I didn't say all expert witnesses are good nor did I claim they are all used in good faith.

Merely that, unlike in the invented scenario above, statistical differences in the random garbage that gets written to a disk across different tool or OS versions has been successfully used to place a time window on when exactly someone destroyed evidence.

I heard one argue that "zooming" on an image by adding pixels with an algorithm is normal, and he's had such "evidence" used in court before. I was a little horrified as someone who has worked on digital forensic software at a former employer. Adding pixels to an image is not evidence, you're fabricating something out of thin air, especially if its drastically smaller, its even more likely to be BS.