Whatever his motivation, Savoy logged on to the 120 machine using the "temp/temp" username and password he had found on Mail2. He spent 15 minutes there, looking at a phonebook file, and a list of account names, and found information that led him to believe Heckenkamp had an account on the machine. He also saw what he called "computer hacking tools" and files that Qualcomm had described. Savoy made screen-print copies of these files as evidence.
Jennifer Granick has more information about the University hacking case.
