Dr. Nicolas Dubin Caught by the FBI

Post Reply New Topic

This much is true.
The areas previously used for storing an image are made available for use once it gets deleted. They simply contribute to the free space on the drive and are generally available for other files; until they're reused or specially treated (below) the original data remains.

But this is not.
Once data has been overwritten with something else, what was originally there is lost.
There are no successive "layers" of data; to realise this would require a drive of infinite capacity - or at least some specification of the number of layers a drive supports, yet there are none.

Also, so-called "bit-bleachers" are available where, instead of deleting a file, those areas of the disk used by it are overwritten with zeros or random numbers before finally renaming the file to something meaningless and deleting it.
That way the only remaining data associated with the "deleted" file is rendered useless.

However, (and excluding bit-bleaching) even though a deleted file can have some of it overwritten there could still be sections that weren't yet overwritten and that may be enough to show what the original undeleted image was.

Seems you're referring to the network interface MAC address - but it's not "unique in the world" and possibly not even unique in a country. It can also be spoofed as a totally fictitious number.
See, among many others: https://www.howtogeek.com/228286/how-is ... -enforced/

But this, even if it's not unique, could still be used to identify the device using it and that, along with whole or fragments of "deleted" images, the IP and certain ISP data, could be enough to reliably confirm that device's involvement with CP.
Spoofing the MAC would make this next to impossible to achieve since there's nothing permanent about the spoofed MAC - it could be anything at any time.

And this all doesn't even touch VPN services that keep no logs...

Unfortunately, law enforcement agencies, at least here in the U.S.A., tend to be a bit behind the times regarding technology. Also they tend not to prioritize forensic science anywhere near as highly as they should. They prefer to rely, much more than they should, on old-fashioned interrogations -- despite the risk of false confessions.

(All of the above is contrary to the public image that law enforcement agencies like to project, of course.)


In general I favor harm reduction, but I'm not sure why you brought this up. How do you apply the concept of harm reduction to this issue?


I agree that there should be safe, adult (in both content and viewership) porn sites. The problem is that, until just last year, Pornhub was nowhere near careful enough to keep under-age porn and nonconsensual porn (e.g. revenge porn) off their site. Illegal material was apparently NOT just an occasional "rare incident," alas. (See various articles linked here and here.)

I know there are technical ways the guilty try to cover their tracks.

My post was just to illustrate the fact the the innocent have little to fear from this kind of thing.

The cops are usually able to recover deleted files on a hard drive and confirm a device was not used in a crime if an IP is flagged.

You have a lot more faith in the technical competence (and honesty!) of law enforcement agencies than I do.

As any defense lawyer can tell you, innocent people do indeed have a lot to fear from the police -- and not just on this matter in particular.