/news/archive/2017/02/01/zenima... that " (vi) Carmack intentionally destroyed data on his computer after he got notice of this litigation and right after he researched on Google how to wipe a hard drive—and data on other Oculus computers and USB storage devices were similarly deleted (as determined by a court-appointed, independent expert in computer forensics); ... (viii) Carmack filed an affidavit which the court's expert said was false in denying the destruction of evidence; "

What is a reasonable explanation of this discrepancy? Varying notions of what consitutes "evidence"? Or differences in facts?

[ Parent | on HN ]

Re:John Carmack on expert witnesses and 'non literal' copying by zardo on Thursday February 02, 2017 @01:40PM (#13553161)

I wouldn't trust the testimony of a paid expert witness. They always have strong convictions in favor of the side paying the bill, even if the evidence available clearly can't support such absolute conclusions.

Even if they aren't just liars, the lawyers can just keep trying different 'experts' untill they get one who tells the story they want to hear. It's just cover for making an argument from authority.

[ Parent | on HN ]

Re:John Carmack on expert witnesses and 'non literal' copying by arca_vorago on Thursday February 02, 2017 @02:11PM (#13553502)

I did an advanced forensics course a few years back that was geared towards preparing me for court cases for the company I was working for. I quickly realized how easily "expert" witnesses could and most likely were being abused in the system just as you say. Expert shop till you get what you want.

That's not even mentioning the epic level of incompetence I saw among others. I'm talking about "forensic experts" who didn't know any filesystem other than NTFS, and even then if the tool didn't do it for them they didn't see it... At least I know if I ever end up defending myself I have plenty of inside knowledge on how to undermine the prosecutors arguments.

[ Parent | on HN ]

Re:John Carmack on expert witnesses and 'non literal' copying by Buttons840 on Thursday February 02, 2017 @01:55PM (#13553341)

"As an expert, I can definitely tell you that the people paying me are correct."

[ Parent | on HN ]

Re:John Carmack on expert witnesses and 'non literal' copying by jonknee on Thursday February 02, 2017 @01:43PM (#13553195)

> Carmack intentionally destroyed data on his computer after he got notice of this litigation and right after he researched on Google how to wipe a hard drive

Somehow I think John knows how to wipe a drive...

[ Parent | on HN ]

Re:John Carmack on expert witnesses and 'non literal' copying by Ygg2 on Thursday February 02, 2017 @02:00PM (#13553395)

Every dev knows how to wipe a drive. Buy an identical drive. Throw old drive into the incinerator.

[ Parent | on HN ]

Re:John Carmack on expert witnesses and 'non literal' copying by rasz_pl on Friday February 03, 2017 @02:33AM (#13558376)

Lack of history is a clue system was wiped or reinstalled from scratch.

Its very difficult to make windows appear to be an old actively used install. Encase (or new software, I havent done forensic for >6 years now) will tell you everything about timestamps and what that means.

[ Parent | on HN ]

Re:John Carmack on expert witnesses and 'non literal' copying by Ygg2 on Friday February 03, 2017 @09:46AM (#13560091)

I was joking. But honestly, if you don't your secrets to be found, you do have to go for extreme measures.

[ Parent | on HN ]

Re:John Carmack on expert witnesses and 'non literal' copying by rockdoe on Thursday February 02, 2017 @03:18PM (#13554230)

I didn't know this but I do now.

[ Parent | on HN ]

Re:John Carmack on expert witnesses and 'non literal' copying by r3xpi on Thursday February 02, 2017 @02:07PM (#13553463)

This is not a valid assumption. Shredding a drive to the extent that data recovery is not possible requires knowledge that, often times, revolves around the architecture of the drive in question (see: wear leveling).

An unrelated, yet illustrative, counter example is the seemingly reasonable, yet false, assumption that RMS performs his own installs of GNU/Linux.

[ Parent | on HN ]

Re:John Carmack on expert witnesses and 'non literal' copying by MrWhiz on Thursday February 02, 2017 @03:11PM (#13554155)

You mean the guy that once used thermite to break into a computer lab to impress boyhood friends? The guy that literally has a warehouse full of rocket fuel?

[ Parent | on HN ]

Re:John Carmack on expert witnesses and 'non literal' copying by mememachine on Thursday February 02, 2017 @01:29PM (#13553069)

It looks like either someones lying or wrong

[ Parent | on HN ]

Re:John Carmack on expert witnesses and 'non literal' copying by rsync on Thursday February 02, 2017 @05:11PM (#13555300)

"right after he researched on Google how to wipe a hard drive"

I find it difficult to believe that Carmack needs to google how to wipe a hard drive ...

[ Parent | on HN ]

Re:John Carmack on expert witnesses and 'non literal' copying by fulafel on Friday February 03, 2017 @01:29AM (#13558173)

The ATA security erase implementations in SSDs frequently lie, and few people know off the top of their heads what tools/procedure use to get to that command in the first place. Nobody knows how to issue this command or knows if this command works on their drive off the top of their heads.

(OTOH I have researched this issue a few times a year despite rarely personally applying the information, so this Google trail is hardly evidence about anything)

[ Parent | on HN ]

Re:John Carmack on expert witnesses and 'non literal' copying by rsync on Friday February 03, 2017 @12:53PM (#13561662)

"Nobody knows how to issue this command or knows if this command works on their drive off the top of their heads."

Sure they do.

You overwrite the drive with a known large file and then check the checksum of it.

It doesn't matter what kind of mumbo-jumbo the SSD is doing - it doesn't have phantom-double-capacity hiding in there ... if the (drive sized file) you wrote checksums out, you're done.

And if you're paranoid, do it a few times with different (drive-sized-files). Quick and easy and faster than googling anything.

[ Parent | on HN ]

Re:John Carmack on expert witnesses and 'non literal' copying by fulafel on Saturday February 04, 2017 @07:20AM (#13566729)

No. See eg. https://www.usenix.org/legacy/events/fast11/tech/full_papers...

[ Parent | on HN ]

Re:John Carmack on expert witnesses and 'non literal' copying by MaxfordAndSons on Thursday February 02, 2017 @01:46PM (#13553225)

Is it possible he wanted to protect other proprietary code from being exposed in discovery? I guess he could have tried to explain that, but that might still have constituted an admission of guilt anyway.

[ Parent | on HN ]

Re:John Carmack on expert witnesses and 'non literal' copying by gregw2 on Friday February 03, 2017 @05:31PM (#13563926)

New thought: maybe Carmack didn't wipe his own laptop, he let someone else do it? Both partys' statements would still be true if this were true.

[ Parent | on HN ]