Forensic Computer Problem

[chrissy451]

sfsdfsfsddfsfsdfsdfsfsfsfsfsfsfs

[cybercop]

We would have no idea as to why they would be asking questions about anything they found on the computer. We also would not know what they found.
Well let me rephrase, if the investigator happens to be a member of the forum, he/she might know but most likely wouldnt be able to answer.

I would recommend that you just answer their questions as best as you can. If the answer is "I don't know", then just tell them that you don't know.

I have no idea what the investigators would be looking for or what "Steve" has to do with it so guessing what they might have found would be nothing more than speculation and wild guessing.

[chrissy451]

tdfsfsfsddfsfsd

[cybercop]

And still don't have any idea as to what they may or may not have found.

If timestamps were changed, there are ways for them to discover and prove it.

Sounds like you really need to consult a lawyer.

[chrissy451]

.dd

[cybercop]

Yeah, you need a lawyer. They WILL be able to prove that. By the time they are done, they will be able to tell you what brand and model thumb drive you used and at exactly what time you transferred them.

It is fairly easy to prove timestamps have been modified, even when done on a different computer.

[chrissy451]

fdsfsdfsfsd

[cybercop]

Sent you an email.

[cybercop]

Wow, You tell a person that you have contacted the courts in the UK about their attempts to commit fraud and they go through and edit their posts and delete their gmail account thinking that it will eliminate the evidence. I guess they don't understand the concept of archives and how servers maintain their data. Not to mention the archives that I have.
Would have thought that my nickname would have been enough to prevent them from asking me to help in the fraud.

[Admin5]

Just incredible.