[7] In February 2011, OdaTV's offices were raided and some of its staff were arrested (including the founder Soner Yalçın and executive editor Barış Pehlivan as well as news co-ordinator Doğan Yurdakul, journalist Barış Terkoğlu) and accused of links with the Ergenekon organization.

Rare and malicious computer viruses, including Autorun-BJ and Win32:Malware-gen, allowed the placement of the documents to go unnoticed by the defendants.

[13] Digital forensics company Arsenal Consulting examined the OdaTV evidence and found that while the malware on Barış Pehlivan's OdaTV computer was much more interesting than known prior to Arsenal’s involvement (e.g. the Ahtapot remote access trojan never seen before “in the wild”), it was not responsible for delivery of the incriminating documents.

The “Anchors in Relative Time”[14] analysis technique was used to reveal a series of local (physical access) and remote (across the Internet) attacks against his computer.

The final two local attacks (on the evenings of February 9 and 11, 2011) resulted in delivery of the incriminating documents to his computer, just prior to its seizure by the Turkish National Police.