Anthony's Computer Forensics

[joyce D]

Hey everyone had to re sign up due to forgot my login stuff.I dont know where on here to ask a question about computers.Its not related to this case so if you can send me a message with a link for help with my pc.Or if you have any knowledge i have a question.Thanks and you guys rock

 

[ziggy]

On the other hand...if Casey's chloraform search is on the 17th, perhaps she is asking RM about it and they have a discussion which triggers RM to find the dark humor chloraform pic. and post it on the 18th. That piques KC's interest even more and she continues the searchs on the 21st. (hope I have these dates right, 4 hours of sleep).

 

[BondJamesBond]

Bringing over from the Q&A thread:

Verrrrry Interesting ...

The screenshot clearly indicates WFTV had access to a file we have not seen.

If it was released to the media, the public ought to be able to get it.

Wonder if this is a job for Muzikman?? I hate to always lean on him. Do you know of anyone else in the area that has had the gumption to visit the office down there?

...adding after a little Google work...

Here's the link to the WFTV report that makes these specific claims:

http://www.wftv.com/news/17567178/detail.html

If you watch the video (link in the story) they show a screenshot of the specific site they allege Casey visited.

Now...(a) I defer to JWG on the released docs being silent on these searches, and (b) the media made errors in their reporting such as claiming the computer forensics showed Casey searched re: ZFG in June.

There were also references to the Duckett case early on...and another website claims that Lee was in contact with Josh...

So...FWIW...hope that helps.

The website WFTV showed in the video and indicated Casey visited, "over a year ago" is:
http://www.get-involved.com/

The story aired in September 26, 2008.

The link to missing children at the above site is a tool that was created Memorial Day Weekend 2006. The tool allows (1) a view of missing children by geographic location, and (2) adding a missing child to your MySpace friend's list to increase visibility to their cause. So, the timeframe we're talking about here for Casey to have visited the site is June 2006-September 2007.

Consider that Trenton Ducket went missing August 27, 2006 and the case obviously had a tremendous amount of local media attention.

Given Casey's proclivity for all things MySpace. Perhaps she ventured here to add Trenton's missing person file to her own MySpace friends list. Perhaps that has already been established, or if not, would be simple enough to confirm or debunk. Just a thought...

 

[JWG]

Bringing over from the Q&A thread:

The website WFTV showed in the video and indicated Casey visited, "over a year ago" is:
http://www.get-involved.com/

The story aired in September 26, 2008.

The link to missing children at the above site is a tool that was created Memorial Day Weekend 2006. The tool allows (1) a view of missing children by geographic location, and (2) adding a missing child to your MySpace friend's list to increase visibility to their cause. So, the timeframe we're talking about here for Casey to have visited the site is June 2006-September 2007.

Consider that Trenton Ducket went missing August 27, 2006 and the case obviously had a tremendous amount of local media attention.

Given Casey's proclivity for all things MySpace. Perhaps she ventured here to add Trenton's missing person file to her own MySpace friends list. Perhaps that has already been established, or if not, would be simple enough to confirm or debunk. Just a thought...

Or perhaps the visit germinated the seed for an extreme version of Münchausen syndrome by proxy. :waitasec:

 

[Lovejac]

Or perhaps the visit germinated the seed for an extreme version of Münchausen syndrome by proxy. :waitasec:

That's what I'm thinking, personally, JWG.

The bad seed.

 

[awakewriter]

Or perhaps the visit germinated the seed for an extreme version of Münchausen syndrome by proxy. :waitasec:

Interesting thought. I don't think she was trying to keep Caylee sick to get attention, though.

In fact, her text messages indicate she was annoyed when Caylee was sick because she had to stay home with her.

I haven't seen any evidence to indicate Caylee had recently been extremely ill or that Casey was trying to get Caylee treatment for any illnesses.

 

[JWG]

Interesting thought. I don't think she was trying to keep Caylee sick to get attention, though.

In fact, her text messages indicate she was annoyed when Caylee was sick because she had to stay home with her.

I haven't seen any evidence to indicate Caylee had recently been extremely ill or that Casey was trying to get Caylee treatment for any illnesses.

Illness is not what I was thinking. I was thinking more along the lines of "gee, Trenton's parents became celebrities when he went missing...wonder if the same would work for me?"

 

[debs]

Illness is not what I was thinking. I was thinking more along the lines of "gee, Trenton's parents became celebrities when he went missing...wonder if the same would work for me?"

There seems to be a lot of that going around.

 

[eddeva]

Hey everyone had to re sign up due to forgot my login stuff.I dont know where on here to ask a question about computers.Its not related to this case so if you can send me a message with a link for help with my pc.Or if you have any knowledge i have a question.Thanks and you guys rock

hi joyce - you only have 6 posts so i'm afraid it's impossible, as yet, to send you a message

 

[BondJamesBond]

Illness is not what I was thinking. I was thinking more along the lines of "gee, Trenton's parents became celebrities when he went missing...wonder if the same would work for me?"

...although "over a year ago" would be in the neighborhood of 525,590 minutes beyond Casey's attention span

FWIW...Melinda's 'fame' was short-lived...having committed suicide (with a shotgun ) less than two weeks after he was 'abducted'.

I checked the "cayleeismissing" myspace last night and "missing" friends are listed there for both Trenton and Josh (Trenton's living father). I haven't followed the MySpace transformation in detail, but, if (1) the cayleeismissing site is the reincarnation of Casey's former personal site, and (2) MySpace provides a means to view when a "friend" was added, a little sleuthin' might confirm/debunk if adding Trenton occurred pre-September '07 resulting in this report we're given by WFTV.

My suspicion is - not unlike JWG's earlier speculation about stream-of-consciousness surfing through sites re: chloroform, etc, being unrelated to Caylee's death - that this visit to a missing children site was just Casey's foray into something vogue for MySpace @ the time.

JWG - did you look specifically for the following sites?
http://www.get-involved.com/
http://www.peace-train.org/
...as their description alone might not have been explicit enough scanning through casually to denote them as being related to 'missing children'.

 

[JWG]

...although "over a year ago" would be in the neighborhood of 525,590 minutes beyond her attention span

I checked the "cayleeismissing" myspace last night and "missing" friends are listed there for both Trenton and Josh (Trenton's living father). I haven't followed the MySpace transformation in detail, but, if (1) the cayleeismissing site is the reincarnation of Casey's former personal site, and (2) MySpace provides a means to view when a "friend" was added, a little sleuthin' might confirm/debunk if adding Trenton occurred pre-September '07 resulting in this report we're given by WFTV.

My suspicion is - not unlike JWG's earlier speculation about stream-of-consciousness surfing through sites re: chloroform, etc, being unrelated to Caylee's death - that this visit to a missing children site was just Casey's foray into something vogue for MySpace @ the time.

JWG - did you look specifically for the following sites?
http://www.get-involved.com/
http://www.peace-train.org/
...as their description alone might not have been explicit enough scanning through casually to denote them as being related to 'missing children'.

Good point. It took a moment for me to see that there is a connection between those sites and missing person's sites. Question is, what did those sites look like when KC surfed across them? How prominent were the missing children links back then.

stream-of-consciousness surfing is probably behind these searches as well...

 

[BondJamesBond]

Good point. It took a moment for me to see that there is a connection between those sites and missing person's sites. Question is, what did those sites look like when KC surfed across them? How prominent were the missing children links back then.

stream-of-consciousness surfing is probably behind these searches as well...

Upon reading further...

It appears the Memorial Day 2006 date is associated with a petition that was drafted and subsequently circulated to get MySpace to participate.

Then, January 23, 2007, MySpace joined in partnership with the Nat'l Center for Missing & Exploited Children.

So....Casey either:
(a) signed the petition through this website late-May 2006-September 2007, or
(b) she added Trenton as a 'missing' Friend to her MySpace late-Aug 2006 to early-Sep 2007, or
(c) she visited the Yahoo Map=NMEC map "mash up" tool (dunno the origin date), or
(d) something else???

I can't view the petition link from here...perhaps someone that can will be able to see other signatures and check for Casey's???

 

[JWG]

First, a BIG thanks to Muzikman :rocker: for uploading the Sept. 26 computer search data. Some questions answered, some left unanswered. This was a big help though. :bow:

As much as I love the guy - and I do want to give him a hug some day - I am convinced now that the visits to escort sites found on the Anthony home computer were visits done by George and not by KC.

First, there are no similar visits on the laptop computer that was in KC's possession after June 16. Admittedly, that is not saying much as the internet history on that computer only went back to July 3.

More importantly though, there are four time periods in which the visits occur on the home computer that KC could not possibly have been responsible:

• Saturday, July 12 6:49 to 7:09 AM (no pings at that time, but near that time KC pings from Tony's)
• Tuesday, July 8 3:08 to 3:18 PM (KC pings from Tony's)
• Sunday, June 22 11:25 to 11:28 PM (no pings at that time, but near that time KC pings from Tony's)
• Thursday, June 19 9:49 PM (no pings at that time, but near that time KC pings from Tony's)

No other visits occur between June 16 and July 16.

Many other visits occur prior to June 16, but they are often preceded by visits to sports news websites and career / job-hunting websites. Unlikely visits by KC, IMHO.

I will post more on those earlier visits later.

 

[karen in New York]

You know its possible that George was checking to see if his daughter, Casey was on any of those adult sites. They probably suspected something bad and G tried to check it out.
I was wondering if she did phone sex for a living ...

 

[JWG]

Here are the other dates and approximate times escort sites were visited on the Anthony home computer. Note that no visits were recorded on the laptop in KC's possession.

Anyone thinking that March 2008 might be an important month in the Anthony family dynamic?

May 30 5:23 PM
May 7 11:28 PM
May 5 11:01 - 11:10 PM
April 10 11:06 PM
April 7 2:04 PM, 4:07 PM
April 6 11:05 - 11:37 PM
April 5 9:56 AM, 4:35 PM
April 3 11:20 PM - 11:59 PM
April 3 11:22 AM - 12:22 PM
April 2 11:47 PM - 12:42 AM
April 2 8:20 AM - 1:34 PM (sparse - not very many clicks)
April 1 8:09 AM
March 31 11:53 PM
March 30 11:50 PM
March 28 12:47 AM, 1:48 PM
March 27 12:09 AM, 7:21 PM
March 26 12:25 AM, 11:21 PM
March 25 11:52 PM
March 24 12:26 PM, 11:02 PM
March 23 10:18 PM - 11:35 PM
March 21 7:15 AM, 6:16 PM
March 20 6:15 AM, 6:46 PM
March 21 6:45 AM
March 18 6:44 PM
March 17 6:56 AM, 11:09 AM - 12:54 PM
March 16 11:38 PM
March 15 7:05 AM, 11:56 AM - 12:30 PM
March 14 6:04 AM - 8:34 AM
March 15 7:04 AM - 7:42 AM, 10:47 AM - 11:33 AM, 1:44 PM - 2:58 PM, 4:23 PM - 4:39 PM
March 14 9:16 AM - 9:26 AM
February 22 4:27 PM
February 20 8:29 AM - 8:41 AM
February 10 12:35 PM, 7:38 PM
February 8 4:44 PM - 4:56 PM
February 7 4:55 PM
January 31 1:53 PM, 6:31 PM
January 29 6:25 AM
January 28 6:09 AM
January 27 11:11 AM
January 25 4:55 PM
January 24 2:45 PM
January 23 11:40 AM, 10:39 PM
January 22 2:22 PM
January 13 4:06 AM
January 6 7:04 AM
December 20 9:45 - 9:58 PM
December 8 7:02 AM

 

[wonderer]

I don't know if this is the case, but there's actually a "company" that pays people to get others to sign up to their escorts' website. They post an ad on Craigslist, talk to people on IM and get them to sign up (and get paid via Paypal or check for each sign up).

It's a slight possibility that this is why there's so many escort page vists. It's probably more likely that someone was looking up escorts for themselves or looking to be one, though.

 

[Annie Maude]

Illness is not what I was thinking. I was thinking more along the lines of "gee, Trenton's parents became celebrities when he went missing...wonder if the same would work for me?"

I wouldn't be surprised if that is a big part of motive. It's almost understandable, in a very sick sort of way.

 

[Where's Andre]

I don't know if this is the case, but there's actually a "company" that pays people to get others to sign up to their escorts' website. They post an ad on Craigslist, talk to people on IM and get them to sign up (and get paid via Paypal or check for each sign up).

It's a slight possibility that this is why there's so many escort page vists. It's probably more likely that someone was looking up escorts for themselves or looking to be one, though.

This could also be evidence of malware activity. Malware can generate what some people call "pornado" activity meant to inflate click count advertising revenue of pr0n sites or similar baditude, by forcing clicks without user input.

 

[JWG]

I've been looking through the mountain of computer forensic data released last September and uploaded yesterday to a file sharing site by dedicated websleuther Muzikman. :rocker:

I posted yesterday on the escort service surfing activity, and I will have more to say about that in a future post. Suffice it to say, I am 99% certain George is solely responsible for the visits to escort sites, :blushing: and KC is uninvolved in that surfing activity.

This evening I took a close look at the visits to missing person's websites widely reported last September in the media. My conclusion is that KC did not visit missing persons websites prior to Caylee's disappearance. In fact, I do not believe she is responsible for those visits at all.

Following is the raw data for the visits in question:

07/16/2008 14:51:37 06/24/2008 16:01:46 http://www.missingkids.com/photographs/NCMC1097725c1t.jpg
07/16/2008 14:51:31 07/03/2008 01:28:12 http://www.missingkids.com/photographs/NCMC1099693c1t.jpg
07/16/2008 14:51:25 07/10/2008 11:37:33 http://www.missingkids.com/photographs/NCMC1096469c1t.jpg
07/16/2008 14:51:24 05/27/2008 12:58:47 http://www.missingkids.com/photographs/NCMC1096536c1t.jpg
07/16/2008 14:51:24 04/24/2008 16:06:48 http://www.missingkids.com/photographs/NCMC1094062c2t.jpg
07/16/2008 14:51:24 04/24/2008 16:06:48 http://www.missingkids.com/photographs/NCMC1094062c1t.jpg
07/16/2008 14:51:24 05/03/2008 17:07:29 http://www.missingkids.com/photographs/NCMC1094659c1t.jpg
07/16/2008 14:51:24 06/23/2008 15:30:12 http://www.missingkids.com/photographs/NCMC1098504c1t.jpg
07/16/2008 14:51:24 04/24/2008 16:06:48 http://www.missingkids.com/photographs/NCMC1094062c3t.jpg
07/16/2008 14:51:24 06/24/2008 14:14:01 http://www.missingkids.com/photographs/NCMC1098088c1t.jpg
07/16/2008 14:51:24 07/02/2008 19:50:00 http://www.missingkids.com/photographs/NCMC1099149c1t.jpg
07/16/2008 14:51:24 07/01/2008 00:06:13 http://www.missingkids.com/photographs/NCMC1099410c1t.jpg
07/16/2008 14:51:24 03/17/2008 15:47:48 http://www.missingkids.com/photographs/NCMC1091268c1t.jpg

07/16/2008 14:51:24 04/10/2007 12:29:03 http://www.get-involved.com/mashup/marker.swf
07/16/2008 14:51:22 http://www.get-involved.com/mashup/RSS_Read.php?state=XX
07/16/2008 14:51:22 http://www.get-involved.com/mashup/RSS_Read.php?state=XX
07/16/2008 14:51:21 06/19/2007 06:32:24 http://www.get-involved.com/mashup/map_small.swf
07/16/2008 14:51:20 04/26/2007 08:04:49 http://www.get-involved.com/mashup/images/kids_widget_04.gif
07/16/2008 14:51:20 04/26/2007 08:04:48 http://www.get-involved.com/mashup/images/kids_widget_01.gif
07/16/2008 14:51:20 04/26/2007 08:04:49 http://www.get-involved.com/mashup/images/kids_widget_05.gif
07/16/2008 14:51:20 04/26/2007 08:04:49 http://www.get-involved.com/mashup/images/kids_widget_02.gif
07/16/2008 14:43:09 http://www.get-involved.com/mashup/RSS_Read.php?state=XX

There are a few things to note about each item listed. First, the items are objects on the website, such as an image (.gif or .jpg) or shockwave video (.swf). The web browser will store the objects on the computer so that the next time the website is visited, it will appear to load faster than the first time. This is called caching.

The date / time shown in red indicates when the object was accessed by the web browser. This is indicative of when the website was surfed.

The other date / time (if there is one) indicates when the object was last modified by whoever created it or otherwise owned the object. Using an image, for example, this date / time could indicate when the picture was taken, resized, photoshopped...you name it. It is often indicative of when the web page was created or modified. It is not indicative of when the web page was surfed.

Unfortunately, the media saw the old dates and assumed that they were surf dates. LE did not make that assumption. There is nothing in the complete forensic report that indicates they ever thought this was something to look into.

I should further point out that the sites were visited from the desktop computer.

So what really happened?

Sometime during the afternoon of the 16th the "cayleeismissing" myspace page goes live. This page becomes a missing person's website - Caylee's. Work on this page occurred between 2:37 PM and 2:52 PM on July 16th - completely encompassing the time the missing person's sites were accessed. It may have started earlier, but it definitely occurred during this time period.

Given KC was pre-occupied during this time, the best candidate for this activity is ... Lee. He was just trying to get Caylee's name out there as a missing person.

 

[kashell]

JWG-
You are brilliant!