quote:
He is being accused of Unauthorized Use of Technology. They are saying numerous files were moved or had permission changes. They couldn't prove it was actually him but said forensic evidence showed it was his login that made these changes.

They can prove it was his login, absolutely, presuming they use AD (which I cannot imagine they don't). Of course you could take them to court and demand they show said evidence.

Now the other thing it can prove is WHEN it occurred and from which device or IP. Are the systems accessible outside of their network? Do the students have access from outside the network? I would guess the second one is "no". If so, can he prove that he was not on a computer at the time (like if it occurred when a teacher can verify he wasn't in front of a computer)? Then, as someone above has already stated, then he might be more in trouble for password sharing. This presumes, of course, that he simply didn't use a password that was easy to guess (like his girlfriend's name and the year she was born or something).

There's more evidence than just the logon name. I'd ask for the date and time the files were moved and the corresponding logon information (computer name and physical location of the computer).

That being said, there's this:

quote:
My Son says the was supposed to be in that folder because of an assignment in another class

This implies your son was definitely in the folder. In all honesty, he shouldn't have been able to make ANY changes to the files. Why his account was granted that level of access to a folder is beyond me - that's definitely something that should not have been possible (as a student his account should have "Read Only" access to files and incapable of altering their permissions or location).