[vox-tech] Search Warrant Question re: GUID

[Alex Mandel]

Sounds to me like you should think about a GUID as a unique ID. In this
case it sounds like Gnutella assigns GUIDs to user accounts so it knows
who's who (mildly anonymously). My guess is that it's based on the user
account when they log in to Gnutella or it's assigned by the Gnutella
service to the IP on login.

Any program could have GUIDs as part of how it works, even my hard drive
have UUIDs to keep track of what partition is what. That doesn't mean
that there is some magic number that uniquely identifies your computer
to all who ask in the world. At least not in a way that wouldn't require
law enforcement to break the law to obtain it by hacking into your system.

Enjoy,
Alex

On 01/07/2011 12:26 PM, Bob Scofield wrote:
> I'm trying to understand the notion of a GUID as used in a search warrant for 
> child pornography.  In fact a GUID has nothing to do with the case in which 
> the defendant is charged with possessing child pornography.  The police 
> officer who drafted the warrant has a section discussing various high tech 
> issues that were not used in the case.  But I'm just trying to learn this 
> stuff.
> 
> Below is an excerpt from the warrant.  "CPS" refers to a software program used 
> by the police in child porn cases.
> 
> "CPS will also keep a record of each time an IP address is identified as being 
> a download candidate for suspected child pornography on the Gnutella network.  
> CPS also keeps record of each time a users GUID (Globally Unique Identifier a 
> special type of identifier used in software applications to provide a unique 
> reference number) is identified as being a download candidate for suspected 
> child pornography on the Gnutella network."
> 
> Later in the warrant we have this:
> 
> "An investigator, using the CPS software, can also generate a historical 
> report showing the dates and times that a specific GUID was logged on the 
> Gnutella network, the IP address used and the SHA 1 hash values of any 
> suspected child porn images or videos shared by that computer."
> 
> I've been Googling "GUID," and I see that there are various uses of GUIDs.  
> But it's not crystal clear to me how it works in child porn investigations.  
> Does it mean that a person's Limewire program has a unique GUID, that is 
> different from another copy of the Limewire program?  Or is it that the 
> person's version of Windows has a unique GUID that is different from mine?
> 
> Do Linux and open source programs have GUIDs, or is this just a Microsoft 
> thing?
> 
> Thank you.
> 
> Bob
> _______________________________________________
> vox-tech mailing list
> vox-tech at lists.lugod.org
> http://lists.lugod.org/mailman/listinfo/vox-tech