I guess we could label this one as..how not to try and wipe or cover your tracks on a macbook harddrive.
During the Article 32 hearing, the prosecution, led by Captain Ashden Fine, presented 300,000 pages of documents in evidence, including chat logs and classified material. The court heard from two army investigators, Special Agent David Shaver, head of the digital forensics and research branch of the army's Computer Crime Investigative Unit (CCIU), and Mark Johnson, a digital forensics contractor from ManTech International, who works for the CCIU. They testified that they had found 100,000 State Department cables on a workplace computer Manning had used between November 2009 and May 2010; 400,000 military reports from Iraq and 91,000 from Afghanistan on an SD card found in his basement room in his aunt's home in Potomac, Maryland; and 10,000 cables on his personal MacBook Pro and storage devices that they said had not been passed to WikiLeaks because a file was corrupted. They also recovered 1415 pages of encrypted chats, in unallocated space on Manning's MacBook's hard drive, between Manning and someone believed to be Julian Assange. Two of the chat handles, which used the Berlin Chaos Computer Club's domain (ccc.de), were associated with the names Julian Assange and Nathaniel Frank.
Johnson said he found SSH logs on the MacBook that showed an SFTP connection, from an IP address that resolved to Manning's aunt's home, to a Swedish IP address with links to WikiLeaks. There was also a text file named "Readme" attached to the logs, a note apparently written by Manning to Assange, which called the Iraq and Afghan War logs "possibly one of the most significant documents of our time, removing the fog of war and revealing the true nature of 21st century asymmetric warfare." The investigators testified they had also recovered an exchange from May 2010 between Manning and Eric Schmiedl, a Boston mathematician, in which Manning said he was the source of the Baghdad helicopter attack ("Collateral Murder") video. Johnson said there had been two attempts to delete material from the MacBook. The operating system was re-installed in January 2010, and on or around January 31, 2010, an attempt was made to erase the hard drive by doing a "zero-fill," which involves overwriting material with zeroes. The material was overwritten only once, which meant it could be retrieved.