April 22 weekend of Sleuthiness

Status
Not open for further replies.
Nicely done.

In addition, if I understand correctly, the example shown from BC's laptop showed each cursor file with all three visible identical with each other. Open hand and closed hand files had identical timestamp for all visible values. Not normal after having done a search.

Further, any search after that time would have also updated these values. Not sure which other Google apps might share those images.

Finally, the report was indicating invalid timestamp, probably because one of the hidden timestamps is inconsistent with the visible ones.

So what does this mean? The CPD tampered with the files, Brad thought he deleted them. Somebody else? The operating system updated, Google updated? I'm just trying to get an understanding of what happened and what the next logical conclusion is.
 
Nicely done.

In addition, if I understand correctly, the example shown from BC's laptop showed each cursor file with all three visible identical with each other. Open hand and closed hand files had identical timestamp for all visible values. Not normal after having done a search.

Further, any search after that time would have also updated these values. Not sure which other Google apps might share those images.

Finally, the report was indicating invalid timestamp, probably because one of the hidden timestamps is inconsistent with the visible ones.

I am not sure sure, because the time stamp for that search only indicates one search and time captured was when the search ended..not when he first entered the site to his searchings and zoomings...It to me just indicates he never visited that site again on that map to do further searchings...Thats how I see it....Why would a site keep entrance and exit times of every search anyway?? Just asking...

I know JW believes it indicates program initiated...but not so sure..I hope testimony (Google Guy) clearify's that clear and concisely for the jury..
 
I don't think the money accusations about Nancy are fair in any way. Yes, people can make do with $300 a month, and she had $300 a week. I suspect that she was buying groceries out of that, and whatever was leftover was hers to do with as she pleased. But groceries for 4 will set you back a ways, and expendable income left over isn't going to be huge.

<respectively snipped>.

According to AS, BC was buying his own groceries, so NC was only buying groceries for herself and two children under five and it seems that BC was still buying the incidentals. I can't imagine that food for one adult woman and two young children exceeded even $100 a week, if that. BC was also paying all the bills, mortgage, line of credit, credit cards, utilities, car lease payments, 401k, his portion of health insurance through his employer for a family, etc. I am thinking that didn't leave a lot of play money over for him.
 
I am not sure sure, because the time stamp for that search only indicates one search and time captured was when the search ended..not when he first entered the site to his searchings and zoomings...It to me just indicates he never visited that site again on that map to further do searchings...Thats how I see it....Why would a site keep entrance and exit times of every search anyway?? Just asking...

I know JW believes it indicates program initiated...but not so sure..I hope testimony (Google Guy) clearify's that clear and concisely for the jury..

Since this would be the time he ended this search, could it be possible that the orginial search was done weeks, days before. That day he just 'looked' again to verify his intentions/needs? This is the search that ended at 1:15 that day?

So premeditation if that is the case..and I could live with that for a guilty vote if the Google Guy can confirm, somehow, that is what this means.

Kelly
 
If CPD tampered with the files, why the heck did they then have the FBI look at them? Wouldn't they be concerned about advanced techniques/technologies that could detect tampering? That would just be idiotic to drag the FBI into it, if they'd planted files.
 
I'm not Dramamama, but in an effort to allow you to keep your focus on your particular area of expertise, I'll take a shot at explaining it.

First of all, let's clarify what we are talking about. These "openhand" and "closedhand" files are not maps and they are not something that a user would typically be saving themselves. When you are in Google Maps with IE and not clicking on anything, your cursor is an arrow. Then, when you click on the map and start dragging it around, your cursor will change to a little picture of a closed hand.

The picture of that closed hand is what is in the closedhand.cur file (the name of the file is actually closedhand_8_8.cur for IE8). That's all this file is. Just a picture of a closed hand.

The first time you click and drag on the map, Google actually goes across the Internet and gets that little picture from a Google site called maps.gstatic.com. For IE8, it gets the closed hand picture from here: http://maps.gstatic.com/intl/en_us/mapfiles/closedhand_8_8.cur

Now, Google Maps doesn't want to have to keep going across the Internet to get the little picture of the hand every time you click+drag on the map, so it caches a copy of the picture on your computer. When you subsequently click+drag on the map, it uses that cached picture of the hand. On my Win7 system with IE8, the cached version of the little picture is a .bmp file. I didn't ask it to save it in that format, it just did it. I would assume that it did the same thing with whatever version of Windows and IE that BC had.

I have attached a screen grab of what Windows file properties shows for the closedhand_8_8.cur file on my system. Notice that the name it shows for the actual file is the .cur one out on the Internet at maps.gstatic.com. But, below that, it says that the Cached name is closedhand_8_8[1].bmp.

I assume that the cached file is what they were talking about in court. The create date on it would be the time that it was downloaded from maps.gstatic.com and the cache file was saved. Presumably, the access time would be the last time the closed hand was loaded. So, not the last time you dragged. It's the last time you changed the cursor from the arrow to the closed hand. So, the last time you did click+drag.

If the question was how the create time and access time would be the same on the cached file, it seems like it would mean that you clicked+dragged on a map to make it switch to the closed hand cursor, dragged the map around, then released the mouse button and never did click+drag again.
Thanks, SS!
So, in English, can you guys tell me what it means with regard to the testimony in question? :)

Also how about this testimony? (following State objecting to using time zone setting registry report--objection sustained.)
K-Last access file is the time last access on local machine. If the cursor moves at all would you expect to see the same beginning and end time?
W-No. It's not logical or possible.
 
If CPD tampered with the files, why the heck did they then have the FBI look at them? Wouldn't they be concerned about advanced techniques/technologies that could detect tampering? That would just be idiotic to drag the FBI into it, if they'd planted files.

I don't think they thought they screwed it up. If this file plant was done correctly it could have been undetectable.
 
I just did an experiment on the google maps. I zoomed out to see the whole earth map, and then zoomed in 11 times (per the testimony). Each zoom doubles the size. There is absolutely no detail to be seen - just a road map.

http://maps.google.com/
 
I don't think they thought they screwed it up. If this file plant was done correctly it could have been undetectable.

And so the FBI comes across odd timestamps. Yet they're still testifying for the prosecution? Collusion?
 
Since this would be the time he ended this search, could it be possible that the orginial search was done weeks, days before. That day he just 'looked' again to verify his intentions/needs? This is the search that ended at 1:15 that day?

So premeditation if that is the case..and I could live with that for a guilty vote if the Google Guy can confirm, somehow, that is what this means.

Kelly

Actually momof7, I think he only searched that site once..and happen to believe ( my speculation tho) that he caught site of that area Friday, after he left Lowe's purchase of Drop Cloth at 930AM and didnt get to work until almost 1130...I have alwas wondered what he did in that timeframe???? Naybe he had a lookyloo then did his search to be sure before he left for lunch about 130PM July 11th, 2008..I tend to think he was still formulating some plan at that point and needed a good spot to deposit poor Nancy??

I still hold the belief that this search is the one thing that the jurors will be able to grasp as it the one item that Defense so far has focused on to discredit....I doubt Def. will even brooch that subject specifically, but sure pros. will...Def. will do all they can to confuse the jury....We will see on Monday just how it goes I guess.

ETA~~ If Brad had visited that site prior and to that particular area..it would have shown initial search and last search time (edited date of access or change)..For us guys not forensically speaking..if you check properties of your image after 2nd or 3rd visit..you will the to various timestamps..i.e last accessed etc
 
This is what makes me think this is all nuts. The CPD tampered with the files to frame Brad. The FBI knows this, but testifies for the prosecution anyway, because everyone is corrupt.

Why didn't CPD just put some mica on Brad's shoes?
 
Wonder if any jurors have as much computer knowledge as it appears some of the posters have. It is interesting to read but most goes over my head. Actually, I just come to the thinking of common sense...who's computer, why would anyone hack it, the chances of it happening when his wife goes missing, etc. and don't get as technical. Someone on that jury is going to have to take the lead with this stuff if it is going to be sifted through as much as it has been here. For me, I think the jurors will pay a lot of attention to the circumstantial evidence of Brad's behavior and the state of their marriage. It will be very interesting to hear from the jurors if they choose to speak.
 
I just did an experiment on the google maps. I zoomed out to see the whole earth map, and then zoomed in 11 times (per the testimony). Each zoom doubles the size. There is absolutely no detail to be seen - just a road map.

http://maps.google.com/

No, the zip code 27518 defaults to zoom 11, which is the middle of the scale. That was the starting point. Then it scrolled and zoomed, scrolled and zoomed to almost maximum. I'm not sure exactly what he meant by almost maximum zoom, but I'm sure about the starting point. Does that help?
 
If CPD tampered with the files, why the heck did they then have the FBI look at them? Wouldn't they be concerned about advanced techniques/technologies that could detect tampering? That would just be idiotic to drag the FBI into it, if they'd planted files.

Good grief, you're exactly right about that.
 
And so the FBI comes across odd timestamps. Yet they're still testifying for the prosecution? Collusion?

Personally I found it strange that SA J did the initial investigation of the laptop but CC did the testimony around the Google search.

The FBI testimony also said they saw the invalid files one said he could not explain them and the other didn't mention them in his report.

All these things seem fishy to me.
 
Actually momof7, I think he only searched that site once..and happen to believe ( my speculation tho) that he caught site of that area Friday, after he left Lowe's purchase of Drop Cloth at 930AM and didnt get to work until almost 1130...I have alwas wondered what he did in that timeframe???? Naybe he had a lookyloo then did his search to be sure before he left for lunch about 130PM July 11th, 2008..I tend to think he was still formulating some plan at that point and needed a good spot to deposit poor Nancy??

I still hold the belief that this search is the one thing that the jurors will be able to grasp as it the one item that Defense so far has focused on to discredit....I doubt Def. will even brooch that subject specifically, but sure pros. will...Def. will do all they can to confuse the jury....We will see on Monday just how it goes I guess.

I agree, I have always been convinced he went to at least Fielding Drive during the time between Lowe's and work. Since it was so close to his home, I was not sure if 'maybe' he went there before Lowe's, then after Lowe's was flirting with other areas. I really find it odd, the Fielding Drive location is the only one on the computer, honestly. I have the belief that he was checking the ariel look to make sure there was no other way in or out, closest house etc as it is wooded in the back (appears so in the pictures posted). If the Pros can get someone, anyone to confirm that that it could have been there BEFORE 7/11 and he only ACCESSED it again, causing a different timestamp I think I could say premed all the way, guilty as charged.

Kelly
 
Actually momof7, I think he only searched that site once..and happen to believe ( my speculation tho) that he caught site of that area Friday, after he left Lowe's purchase of Drop Cloth at 930AM and didnt get to work until almost 1130...I have alwas wondered what he did in that timeframe???? Naybe he had a lookyloo then did his search to be sure before he left for lunch about 130PM July 11th, 2008..I tend to think he was still formulating some plan at that point and needed a good spot to deposit poor Nancy??

<snip>

Where is the report or testimony that he badged into work at 11:30 on that Friday?
 
Where is the report or testimony that he badged into work at 11:30 on that Friday?

There's not. There's a coworker who says "I talked to him on the chat program around 11:30 at work, but that doesn't mean he wasn't there before that." Or something to that effect. We've had no testimony on the time he arrived at work on Friday at all.
 
if you moved the file to another folder or directory, then the created and modified would be the same time. If you copy a file, then they would be different.

I am not sure what utility he used to save the file as a .bmp. But with certain imaging programs, you can save a set of tiles as static content, and then specify when you open them to be dynamic and opened as another file type. Make sense?

When who saved it?
 
Status
Not open for further replies.

Staff online

Members online

Online statistics

Members online
102
Guests online
3,157
Total visitors
3,259

Forum statistics

Threads
592,290
Messages
17,966,750
Members
228,735
Latest member
dil2288
Back
Top