I'm so glad you posted this. I've had to walk away for awhile to try to absorb this. BK's commentary made me very nervous and I was praying she just didn't understand.
In my mind I'm thinking BN has used his working copy to manipulate the data and even tried to erase the incinerator to hide the fact that he used it. How much more hinky could you get? But maybe that is just my mind trying to make this go away?
I have no idea if he tried to manipulate data for a reason or not, but the fact is that data was changed and therefore his work product means nothing. He may not have even been the person that used incinerator, but if he is the expert, why didn't he know and why didn't he do the work himself? But I will admit to being curious as to the reason they wanted to permanently delete files of any type on a working file. I'm not even sure he actually did a proper image copy, but if he did, why is it taking so long to make a copy of it?
I guess my question is, would BN be able to come to court and show, now, where this data is on the original copy? If he used his working copy to dig through the minutia and didn't add or delete anything I would think he should be able to prove it's on the original.
They will have to use Dworkin's image copy to show what happened in 2009, but yes whatever is there and how it compares to the 2008 version should be easy enough to find. Again, I think it's the difference in definition of "


", and no one cared about malware log files during the first trial. Doubt anyone on the jury will care in this phase either, if that's all they've got.
And when the state witness said there was




on the computer, was he referring the things the virus put on there or things that were actually sought out?
I think even Nurmi admitted toward the end of yesterday's testimony that it may just be from log files, with maybe one search or something. Neither would lead anyone that uses computers to see this as close to proof that TA had 


on his computer, much less tons of it.
Obviously, I just don't get it!