I have some comments about JW's response:
First, she either doesn't understand what a damaged hard drive is, or she's playing it that way in hopes that JSS won't know the difference between a hard drive and a connector with bent pins.
She then goes on to confuse the issues re: the State's request for an image copy as of the day defense rec'd the computer in 2014 to the copy the State made in 2008. She says he obviously didn't need another image copy, since JM later said they had gone back and analyzed their original copy. His original 2008 copy would not show the damage they claim was done in 2009, thus the need for a later dated one, and one they should have been able to furnish. It's their allegation, and their need to provide proof - I suspect she knows the difference.
She admits they sent the wrong file originally, but somehow blames "FTK software" for "grabbing the wrong drive". How exactly does software "grab" the wrong drive to turn over? This is ridiculous!
She then says the State had all this time to make one, but if they were unaware of these supposed 2009 changes, why would they do that? There would be no need. Both State & defense forensic examiners (that knew what they were doing) testified to what was on the 2008 copy, and both agreed there was no evidence of *advertiser censored* then. Again, you claim all this was done in 2009 - it's your allegations of wrong doing to prove, JW.
She then says there is nothing wrong with the 2nd copy they sent over and that they are appalled that the State doesn't know how to read what they sent...um, what exactly was sent and are we supposed to think State forensics wouldn't be able to read a real image copy? She says it's a clone, but not an untouched image - so what is it exactly? It's not a forensic image copy as protocol requires, but that's the State's problem, how? A clone is used basically to restore a drive to a existing state. It's for backup if your computer goes out, it's not what is required in forensic computer work and anyone familiar with those requirements would know that. I know she mentioned FTK software (above), but I have my suspicions (below) that neither FTK or Encase software with a write block was used, but either one would have done the job.
If you notice the picture of the pin damage, they included some interesting information:
Name: DSC09743.jpg
Item(?) type: FarStone.JPG File
Folder path E:/ARIAS MESA PD
Date created 8/26/2014 2:02PM (hard to read the day and could be 25th - but if it is it's @ a later time than when modified)
Date modified 8/25/2014 10:49AM (on the pdf, the font or size of the lettering here looks a little different to me, but could be the angle or something?)
The first thing I noticed was that the created date is after the modified date - unless I just need a new prescription and am reading this wrong. How can you modify a file before it's created? Also, I thought they didn't get this until late Sept or so?
Next was the "Item type": FarStone, which meant nothing to me, so I hit Google only to find a company that sells cloning/backup software that is basically for consumers and small businesses. It's products get good consumer reviews for inexpensive cloning or backup type software, but it's certainly not something a professional forensic person would use. Who might buy a copy of something like this? Maybe a private investigator, who in trying to provide what JA said was there, somehow screwed up the contents of the HD so badly that it can't be read again. Who knows what was furnished to the State, but JW's feigned surprise that the State couldn't read whatever they sent to them reads a little false after seeing "FarStone" on that pic. I notice the BBM on one of their product descriptions:
If this is indeed what their "expert" used, who knows what they had to 'analyze' and how it compared to the 2008 image copy?
All just my 2cents ...
