SCSam
New Member
- Joined
- Aug 12, 2006
- Messages
- 670
- Reaction score
- 0
Anthony's Computer Forensics
- Thread starter DAWN TREADER
- Start date
Nana46
Runs with Scissors
- Joined
- Jul 29, 2008
- Messages
- 4,315
- Reaction score
- 29
BondJamesBond
Blunt Instrument
- Joined
- Aug 21, 2008
- Messages
- 3,871
- Reaction score
- -12
LinasK
Verified insider- Mark Dribin case
- Joined
- Jun 3, 2004
- Messages
- 26,876
- Reaction score
- 24,349
It does to me!! It screams pre-meditation. She created a Zenaida file as far back as Oct. '07, she accessed it on June 12th. Those dates don't lie. It was also accessed on July 16th, but I'm sure that was Cindy...
BondJamesBond
Blunt Instrument
- Joined
- Aug 21, 2008
- Messages
- 3,871
- Reaction score
- -12
Hey, LinasK.
What I'm attempting to say is...based on what I'm gathering from computer techs alot smarter than me (not sayin' alot
)that the dates associated w/ the creation of those files isn't tied specifically to searches for ZFG. Those files (e.g. index.dat & history.dat) are generic files that are used for a bunch-o-stuff. IOW...it's just a coincidence those file creation dates are anywhere in the range of dates we're interested in...those files are a dumping ground.Not trying to be argumentative...just tryin' to understand it myself. And, I'm learning...so, I'm open to be corrected @ anytime, by anyone.
LinasK
Verified insider- Mark Dribin case
- Joined
- Jun 3, 2004
- Messages
- 26,876
- Reaction score
- 24,349
Hey, LinasK.
What I'm attempting to say is...based on what I'm gathering from computer techs alot smarter than me (not sayin' alot
Not trying to be argumentative...just tryin' to understand it myself. And, I'm learning...so, I'm open to be corrected @ anytime, by anyone.
Just because she didn't search for Z until June, she was already thinking about it as far back as Oct. Why else create a Zenaida file back then??? She was already trying to frame her, just hadn't made it a point or found the time to do it until days before she killed Caylee. She also searched missing children's websites back in March. All of this and the chloroform searches scream pre-meditation.
Broderick
New Member
- Joined
- Sep 8, 2008
- Messages
- 1,548
- Reaction score
- 0
LOL, they are NOT ZFG files. They are generic index files created either when the computer was first fired up or when the history files were created (which will have ALL search information). It collects search information as records from that point on. There is absolutely no indication that the computers ever saw any search or information of ZFG prior to July 16th. Sorry, this forensic release does not help premediation. It only tells us that whoever was at the computer on JULY 16 of 2008, did searches for ZFG.
I'll bet the GJ hears about it tomorrow. (Wish I could be a fly on that wall!)
I do not know anything about anonymizers. Wouldn't it still show that is was sent via a certain computer?
HRCODEPINK
Verified Insider
Sorry if this has been covered, but is this a new spoof email from work, or is it the ones that they already gave us in the first 400 pages....pages 411 - 415?
If it is those, they are all from Yahoo addresses which tells me that she spent a day making up yahoo addresses and faking emails to herself. Might have even been smart enough to at least go to a library, but I doubt it. Guaranteed none of them came from Universal.
If it is those, they are all from Yahoo addresses which tells me that she spent a day making up yahoo addresses and faking emails to herself. Might have even been smart enough to at least go to a library, but I doubt it. Guaranteed none of them came from Universal.
truthsleuth
New Member
- Joined
- Aug 5, 2008
- Messages
- 1,946
- Reaction score
- 9
Snip:
Every day I have resisted calling her a moron just to be polite. But after your fabulous "murderous vixen that destroys its young" remark, I thought, what the heck? Why not? ...
So here you go, Mrs. Peel, in your honor:
Casey Anthony is a moron.
I'm so proud of myself.
Every day I have resisted calling her a moron just to be polite. But after your fabulous "murderous vixen that destroys its young" remark, I thought, what the heck? Why not? ...
So here you go, Mrs. Peel, in your honor:
Casey Anthony is a moron.
I'm so proud of myself.
JWG
Active Member
- Joined
- Oct 22, 2007
- Messages
- 1,786
- Reaction score
- -47
Time to bump this thread up some and updating what we know from the computer searches. In particular, some of the information we have from various computer searches can help fill gaps in our understanding of where Casey was.
For example, if she was on the HP desktop, she had to be at mom and dad's.
If she was on her laptop, she probably had to be at Tony's or Amy's where she could get an internet connection. Yes, she could have been at Starbuck's. But doubtful she was at Jay Blanchard Park.
Of course, this does mean a more meaty post is forthcoming.
For example, if she was on the HP desktop, she had to be at mom and dad's.
If she was on her laptop, she probably had to be at Tony's or Amy's where she could get an internet connection. Yes, she could have been at Starbuck's. But doubtful she was at Jay Blanchard Park.
Of course, this does mean a more meaty post is forthcoming
.
BondJamesBond
Blunt Instrument
- Joined
- Aug 21, 2008
- Messages
- 3,871
- Reaction score
- -12
Time to bump this thread up some and updating what we know from the computer searches. In particular, some of the information we have from various computer searches can help fill gaps in our understanding of where Casey was.
For example, if she was on the HP desktop, she had to be at mom and dad's.
If she was on her laptop, she probably had to be at Tony's or Amy's where she could get an internet connection. Yes, she could have been at Starbuck's. But doubtful she was at Jay Blanchard Park.
Of course, this does mean a more meaty post is forthcoming
Drop the hammer...:highfive:
JWG
Active Member
- Joined
- Oct 22, 2007
- Messages
- 1,786
- Reaction score
- -47
On pages 2844 and 2845 are two screen shots of a computer forensic application called Encase Law Enforcement. It appears that this program is reporting the number of files that were created / written / accessed / modified / deleted. The data is summarized to show hourly activity on the HP desktop and Compaq laptop by hour for the days of June 16 and June 17. Although we do not know exactly what each "dot" means in the plot, we can use the information to see a relative usage pattern.
I am going to make the following assumptions:
1) The HP desktop always stays in the Anthony home
2) The Compaq laptop traveled around with Casey
3) Cindy's working hours ~ 8-5 PM so not at home during that time
4) George's working hours ~ 2-10 PM so not at home during that time
5) Cindy clearly used computer for email and managing social networking page
6) Not sure what George's usage of computer was, but reasonable to assume he surfed as well.
Looking back at the screen shot, although we do not know exactly what each "dot" means in the plot, we can use the information to see a relative usage pattern. What I have done below is show the relative usage of the two computers, as reported by EnCase. The 100% from 9-10 PM on the 17th for the Compaq computer means that was the most active computer usage for either computer during the two days. A 49% from 12-1 AM on the 16th for the desktop means the computer was roughly half as active as the previous example.
My interpretation is as follows:
The HP computer had relatively light usage on the 17th. I believe this was likely indicative of the parent's computer usage. The 11PM to 1AM usage into the 17th is probably Cindy, and after that is probably George - based on when each has to get up for work in the AM. Yes, seems odd for George, but maybe he was surfing Websleuths. :waitasec:
KC was a very active user, based on what we see with the Compaq on the 17th. Thus, based on the level of activity and the assumptions I listed above, I humbly conclude the following:
KC spent the night of the 15th / morning of the 16 at her parents. She is very active on the HP in the morning, probably before Caylee gets up. Caylee gets up between 8 and 9, usage drops. Caylee then plays or watches TV from 9-10 while Casey gets back on the computer until noon.
From noon to 2 PM there is no HP activity, supporting George's statements he saw the two and they left around 1 PM. However, from 2 to 3 - after George has left for work - the usage goes way up. This is the second most active period of either computer during this time.
Usage abruptly ends at 3 PM. I suspect Casey was preoccupied from 2 to 3 and not paying attention to Caylee. Around 3 PM, I submit, is when Casey discovers something awful happened to Caylee.
The minimal activity seen on the Compaq (and I do mean minimal) can easily be explained by the laptop being powered on and open and connected to the internet. This alone will cause some small number of files to be accessed and modified. Casey did not really need to be doing anything on the computer.
I am going to make the following assumptions:
1) The HP desktop always stays in the Anthony home
2) The Compaq laptop traveled around with Casey
3) Cindy's working hours ~ 8-5 PM so not at home during that time
4) George's working hours ~ 2-10 PM so not at home during that time
5) Cindy clearly used computer for email and managing social networking page
6) Not sure what George's usage of computer was, but reasonable to assume he surfed as well.
Looking back at the screen shot, although we do not know exactly what each "dot" means in the plot, we can use the information to see a relative usage pattern. What I have done below is show the relative usage of the two computers, as reported by EnCase. The 100% from 9-10 PM on the 17th for the Compaq computer means that was the most active computer usage for either computer during the two days. A 49% from 12-1 AM on the 16th for the desktop means the computer was roughly half as active as the previous example.
Code:
[FONT=Courier New]HP Desktop Compaq Laptop
16-Jun
12AM 1AM 49% *****
7AM 8AM 74% *******
8AM 9AM 15% **
10AM 11AM 80% ********
11AM 12PM 49% ***** 0%
1PM 2PM 1%
2PM 3PM 82% ******** 1%
4PM 5PM 1%
11PM 12AM 23% **
17-Jun
12AM 1AM 3%
1AM 2AM 6% *
3AM 4AM 36% ****
4AM 5AM 5% *
8AM 9AM 5% *
12PM 1PM 26% ***
1PM 2PM 3%
2PM 3PM 80% ********
4PM 5PM 13% *
7PM 8PM 54% *****
8PM 9PM 44% ****
9PM 10PM 100% **********
10PM 11PM 65% *****
11PM 12AM 6% * [/FONT]The HP computer had relatively light usage on the 17th. I believe this was likely indicative of the parent's computer usage. The 11PM to 1AM usage into the 17th is probably Cindy, and after that is probably George - based on when each has to get up for work in the AM. Yes, seems odd for George, but maybe he was surfing Websleuths. :waitasec:
KC was a very active user, based on what we see with the Compaq on the 17th. Thus, based on the level of activity and the assumptions I listed above, I humbly conclude the following:
KC spent the night of the 15th / morning of the 16 at her parents. She is very active on the HP in the morning, probably before Caylee gets up. Caylee gets up between 8 and 9, usage drops. Caylee then plays or watches TV from 9-10 while Casey gets back on the computer until noon.
From noon to 2 PM there is no HP activity, supporting George's statements he saw the two and they left around 1 PM. However, from 2 to 3 - after George has left for work - the usage goes way up. This is the second most active period of either computer during this time.
Usage abruptly ends at 3 PM. I suspect Casey was preoccupied from 2 to 3 and not paying attention to Caylee. Around 3 PM, I submit, is when Casey discovers something awful happened to Caylee.
The minimal activity seen on the Compaq (and I do mean minimal) can easily be explained by the laptop being powered on and open and connected to the internet. This alone will cause some small number of files to be accessed and modified. Casey did not really need to be doing anything on the computer.
BondJamesBond
Blunt Instrument
- Joined
- Aug 21, 2008
- Messages
- 3,871
- Reaction score
- -12
FWIW...some other information about what was going on in the same timeframe...
Monday, 6/16 Noon-2PM Casey 5 out of 6 pings are on the cell tower closest to Lee's (a.k.a.Twr 22).
Monday, 6/16 3:04:06 PM INCOMING CALL George A. (Cell) Casey A. 0.4 mins
Tuesday, 6/17, 3:15PM Casey texts Amy, "can't wait to finally get you moved in""
Tuesday, 6/17, 3:31PM the nursing home pics of Caylee are downloaded onto the laptop.
Monday, 6/16 Noon-2PM Casey 5 out of 6 pings are on the cell tower closest to Lee's (a.k.a.Twr 22).
Monday, 6/16 3:04:06 PM INCOMING CALL George A. (Cell) Casey A. 0.4 mins
Tuesday, 6/17, 3:15PM Casey texts Amy, "can't wait to finally get you moved in""
Tuesday, 6/17, 3:31PM the nursing home pics of Caylee are downloaded onto the laptop.
Georgia101957
Inactive
- Joined
- Jul 31, 2008
- Messages
- 279
- Reaction score
- 1
Snipped
Around 3 PM, I submit, is when Casey discovers something awful happened to Caylee.
and would that tie in with the flurry of phone calls? Great sleuthing!
Around 3 PM, I submit, is when Casey discovers something awful happened to Caylee.
and would that tie in with the flurry of phone calls? Great sleuthing!
Devon
New Member
- Joined
- Nov 29, 2008
- Messages
- 767
- Reaction score
- 0
On pages 2844 and 2845 are two screen shots of a computer forensic application called Encase Law Enforcement. It appears that this program is reporting the number of files that were created / written / accessed / modified / deleted. The data is summarized to show hourly activity on the HP desktop and Compaq laptop by hour for the days of June 16 and June 17. Although we do not know exactly what each "dot" means in the plot, we can use the information to see a relative usage pattern.
I am going to make the following assumptions:
1) The HP desktop always stays in the Anthony home
2) The Compaq laptop traveled around with Casey
3) Cindy's working hours ~ 8-5 PM so not at home during that time
4) George's working hours ~ 2-10 PM so not at home during that time
5) Cindy clearly used computer for email and managing social networking page
6) Not sure what George's usage of computer was, but reasonable to assume he surfed as well.
Looking back at the screen shot, although we do not know exactly what each "dot" means in the plot, we can use the information to see a relative usage pattern. What I have done below is show the relative usage of the two computers, as reported by EnCase. The 100% from 9-10 PM on the 17th for the Compaq computer means that was the most active computer usage for either computer during the two days. A 49% from 12-1 AM on the 16th for the desktop means the computer was roughly half as active as the previous example.
My interpretation is as follows:Code:[FONT=Courier New]HP Desktop Compaq Laptop 16-Jun 12AM 1AM 49% ***** 7AM 8AM 74% ******* 8AM 9AM 15% ** 10AM 11AM 80% ******** 11AM 12PM 49% ***** 0% 1PM 2PM 1% 2PM 3PM 82% ******** 1% 4PM 5PM 1% 11PM 12AM 23% ** 17-Jun 12AM 1AM 3% 1AM 2AM 6% * 3AM 4AM 36% **** 4AM 5AM 5% * 8AM 9AM 5% * 12PM 1PM 26% *** 1PM 2PM 3% 2PM 3PM 80% ******** 4PM 5PM 13% * 7PM 8PM 54% ***** 8PM 9PM 44% **** 9PM 10PM 100% ********** 10PM 11PM 65% ***** 11PM 12AM 6% * [/FONT]
The HP computer had relatively light usage on the 17th. I believe this was likely indicative of the parent's computer usage. The 11PM to 1AM usage into the 17th is probably Cindy, and after that is probably George - based on when each has to get up for work in the AM. Yes, seems odd for George, but maybe he was surfing Websleuths. :waitasec:
KC was a very active user, based on what we see with the Compaq on the 17th. Thus, based on the level of activity and the assumptions I listed above, I humbly conclude the following:
KC spent the night of the 15th / morning of the 16 at her parents. She is very active on the HP in the morning, probably before Caylee gets up. Caylee gets up between 8 and 9, usage drops. Caylee then plays or watches TV from 9-10 while Casey gets back on the computer until noon.
From noon to 2 PM there is no HP activity, supporting George's statements he saw the two and they left around 1 PM. However, from 2 to 3 - after George has left for work - the usage goes way up. This is the second most active period of either computer during this time.
Usage abruptly ends at 3 PM. I suspect Casey was preoccupied from 2 to 3 and not paying attention to Caylee. Around 3 PM, I submit, is when Casey discovers something awful happened to Caylee.
The minimal activity seen on the Compaq (and I do mean minimal) can easily be explained by the laptop being powered on and open and connected to the internet. This alone will cause some small number of files to be accessed and modified. Casey did not really need to be doing anything on the computer.
This fits in very well with the theory that I have been nursing along for some time now, although I suspected that it was either during her long phone call that afternoon (with Amy?) or whilst she was on the PC. I also think the 'ladder still by the pool and gate left open' incident mentioned by GA/CA may have been on the same day.
JWG
Active Member
- Joined
- Oct 22, 2007
- Messages
- 1,786
- Reaction score
- -47
Yes, Casey was very distracted from 1:45 until just after 3, with the Amy call, computer work, and Jesse G. call. She was not paying close attention to Caylee, IMO.
BondJamesBond
Blunt Instrument
- Joined
- Aug 21, 2008
- Messages
- 3,871
- Reaction score
- -12
...doesn't necessarily change your generally theory, but, FWIW, after the long call w/ Amy is the 11min call w/ Jesse when he stated he heard Caylee...just FYI. The "flurry" started @ 4:10PM. George called right on the heal of the end of Jesse's call for <1min @ 3:04PM. Between 3:04PM and the start of the flurry of calls @ 4:10PM there is less than 1minute cumulative phone time (texts & calls), and no computer activity. Of course, this means you have to buy Jesse's statement...or....something happened immediately after he heard Caylee and Casey was distracted otherwise...
Apologies in advance...since the call info OT to computer forensics, but, IMHO, relevant to using in combo w/ computer forensics to establish what was actually going on.
Thinking of Jesse's statement, when were the photos and videos of Caylee being downloaded? Could the perp have been listening to those when talking with Jesse, or they were just playing in the background on the computer, you see where I am going with that...