This question was motivated by this 2018 article by the Electronic Frontier Foundation that discusses the findings from the Mark Rettenmaier case.

For a bit of background on that case, this article at ocweekly.com explains

Rettenmaier is a prominent Orange County physician and surgeon who had no idea that a Nov. 1, 2011, trip to a Mission Viejo Best Buy would jeopardize his freedom and eventually raise concerns about, at a minimum, FBI competency or, at worst, corruption. Unable to boot his HP Pavilion desktop computer, he sought the assistance of the store’s Geek Squad. At the time, nobody knew the company’s repair technicians routinely searched customers’ devices for files that could earn them $500 windfalls as FBI informants. This case produced that national revelation.

The $500 payment to the Geek Squad employee is, according to EFF, shown in this document and on page 15 of this document.

I have no issues with authorities being alerted by Geek Squad if they find something suspicious in the course of their daily work. After all it is similar to me calling the police if I see someone trying to break into my neighbors house (I would just not expect to get a bonus payment for doing so).

The concern I have here is about payments and possibly other motivating factors (such as political) that may cause a technician to plant evidence on a user machine.

Are there any strategies (from technical perspective) that could be used to prove ones innocence against evidence planted on a customer's computer, or is that an unnecessary concern?

  • I believe that if a really effective answer to your question exists, and it covers most of the possible scenarios, it would be so complex to implement that in that case the owner of the computer would also have the knowledge to repair it – Felipe Pereira Sep 6 '19 at 3:04

There’s a bunch of discussion embedded in your question.

Personally I would never trust Geek Squad, but most people don’t have a viable option.

First of all, make sure you understand that you are handing over everything currently on your machine, most things recently deleted from your drive, and many back versions of things on your drive. Do you trust this information with whomever?

Ideally you have backups, but most people don’t and that’s why they are trying to get their machine fixed in the first place. If you can backup or “image” the drive first, great, but most people can’t do that. Even if you did, who’s to say it’s a real copy of what was provided?

The most practical thing you can do is record exactly when you hand over the machine for repair by obtaining a time stamped receipt. This is the most likely basis for any future legal challenge.

While it’s technically possible to plant evidence with consistent time stamps, realistically it’s more difficult to get it right than one might think.

Legal “Chain of evidence” becomes a very powerful argument for a good attorney, and a chain that runs through “Geek Squad” is less than ideal from a prosecution point of view. That said, the detailed forensic analysis of the "Time Line” is still a potentially powerful factor for both prosecution and defense.

The unfortunate reality when it comes to criminal system forensics is that the prosecution is well funded, but the defense is mostly on their own and public defenders are not funded to hire forensic resources.

| improve this answer | |

Take snapshots of the storage media and keep (secured) audit trails of new files added to the media.

In this particular case, a backup or image of the drive before sending it in for repair.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.