content: Looks interesting... Why would forensics software ever need to write evidence rather than just extract it. Have you had a chance to see where all this function is being called? I wonder if it might just be left over to setup for functional tests or a similar less malicious perspective.