I didn't say all expert witnesses are good nor did I claim they are all used in good faith.

Merely that, unlike in the invented scenario above, statistical differences in the random garbage that gets written to a disk across different tool or OS versions has been successfully used to place a time window on when exactly someone destroyed evidence.