LivingonaPrayer
Student
- Joined
- Aug 30, 2011
- Messages
- 26
No need for anyone to enter. The file could be accessed through internet.
It was connected to a peer-to-peer file-sharing network and Stardust was in the shared folder. So anyone in the world in that network who downloaded Stardust in that period could download some part of it from Raffaele's computer thereby changing the timestamp of Last Access.
So you seriously thought that the police entered Raffaele's house before 02:47AM on Nov 6, while the pair were being questioned, in order to modify the time stamp of Stardust?
Well, if they had said at the beginning that "We were watching Stardust" then it would have some relevance.
They did not say anything like that.
Stardust came up only late, when their own experts found that they had no proof of computer usage and had no timestamps to support their alibi.
So they tried to make use of those files that had been created before Nov 1, had Last Access timestamps after Nov 1 and tried to recycle them claiming "Oh, now I remember, we were watching just these films, unfortunately the timestamps have been overwritten".
That's how the Stardust myth was created.
But even with this practice they could only find this one film.
The only credible finding was the Naruto 21:26 opening.
You are missing a major point here. When doing a forensic analysis of any computer you take a mirror copy of the hard drive you DON'T play around on the computer. This is the first thing any first year IT tech learns. Encase only examines 3 types of timestamps not 5
