What am I missing?

[Robert J. Hansen]

> What am I missing in this whole case?

As I might someday want to work in the field of digital forensics again,
I'm going to keep my mouth shut about this specific case.  But speaking
generally ...

Bruce Schneier is fond of saying that experience in breaking ciphers is
necessary before someone can write a good cipher.  The same applies to
forensics: without a background in how forensicists actually work, you
don't have good odds of figuring out how forensicists have recovered data.