Re:John Carmack on expert witnesses and 'non literal' copying
by Ygg2 on Thursday February 02, 2017 @02:00PM
(#13553395)
Every dev knows how to wipe a drive. Buy an identical drive. Throw old drive into the incinerator.
[ Parent
| on HN ]
Re:John Carmack on expert witnesses and 'non literal' copying
by rasz_pl on Friday February 03, 2017 @02:33AM
(#13558376)
Lack of history is a clue system was wiped or reinstalled from scratch.
Its very difficult to make windows appear to be an old actively used install. Encase (or new software, I havent done forensic for >6 years now) will tell you everything about timestamps and what that means.