All Casey Cell Phone LOGS and PINGS Part#3

DNA Solves
DNA Solves
DNA Solves

New Posts

JWG said:
I wrote here that there is at least one substantive error in the spreadsheet WSers are using to analyze phone records. It turns out the error is actually in the cell phone summary material LE included in the latest document dump. :eek: To be fair, what LE released is not evidence - it is a work-in-progress investigative summation. Errors are easy to make - and we can do our best to find them and help them clean them up before trial. Dot the i's and cross the t's, if you will.

What is the error? On page 2577 of the latest document dump they identify two afternoon calls to number *advertiser censored*-*advertiser censored*-7965 as Andy F. We had previously thought this was Matt C. This was critical to us in establishing a time line for the Crane's Landing visit. Seeing this in the document dump started to unravel a lot of theories about that day.

However, in the same document at page 2565 we see a dump of KC's cell phone address book, and clear as day is Matt C. with the 7965 number. In fact, these pages could go a long way in clearing up confusion about which numbers belong to whom. :)

Going back to page 2577, this and the surrounding pages indicate they summarize incoming and outgoing calls only for June 15 through June - and for the most part they do. However, an occasional text message is included. At first I wondered why - were the specific texts somehow critical to the investigation?

Looking carefully at the text details - time and phone number - I have determined that these text records are not part of the original cell phone records released in September. This means LE has updated records with possibly more information. :eek: For example, a text to Sean H. on June 19 is new to the mix and confirms our assumption that KC stopped by his place right around 6 PM.

Can't wait to see those new records.
Click to expand...

For completeness, the error mentioned above has been corrected by LE, and the "new" text message to Sean H on June 19 is no longer there. This can be seen on discovery page 4212. LE's records now closely align with ours. :)
 
Looking @ the Incoming "Numbered texts" of the 132665* ilk today, owing to one coming in @ a critical time on the afternoon of 6/16 I decided to expand my view to see if it revealed anything of interest.

Maybe nothing, but, this series spikes in volume on Saturday 6/14. I believe these 'numbered texts' are from a specific social networking site and are generated from activity on that site (of the MySpace, Facebook, LinkedIn, etc. variety).

The incoming activity from this site begins on 6/3, and ceases on 6/24. Perhaps there is something in the computer forensics that could suggest what site this activity maybe from (e.g. set-up a new account, or enabled the feature on or near 6/3 ~3:40PM).

Again, maybe nothing...but, thought the pattern worth further consideration.

Date DOW Time Type From
6/3/08 TUE 3:40:53 PM INCOMING TEXT Numbered text: 132665178
6/4/08 WED 1:06:32 AM INCOMING TEXT Numbered text: 132665123
6/4/08 WED 11:03:32 AM INCOMING TEXT Numbered text: 132665123
6/4/08 WED 2:03:18 PM INCOMING TEXT Numbered text: 132665123
6/4/08 WED 2:08:48 PM INCOMING TEXT Numbered text: 132665123
6/4/08 WED 2:09:09 PM INCOMING TEXT Numbered text: 132665123
6/4/08 WED 2:09:31 PM INCOMING TEXT Numbered text: 132665123
6/4/08 WED 2:09:54 PM INCOMING TEXT Numbered text: 132665123
6/4/08 WED 3:57:57 PM INCOMING TEXT Numbered text: 132665115
6/4/08 WED 4:11:23 PM INCOMING TEXT Numbered text: 132665115
6/6/08 FRI 3:01:42 PM INCOMING TEXT Numbered text: 132665115
6/6/08 FRI 6:14:11 PM INCOMING TEXT Numbered text: 132665111
6/6/08 FRI 8:58:29 PM INCOMING TEXT Numbered text: 132665187
6/7/08 SAT 10:10:29 AM INCOMING TEXT Numbered text: 132665123
6/7/08 SAT 10:13:07 AM INCOMING TEXT Numbered text: 132665116
6/7/08 SAT 10:18:04 AM INCOMING TEXT Numbered text: 132665123
6/7/08 SAT 10:18:29 AM INCOMING TEXT Numbered text: 132665123
6/7/08 SAT 10:32:00 AM INCOMING TEXT Numbered text: 132665123
6/7/08 SAT 10:47:54 AM INCOMING TEXT Numbered text: 132665123
6/7/08 SAT 11:20:41 PM INCOMING TEXT Numbered text: 132665117
6/8/08 SUN 12:46:35 AM INCOMING TEXT Numbered text: 132665118
6/8/08 SUN 9:44:47 PM INCOMING TEXT Numbered text: 132665119
6/9/08 MON 3:17:37 PM INCOMING TEXT Numbered text: 132665123
6/9/08 MON 3:52:49 PM INCOMING TEXT Numbered text: 132665120
6/11/08 WED 1:32:06 PM INCOMING TEXT Numbered text: 132665121
6/11/08 WED 1:55:27 PM INCOMING TEXT Numbered text: 132665121
6/11/08 WED 1:56:21 PM INCOMING TEXT Numbered text: 132665121
6/11/08 WED 1:58:08 PM INCOMING TEXT Numbered text: 132665121
6/11/08 WED 1:59:38 PM INCOMING TEXT Numbered text: 132665121
6/11/08 WED 2:01:46 PM INCOMING TEXT Numbered text: 132665121
6/11/08 WED 2:06:49 PM INCOMING TEXT Numbered text: 132665121
6/11/08 WED 2:07:01 PM INCOMING TEXT Numbered text: 132665121
6/11/08 WED 2:11:25 PM INCOMING TEXT Numbered text: 132665121
6/11/08 WED 2:20:19 PM INCOMING TEXT Numbered text: 132665121
6/12/08 THU 10:53:05 AM INCOMING TEXT Numbered text: 132665186
6/12/08 THU 3:19:39 PM INCOMING TEXT Numbered text: 132665115
6/12/08 THU 5:12:36 PM INCOMING TEXT Numbered text: 132665123
6/14/08 SAT 8:47:14 PM INCOMING TEXT Numbered text: 132665122
6/14/08 SAT 8:48:21 PM INCOMING TEXT Numbered text: 132665122
6/14/08 SAT 8:50:34 PM INCOMING TEXT Numbered text: 132665122
6/14/08 SAT 8:53:03 PM INCOMING TEXT Numbered text: 132665122
6/14/08 SAT 8:55:33 PM INCOMING TEXT Numbered text: 132665122
6/14/08 SAT 8:56:01 PM INCOMING TEXT Numbered text: 132665122
6/14/08 SAT 8:58:42 PM INCOMING TEXT Numbered text: 132665122
6/14/08 SAT 9:03:28 PM INCOMING TEXT Numbered text: 132665122
6/14/08 SAT 9:05:04 PM INCOMING TEXT Numbered text: 132665122
6/14/08 SAT 9:07:28 PM INCOMING TEXT Numbered text: 132665122
6/14/08 SAT 9:18:05 PM INCOMING TEXT Numbered text: 132665122
6/14/08 SAT 9:18:37 PM INCOMING TEXT Numbered text: 132665122
6/14/08 SAT 9:20:45 PM INCOMING TEXT Numbered text: 132665122
6/14/08 SAT 9:21:23 PM INCOMING TEXT Numbered text: 132665122
6/14/08 SAT 9:24:06 PM INCOMING TEXT Numbered text: 132665122
6/14/08 SAT 9:29:12 PM INCOMING TEXT Numbered text: 132665122
6/14/08 SAT 9:32:09 PM INCOMING TEXT Numbered text: 132665122
6/14/08 SAT 9:34:31 PM INCOMING TEXT Numbered text: 132665122
6/14/08 SAT 9:41:02 PM INCOMING TEXT Numbered text: 132665122
6/14/08 SAT 9:41:26 PM INCOMING TEXT Numbered text: 132665122
6/14/08 SAT 9:50:50 PM INCOMING TEXT Numbered text: 132665122
6/14/08 SAT 9:53:37 PM INCOMING TEXT Numbered text: 132665122
6/15/08 SUN 8:26:41 PM INCOMING TEXT Numbered text: 132665122
6/15/08 SUN 9:09:41 PM INCOMING TEXT Numbered text: 132665122
6/16/08 MON 4:53:33 PM INCOMING TEXT Numbered text: 132665187
6/17/08 TUE 4:36:13 PM INCOMING TEXT Numbered text: 132665123
6/18/08 WED 2:11:30 PM INCOMING TEXT Numbered text: 132665124
6/18/08 WED 4:15:45 PM INCOMING TEXT Numbered text: 132665125
6/19/08 THU 9:02:02 PM INCOMING TEXT Numbered text: 132665113
6/20/08 FRI 7:07:03 PM INCOMING TEXT Numbered text: 132665159
6/21/08 SAT 6:40:38 PM INCOMING TEXT Numbered text: 132665126
6/22/08 SUN 12:16:39 AM INCOMING TEXT Numbered text: 132665127
6/23/08 MON 1:54:09 AM INCOMING TEXT Numbered text: 132665125
6/24/08 TUE 4:50:01 PM INCOMING TEXT Numbered text: 132665113
6/24/08 TUE 7:33:33 PM INCOMING TEXT Numbered text: 132665128
6/25/08 WED 2:07:29 PM INCOMING TEXT Numbered text: 132665120
 
BondJamesBond said:
Looking @ the Incoming "Numbered texts" of the 132665* ilk today, owing to one coming in @ a critical time on the afternoon of 6/16 I decided to expand my view to see if it revealed anything of interest.

Maybe nothing, but, this series spikes in volume on Saturday 6/14. I believe these 'numbered texts' are from a specific social networking site and are generated from activity on that site (of the MySpace, Facebook, LinkedIn, etc. variety).

The incoming activity from this site begins on 6/3, and ceases on 6/24. Perhaps there is something in the computer forensics that could suggest what site this activity maybe from (e.g. set-up a new account, or enabled the feature on or near 6/3 ~3:40PM).

Again, maybe nothing...but, thought the pattern worth further consideration.

Date DOW Time Type From
6/3/08 TUE 3:40:53 PM INCOMING TEXT Numbered text: 132665178
Click to expand...

*SNIP*

When in doubt, ask a teenager. :rolleyes:

I asked my 18-year old who's texting makes KC look like an amateur: typically 4000 - yes, four thousand - texts per month. We stopped getting paper bills and went to e-bills when they started arriving in a box. :eek:

(Don't worry...straight A's with five AP courses and a multi-sport all-stater, so somehow she makes it work. And she has the unlimited $10 per month texting plan that she, of course, pays for herself. Not sure how KC missed that particular option :waitasec:).

She does not get alerts from myspace or facebook, but she gets them from AIM. She told me that she can tell it is an AIM text because it starts with the same five or six digits, but can sometimes ends with different digits. The number that comes across is not tied to any particular AIM messenger. She can get IM's from five different people on the same number, or five different numbers from one person.

None of the originating numbers in KC's record start with the same digit sequence as AIM, so I am guessing KC did not get AIM alerts. But she probably got Yahoo mail and Facebook alerts, which should account for many of the numbers we see.

Just after I wrote the previous paragraph my good friend Google took the search string "facebook text 132665" and pointed me to a website facebook FAQ that said "FBOOK corresponds to 32665, the 5-digit US shortcode for Facebook. All texts sent to and from Facebook begin with 32665." So we have solved part of our mystery. :highfive:
 
JWG said:
*SNIP*

When in doubt, ask a teenager. :rolleyes:

I asked my 18-year old who's texting makes KC look like an amateur: typically 4000 - yes, four thousand - texts per month. We stopped getting paper bills and went to e-bills when they started arriving in a box. :eek:

(Don't worry...straight A's with five AP courses and a multi-sport all-stater, so somehow she makes it work. And she has the unlimited $10 per month texting plan that she, of course, pays for herself. Not sure how KC missed that particular option :waitasec:).

She does not get alerts from myspace or facebook, but she gets them from AIM. She told me that she can tell it is an AIM text because it starts with the same five or six digits, but can sometimes ends with different digits. The number that comes across is not tied to any particular AIM messenger. She can get IM's from five different people on the same number, or five different numbers from one person.

None of the originating numbers in KC's record start with the same digit sequence as AIM, so I am guessing KC did not get AIM alerts. But she probably got Yahoo mail and Facebook alerts, which should account for many of the numbers we see.

Just after I wrote the previous paragraph my good friend Google took the search string "facebook text 132665" and pointed me to a website facebook FAQ that said "FBOOK corresponds to 32665, the 5-digit US shortcode for Facebook. All texts sent to and from Facebook begin with 32665." So we have solved part of our mystery. :highfive:
Click to expand...

That does it...we need more teen sleuths! :applause:

Nice work. This will resolve several entries. Now...it would be helpful to know if we can associate the last 3-digs w/ a....

  • Facebook User? (e.g. *122=person1, *123= person2, etc.)
  • Type of Facebook entry (e.g. wall post, photo tag, etc.)?
  • Facebook Other?

The date of start/stop is quite interesting as well...wonder if we have any entries to compare date/timestamps against...:waitasec:
 
"246246" AIM (AOL Instant Messenger)

To see a full listing go here and search by "Campaign Type:"

https://www.usshortcodes.com/csc/directory/directoryList.do?method=basicTypeSearch


United States of America
As of May 31, 2006, the standard lengths for interoperable short codes are five and six digits. Carriers use short codes with fewer digits for carrier-specific programs - e.g., "Text 611 to see how many minutes you have remaining on your plan." Codes starting with 1 are not permitted. Common short codes in the U.S. are administered by NeuStar, under a deal with Common Short Code Administration - CTIA. Short codes can be leased at the rate of $1000 a month for a selected code or $500 for a random code. Some carriers assign a subset of their carrier-specific codes to third parties. For example, 4 digit codes on T-Mobile's network are reserved for a "Beta test service" or "Free to end user" marketing campaigns.

Alternatives to short codes for SMS reception
An alternative to inbound SMS is based on long numbers (international number format, e.g. +44 7624 805000), which can be used in place of short codes or premium-rated short messages for SMS reception in several applications, such as television voting, product promotions and campaigns. Long numbers are internationally available, as well as enabling businesses to have their own number, rather than short codes which are usually shared across a number of brands. Additionally, long numbers are non-premium inbound numbers.
 
Georgia PI said:
Here is a text listing of all the CSC Codes.


The US Common Short Code WHOIS Directory: http://www.usshortcodeswhois.com/
Click to expand...

Great resource! Was able to confirm the Yahoo msgr, Facebook and Myspace entries here.

Two I couldn't find listed in this resource, were...

1110440601
1110440104

These appears at times when it is my assumption Casey is msg'g back & forth between either Tony (in class) or Ricardo (at work). I just can't nail it down. Not all that important, but, if its something you stumble across, lemme know.

Based on the confirmation of the Facebook, etc. and if/when we get the rest of the 'no data' entries resolved it'll be time to increment to Rev13 :rolleyes:
 
BondJamesBond said:
Great resource! Was able to confirm the Yahoo msgr, Facebook and Myspace entries here.

Two I couldn't find listed in this resource, were...

1110440601
1110440104

These appears at times when it is my assumption Casey is msg'g back & forth between either Tony (in class) or Ricardo (at work). I just can't nail it down. Not all that important, but, if its something you stumble across, lemme know.

Based on the confirmation of the Facebook, etc. and if/when we get the rest of the 'no data' entries resolved it'll be time to increment to Rev13 :rolleyes:
Click to expand...

1110440601 & 1110440104 shows up when people are texting from their yahoo messenger. Whoever sent those texts were sending them from/through use of yahoo messenger.
 
momtective said:
1110440601 & 1110440104 shows up when people are texting from their yahoo messenger. Whoever sent those texts were sending them from/through use of yahoo messenger.
Click to expand...

Hey, momtective, thanks! :cool2:

This seems like the best candidate for what was going on, but, I've never seen an independent source that provides these #'s linked to Yahoo msgr. (or any service). The reference Georgia PI provided includes the 92466 for Yahoo, which appears in Casey's logs, but, I couldn't find these 111044...#'s there. Just for grins...how do you know these are tied to Yahoo? TIA!
 
BondJamesBond said:
Hey, momtective, thanks! :cool2:

This seems like the best candidate for what was going on, but, I've never seen an independent source that provides these #'s linked to Yahoo msgr. (or any service). The reference Georgia PI provided includes the 92466 for Yahoo, which appears in Casey's logs, but, I couldn't find these 111044...#'s there. Just for grins...how do you know these are tied to Yahoo? TIA!
Click to expand...

She's right! Check this page out and look at the instructions for using it with your phone.

http://mobile.yahoo.com/messenger/sms/receive-reply
 
JWG said:
She's right! Check this page out and look at the instructions for using it with your phone.

http://mobile.yahoo.com/messenger/sms/receive-reply
Click to expand...

I just sent myself a text msg from yahoo messenger to my cell phone. The number that showed up on my phone was 111144060. I think the 1110440104
# shows up when an instant msg is sent to your phone. Two different services, 2 different #'s.
 
momtective said:
I just sent myself a text msg from yahoo messenger to my cell phone. The number that showed up on my phone was 111144060. I think the 1110440104
# shows up when an instant msg is sent to your phone. Two different services, 2 different #'s.
Click to expand...

I noticed too in KC's cell logs that sometimes the numbers start 110440 and sometimes they have an extra "1" in the prefix - 1110440. Not sure why the difference, but verified both exist in the original copies.
 
Okay, I just set up my messenger account to send my incoming messages to my cell when I'm not on messenger and the number associated with the incoming messages, showing on my cell phone is the 1110440104 number.
 
momtective said:
Okay, I just set up my messenger account to send my incoming messages to my cell when I'm not on messenger and the number associated with the incoming messages, showing on my cell phone is the 1110440104 number.
Click to expand...

Hey, thanks, Momtective! :blowkiss:

Hope you didn't think I was doubting you...just wondering how you knew. Thanks for the follow-up. Much appreciated :clap:
 
Hey...now were down to something like...44 unidentified #'s (18 of which were INBOUND-ONLY ON 7/17, and never called as OUTBOUND between 6/1-7/17)...so...call it ~ 26 'real' unidentified #'s :woohoo: :rolleyes:
 
BondJamesBond said:
Hey...now were down to something like...44 unidentified #'s (18 of which were INBOUND-ONLY ON 7/17, and never called as OUTBOUND between 6/1-7/17)...so...call it ~ 26 'real' unidentified #'s :woohoo: :rolleyes:
Click to expand...

Bond or JWG,

Send me a list a I will see what I can do.
 
Warning-somewhat OT,
but I just had to let you'all know how glad I am to have found this "analysis" forum thank to JBean's post in the main Caylee forum entitled "Sleuth's Wanted."

It's so refeshing to find all the serious sleuthing going on over here, and fascinating as well. I've been reading for a few days now, trying to catch up on some of the great work all of you have done. Bond, JWG, Momdetective, ibyounger, GeorgiaPI, and all the others, can't list them all. It's like a different world over here.

I'll be mostly lurking here like I do in the other forums, but for different reasons. Here, it's because I doubt I'll have anything worthwhile to add because you guys are so, well . . . d**n Good!! (And I'm, well . . . not! :bang:)

Even though you don't hear from me, I just wanted you to know how much your hard and excellent work is appreciated, and that I'm following along in fascination.

I didn't know where to post this so I put it here in one the few threads with recent activity. Which is another great thing over here, you'all don't just post to be posting-"talk to hear yourselves talk" as my Mom used to say--sorry for breaking away from that tradition with this post, it'll only be this once. I just wanted you to know that I, and others no doubt, are gleaning so much from your detective work.

Not saying there isn't good sleuthing going on elsewhere of course, because there is. I just get tired some times of having to wade through so much "other" stuff to find it. Oops, did I say that outloud-lol?

Anyway, thanks guys. :blowkiss:
 
You must log in or register to reply here.

DNASolves

Who is DeKalb County John Doe (2022)?

Members online

... and 130 more.
Total: 2,155 (members: 131, guests: 2,024)

Online statistics

Members online
131
Guests online
2,024
Total visitors
2,155
Totals may include hidden visitors.

Forum statistics

Threads
601,866
Messages
18,130,965
Members
231,164
Latest member
mel18
Back
Top