Yes this stood out to me too. I don't really understand why a warrant would enable alteration. Copying I can wrap my head around, but alteration without oversight seems awful. Hopefully the warrant has more fine print than the journalist implied.
Perhaps they had a ruling in the past that during accessing a computer, things got changed, like the logs. And so now they have to have that in the warrant so that they don't lose their case.
This wasn’t a forensic extraction of data from a recovered hard drive, it was a drag net across email server, file servers, content management systems, wikis, phone records, written notes … basically every form of communication that left any trace.
The ABC staff literally copied all the stuff that might be interesting (found using keyword searches) into a folder, which the ABC legal and AFP investigators went through one by one to determine what was of interest to AFP. The items of interest was then copied to a “sealed” package which the AFP pinky swears nobody will look at for two weeks while the ABC seeks an injunction.
Probably legal completeness. Think about it, log in to a windows computer there is probably an event log that gets updated. While checking browser history the history may be altered. Installing surveillance applications would modify the machine. Etc.
