If you're given a suspect drive to analyse, and all you find is a large amount of what you suspect to be pirated movies (commercial cinema films, not IIOC)...
1) How do you go about establishing whether or not they are pirated? It would, as far as I know, be legal for someone to own a DVD and then save a digital copy of it. If all there are is video files with the name of the title of the movie, is there any way to identify them as 'pirated'?
2) At the end of the investigation, if you are satisfied that the content is pirated, would it be legal for you to return the drive to the suspect, or would you have to recommend that the drive be wiped before returning it in order to absolve yourself of any risk of distributing pirated content?
What is the reason you are looking at the drive?
If you're looking at it for drugs or money and come across a few movies, then fruit of the poison tree.
If it's an intellectual property case, pretty sure you are not allowed to burn even a copy you own of a movie to a pc. Or at least you can't convert/circumvent the security in place, legally.
If it's an intellectual property case, pretty sure you are not allowed to burn even a copy you own of a movie to a pc. Or at least you can't convert/circumvent the security in place, legally.
You can. You can even burn copies of a DVD/CD you legally own onto other discs, AS LONG as they are for your own personal use.
If you're given a suspect drive to analyse,...
2) At the end of the investigation, ... would it be legal for you to return the drive to the suspect, or would you have to recommend that the drive be wiped ...
Write a report as to the result of your analysis.
You should be done at that point. I have a hard time envisioning an operational environment where the analyst passes judgment on evidence custody.
which is your position? LE consultant o for the lawyer?
In my country the LE consultant can't destroy evidence!