wenwe4
Well-Known Member
- Joined
- Oct 6, 2008
- Messages
- 9,499
- Reaction score
- 7,359
John Dennis Bradley - owner business - computer software since 2001, LE officer in Ontario CA, investigator training and professional training most career, in 2000 transferred to ?crime....in 2005 rank sargent - back in uniform 10 months later left LE and director of crimes ....started software co. Armor(?) data....develop software .....with bank and found it wasn't for him....didn't further his ability to further computer forensic investigation renamed Amor data to fulltime business - increase demand for software 2 yrs ...he does primary training on his software....expert witness in Canada in computer forensic in Ontario Canada...in connection with his Co. criminal defense case in Torornto - 2 years ago... expert witness accepted in computer analysis....casheback focus on computer cashe history or cache (sorry sics) temp folders or series of folders to make it easier to navigate the internet - fill a request faster...extract info with software...present in fashion for investigation of what is taking place..compensates for times changes....lots info stored in cache in time fragments.....conversion time zones from GMT.....take into account time.....
he teaches...while LE 2 years advanced computer forensics ....along lines of time he went to the bank....local college forensic course...train circulum for his software....also guest speaker @ conferences....met Kevin Stanger....look @ a datafile....he had a file on thumbdrive part of investigation....recovered from harddrive relating to a matter...object overruled
general asked what info given to him....block of data firefox 2 browser, certain characteristics plain text info....keyword info word chloroform....contiguous info....,location on the hard drive recovered from...unallocated clusters portion harddrive not being used - subject to be overwritten - sometimes not for a long time- header and content within the footer...was intact...why important in unallocated space...greater the number less likely attacked? file....file was intact...copied to laptop workstation and copied his thumbdrive to laptop....what they were looking @ when he reviewed file....took time scrol thru entire file...correct and keyword chloroform contained within....replicated and present on the data he copied..
....size of file (missed it)
deleted file from it's size conclusion belief @ time based on size of file unallocated space....a level of inactivity for that not be overwritten - varies use/size of hard drive/how much data actually used.....surprised actually recoverable.....tell when internet hx was deleted? can't say ....firefox auto delete once reach size or date....that version didn't come with any auto default to delete history.....must be deleted manually....next step .....ran thru enormous number of tests....issues were why couldn't be parced or decoded ....over 3 days spent looking @ very small details...spent a long time how this was different from anything else...parce and decoded it able to write to improve functions in software deal with anamoly - corrorborate work done with 3rd party to account records should be finding....cacheback generate report... 2 reports given to witness portion of the cacheback report for 3/17/08 and report for 3/21/08 except of one entry for the 20th...publish to jury during testimony (JB being entered into evidence?) HHBP any add'l objections? not at this time....publish
