Windows Forensics Cookbook

It was a virus / I was hacked

Sometimes, a defendant will move from one defense to another, in a kind of cascading avalanche of desperation. Lets stick with our example above. Having established that it must have been person A at the computer when the files were downloaded, they have now come up with a new defense: it still wasn't them because, although they were using the device, they didn't deliberately download the files. So either the machine must have a virus, or they might have been hacked.

In today's world it can be difficult to establish that a device had no viruses. Alongside the usual challenges with trying to prove a negative, investigators also come up against increasingly intelligent malware which can cover its tracks, overwrite ...