MyLowBandwidth
Well-Known Member
there not a single chance in hell that the digital evidence will be admissible i court.
specific protocols need to be observed in order to preserve forensic the integrity of any evidence.
that chain was broken from the very outset when the computer was removed.
the 1st thing to have been done, would have been the capture of "volatile data" contained within ram.
following that, the cloning of the hard drive - prior to the machine even being shut down.
the fact that the machine was moved prior to any of the above being done, and then a 3rd party having full access to any data contained on the drive, will have any half baked attorney having any digital evidence obtained in this manner ruled as inadmissible.
and then of course, the attorney will ask if the person who obtained the evidence being presented if they are qualified & accredited in the field of digital forensics - the answer in this case would be an obvious no.
Actually.... if it ever got to court, you'll probably end up with a moron for a judge who doesn't know the difference between a computer and calculator.