I think it's a relatively weak correlation that the Trojan showed up the day before the images did. It seems likely that the Trojan downloaded them, but I wouldn't call that proof!
Couldn't they analyze the trojan, either by reverse-engineering it or by running it in a controlled environment, to prove "beyond a shadow of a doubt" that it was the Trojan and not Mr. Schofield who downloaded them?
I think it's a relatively weak correlation that the Trojan showed up the day before the images did. It seems likely that the Trojan downloaded them, but I wouldn't call that proof! Couldn't they analyze the trojan, either by reverse-engineering it or by running it in a controlled environment, to prove "beyond a shadow of a doubt" that it was the Trojan and not Mr. Schofield who downloaded them?