It’s too bad her Mac was wiped. It’s clear Tufts messed this up, and they should forgive her loans; it’s not clear she’s innocent.
We asked Jake Williams, a former NSA hacker who founded cybersecurity and digital forensics firm Rendition Infosec, to examine the metadata embedded in the photos. The photos, taken from her iPhone, contained a matching date and time for the alleged hack, as well as a set of coordinates putting her at the Mark Twain House.
While photo metadata can be modified, Williams said the signs he expected to see for metadata modification weren’t there. “There is no evidence that these were modified,” he said.
Assuming the person changed all data/time fields including those in the file system, what other signs of modification would there be? I poked around online and didn't find anything.
TFA says he looked at the [EXIF] metadata of the photos. There’s nothing in here to suggest a comprehensive forensic analysis of the cellphone itself (eg from a Cellebrite extraction). A phone is a treasure trove of SQLite databases.
This is so true. I've thought for a long time that a cool art experiment would be a blackbox with a lightning cable protruding out of it. You plug your phone in and answer "Do you trust this computer?" And if you do, those "SQLite databases" you mention get projected on the wall. A bit like the wall of sheep, I guess, but more for the purpose of educating people just how much data is actually on their phone.