That's a point.
The prosecution would still have to show it wasn't related to a rootkit or spam for me to start overcoming reasonable doubt, though. I'd be thinking of that teacher up in New England.
That wouldn't be too hard for a reasonably proficient examiner to prove. The detective in the teacher case was an incompetent idiot, and almost anyone in the business could tell that just from reading the news stories.