Thank you. I have mentioned my reasons that look reasonable for me to believe that the forensic image is altered. Once I rise my suspicions, I think there is a burden of proof (that the image is not altered) on the local forensic company as well because (i). it failed to meet the court given deadlines by several months (ii). there are weaknesses in Encase and (iii). I have dispute with the person who really collected the forensic image from my computer (iv). I have no chance to look at a copy of that image. (v). the local company lied in the past that I never submitted the computer: the forensic image is in the lier�s hand.
Finally, my computer has no incriminating evidence in it but my goal is to stop this forensic image to be used as a witness so that the plaintiff reaches a dead end.
Have your attorney guide you, leventhal, because everything you mention above (including possible bias by an examiner) has to be introduced carefully and with good support.
The forensic examiner will have documents to show the process used to retrieve the data from your computer and will testify to its authenticity and reliability. Your attorney will need to find flaws in the examination of your computer (the process, the results), in the examiner's testimony (looking into his qualifications, his testimony in past cases) and in the documents presented by the examiner used to support the examination and his testimony. Your attorney will want to argue that the computer evidence should be given no weight or little weight due to the pointed-out flaws (if any) and your attorney will probably suggest having an expert or experts of your own as counterbalance.
I strongly advise that you do not make any
public claims about the local company or its workers. Save discussion of this for talks with your lawyer. You already have enough to handle with the one action filed against you. You do not want to defame the local forensics company by making false statements about it or those who work for the company. You could find yourself facing another lawsuit if you do.
Your situation is complicated in several ways. You did not have your own forensics expert examine your computer prior to its destruction, and you apparently do not have your own forensics expert now, so you have little to use in your defense to show there were modifications or alterations made to your computer contents.
If you attempt to challenge any data that was retrieved from your computer, the fact that you no longer have your computer can be used by the plaintiffs to show spoliation of evidence. This can potentially lead to sanctions. Parties have lost their cases on spoliation of evidence alone. Whether the loss of your computer will be a factor in your case, after the computer has already been examined, is a question mark but it needs to be considered.
The bottom line is that you need good support for any claims you make. And, apparently, you need a lot of good luck.
