Windows Forensics Cookbook

It wasn't me

One of the most difficult challenges to deal with in digital forensic investigations is the defense that someone else must have been using a device when a crime or other nefarious activity occurred. It is a favorite among defendants around the world.

It is almost always impossible to definitively prove that a specific individual was the one using a particular device at a given time. However, in most courts of law and certainly in civil cases, all the investigator is required to do is demonstrate that this is the case beyond reasonable doubt. Sure, someone else could have broken into the defendants house, guessed their password, and downloaded some indecent images of children onto their machine when they were out shopping for ...