It's not overly clear, but it looks from one of your statements that this is a work PC -
I am basically trying to prove that poker was played on this PC - doesn't matter whether it was during working hours or not, as this computer shouldn't have been used for that no matter what.
Any chance of firewall logs during the day ?
As well as firewall logs try any proxy or Internet gateway logs
1. He has no experience at all in forensics.
2. He has booted the system, poked around and apparently installed software directly on the suspect's computer.
3. He has admitted he's biased and just looking to prove someone guilty.
4. He probably hasn't been documenting his actions and mistakes.
5. He probably has no chain of custody.
If the above is true then maybe he could confront the suspect with "evidence" and get a confession, but aside from that, isn't the investigation most likely ruined?