|
|
|
|
|
by falcolas
5477 days ago
|
|
I think it's always important to remember that the first order of business in a raid is to preserve evidence against deletion or modification. This means that their first task is to remove the hardware from anybody's hands but theirs. At which point they can peruse the data as they are able. Why did they take an entire rack, instead of a few servers? I can think of a couple of potential reasons.
- VM's, which could potentially live on any physical server in a VM pool
- Insufficient information on which physical servers belong to their suspects
- They just don't trust the colo operators to not be involved, and thus limit the suspect data to the servers they provide. While I wholly agree that it's unfortunate that Instapaper and Pinboard were affected, it's not an unexpected consequence of having your servers alongside (or on the same physical machines) of people you don't know. |
|