Yes, that's what they do on TV shows. But it is NOT what is done in real life. The target hard disk would be imaged by using a special forensic transfer device that costs thousands of dollars. These devices create a byte-by-byte mirror image of the target hard drive, including all hidden files, files in unallocated spaces, etc. In addition to capturing the data from the target hard disk, when the "capture machine" writes the captured data for later examination by a forensic expert, it writes it in a specially encrypted manner. This specialized encryption of the data would then prevent any data from being altered without such an alteration showing up.
EVERYTHING I have read has stated that no one has ever beaten these types of encryption programs.
Which leads to: Why has there been such an extraordinary amount of foot dragging on the turning over by the Defense Team of the CDs they used to find all of these purported *advertiser censored* files. This expert keeps repeating his mantra of "There are lots of *advertiser censored* files and I know more about computers than you do".
He probably is right that he knows more about computers than JM does. So what? It is not JM's job to be a computer expert. But it IS his job to hire someone who knows as much or more than BN to examine the discs used by BN. And JM was smart enough to get the judge to require BN to turn over ALL discs he used, even his "working copy, which you would not understand".
Folks, while most of us are not "computer experts" or "forensic computer experts", there are plenty of people nowadays out there who are. And the thing about a hard disk or a mirror image of a hard disk is that there is a finite amount of information on it. Period.
It is a matter of understanding the operating system and being educated as to how and where that particular operating system stores data. Any so-called "volatile information" such as what was stored in the RAM (random access memory) is long gone, what with the number of times the original computer with the target hard disk was turned on and off.
Depending on the amount of RAM and the size of the original hard disk, there could possibly have been some "spillage" of data onto the hard drive. COULD have been. And if there was, it would have been captured when the original mirror image was made.
Could both the State computer expert and the Defense's Mr. Dworkin have both missed something like this? Well, anything is possible, I guess.
All JM needs to do is obtain ALL discs used by this latest "Defense expert" and hire someone who knows more than he does. I'd suggest he contact Carnegie Mellon University in Pittsburgh, PA. This is where the people who are writing the codes for these forensic programs often come from.
For those who want to learn a bit more about forensic examination of hard drives, etc this is a very good read. Some of it is basic and some more technical. But even for those of us who don't know all that much, it is worthwhile to plow through it:
https://resources.sei.cmu.edu/asset_files/Handbook/2005_002_001_14429.pdf