JeffM wrote:
"Touch" utilities have been around since the dawn of computing
and can alter the file dates at will.

Anyone who can use a search engine can find a bootable disk image/USB stick
image of disk utilites that let you read all sorts of disks, in all sorts
of condition. They allow you to look at files without setting access flags
and dates, etc.

Someone mentioned using Acronis True Image to image a disk, that leaves
no records and then if you were to make the image onto a permanent medium,
such as a DVD, you can then make a copy of the file off of the image and no
record is made on the image of the access.


The repair person having possession of the computer
queers the chain of custody.
If I was on a jury hearing this, I'd consider the whole case suspect.

What chain of custody? This is not an episode of CSI, my giving you a computer
to fix, and having a recipt for the the computer or a repair is not a chain
of custody. It's evidence that you had it and I did not. Evidence is not
proof and it's certainly not any evidence that once I gave it to you, you kept
control of it.

Yet another unethical snooper.

That I agree.

Geoff.

--
Geoffrey S. Mendelson N3OWJ/4X1GM
Those who cannot remember the past are condemned to misquote it.