Hi all, I have a bad justice deception scenario… namely;
We have a malicious examiner ,a innocent suspact and an evidence (hard disk)
event 1
examiner take evidence and give original evidence image(E.01) to suspact.(not give image hash number, only image)
event 2
suspact is investigate on image and find some important proofs for himself.
event 3
malicious examiner is restore image(in original hard disk ), and delete some folders, add files, later constitute new image.
event 4
suspact is protest to exmainer report but examiner say "my image is original and suspect is
changing real image."
This story is probable? If probable suspact what to do? (technical)
Thanks…
S
Story is possible.
Suspect should hire own professional forensic investigator to demonstrate event 2 & event 3.
Suspect should hire own professional forensic investigator to demonstrate event 2 & event 3.
Agreed. This not the kind of investigation that a suspect (or friend) would want to undertake himself. For one thing, there is the issue of both bias and evidence tampering.
Get a professional.
Thanks for answers. I understand it is dangerous state…
Good luck.
By the way, this was posted to the wrong thread.