interesting:
code monkey was just called by his lawyer and told to stop looking at the images. something about hard drives being “stolen” from the office.
images aren’t hard drives though.
Forensic analysis is done on a mirror image of the original file. Hash tags are matched at the time to assure it is an exact duplicate.
This allows the forensic data to be presented in court as evidence in lieu of producing the original equipment and data.
It’s been a few years since I did forensic courtroom work on electronic data, but I doubt it has changed very much.
It is very evident that Dominion is very guilty of Spoliation of Evidence by deleting data.