>I think the key is going to be analyzing the contents of the SQL databases
>>14334637 pb
What do you need?
>How do we demonstrate that the data within are not fraudulent?
I appreciate your energy, but ultimately we do not. The forensic images prove what changed on the machine, together with the time of the change, proved in the forensic images, and access to the source hardware to confirm the forensic images are from that machine (hence the eeprom partitions) you have a crime/investigation. Yes there are deleted DBs but there is nothing that juicy in there, for example I was unable to find actual ballot images or anything like that (only focused on pres, there are heaps more elections in the dbs). The de-hardening and deleted dbs and logs are the info that needed to get out. The torrent was the most appropriate method to disseminate information of that size and type, no matter how hot the material is.
>How do we prove
Ultimately we don't. If I had my skills on the denial side you could not convince me without physical access to the machine the image came from. What you can do though is use this as probable cause for your SOS/State Legislature to inspect their own machines for similar evidence.