Anthony's Computer Forensics

[faefrost]

KC did not attempt to erase files in unallocated space, as her infamous Google searches from one year ago tomorrow mad were found in unallocated sectors.

As an aside, no LE agency possesses the type of sensor equipment needed to identify the possible 1's or 0's that have been over-written on a drive, nor the computer horsepower to separate the wheat from the statistical chaff - as Gutmann theorizes is possible to do. Maybe, maybe, the CIA or NSA could do it on a high-value hard drive, but the cost of doing so would be extraordinary.

In other words, if a deleted file was written over in unallocated space, LE would never find it.

Not entirely true. The FBI and the NSA have the capabilities, although they may be limited in actual effectiveness and cost effectiveness. the FBI labs caused a stir in security circles a few years back when they recovered useable data from the platters of defense department hard drives that had been sandblasted (which at the time was viewed as a secure method of permanent destruction).

Regardless I can't see them taking the time and resources to go through that for a criminal case such as this. I also don't think they would be willing to subject the methods that they use for such deep data recovery to open court or defense cross examination. That level of tech is probably mainly reserved for espionage and anti terrorism.

 

[ElizaAvalon]

Well...I can't be positive one way or the other who was on the computer, as only one new URL was added and it was in the evening. The temporary internet history (caching information) does not go that far back. I'd need to see what is in the unallocated sectors, to be certain.

I will say that one week earlier, on the 9th, around 4:30 PM someone - I am guessing George - visited a couple of sites on car sales and a couple of job sites.

So it is possible the computer usage was due to George, but I am not completely sold on this. The usage between 2 and 3 on the 16th was quite heavy, which indicates to me someone was surfing big time and creating a lot of cache files. Yet the actual computer history files we have show absolutely nothing. KC seemed to have a habit of covering her computer tracks as it is near impossible to find any activity related to her, even with all of the Photobucket, Facebook, and Myspace visits.

Therefore, although I'm hearing you on the pings, my nickle is still on KC, and she covered her tracks as she always did. :twocents:

JWG -

I'm not completely sold on George being the sole user of the desktop. I think Cindy used it, too.

One specific example I can give is on 7/3 - we know Cindy posted her "distraught" message on myspace on that date and you can see the cookie for that on 7/3. There are also several cookies on that date that indicate to me that she was the one using the computer (fragrancenet.com, for example).

Can you please point me to docs showing how we know KC used the desktop for myspace/facebook, etc.? Not seeing it but I trust it's there, just don't know where to look. TIA!

O/T: I also see evidence of malware on the desktop - mywebsearch, for example.

 

[ElizaAvalon]

JWG - I still don't understand why KC would go through so much trouble to hide her footprints on the desktop if she had her very own laptop.

I also don't think she's savvy enough to find a way to delete her own footprints while keeping everyone else's. IMO, it's way easier to just whack everything using a button called 'delete browsing history'.

When do we know KC to go through any hoops to do anything to cover her tracks? Remember where she hid her daughter's body? Really, she takes the easy way out of everything.

I'd venture to throw out there that she never used the desktop after she got her laptop, whenever that was.

Of course, I may be missing something...

Trying to tie a bunch of random conclusions I am drawing together in one neat package. Not sure if it is "neat" to anyone but me.

As I mentioned previously, the absence of KC surfing history in the internet history file was quite noticeable and seemed to indicate that KC deliberately tried to cover her tracks when surfing the web. George, on the other hand, made no attempt whatsoever - otherwise he would have eliminated evidence he was viewing escort sites.

<respectfully snipped>

 

[It's Not the Nanny]

Is it possible that LE held back some very important searches, cookies, history in their doc dump??

Maybe we just aren't seeing the entire story yet.

 

[ElizaAvalon]

ETA: The passwords for all six accounts were updated simultaneously on 05/14/08 at 08:49:19AM. Just an observation...not sure how one does that though, unless the accounts are all one and the same.

Indicative of a virus...

 

[It's Not the Nanny]

Indicative of a virus...

Agreed!

 

[ElizaAvalon]

Snipped for space. Bold is mine

LOL, ya know I was gonna ask you last night if he was visiting *advertiser censored* sites.

As always, thanks for your hard work!

Yes, often!

I feel dirty.

 

[ElizaAvalon]

I see what you mean publius. I tried using Facebook without cookies enabled, to no avail. :doh:

I guess it would not be too difficult to go to C:\Documents and Settings\Casey\Cookies, sort by date, and just delete the ones she knew she just set during her previous browse time.

In fact, again revisiting the thought that KC knew George was occasionally surfing escort sites, viewing the sorted cookie folder would be a very easy way for her to have stumbled upon his surfing history, IMO. :blushing:

Let me throw this out there:

Perhaps George was using Casey's user id on the desktop to hide his own penchant for surfing to escort sites from Cindy?

It looks to me like the "owner" account was in use, too. Yet we weren't given the owner history/cookies/etc. evidence in the doc dumps.

Using the owner account with administrative rights is the usual state of most home computers (I fix home computers). I wouldn't find it unusual for the owner account to be in use on the Anthony family's computer.

 

[ElizaAvalon]

Is it possible that LE held back some very important searches, cookies, history in their doc dump??

Maybe we just aren't seeing the entire story yet.

They may have only released what was relevant. For example, they did not release the history for the "owner" userid on the desktop, yet we know it was last logged into on 7/16/08.

 

[JWG]

JWG -

I'm not completely sold on George being the sole user of the desktop. I think Cindy used it, too.

One specific example I can give is on 7/3 - we know Cindy posted her "distraught" message on myspace on that date and you can see the cookie for that on 7/3. There are also several cookies on that date that indicate to me that she was the one using the computer (fragrancenet.com, for example).

Can you please point me to docs showing how we know KC used the desktop for myspace/facebook, etc.? Not seeing it but I trust it's there, just don't know where to look. TIA!

O/T: I also see evidence of malware on the desktop - mywebsearch, for example.

Hello Eliza,

I did not mean to imply Cindy did not use the computer. There were also some surfs to vacation information that could have been her as well. However, I think by and large the activity we see was George.

Your question regarding whether or not KC used the desktop for myspace and facebook caused me to uncover something interesting.

Looking closely at the forensic report, I see that the IM chat logs were recovered from a file path that includes 08-069208\S013J10X237614\D\Documents and Settings\Owner\My Documents. There is also a Facebook fragment included in that portion of the report.

The "full name" of Owner is "case", who is an administrator. The Owner account appears only on the desktop, not the laptop. Furthermore, the 08-069208 and S013J10X237614 IDs belong to the HP desktop.

So perhaps the solution to this mystery of how KC covered her tracks is even simpler: She used the Owner account and her parents used the casey account.

The forensic evidence files released by LE back in September include internet history, cookies, temporary internet files for the casey account but not for the Owner account. :banghead:

 

[JWG]

They may have only released what was relevant. For example, they did not release the history for the "owner" userid on the desktop, yet we know it was last logged into on 7/16/08.

I'm thinking the Owner userid holds a lot of potential goodies. All of the chat logs came from there. Example - Tony's:

08-069208\S013J10X237614\D\Documents and Settings\Owner\My Documents\AIMLogger\caseyomarie\IM Logs\l7tone.html

 

[JWG]

The date / time of the title is approximately 24 hours after the death of Caylee and is also a time that the cell pings place KC at her parent's home. Neighbor Brian B. recalled seeing her backed into the garage at that time.

A lot of speculation as to what she was doing during that time, with her daughter's body in the trunk. Her laptop computer tells us one thing she was doing was copying pictures and movies of Caylee to the laptop at 3:28PM.

 

[ElizaAvalon]

So perhaps the solution to this mystery of how KC covered her tracks is even simpler: She used the Owner account and her parents used the casey account.

Agreed.

I'll bet KC rarely used the casey account. So there was no covering of tracks at all. She just wasn't there.

 

[JWG]

Bringing some stuff over from the timer55 thread since it ties directly into the computer.

First...If I go into Excel and enter May 14, 2008 into one cell, then in another cell I add 55 to that date, I get July 8. This is the date Amy leaves for Puerto Rico. The date KC was supposed to leave as well.

If I enter June 16, 2008 into a cell, then in another cell I add 55 to that date, I get August 10. The day after Caylee's birthday. Cindy is the one that interpreted for all of us that timer55 meant Caylee's birthday. Close, but not quite right on.

Let's look at some things a little more closely, shall we?

Info from the laptop:

[FONT=&quot]User name: bobby[/FONT]

[FONT=&quot]Full Name: case face[/FONT]
[FONT=&quot]Type of User: Local User[/FONT]
[FONT=&quot]Account Description: [/FONT]
[FONT=&quot]Primary Group Number: 513[/FONT]
[FONT=&quot]Security Identifier: S-1-5-21-4184637735-1215142919-1304212445-1005[/FONT]
[FONT=&quot]User belongs to group: Administrators[/FONT]
[FONT=&quot]Logon Script: [/FONT]
[FONT=&quot]Profile Path: %SystemDrive%\Documents and Settings\bobby[/FONT]
[FONT=&quot]Last Logon: 07/15/08 06:42:10PM[/FONT]
[FONT=&quot]Last Password Change: 06/24/08 08:56:47PM[/FONT]
[FONT=&quot]Last Incorrect Password Logon:[/FONT]

Info from the desktop:

[FONT=&quot] User name: casey[/FONT]

[FONT=&quot]Full Name: casa de anthony[/FONT]
[FONT=&quot]Type of User: Local User[/FONT]
[FONT=&quot]Account Description: [/FONT]
[FONT=&quot]Primary Group Number: 513[/FONT]
[FONT=&quot]Security Identifier: S-1-5-21-121217872-2017380362-3718819000-1007[/FONT]
[FONT=&quot]User belongs to group: Users[/FONT]
[FONT=&quot]Logon Script: [/FONT]
[FONT=&quot]Profile Path: %SystemDrive%\Documents and Settings\casey[/FONT]
[FONT=&quot]Last Logon: 07/16/08 04:19:08PM[/FONT]
[FONT=&quot]Last Password Change: 05/14/08 08:49:19AM[/FONT]
[FONT=&quot]Last Incorrect Password Logon: [/FONT]

[FONT=&quot]User name: Owner[/FONT]

[FONT=&quot]Full Name: case[/FONT]
[FONT=&quot]Type of User: Local User[/FONT]
[FONT=&quot]Account Description: [/FONT]
[FONT=&quot]Primary Group Number: 513[/FONT]
[FONT=&quot]Security Identifier: S-1-5-21-121217872-2017380362-3718819000-1003[/FONT]
[FONT=&quot]User belongs to group: Administrators[/FONT]
[FONT=&quot]Logon Script: [/FONT]
[FONT=&quot]Profile Path: %SystemDrive%\Documents and Settings\Owner[/FONT]
[FONT=&quot]Last Logon: 07/16/08 04:57:56AM[/FONT]
[FONT=&quot]Last Password Change: 05/14/08 08:49:19AM[/FONT]
[FONT=&quot]Last Incorrect Password Logon: 07/16/08 02:38:19PM[/FONT]
​

Nice piece of work by Ariane in bringing this theory forward.

Have you (or anyone) found a computer forensic document that supposedly says a password was changed to timer55 on 15 May? That post you copied from topix a while back seemed to make sense to me at first glance.

I think you were the one to bring this quote here from a post at Topix.

Margaret In Houston wrote:
<quoted text>
In the interview cindy says she(Casey) changed the password on the desktop to timer55. They thought maybe it was changed on June 14th- a date cindy and george both mention.
Here is when the password was changed...
From the computer forensic report
May 14- 8:49 am Password for DESKTOP computer changed for user casey.55 days from May 14th is approximately when they all left for Puerto Rico (july 8)so I think it was related to that. ​

Intermezzo, Are you certain that you saw this in an official document?
Because I am now wondering if it was totally a hoax.

1. It is surprising to me that if this exists in the documents someone here has not found it. As I'm sure you know, it is not in that OCSO computer forensic report that has the "Diary of Days" etc.

2. This topix post quote purportedly from a computer forensic report, is about the computer logon password. But "timer55" was supposed to be her facebook password; . She said there was not meaning behind the computer PW. And if the computer and facebook pws were both "timer55", why would she say only one was significant? http://www.websleuths.com/forums/showpost.php?p=3057681&postcount=227

Does anyone know if Margaret In Houston still posts on topix ? One could ask for a link to where she got the info.

How are facebook passwords stored? Would that be in a cookie?

Ariane, I think you may have nailed it. :thumb: Consider the following texts between KC and Amy on May 14:

OUTGOING TEXT Casey Anthony Amy Huzienga It&#8217;s official. As long s we take our trip within the first 2 weeks of July I'm set. I just got my vacation cleared.

INCOMING TEXT Amy Huzienga Casey Anthony So the earliest JP can leave is the 8th. Can you do the 8th through the 15th?

OUTGOING TEXT Casey Anthony Amy Huzienga I can.

INCOMING TEXT Amy Huzienga Casey Anthony Awesome.
​

Consider the time stamp on that very first text was [FONT=Arial, sans-serif]08:49:23AM[/FONT].

The official act was not getting imaginary vacation from her imaginary boss at her imaginary place of employment. The "official" act was changing her real password 4 seconds prior!

 

[ibyoungr]

FYI

Just fro easy reference

JG was on the family desktop sometime on July 16th.

 

[JWG]

LE released KC's March 2008 cell phone records in the March 5 document dump. Wrapping these around her infamous Google searches may add more perspective, although I still believe these were the sort of stream-of-consciousness searches I do rather than some deliberate, well-planned endeavor.

Nevertheless, the context is interesting...

3/17/08 MON 2:13 AM 3/17/08 2:13 AM 2 INCOMING TEXT Ricardo "Boyfriendizzle" Morales (Cell) Casey Anthony
3/17/08 MON 2:15 AM 3/17/08 2:15 AM 2 INCOMING TEXT Ricardo "Boyfriendizzle" Morales (Cell) Casey Anthony
3/17/08 MON 3:27 AM 3/17/08 3:27 AM 2 INCOMING TEXT Ricardo "Boyfriendizzle" Morales (Cell) Casey Anthony
3/17/08 MON 12:50 PM 3/17/08 12:50 PM 2 INCOMING CALL Ricardo "Boyfriendizzle" Morales (Cell) Casey Anthony
3/17/08 MON 12:53 PM 3/17/08 12:53 PM 2 OUTGOING CALL Casey Anthony Ryan "Best Friend" Pasley (Cell)
3/17/08 MON 1:09 PM 3/17/08 1:09 PM 2 OUTGOING TEXT Casey Anthony Ricardo "Boyfriendizzle" Morales (Cell)
3/17/08 MON 1:35 PM 3/17/08 1:35 PM 2 INCOMING CALL Ricardo "Boyfriendizzle" Morales (Cell) Casey Anthony
3/17/08 MON 1:39 PM 3/17/08 1:39 PM 2 INCOMING TEXT Casey Anthony Casey Anthony
3/17/08 MON 1:43 PM 3/17/08 1:43 PM 2 Search chloraform
3/17/08 MON 1:43 PM 3/17/08 1:43 PM 2 Search chloroform (Google corrected spelling)
3/17/08 MON 1:54 PM 3/17/08 1:54 PM 2 Search alcohol
3/17/08 MON 1:54 PM 3/17/08 1:54 PM 2 Search acetone
3/17/08 MON 1:55 PM 3/17/08 1:55 PM 2 Search peroxide
3/17/08 MON 1:58 PM 3/17/08 1:58 PM 2 13:53:25 to 13:58:38 Wikipedia searches for inhalation, chloroform, alcohol, acetone, peroxide, hydrogen peroxide, death
3/17/08 MON 2:03 PM 3/17/08 2:03 PM 2 INCOMING TEXT #N/A Casey Anthony
3/17/08 MON 3:35 PM 3/17/08 3:35 PM 2 OUTGOING CALL Casey Anthony Ricardo "Boyfriendizzle" Morales (Cell)
3/17/08 MON 3:35 PM 3/17/08 3:35 PM 2 OUTGOING CALL Casey Anthony Ricardo "Boyfriendizzle" Morales (Cell)

3/18/08 - Ricardo posts the Win her over with Chloroform image on his myspace page.

And then three days later:

3/21/08 FRI 1:04 PM 3/21/08 1:04 PM 6 INCOMING TEXT Amy "Amy Hu" Huzienga (Cell) Casey Anthony
3/21/08 FRI 1:05 PM 3/21/08 1:05 PM 6 OUTGOING TEXT Casey Anthony Amy "Amy Hu" Huzienga (Cell)
3/21/08 FRI 1:07 PM 3/21/08 1:07 PM 6 OUTGOING TEXT Casey Anthony Amy "Amy Hu" Huzienga (Cell)
3/21/08 FRI 1:08 PM 3/21/08 1:08 PM 6 INCOMING TEXT Amy "Amy Hu" Huzienga (Cell) Casey Anthony
3/21/08 FRI 1:09 PM 3/21/08 1:09 PM 6 OUTGOING TEXT Casey Anthony Amy "Amy Hu" Huzienga (Cell)
3/21/08 FRI 1:11 PM 3/21/08 1:11 PM 6 OUTGOING TEXT Casey Anthony Amy "Amy Hu" Huzienga (Cell)
3/21/08 FRI 1:14 PM 3/21/08 1:14 PM 6 INCOMING TEXT Amy "Amy Hu" Huzienga (Cell) Casey Anthony
3/21/08 FRI 1:15 PM 3/21/08 1:15 PM 6 INCOMING TEXT Amy "Amy Hu" Huzienga (Cell) Casey Anthony
3/21/08 FRI 1:15 PM 3/21/08 1:15 PM 6 INCOMING TEXT Casey Anthony Casey Anthony
3/21/08 FRI 1:15 PM 3/21/08 1:15 PM 6 OUTGOING TEXT Casey Anthony Amy "Amy Hu" Huzienga (Cell)
3/21/08 FRI 2:16 PM 3/21/08 2:16 PM 6 Search how to make chloraform
3/21/08 FRI 2:16 PM 3/21/08 2:16 PM 6 Search how to make chloroform Google automatically suggested correct spelling
3/21/08 FRI 2:19 PM 3/21/08 2:19 PM 6 Clicked a Google syndicated ad
3/21/08 FRI 2:20 PM 3/21/08 2:20 PM 6 Search self defense
3/21/08 FRI 2:21 PM 3/21/08 2:21 PM 6 Clicked a Google syndicated ad
3/21/08 FRI 2:21 PM 3/21/08 2:21 PM 6 Search household weapons
3/21/08 FRI 2:22 PM 3/21/08 2:22 PM 6 Clicked a Google syndicated ad
3/21/08 FRI 2:23 PM 3/21/08 2:23 PM 6 Clicked a blog poll hosted by Google http://www.google.com/reviews/polls/...kclr=#5588aa
3/21/08 FRI 2:25 PM 3/21/08 2:25 PM 6 Clicked a Google syndicated ad
3/21/08 FRI 2:25 PM 3/21/08 2:25 PM 6 Search household weapons
3/21/08 FRI 2:25 PM 3/21/08 2:25 PM 6 Clicks http://books.google.com/books?id=_QMJNJIOKPEC&pg=PA79
3/21/08 FRI 2:26 PM 3/21/08 2:26 PM 6 Clicks http://books.google.com/books?id=_QMJNJIOKPEC&pg=PA79
3/21/08 FRI 2:26 PM 3/21/08 2:26 PM 6 Search neck breaking
3/21/08 FRI 2:28 PM 3/21/08 2:28 PM 6 Search shovel
3/21/08 FRI 4:08 PM 3/21/08 4:08 PM 6 OUTGOING CALL Casey Anthony DRF "The Reid" Dealership
3/21/08 FRI 4:38 PM 3/21/08 4:38 PM 6 OUTGOING CALL Casey Anthony Casey Anthony
3/21/08 FRI 4:39 PM 3/21/08 4:39 PM 6 OUTGOING CALL Casey Anthony Ryan "Best Friend" Pasley (Cell)
3/21/08 FRI 4:47 PM 3/21/08 4:47 PM 6 OUTGOING TEXT Casey Anthony Troy "T-roy Brown" Brown (Cell)
3/21/08 FRI 4:48 PM 3/21/08 4:48 PM 6 INCOMING TEXT Troy "T-roy Brown" Brown (Cell) Casey Anthony
3/21/08 FRI 4:49 PM 3/21/08 4:49 PM 6 OUTGOING TEXT Casey Anthony Troy "T-roy Brown" Brown (Cell)
3/21/08 FRI 4:51 PM 3/21/08 4:51 PM 6 INCOMING TEXT Troy "T-roy Brown" Brown (Cell) Casey Anthony
3/21/08 FRI 4:52 PM 3/21/08 4:52 PM 6 OUTGOING TEXT Casey Anthony Troy "T-roy Brown" Brown (Cell)
3/21/08 FRI 4:53 PM 3/21/08 4:53 PM 6 INCOMING TEXT Troy "T-roy Brown" Brown (Cell) Casey Anthony
3/21/08 FRI 4:54 PM 3/21/08 4:54 PM 6 OUTGOING TEXT Casey Anthony Troy "T-roy Brown" Brown (Cell)
3/21/08 FRI 4:54 PM 3/21/08 4:54 PM 6 INCOMING TEXT Troy "T-roy Brown" Brown (Cell) Casey Anthony
3/21/08 FRI 4:55 PM 3/21/08 4:55 PM 6 OUTGOING TEXT Casey Anthony Troy "T-roy Brown" Brown (Cell)
3/21/08 FRI 4:55 PM 3/21/08 4:55 PM 6 INCOMING TEXT Troy "T-roy Brown" Brown (Cell) Casey Anthony
3/21/08 FRI 4:56 PM 3/21/08 4:56 PM 6 OUTGOING TEXT Casey Anthony Troy "T-roy Brown" Brown (Cell)

 

[Intermezzo]

LE released KC's March 2008 cell phone records in the March 5 document dump. Wrapping these around her infamous Google searches may add more perspective, although I still believe these were the sort of stream-of-consciousness searches I do rather than some deliberate, well-planned endeavor.

Nevertheless, the context is interesting...

3/17/08 MON 2:13 AM 3/17/08 2:13 AM 2 INCOMING TEXT Ricardo "Boyfriendizzle" Morales (Cell) Casey Anthony
3/17/08 MON 2:15 AM 3/17/08 2:15 AM 2 INCOMING TEXT Ricardo "Boyfriendizzle" Morales (Cell) Casey Anthony
3/17/08 MON 3:27 AM 3/17/08 3:27 AM 2 INCOMING TEXT Ricardo "Boyfriendizzle" Morales (Cell) Casey Anthony
3/17/08 MON 12:50 PM 3/17/08 12:50 PM 2 INCOMING CALL Ricardo "Boyfriendizzle" Morales (Cell) Casey Anthony
3/17/08 MON 12:53 PM 3/17/08 12:53 PM 2 OUTGOING CALL Casey Anthony Ryan "Best Friend" Pasley (Cell)
3/17/08 MON 1:09 PM 3/17/08 1:09 PM 2 OUTGOING TEXT Casey Anthony Ricardo "Boyfriendizzle" Morales (Cell)
3/17/08 MON 1:35 PM 3/17/08 1:35 PM 2 INCOMING CALL Ricardo "Boyfriendizzle" Morales (Cell) Casey Anthony
3/17/08 MON 1:39 PM 3/17/08 1:39 PM 2 INCOMING TEXT Casey Anthony Casey Anthony
3/17/08 MON 1:43 PM 3/17/08 1:43 PM 2 Search chloraform
3/17/08 MON 1:43 PM 3/17/08 1:43 PM 2 Search chloroform (Google corrected spelling)
3/17/08 MON 1:54 PM 3/17/08 1:54 PM 2 Search alcohol
3/17/08 MON 1:54 PM 3/17/08 1:54 PM 2 Search acetone
3/17/08 MON 1:55 PM 3/17/08 1:55 PM 2 Search peroxide
3/17/08 MON 1:58 PM 3/17/08 1:58 PM 2 13:53:25 to 13:58:38 Wikipedia searches for inhalation, chloroform, alcohol, acetone, peroxide, hydrogen peroxide, death
3/17/08 MON 2:03 PM 3/17/08 2:03 PM 2 INCOMING TEXT #N/A Casey Anthony
3/17/08 MON 3:35 PM 3/17/08 3:35 PM 2 OUTGOING CALL Casey Anthony Ricardo "Boyfriendizzle" Morales (Cell)
3/17/08 MON 3:35 PM 3/17/08 3:35 PM 2 OUTGOING CALL Casey Anthony Ricardo "Boyfriendizzle" Morales (Cell)

3/18/08 - Ricardo posts the Win her over with Chloroform image on his myspace page.

And then three days later:

3/21/08 FRI 1:04 PM 3/21/08 1:04 PM 6 INCOMING TEXT Amy "Amy Hu" Huzienga (Cell) Casey Anthony
3/21/08 FRI 1:05 PM 3/21/08 1:05 PM 6 OUTGOING TEXT Casey Anthony Amy "Amy Hu" Huzienga (Cell)
3/21/08 FRI 1:07 PM 3/21/08 1:07 PM 6 OUTGOING TEXT Casey Anthony Amy "Amy Hu" Huzienga (Cell)
3/21/08 FRI 1:08 PM 3/21/08 1:08 PM 6 INCOMING TEXT Amy "Amy Hu" Huzienga (Cell) Casey Anthony
3/21/08 FRI 1:09 PM 3/21/08 1:09 PM 6 OUTGOING TEXT Casey Anthony Amy "Amy Hu" Huzienga (Cell)
3/21/08 FRI 1:11 PM 3/21/08 1:11 PM 6 OUTGOING TEXT Casey Anthony Amy "Amy Hu" Huzienga (Cell)
3/21/08 FRI 1:14 PM 3/21/08 1:14 PM 6 INCOMING TEXT Amy "Amy Hu" Huzienga (Cell) Casey Anthony
3/21/08 FRI 1:15 PM 3/21/08 1:15 PM 6 INCOMING TEXT Amy "Amy Hu" Huzienga (Cell) Casey Anthony
3/21/08 FRI 1:15 PM 3/21/08 1:15 PM 6 INCOMING TEXT Casey Anthony Casey Anthony
3/21/08 FRI 1:15 PM 3/21/08 1:15 PM 6 OUTGOING TEXT Casey Anthony Amy "Amy Hu" Huzienga (Cell)
3/21/08 FRI 2:16 PM 3/21/08 2:16 PM 6 Search how to make chloraform
3/21/08 FRI 2:16 PM 3/21/08 2:16 PM 6 Search how to make chloroform Google automatically suggested correct spelling
3/21/08 FRI 2:19 PM 3/21/08 2:19 PM 6 Clicked a Google syndicated ad
3/21/08 FRI 2:20 PM 3/21/08 2:20 PM 6 Search self defense
3/21/08 FRI 2:21 PM 3/21/08 2:21 PM 6 Clicked a Google syndicated ad
3/21/08 FRI 2:21 PM 3/21/08 2:21 PM 6 Search household weapons
3/21/08 FRI 2:22 PM 3/21/08 2:22 PM 6 Clicked a Google syndicated ad
3/21/08 FRI 2:23 PM 3/21/08 2:23 PM 6 Clicked a blog poll hosted by Google http://www.google.com/reviews/polls/...kclr=#5588aa
3/21/08 FRI 2:25 PM 3/21/08 2:25 PM 6 Clicked a Google syndicated ad
3/21/08 FRI 2:25 PM 3/21/08 2:25 PM 6 Search household weapons
3/21/08 FRI 2:25 PM 3/21/08 2:25 PM 6 Clicks http://books.google.com/books?id=_QMJNJIOKPEC&pg=PA79
3/21/08 FRI 2:26 PM 3/21/08 2:26 PM 6 Clicks http://books.google.com/books?id=_QMJNJIOKPEC&pg=PA79
3/21/08 FRI 2:26 PM 3/21/08 2:26 PM 6 Search neck breaking
3/21/08 FRI 2:28 PM 3/21/08 2:28 PM 6 Search shovel
3/21/08 FRI 4:08 PM 3/21/08 4:08 PM 6 OUTGOING CALL Casey Anthony DRF "The Reid" Dealership
3/21/08 FRI 4:38 PM 3/21/08 4:38 PM 6 OUTGOING CALL Casey Anthony Casey Anthony
3/21/08 FRI 4:39 PM 3/21/08 4:39 PM 6 OUTGOING CALL Casey Anthony Ryan "Best Friend" Pasley (Cell)
3/21/08 FRI 4:47 PM 3/21/08 4:47 PM 6 OUTGOING TEXT Casey Anthony Troy "T-roy Brown" Brown (Cell)
3/21/08 FRI 4:48 PM 3/21/08 4:48 PM 6 INCOMING TEXT Troy "T-roy Brown" Brown (Cell) Casey Anthony
3/21/08 FRI 4:49 PM 3/21/08 4:49 PM 6 OUTGOING TEXT Casey Anthony Troy "T-roy Brown" Brown (Cell)
3/21/08 FRI 4:51 PM 3/21/08 4:51 PM 6 INCOMING TEXT Troy "T-roy Brown" Brown (Cell) Casey Anthony
3/21/08 FRI 4:52 PM 3/21/08 4:52 PM 6 OUTGOING TEXT Casey Anthony Troy "T-roy Brown" Brown (Cell)
3/21/08 FRI 4:53 PM 3/21/08 4:53 PM 6 INCOMING TEXT Troy "T-roy Brown" Brown (Cell) Casey Anthony
3/21/08 FRI 4:54 PM 3/21/08 4:54 PM 6 OUTGOING TEXT Casey Anthony Troy "T-roy Brown" Brown (Cell)
3/21/08 FRI 4:54 PM 3/21/08 4:54 PM 6 INCOMING TEXT Troy "T-roy Brown" Brown (Cell) Casey Anthony
3/21/08 FRI 4:55 PM 3/21/08 4:55 PM 6 OUTGOING TEXT Casey Anthony Troy "T-roy Brown" Brown (Cell)
3/21/08 FRI 4:55 PM 3/21/08 4:55 PM 6 INCOMING TEXT Troy "T-roy Brown" Brown (Cell) Casey Anthony
3/21/08 FRI 4:56 PM 3/21/08 4:56 PM 6 OUTGOING TEXT Casey Anthony Troy "T-roy Brown" Brown (Cell)

JWG
Do we know the contents of those texts between Ricardo and KC?

Curious now about what they were texting about that led Casey to search for Chloroform etc.... followed by Ricardo uploading the "win her over with chloroform" pic to his myspace...

Was there talk at one point about the younger crowd using certain substances to heighten (ahem) personal acts?

PS You do very great sleuthing work. I enjoy your posts.

 

[Lanie]

LE released KC's March 2008 cell phone records in the March 5 document dump. Wrapping these around her infamous Google searches may add more perspective, although I still believe these were the sort of stream-of-consciousness searches I do rather than some deliberate, well-planned endeavor.

Snipped for space.

Well, there goes the theory Casey saw Ricardo's myspace chloroform pic and that is what made her look up chloroform. It reinforces my theory Casey is the one who came across that pic and told Ricardo about it, or showed it to him at his house. Thanks for posting when Ricardo put that on his myspace, as it was something I have been very curious about, but never made the time to look up.
JWG, do you, or anyone else, for that matter, have any idea when Casey got her other tattoos? Not 'la bella vita', but the ones before that? I have looked, but not been able to find any information on it. My idea on this, which IMO completely fits Casey's profile, is she was at the tattoo parlor, came across a bottle of chloroform there, thought it looked interesting/cool/fun/whatever, and just stole it because she decided she wanted it. I don't think at the time she took it she had any plans for it, and she probably didn't have more than a vague idea what it was for, so she looked it up online.
Lanie

 

[JWG]

Snipped for space.

Well, there goes the theory Casey saw Ricardo's myspace chloroform pic and that is what made her look up chloroform. It reinforces my theory Casey is the one who came across that pic and told Ricardo about it, or showed it to him at his house. Thanks for posting when Ricardo put that on his myspace, as it was something I have been very curious about, but never made the time to look up.
JWG, do you, or anyone else, for that matter, have any idea when Casey got her other tattoos? Not 'la bella vita', but the ones before that? I have looked, but not been able to find any information on it. My idea on this, which IMO completely fits Casey's profile, is she was at the tattoo parlor, came across a bottle of chloroform there, thought it looked interesting/cool/fun/whatever, and just stole it because she decided she wanted it. I don't think at the time she took it she had any plans for it, and she probably didn't have more than a vague idea what it was for, so she looked it up online.
Lanie

Hi Lanie,

I'm not sure it really shoots that theory down. Here's why I still think Ricardo is the source of the image:

A while back when I found out what the file name was I entered it into Google image search and saw it on a lot of myspace pages. I noticed that the majority of the ones I looked at were uploaded to myspace during January to March of 2008, which told me it was a hot / popular image around that time frame.

Also, the image was found on Ricardo's myspace and his computer, but does not appear to have ever been on any KC website or computer. Thus, I could easily be convinced that Ricardo found the image on someone else's myspace, downloaded it to his computer on one day before the 17th, then later on the 18th uploaded it to his own myspace. Prior to the upload, he showed it to KC.

It is quite possible the texts / calls earlier on Monday are Ricardo telling her about the picture on someone else's myspace and teasing her about it. I still think her searches on the 17th were KC's attempt to answer the question "what is chloroform?"

 

[ibyoungr]

I need help pulling together computer forensics, ping records and cell records for June 17th. Would like to nail down her movements for that day. It seems that this particular day is discussed in on thread with ping records, another on the calendar and another on cell/text threads. I would like to see what JWG did above but for the June 16th and 17th.



Did she have time to hang out a Sawgrass.. I do not think ping records show her there.

Does any computer activity show up at the desktop at the A house? Does it only show up on her laptop computer? None at all?


Off to work, I go...