As I was looking through the internet history files recently "rediscovered" from the September document dump, I noticed something odd about the Internet Explorer history from the desktop computer. Before I get into this oddity, let me provide some background.
There are 4 files of interest from this 95MB behemoth:
- Internet History unfiltered.csv - Desktop Internet Explorer browser and cookie history. This history goes back to August 8, 2007, although the older history is much more sparse than the newer history.
- Unfiltered Temporary Internet History for Casey Profile.csv - Desktop Internet Explorer cache listing. This file dates go back to June 27, 2008. It appears, however, that there are some "holes" between June 27 and July 16. This does not imply anything nefarious as I don't know what caching policy was set in the Anthony's browser.
- Unfiltered History for user bobby.csv - Laptop Internet Explorer browser and cookie history. This history goes back to July 3, 2008.
- Unfiltered Safari Internet History for bobby.csv - Laptop Safari browser (Apple) and cookie history. This history goes back to July 13, 2008.
This looks like a lot of information, but I want to point out that much is still missing and leaves a lot of questions unanswered. Some key things that are missing:
- Internet history and temporary internet history from unallocated space, meaning deleted histories, from both computers. This is where the infamous Google searches for chloroform were found.
- Temporary internet history (cache listings) from the laptop.
- Safari internet history from the desktop, if it exists. I am thinking not, as it appears that Safari was installed on the laptop on July 13, 2008.
The desktop Internet Explorer browser and cookie history has the most and oldest information available, so this is where I have focused my attention.
The oddity I noticed is that the cookies and URLs listed all looked like they were the result of
George using the computer, and no one else. Up until the evening of the July 15, that is.
What I find odd is that we know KC used the desktop computer to visit Myspace, Facebook, and Photobucket yet prior to July 15 there are no urls or cookies from any of those sites recorded in the internet history. Based on this, it seems to me KC was in the habit of covering her tracks as she surfed. She did not clean everything because George's history is still there, so she was pretty sophisticated in this regard.
Of course it could have been Lee, but it is a lot harder to selectively clean a year's worth of history at once versus doing it as she goes. My money is on KC doing it as she goes. :twocents:
Knowing the surfing was George, I wondered if I could discern a usage pattern and compare it with what we know of KC's Photobucket uploads and the chloroform searches in March. :waitasec:
It turns out George is quite the creature of habit. While he does not surf every day, when he does surf it seems to always fall into the following time windows:
- 10 AM to Noon
- 10 PM to midnight
To a lesser extent:
- 5AM to 7AM
- 4:30PM to 6:30PM
George's surfing did not fall firmly within those boundaries, but staring at the time windows it is pretty clear his habits were fixed.
Pulling in the graph from a post I did back in early January, we can see KC's Photobucket uploads clearly took place when George was not on the computer - largely between noon and 3PM:
The infamous computer searches took place at the following times:
The clicks from March 17:
17-Mar 9:36:12 Clicked a Google-hosted ad from a myspace page
13:43:41 Search chloraform
13:43:41 Search chloroform
13:54:26 Search alcohol
13:54:42 Search acetone
13:55:34 Search peroxide
13:53:25 to 13:58:38 Wikipedia searches for inhalation, chloroform, alcohol, acetone, peroxide, hydrogen peroxide, death
The clicks on March 21:
Notice that the above computer searches took place during a time window that was consistent with KC's Photobucket uploads and outside the time window of George's usage.
