The computers, the discs, the "damage", etc.
I think the Defense either doesn't know what they are looking at or are pretending not to know what they are looking at. Or, I guess there is the outside chance they are being misled.
Okay, let's start with the police seize the laptop computer. They do not open it and turn it on because they are trained NOT to EVER do that. The laptop is turned over to the LE Forensics Dept. A member of this department who is trained and very experienced in using the specialty forensic computer analysis program called "EnCase" removes the hard disk from the laptop. He (Menendez in this case) then places the hard disk into a special mechanical device that sort of looks like a largish DVR player. This device - which the police have purchased from EnCase - for many thousands of dollars - then proceeds to make a copy of everything that is on the hard disk. It does not just copy files and folders, it copies date and time stamps and file "signatures" regarding all of the actions of the operating system also. When the forensic examination is done, the examiner can see not only what files are on the computer, but they can also see when the file was created, when it was modified, and if applicable when it was deleted.
When the EnCase copied all of those files and signatures it wrote the copied files to a new disc in a very special, encrypted manner. And the files are encrypted in a manner that if anyone tries to change a file, that would show up.
This is called a "mirror disc" and the original mirror disc is not handed out for anyone to use. It is kept pristine. "Working copies" of it are used by the forensic examiners.
Most likely the original hard disc was put back into the laptop after the mirror copy was completed. And both the laptop and the original or master mirror disc are locked away for secure storage.
Now the examiners can use an Encase software program installed on any computer to look at the "actions" and the files. They can run searches by date, by "keyword(s)", by phrases, by any of a number of parameters. They do all of this using a "read only" working copy.
In this case, the Defense requested and was given the laptop with the original hard drive in it. No one knows exactly who has worked on it since then. Apparently the original defense team went to the Evidence room and looked at the computer. Martinez and Flores were in the room with them the whole time. Flores retrieved a compatible electric cord, plugged it in and turned it on, according to the Defense. If the hard disc was in it, it would have booted up at that time.
Surely the Prosecutors made another, updated mirror copy of the hard disc of this computer PRIOR to allowing it to get out of their custody a few months ago. To find out if any changed files show up, an EnCase format copy of the original hard disc as of NOW must be made and then compared to both the original mirror disc and any updated mirror discs. And the program will show all the dates and times of any file openings, closings, changes, etc.
The Defense is appearing to be deliberately obtuse in not sending the correct forensic information back to the Prosecutor's office. There is only one way in which a qualified, certified forensic computer analyst would handle the Prosecution's request. They would provide a current mirror image of the hard drive in the Encase format. Anyone who cannot or will not do this is no "professional".
The fact that the Defense has so far failed to do this will hopefully be noted by the Judge at tomorrow's hearing. She needs to order that the original hard drive, along with any and all mirror copies no matter when made or by whom, be immediately provided to an independent third party certified computer forensic analyst for review.
As long as the hard drive and the mirror images still exist, this can be figured out.
-------------------------------------
Personally, I am very suspicious of the Defense team. Are they delaying turning the correct information over to the Prosecutors while their so-called expert is attempting to cover his own tracks regarding changes to the original hard disk? What will come next, a fire at the office where the original hard disc is currently located?
That Judge needs to take control of the hard disc - NOW!
