Gnomad » Wed Dec 14, 2022 3:25 am wrote:How could there be any independent forensic analysis, if the laptop had been in the hands of Rudy Giuliani before handing it to the authorities? It could no longer be considered evidence, because it has been in the hands of a person who has their own agenda regarding it. It is completely tarnished at that point and can no longer be considered evidence of anything -
I'm going to focus only on the above snippet; don't want to prolong this side-bar at length but it's worthwhile to have clarity on the above points.
- how did you determine that it's 'completely tarnished'? Is there formal information available on this? There is indeed a way to determine if the data on the hard drive was spoliated once handled by Guliani and/or those under his purview.
- who currently has custody of the hard drive? Assuming Guliani or those under his direction at some point transferred custody of the hard drive/computer to authorities, procedures would require transfer of custody documentation.
- once transfer of custody is documented and confirmed, the authorities that now have custody should have minimally generated a forensic image of the computer hard drive.
Once that hard drive image is generated, it can then be analyzed to determine if integrity of the data was compromised in any way, e.g., alteration of date metadata associated with electronic records or documents, any deletions or modifications to any documents/artifacts stored on the hard drive and WHEN such modifications alterations occurred (prior to or during Guliani's access, for example), etc. All of this should have been done as part of any formal investigation or legal matter, along with a full inventory listing of all recoverable contents stored on the hard drive -- as preliminary steps prior to any substantive analysis.
Any spoliation or alteration of data by Guliani or his team would constitute tampering of evidence and would generally involve sanctions or other penalties in any legal proceeding.
Unless you have information or knowledge -- via a linked source, etc -- that indicates ANY of the above steps were taken, you have NO way to know if indeed the data on the hard drive was spoliated (to use the legal term), or 'tarnished', as you put it.
Note: I have testified as an expert witness specific to these types of scenarios, so am not merely speculating here on standard procedure.