He made a crontab task to create a vastaamo.tar file from all of the files that had been randomly published so far. The mistake was that the command for creating the tarball was the wrong command and only worked accidentally in his tests because he was running the command from a specific directory.
tar cvf /var/www/html/vastaamo/vastaamo.tar . -C /var/www/html/vastaamo --exclude vastaamo.tar
Once he added the command to crontab, the command was executed from the root user's home directory and it created a 7.5 GB tarball before running out of space on the server two minutes later. The server didn't crash but started malfunctioning, as for example no logs could be written on disk. The police found that the maximum time that anyone was able to download the tarball was for 1 hour and 41 minutes before the TOR service had stopped responding.
The admin of the server logged back about 10 hours after the tarball was created and tried to figure out how many downloads of the tarball had been made, but because the server had no space left, there was really no way to get a realistic image of the situation.
The admin of the server logged back about 10 hours after the tarball was created and tried to figure out how many downloads of the tarball had been made, but because the server had no space left, there was really no way to get a realistic image of the situation.