Depends on the crime doesn't it?
What is the malware being blamed for?A remote access trojan isn't going to open IE and leave browser artifacts is it? No, but a perv would.
A remote access trojan wouldn't, but one of those redirecting pieces of spyware could- IE would accept the cookies and history as if the client was doing the clicking. That's the argument that Julie Amero's defense counsel should have used
.
A remote access trojan wouldn't install kazaa and start downloading unlicensed software would it? No, but half the country is.
But a warez trader might compromise a machine to host files. The evidence of P2P software and use might not be there, but the warez would be there. It would take some good work on the expert witness for the defense on that one to show it.
I bet the lawyers are gonna love this.
Most of them don't get the basics. A few of us do get the distinctions, and we're either going to sharpen or blur them, depending on what's best for our client.
Smart investigators will use multiple approaches to prove the same facts.
One case I worked on, the lead detective got the defendant to initial every page of the chat logs. Even if I could show evidence of malware that _could_ control the defendant's PC, it's not going to fly- the defendant has admitted to the crime.