This whole hullabaloo about the hard drives is … uh … confusing?
I reviewed the DT expert’s testimony (Dworkin), and he went into great detail about using a mirrored/Encase file: It can be only opened using the Encase application; Encase prevents “writing over” data … and, after the investigation/reports are complete, he basically, “saves” his last version of the hard drive, then runs Encase for a “bit by bit” (microscopic, in computer terms) comparison between the “mirror” with which he started and the hard drive as it exists after his analysis. (Note: TA’s mirror was provided by the Mesa PD; mirror of JA ‘damaged’ (crunched) drive, was provided by a third party.)
This initial DT parsing was in the Fall of 2012. It’s important to note that he was directed to look at specific activity: Internet, photos, email, IM. He didn’t open internet files or photos except as directed by the DT.
Dial back about 3 years from Dworkin … In 2009 (approx. 1 year after TA’s laptop was found in TA’s office in ‘sleep’ mode) … Someone powered it up and Spybot did its thing (apparently) giving the appearance that “NOT-*advertiser censored*-but-Trojan” files had been erased/quarantined. Thinking this might have been an easy mistake, with the (then) DT demanding direct-view of all evidence. (Also hoping the State had made a mirror of the hard drive BEFORE this?) Don’t know.
Anyway, a little strange that ANYONE was allowed to power up TA’s drive outside of computer forensic SOP … if that happened.
Am I right so far? Heck if I know.
But the question is: If, after Dworkin’s analysis, the DT used a computer forensic professional … why can’t they (the DT) provide the end-of-analysis “mirror-check, bit-by-bit,” for which the State is asking?
Sorry it took me so long to get to my point!!! Blame Tony. 