Re:Man Who Refused to Decrypt Hard Drives Still in Prison Af...
by wyager on Saturday September 02, 2017 @11:03AM
(#15156304)
Ding ding ding. This is the answer. I know OS X also stores hashes of at least some downloads for the purpose of checking certificates on downloaded apps and disk images.
This is clearly enough evidence to convict the guy, so I imagine they're holding him for some political reason (like generating jurisprudence for violating the 5th amendment in the future).
Re:Man Who Refused to Decrypt Hard Drives Still in Prison Af...
by geofft on Saturday September 02, 2017 @08:36PM
(#15159043)
I vaguely suspect they're holding him because they expect to get either a stronger conviction or more evidence for other cases from the contents of the external drive (e.g., maybe he's producing child porn or knows people who do).
> The Forensic examination also disclosed that Doe had downloaded thousands of files known by their “hash” values to be child pornography.[3] The files, however, were not on the Mac Pro, but instead had been stored on the encrypted external hard drives. Accordingly, the files themselves could not be accessed.
If he's downloading them or storing them by some content-addressable system (torrents, something rsync-like that generates hashes before syncing them, etc.), I can easily believe that there's forensic evidence on the internal hard drive that the files were copied, including the hash of the plaintext, but the files themselves aren't present in plaintext.