Computer forensics may or may not be an issue here. Chain of custody is a major concern and one way a piece of evidence (The Laptop) can be thrown out as far as any evidentiary/exculpatory evidence located on it no matter what any forensic evidence says... So go ahead and once agsin ask me about my 30+ years in law enforcement and as a District Attorney investigator where many cases have been lost, or thrown out by the lack of a clear and concise chain of custody to prove no one has tampered with anything regardless of what the forensics say. Forensics are only used to determine who may have placed what on the hard drive, where the computers trail shows it has been, which internet connections were used, whether access was done surreptitiously and when it was accessed or added to, nothing else.