Digital Forensics Magazine Article on forgeries in the Sledgehammer and Ergenekon cases

In the Digital Forensics Magazine, computer forensics expert Mark Spencer writes about how he and his team at Arsenal discovered tampering of the digital evidence in the Sledgehammer (hard drive no.5) and Ergenekon (Çağdaş Yaşamı Destekleme Derneği (ÇYDD) hard drive) cases.

Focusing on the ÇYDD hard drive and applying “relative anchor times” analysis, Spencer shows that once after the system was shut down, the hard drive was connected as a “slave” to another computer (whose system clock was backdated), from which the documents were copied to it.

You can read the article here.

(You can see Arsenal’s forensic reports on hard drive no.5 here, and on ÇYDD hard drive here.)