At the very least, the courts should forbid the police from looking at any file timestamped before March 18, 2010 As already pointed out timestamps can often b

At the very least, the courts should forbid the police from looking at any file timestamped before March 18, 2010 As already pointed out timestamps can often be a problem.Limiting searches to a specific timeframe is difficult because of how the forensic tools work. It's infeasible to tell the tool "only search files and data between these dates". Indeed I wish that was possible - it would make things much faster! But more importantly we are limited in what we can investigate. Not just for legal reasons but for cost as well. As a forensic examiner I feel (and I know most of my colleagues do as well) ethically obliged to stick to the requirements of the case - as tempting (for personal interest) as it is to poke into other corners of peoples lives it is entirely unethical and wrong.