Regarding this, has been underlined that according to the report "last accessed files", attached to the report dated 19 November, results that the VLC program has been activated at 6:27 PM. This has to be considered very meaningful when related to the use of a clone of the hard disk and of the same examined file and not of a file having same extension. From 6:27 PM to 9:10 PM ,therefore, the system has interacted with the files, imagining that suspensions of the vision of the film had took place, provided that the last interaction has took place at 9:10 PM. It is restated that in the period of time between 9:10 PM and the 5:32 AM it does not result any human interaction. In fact the only created files, written the last time, of which the Encase program has given proof are 4 files attested in the cache of the Firefox browser and 2 files generated by the operating system. But these are files automatically generated by the system, precisely by the Firefox navigation browser: in fact they are files that are characterized for the fact that they are generated with regular frequency, at a distance of 30 seconds from one another. In case of electronic navigation, it would have been observed references to we addresses with relative components. With regard to the interruption, in some cases, of the regular frequency of updates, is adduced with more than convincing precision that inside Fastweb log files the traffic towards Google turns out to be regularly generated with a frequency of 30 minutes, this proves that the machine has been always on and that the PC has maintained the browser opened. With the same perspective it is added that the interruption of the continuity is found in the data related to the Firefox cache, since "this are components for the functionality of the web-browser application, they are not rewritten on the cache if already downloaded during the previous update". Practically the update appears only when the system recognizes that the machine is not equipped with it, while if there is nothing new, and only appears the traffic generated between computer and server, but without writing on the memory, in particular on the Firefox cache. [end p 30] with regard to the fact that the combination between operating system and the Mozilla Firefox program would have created a block to the Encase software, beyond the fact that the defense advisers had ignored that the system is not actually in commerce, it is assumed that using the same version of the software (Encase 6,8, updated to version 6.7 after the carried out operations) it was possible to generate the Internet history, whose examination has not allowed to find any navigation. The examination of such Internet history had been allowed by the analysis of the log files provided by Fastweb: the search of IP addresses related to systems able to supply web pages, e-mail, ports related to communication services, has produced negative outcomes : the regular frequency and the scarceness of the exchanges bytes, related to the port 80, allows to attribute such traffic to activities of functional and/or informative updates . With regard to the fact that two of the three files of which it had been finished the download had been manually cancelled after the 9:28, period of time to which corresponds the last download, it is deducted that that does not imply at all that the cancellation had happened before, being actually possible that, instead, it happened before the computer content would be analyzed, that is before the seizure, executed some days later. The further observations of the defense advisers provided during the review hearing seem to shape a merely cosmetic reply, practically resulting in a repetition of the already rejected arguments.