Anthony's Computer Forensics

[JWG]

*cropped to the point*

I ABSOLUTELY 100% agree. I do not, for one second, believe George had anything to do with Caylee's death. My concerns lie with whether George, when being confronted (hypothetically speaking) with the death of his granddaughter, and with his daughter standing there saying it was an accident, may have let his love, protectionism and fatherhood take over and assisted in a cover-up.

I do NOT believe George had any part in Caylee's death.

Gotcha :thumb:

IMHO, George would not stand up for KC ahead of Caylee unless Cindy were standing next to him.

 

[OneLostGrl]

I doubt there was any searching.

As her daughter lied rotting in the trunk, KC was copying the all-important icons and party pictures from the desktop to the laptop. Can't leave those behind now can we?

Surfing probably played a rather minor role in it all.

G0d that makes me want to vomit just thinking about it.

 

[OneLostGrl]

Gotcha :thumb:

IMHO, George would not stand up for KC ahead of Caylee unless Cindy were standing next to him.

ITA. And even then you can tell he still has his doubts. Look at his comments on LKL about not being able to question her the way he wanted to and Cindy's reation to that.

The other day when Cindy was walking pretty far ahead of George and Brad on the way into the courthouse people were speculating that Cindy must be mad at Brad and was "punishing" him. I believe she is still angry with George because of that comment on LKL and is still punishing him.

Regardles, there is no doubt who wears the pants in that "family".

 

[Valhall]

I've been researching the Timeline view and believe I've got the graphic figured out. Sadly, it does not break the hour to 20 minute sectors (which would have been marvelous). It is logging each file that had activity during that hour in three files from left to right. So on the first line you have File #1, File #2, File #3, carriage return, File #4, File #5, File #6, carriage return, etc. So that is why the left most column is never shorter than the middle and end columns. It's writing three word sentences basically.

 

[Valhall]

I'm really starting to lean toward the concurrent activity on the two computers being file transfers from the desktop to the laptop. If you look at the laptop activity, it appears to be dominated by new file creations. I think KC went to the house to get the laptop and before she left she transferred all her "stuff" off the desktop.

The unanswered question is...was George there?

 

[JWG]

The unanswered question is...was George there?

No

 

[Valhall]

No

I think I might agree, and I'll tell you why. It appears GA was surfing for about an hour from noon to one. There is only a 9 file activity after 1 pm. I think he probably left the house some time before 1:30 p.m. The activity that had been taking place beginning at noon ceased before the intense activity that started somewhere after 2 pm.

 

[Searchfortruth]

We know that Cindy tries to get Casey to bring back the car that was in their name, I wonder what was said about Cindy's laptop that Casey took from the house. I don't guess we will get any honest answers at this point, but I would bet money it was mentioned by Cindy in conversations during the time Casey was gone.

 

[ZubenElSchemali]

From the Encase link provided earlier:

* Light-gray squares indicate a Last Accessed Date/Time stamp for a file.
* Medium-gray squares indicate a Last Written Date/Time stamp for a file.
* Dark-gray squares indicate a Creation Date/Time stamp for a file.
* A square will be blue when the file’s checkbox is checked.
* A square will be red when the file is highlighted.
If you are working with the same black and white scanned image I am, what indication is there that there are clearly 3 shades of gray with no blue and no red? Actually, I can only make out two shades of grey or gray and black. But any number of boxes could be red or blue and would show up as black wouldn't they?

Also, if she were transferring files from the desktop to the laptop then the laptop should have at least as much activity during that given hour as the desktop. The 2-3 slot has more activity shown on the desktop than the laptop, the desktop, very little use during 3-4. So, I wouldn't say she is simply transfering. She would have to be putting it onto a flash drive, if this is what she was doing, during the 1st hour, then putting it onto the laptop during the 2nd hour. If so, why weren't these types of devices included in the search?

Another observation that may or may not be helpful...
The longest column has 99 rows marked. There are about 125 rows available on the screen. If each box is a file then this would be 297 files for the 99 row column and a potential to show 465 files accessed or created during any given hour. So, would this mean that there were over 465 files active during the hours with 3 dots?

 

[Valhall]

From the Encase link provided earlier:

* Light-gray squares indicate a Last Accessed Date/Time stamp for a file.
* Medium-gray squares indicate a Last Written Date/Time stamp for a file.
* Dark-gray squares indicate a Creation Date/Time stamp for a file.
* A square will be blue when the file’s checkbox is checked.
* A square will be red when the file is highlighted.
If you are working with the same black and white scanned image I am, what indication is there that there are clearly 3 shades of gray with no blue and no red? Actually, I can only make out two shades of grey or gray and black. But any number of boxes could be red or blue and would show up as black wouldn't they?

Also, if she were transferring files from the desktop to the laptop then the laptop should have at least as much activity during that given hour as the desktop. The 2-3 slot has more activity shown on the desktop than the laptop, the desktop, very little use during 3-4. So, I wouldn't say she is simply transfering. She would have to be putting it onto a flash drive, if this is what she was doing, during the 1st hour, then putting it onto the laptop during the 2nd hour. If so, why weren't these types of devices included in the search?

Another observation that may or may not be helpful...
The longest column has 99 rows marked. There are about 125 rows available on the screen. If each box is a file then this would be 297 files for the 99 row column and a potential to show 465 files accessed or created during any given hour. So, would this mean that there were over 465 files active during the hours with 3 dots?

Concerning the blue and red statement - that should only exist if the user has a file linked, or checked (i.e. to get more detail on it), so for the purpose of this graph, I don't think the user would have "clicked" any of the files. They would have just screencapped the overall graph. BUT, if they did click any file, then the blue should show up "black" and the red should show up some shade of gray.

Concerning the discrepancy between laptop and desktop, as previously discussed, she could have started massive downloads (i.e. all the picture folder, all the "*advertiser censored* folder", etc.) and had it operating in the background while she surfed the net, or im'd on the desktop. It doesn't matter if she flashed it and then downloaded it to the laptop or not (don't know why she would do that, but she could have). The graph is just a count of files fiddled with so it would come out the same (i.e. because there is no temporal basis within an hour period, we can't tell if there are gaps of no activity in that hour based on this graph - I had hoped we could, but we can't).

I'm going to look at what you're saying on the file count now.

 

[Valhall]

AE,

I don't think we can determine what the maximum number of files that can be displayed before it goes to "..." is? Not unless we find a document that states that number.

 

[BondJamesBond]

I'm really starting to lean toward the concurrent activity on the two computers being file transfers from the desktop to the laptop. If you look at the laptop activity, it appears to be dominated by new file creations. I think KC went to the house to get the laptop and before she left she transferred all her "stuff" off the desktop.

Curious what suggests specifically a file xfer from the desktop to the laptop vs. simply uploading pics from the camera to the laptop while using the desktop for Facebook, etc. IOW...We have direct evidence of the simple approach...pic upload & Fb activity. What compelling evidence is there for something more involved? Is this simply speculation?

The unanswered question is...was George there?

IMHO, George's presence/absence is best addressed via the cell phone activity...see that thread.

 

[Valhall]

Curious what suggests specifically a file xfer from the desktop to the laptop vs. simply uploading pics from the camera to the laptop while using the desktop for MySpace, etc. IOW...We have direct evidence of the simple approach...pic upload & MS activity. What compelling evidence is there for something more involved? Is this simply speculation?



IMHO, George's presence/absence is best addressed via the cell phone activity...see that thread.

Yes, without a doubt...speculation. And I agree that your presented scenario could be a possibility. However, there are only so many files on a camera. And there is quite a bit of file activity on the laptop. My speculation is based on the concurrent activity, the similar level of activity for both computers, and the fact she probably had a ton of crap on the desktop.

 

[BondJamesBond]

...the fact she probably....

*snipped*

Got it. Thanks.

 

[Valhall]

*snipped*

Got it. Thanks.

HAHA! That's definitely a "valhallism"!

 

[kew17]

I hope this isn't a silly question, and I'm not sure quite how to ask what I want to know, so please bear with me. Is there anyway we can determine what files were accessed/open during this activity? Example, was she listening to music from a CD or maybe her MySpace page from the desktop while she was pecking away on the laptop? Is there any way to detail this computer usage and narrow down to what files were opened to better determine if she was actually transferring files (which I firmly believe she was) or was she multi-tasking and IMing on the desktop and surfing on the laptop?

In thinking about what it is she would want to transfer from the desktop that she would not being using anymore, now that she has started her "new Beautiful life", to the laptop, I would think these items would include: pictures, music, Father's Day video, and files that belong (or created by) to CA or GA that she could use against them in the future. Or is it simply erasing files she doesn't want anyone having access to now that she's moving on?

I guess I'm asking, if we know she downloaded that Father's Day video at 3:31pm that day, how come we can't figure out what else she downloaded, transferred or otherwise accessed?

I'm a mess, I know...my brain has one thought and sometimes doesn't know how to articulate the thought to written words...sorry:bang:

 

[kew17]

I'm still stuck on KC's laptop activity on June 17th for some reason. I stumbled upon this in the docs I'd like to bring up for further discussion:

http://www.orlandosentinel.com/news...y-anthony-google-documents,0,5707965.htmlpage

Last page 8 (doc pg #2008) down to paragraph 5, it lists some of the activity on the laptop and the times. What sticks out to me is that there was activity around midnight (17th) and some "system files" accessed around the 1400-1500 time frame. Then it is specific to note "Safari" Internet activity at 1600 hour....

Safari is an Apple Internet application. KC typically used Mozilla/Firefox as her internet browser. I'm thinking she was using Safari for downloading music from itunes or at best listening to it. The question I pose, is what other use would she have for using Safari vs Mozilla/Firefox? I don't think the iTouch was even out yet at that time and I don't think she had an iPhone. We know her friend (JP?) didn't pick his up at the mall until July 15th cuz they had just come out with a new one.

 

[MidAtlanticNative]

I'm still stuck on KC's laptop activity on June 17th for some reason. I stumbled upon this in the docs I'd like to bring up for further discussion:

http://www.orlandosentinel.com/news...y-anthony-google-documents,0,5707965.htmlpage

Last page 8 (doc pg #2008) down to paragraph 5, it lists some of the activity on the laptop and the times. What sticks out to me is that there was activity around midnight (17th) and some "system files" accessed around the 1400-1500 time frame. Then it is specific to note "Safari" Internet activity at 1600 hour....

Safari is an Apple Internet application. KC typically used Mozilla/Firefox as her internet browser. I'm thinking she was using Safari for downloading music from itunes or at best listening to it. The question I pose, is what other use would she have for using Safari vs Mozilla/Firefox? I don't think the iTouch was even out yet at that time and I don't think she had an iPhone. We know her friend (JP?) didn't pick his up at the mall until July 15th cuz they had just come out with a new one.

(bold mine)

Automated updates, maybe?

 

[Searchfortruth]

I am wondering if the case file, image file, the computer forensics examiner completes is released as discovery to the defense and then the media ? Or do they just release parts of the findings from the case file and wait to submit the whole case file into evidence during trial ? Does part of the case file fall under work product or is it all discoverable, (this might be a better way of asking my question).

 

[okiedokietoo]

I'm still stuck on KC's laptop activity on June 17th for some reason. I stumbled upon this in the docs I'd like to bring up for further discussion:

http://www.orlandosentinel.com/news...y-anthony-google-documents,0,5707965.htmlpage

Last page 8 (doc pg #2008) down to paragraph 5, it lists some of the activity on the laptop and the times. What sticks out to me is that there was activity around midnight (17th) and some "system files" accessed around the 1400-1500 time frame. Then it is specific to note "Safari" Internet activity at 1600 hour....

Safari is an Apple Internet application. KC typically used Mozilla/Firefox as her internet browser. I'm thinking she was using Safari for downloading music from itunes or at best listening to it. The question I pose, is what other use would she have for using Safari vs Mozilla/Firefox? I don't think the iTouch was even out yet at that time and I don't think she had an iPhone. We know her friend (JP?) didn't pick his up at the mall until July 15th cuz they had just come out with a new one.

I had Safari and IE and Opera and Firefox - right now just Firefox and IE -