Comment My thoughts (Score 1) 616
He doesn't suggest that the hard drive has been altered or tampered with. Perhaps you can think of some questions that followup on this point.
He says that he examined a "disk image". Does he have an audit trail?
He makes no mention of the MAC address used to connect Ms. Lindors' computer to the network. Does the MAC address on the HDD match the MAC address on the NIC?
