Because, so far in testing the "how does one fake things in myspace" approaches, it does not appear that the last login date has been faked.
I am not going to pretend I am an expert in web pages and style sheets, because I am very far from it. But I know just enough to be dangerous. :bang:
If I dig through the page
source of my faked myspace page with my last login changed (as well as my sex, age, and location), here is what I see:
<td class="text" width="193" bgcolor="#ffffff" height="75" align="left"><font class="f1">
Female</font><font class="f2">
24 years old</font><font class="f3">
Miami, FL</font><font class="f4">
United States</font><font class="f5">
Last Login: 10/14/2008</font><font class="off">
<br />
<br />Male
<br />48 years old
<br />City, STATE
<br />United States
<br />
<br />
<span class="msOnlineNow "><img src="http://x.myspacecdn.com/modules/common/static/img/onlinenow2.gif" />Online Now!</span>
<br />
<br />Last Login: <span property="myspace:lastLogin" content="2009-05-28" datatype="xsd:date">5/28/2009</span>
<br />
</td>
Here is an image of the spoofed profile. Note the last login date and other information. I did not change any of that in my profile:
View attachment 3926
Notice in the source code that the original information
is still there (highlighted in
blue). The new information is in
red. Why does the new information show but not the original in the displayed page? :waitasec:
Because the hack adds the code
<font class="off">, which essentially
turns off the display of the original information, but does not remove it. So while we cannot see the original information when displayed in a web page, we can
always find it when looking at the page source ("CTL-U" in any browser).
One cannot remove the original information from myspace. They can only obscure it.
When I go into the "zenaida" web page, I find only
one set of information in the page source. There is no hidden original information paired with displayed fake information. :thumb:
The same holds true of the blog page that shows the sign-up date. Only one set of information can be found on that page - nothing is "turned off". :woohoo:
The zenaida myspace page, IMHO, is genuine.
Link to page here.
Which means to me that when LE was given the information by Valhall in late February (is that when you sent it to them Val?), they took the next two months to:
- Subpoena myspace for the IP addresses used to create and modify the page
- Discovered those IP addresses were tied to dates and times consistent with KC's location, possibly using cell records as a guide
- Found enough additional keywords that they could use to search unallocated sectors (deleted files) on the laptop for evidence
- Found traces of KC accessing the specific myspace page in question from those unallocated sectors
Furthermore, because the myspace page was created on June 16, cell pings and Tony's testimony of what he and KC did that evening, coupled with the Encase timeline reports from both computers indicate that KC created the website while at the Anthony home. Myspace IP logs would confirm this.