The following is from the church discipline blog:
http://church-discipline.blogspot.com/2011/01/evidence-and-very-unlikely.html
From the Massei report: "Encase forensic analysis software determined, for such time period, that the only files created (last created) or written (last written) were generated, automatically, either by the computer’s operating system or the Firefox web-browser within its own cache: being files generated at regular intervals."
From Church Discipline: "I'm going to get a bit techie for this paragraph, explain how this is total nonsense, feel free to skip it as just an example. I'd like you if you are on a mac or a linux box to open up a terminal right now and type the phrase man touch. If you are stuck on a windows box here is what you would have seen link. Touch is a program designed to change timestamps because it is such a common activity. Changing those dates are standard Unix activities, I have tons of scripts that modify those dates to things other than their defaults that run on my machine; for example when I push data to the TIVO I script changes to mtime so that it sorts the way I want it on my TV. Mac's internally have 5 timestamps they associate with files: createDate, contentModDate, attributeModDate, accessDate and backupDate. accessDate implements atime, attributeModDate implements ctime and contentModDate implements mtime. The fsCatalogInfo attribute for a file in objective-C (the default language for system's programming on an Apple) has those five as variables (i.e. for example fsCatalogInfo.createDate), which is to say this is not some deeply hidden attribute, Apple invested money in making these timestamps alterable because programs need to do that so frequently. Other than those 5 attributes there is no obvious place any time information is stored. You can in 3 seconds have a file on your mac that was last modified 10 years before you owned the computer, heck before it was created as far as the filesystem is concerned. And there is no secondary record of these changes. With an average user timestamps are obviously good evidence. By definition average users are people who think about how to work their computer not how their computer works. But Raffaele is a computer science graduate who is doing a degree in genetic programming, he's spending all day thinking abut how computers work. For him, the timestamp mean nothing more than the times he choose to assign to files. He's probably 10x the programmer I am, I'm way over the hill he's in his prime. If this were Amanda's computer I'd think "determined that the only files created" was too strong I'd weaken it to something like "indicates that most likely the only files created". For Raffaele's I'd say "a weak easily modifiable record which at the time of analysis showed..." is a fair characterization."
I'm curious about what CD said above and wonder if his point is valid but I lack the technical knowledge. Anyone here know more than I do?