Why would they do an evil maid attack on the Ubuntu laptop, but not at the same time on the Windows one? And is there any information that they accessed the Ub

Why would they do an evil maid attack on the Ubuntu laptop, but not at the same time on the Windows one? And is there any information that they accessed the Ubuntu laptop before he was arrested (to do the evil maid attack)? I see no mention of that. I think it's much more likely that it was a weak password, maybe even partially shared with other passwords. Maybe police obtained user passwords from other low value targets (online shops, ...), looked at them and noticed a pattern. > There are even files that had been deleted and emails that had been downloaded with Thunderbird (and then deleted). This doesn't mean much, unless user didn't know that when you delete a file it's content is not actually scrubbed from storage.