Couple of comments:
- There is no way to do data recovery without seeing the data fly past during the process. I’ve been in this business a long time and the file names and directory names I’m sure were a dead giveaway. At that point, it is illegal to NOT report it.
- Chances are, the guy deleted the illegal photos already in the past and thought they were gone, but the data recovery process unearths stuff like that, you can’t separate it and unless you know what you are doing, deleted doesn’t necessarily mean deleted.
- Secondly, I think he will skate. The evidence was not obtained legally and the search warrant for his home was based on that evidence as well.
- Lastly, never let anyone touch your private data who isn’t willing to sign a privacy/intellectual/non disclosure property agreement in advance. This is S.O.P. for us guys who do this stuff for a living.
You're proceeding on a flawed assumption. There was nothing illegal about how the initial evidence was obtained. He was paying them to recover data from the hard drive, which means they had to look through the contents of the drive to find what was deleted.
When files are deleted, the file table records are often the first things to be overwritten, so while the data still exists, there is nothing on the drive to point out where it is. When I am doing data recovery, I have scripts that will carve out files from the unallocated space on the hard drive based on file type. So if someone wants me to recover their vacation photos, I will run script to recover all JPG files. If it also recovers child porn, you can bet my first call is to the police, and you can bet the recovery of that evidence will stand up in court.
my kid bought a used laptop with a “clean” hard drive. How do I make sure it’s “clean”. Should I just get rid of the hard drive or do the “overwrite” clean of the hard drive and reinstall windows?
Can someone be “set up” by loading their hard drive with porn and then turning them in? Like a virus or trojan horse? My wife’s IE browser goes to auction sites, advertising for travel agency and other sites before going to her designated home page. Is that a “trojan horse” virus.
I had a hard drive crash over a year ago and went to a MacBook Pro, no viruses yet, but I don’t visit many web sites.