← All EvidenceDirectBrian Shaw — Direct Brian Shaw Timothy Howard
Digital Evidence
901
The screenshot displays the primary Marketplace server's authorized_keys file, including frosty@frosty and root/BCW entries and a March 26, 2013 modification date. Although Shaw initially described frosty@frosty as identifying the originating username and computer, he agreed on cross-examination that a key with that ending could be generated on any computer.
Also known as (1)
- FTK Imager screenshot of the primary Marketplace server's authorized_keys file, with frosty@frosty and root/BCW entries and a March 26, 2013 modification date
About
Howard compared the file's March 26, 2013 modification date with March 25 through March 27 server-related entries recovered from Ulbricht's computer; Shaw did not identify who changed the file.