4:11
DIRECT EXAMINATION OF SANDRA OSBORNE BY LDB
Forensic computer examiner with OCSO.
She was asked to search the entire hard drive of the A's HP computer.
The search is done with her software - it's searches the entire hard drive. She used Encase - a forensic application that is widely accepted.
She was initially asked to search - chlorophyl, hand sanitizer and bamboo.
To ensure that any spelling of chlorophyl was found - she searched chloro. It took several hours and she let it run overnight.
In one place she found chlorophyl which was in a Microsoft dictionary that comes with the computer.
She searched for hand sanitizer and she did not find it anywhere on the computer.
She searched for bamboo. She found bamboo figurines, bamboo lanterns, flooring, reference to gaming. Household products would be furniture, lights, panda bears and tiki bars.
She did not find any reference to bamboo leaves.
She searched for access to the Gentiva website for the remote log in. She was not able to find any evidence of any remote log in into Gentiva.
CROSS EXAMINATION BY JB
When someone deletes something from their computer it goes into the unallocated spaces. The deleted data stays in the exact location where it is. When a file is stored on a computer, and then a user deletes the file, the reference to that file is deleted and it makes reference to the file system where the data resides - the computer is then told that that data is available and that will overwrite the original file that was there.
Overwritten items can never be retrieved. The file system has control over the management of the files. It is hard to tell what has been overwritten because the new data overwrites that space.
REDIRECT EXAMINATION BY LDB
Is this why sometimes in unallocated space you will have fragments? Yes.
When there is something that has been overwritten, that is quite obvious.
Witness excused.
