There is a common legal defense nicknamed "Some Other Dude Did It" or SODDI. Often, people on the stand can say their computer had malware or another person had their computer, and all in all, the case gets acquitted. Investigators even start their search and seizures with the wrong people because of mistakes about who did what, like on public Wi-Fi networks! This defense is particularly attractive in child pornography cases, despite it being extremely unlikely any malware would put images on someone's computer.
Usually the SODDI defense raises reasonable doubt, suggests that even if the accused *did* the act, it wasn't knowingly, and must prove there's actually malware on the device in question.
The prosecution can respond by proving the accused *are* in fact computer literate enough to have committed the offense, or at least knowledgeable enough to not simply allow malware to exist on their computer unbeknownst to them, punch holes in defense "facts" and alibi, and/or prove there was no malware on the suspected device in the first place.
If there really is malware, the prosecution has to explain exactly what that malware does, then prove with computer forensics that the malware didn't do what the defense claims it did.
If there is no malware, forensics can use wiping software and data backups on the device to see if there ever was.
From there it's a matter of explaining to a judge and/or jury all of the proof in a way they can understand.
Steel, C. (2014). Technical Soddi Defenses: The Trojan Horse Defense Revisited. Journal of Digital Forensics, Security and Law. https://doi.org/10.15394/jdfsl.2014.1192
SWAT Team Throws Flashbangs, Raids Wrong Home Due To Open WiFi Network – Infinite Unknown. (n.d.). Retrieved January 12, 2022, from https://infiniteunknown.net/2012/06/29/swat-team-throws-flashbangs-raids-wrong-home-due-to-open-wifi-network/
Brenner, S., Carrier, B., & Henninger, J. (2004). The Trojan Horse Defense in Cybercrime Cases. Santa Clara High Technology Law Journal, 21(1), 1. https://digitalcommons.law.scu.edu/chtlj/vol21/iss1/1/
