Pages 3-6 detail the VM. Basically, they found a VM on his computer that was encrypted, with an encrypted file in it, that they unlocked with a password they found on his phone. In the encrypted (truecrypt) file, they found a large amount of what was unmistakenly CP. When they examined the file system, their claim is that there was evidence of a history of using that VM and moving those files around, etc., so it's not like they just appeared one day. Partial files that weren't deleted yet, caches, inode meta data, that sort of thing.
I mean, it's possible to fake, but it would be incredibly easy to fuck that up, and incredibly risky to get caught doing that. If they really wanted to make his life hell, there are easier, less risky, and even legal ways to do it without going to the effort to fabricate 8 years of computer usage that would withstand expert cross examination.
>I mean, it's possible to fake, but it would be incredibly easy to fuck that up, and incredibly risky to get caught doing that.
Maybe, but how hard would it be to convince a tech-illiterate jury of that? Is there a lawyer on earth that could explain the minutiae of metadata on virtual machines to one? And if they get caught, they go "oops!" and pay out a few million dollars as a sorry, at best.
