Jamie posted a link to an article…
…
http//
I think it is a huge leap from "I found a software that deletes & changes time & date stamps, which I also happen to use" to "he intentionally deleted them.
I presume there is either more details we are missing (doctor disabled all function but this particular piece), or the FI is jumping to conclusions he is not qualified to make, in my opinion.
Software such as Windows washer have been around for quite some time now, I am probably not the only one who hates it when the press openly advertise what can only be seen as a success in destroying vital digital evidence. I know people can google for software like this but news papers and the other media should not provide names of the software in articles, it simply spoon feeds potential offenders with anti forensic methods
Software such as Windows washer have been around for quite some time now, I am probably not the only one who hates it when the press openly advertise what can only be seen as a success in destroying vital digital evidence. I know people can google for software like this but news papers and the other media should not provide names of the software in articles, it simply spoon feeds potential offenders with anti forensic methods
As I also said here - in a slightly different but related discussion
I still keep trying to convince every crime TV series writer not to include the part about where they use fingerprints to catch the bad guy… What if the criminals find out that that's one of the ways we can catch them…?!
[…]
People who really want to hide something would need to use more advanced tricks to completely erase all traces on all possible systems (and in reality almost always make a mistake or simply don't even use these tools (hey, we still catch criminals by using fingerprints, even though you can buy gloves for a couple of dollars and the use of fingerprints is more or less common knowledge)).
[…]
And to come back to the fingerprints example trying to hide our knowledge is just a poor effort of 'security by obscurity' - IMHO we won't prevent any crimes by doing that.
I am more worried about what seems to be a (as jhup already pointed out) a huge leap to a conclusion From "There is a tool on the system" to "He must have used this tool to delete evidence".
Better get rid of the household gloves in my kitchen, before I get accused of wiping off fingerprints…
I presume there is either more details we are missing (doctor disabled all function but this particular piece), or the FI is jumping to conclusions he is not qualified to make, in my opinion.
I am assuming the former, based upon a reading of all of the related links. The defense does not appear to be disputing even the assertion that the images were intentionally viewed/downloaded (affirmative defense), but, instead, is asserting that he had an alibi for the times and dates in question and that it must have been his girlfriend (who is defending him, strangely), or the fact that he shared floppies with other staff members.
Oh, except for the link that he followed looking for an old girlfriend named "Evie".
I assume that there are significant details missing from the story because the whole date-time alibi thing doesn't seem to make sense. I mean, if possession is the crime, what is the purpose of changing the dates and times to periods when you were supposedly not at the computer instead of simply deleting and wiping the evidence?