Mark Spencer
2026
Unraveling an Alleged Military Coup with a Broken Worm
As President of Arsenal Consulting, Mark Spencer was well into writing a book focused on high-profile criminal cases involving electronic evidence tampering when he decided to take a fresh look at a hard drive containing documents related to an alleged military coup which led to hundreds of arrests. Mark’s directive to his team was to apply what they had learned (and built) in the 13+ years since they last analyzed the drive. The result was stunning - in addition to a previously known backdated session during which forged documents were delivered to the hard drive by an attacker, six more backdated sessions were identified thanks to advanced analysis and a worm that failed in a very unique way when the drive was connected not to its own computer, but an attacker’s computer.
About Mark Spencer
Mark Spencer is President of Arsenal Consulting, where he leads engagements involving digital forensics for law firms, corporations, and government agencies. Mark is also President of Arsenal Recon, where he guides development of digital forensics tools. He has more than 25 years of law-enforcement and private-sector digital forensics experience. He has led the Arsenal team on many high-profile and high-stakes cases, from allegations of intellectual-property theft and evidence spoliation to support of terrorist organizations and military coup plotting. Mark has testified in cases which include United States v. Mehanna and United States v. Tsarnaev.
