You just know it's because, if you just made a new zero-byte file, the opposition in the case would claim that you forged the file and that the evidence was then tainted. Stupid, but your goal here isn't to reproduce the file, it's to stop a stupid argument from convincing stupid people to make a stupid decision.

> your goal...[is] to stop a stupid argument from convincing stupid people to make a stupid decision.

This is the best explanation of legal practice I have ever seen.

But... to be sent, the file is recreated a bunch of times right? Because a computer only ever copies, and never “moves”, right? How can it then possibly matter whether the 0b file was recreated by a computer from the instruction of copying the file (which then just turns into an instruction to create the file), or if it was created directly through instructing the computer to create the file?

Gah, something something colored bits. http://ansuz.sooke.bc.ca/entry/23

Computers do "move" files, in some cases, by updating the entry in the filesystem registry. In such a case, it might be that no change was made to the file on disk, so no copy was made at all.

I interpreted "provide a set of files for a court case" as some form of sending it either through the Internet or to some portable storage media. He also said "The client insisted we find and copy the original empty file from the original media", which also indicates that. I therefore intended "move" to mean "move from one storage media/computer to another". You're of course correct that if you "move" a file on one file system, the bits won't actually be copied (or moved) anywhere.

Sure, no argument. I was responding only to the "computer only ever copies" statement. Sometimes it's hard to know how literal someone is being. :)

It's like homeopathic copying: A zero byte string can contain trace amounts of the original.

You wanted to provide a zero-byte file of the wrong colour. Unlike in physical reality, in legal world it strongly matters what colors are your bits (or in this case, what color is the lack of them).

http://ansuz.sooke.bc.ca/entry/23

Not a wholly insane request if they were interested in the file metadata as much as the file data.

You might think, but metadata travels separately from the actual file, so that wasn't a factor.

Depending on how it's copied, they can be preserved.

Well, I can see the point of leaving a trail that shows you aren't fraudulently claiming the file is zero bytes. Otherwise, it's just your word.

Yeah, if they didn't find a copy on the backup/original media to confirm it's zero bytes, then really all they've provided is their assumption that it's zero bytes.

I'm no lawyer, but the testimony of the IT guy (and associated reasoning/etc) seems like a totally different kind of evidence than a true and accurate copy of a file from an original medium. And having the IT guy testifying seems like way more of a pain than just making him find the file.