Anthony's Computer Forensics

[Ssejors]

Its called a Julian Date. All the number 84 means is someone visited MySpace on the 84th day of 2008, which happens to coincide to same date of search.

Not just handsome, but smart too

 

[Hot Dogs]

It maybe a coincidence it was both 84 julian date and 84 times in the counter.

84 Julian Date.
84 MySpace.
84 Chloroform.

That ain't no coincidence.

 

[Turnadot]

I'm feeling ticked off with the State, because I feel only a clueless *unusual person* could have missed this. And since I know the State aren't clueless, I feel like they intentionally misrepresented the computer forensic evidence, and it makes me angry.

 

[Tuffy]

This "how many times was it searched" question may not be so easy to answer. From the report that harmony2 linked to:

http://media2.myfoxorlando.com/docum...0-anthony1.pdf PAGE 99

The problem with the 'mork' format might be the problem. Mork format is not human readable. You need a parser to 'read' the file. That is what Casheback is apparently.

Firefox was updated to use SQLlite, but the history.dat file found on the Anthony's computer was in the mork format.

Here's a little bit of info about mork from Wikipedia:

The file format has been severely criticized by Jamie Zawinski, a former Netscape engineer. He has lambasted the ostensibly "textual" format on the grounds that it is "not human-readable",[3] bemoaned the impossibility of writing a correct parser for the format,[4] and referred to it as "...the single most braindamaged file format that I have ever seen in my nineteen year career".[4]

http://en.wikipedia.org/wiki/Mork_(file_format)

 

[benjaminfpierce]

84 Julian Date.
84 MySpace.
84 Chloroform.

That ain't no coincidence.

Not if she actually visited both of those pages on average 1 time a day since January. It wouldn't be that big of a coincidence. The hard drive is there, they will recheck the data and see. John Bradley has probably already looked at it to see if there is an error. He could find even more information harmful to Cindy and Casey based on the information they have now.

 

[benjaminfpierce]

I'm pretty certain that the Mork Firefox format did NOT store a Julian day (numerical day of year from January 1 of that year).

They will establish exactly how that format stored it's dates.

 

[technicalconfusion]

Precisely!! But it was presented to the jury as 84 visits to the chloroform site. Baez needs to jump on that and make it clear.

Right now I've got the net analysis program running on my computer and I'm looking thru one of my history files.

This shows hits. It's got a column named hits. It's a very thorough program.
Shows all kinds of stuff.

This is one line from the file I'm looking at. Remember: it's the Net Analysis Program.

Look at the hits line. 333 hits. Now. In web terms, when you hit a web page- everything on that page counts as one hit.

So if you hit a page, say it's got 10 images, the html file itself, and a video, this will count as 12 hits. 10 for the images, 1 for the html file and one for the video.

The record below is for my google adsense account. This was at a time when I was literally sitting on it - kept it open and refreshed the page obsessively. This program is picking up everytime I refreshed the page over a period of time, which looks like the Last Visited [UTC]: Last Visited [Local]:

Type: https
Tag: 0
Last Visited [UTC]: 2008-07-01 15:00:21 Tue
Last Visited [Local]: 2008-07-01 11:00:21 Tue
Hits: 333
User:
URL: https://www.google.com/adsense/report/overview?timePeriod=today
Host: www.google.com
Page Title: Google AdSense - Reports
Absolute Path: /adsense/report/overview
Query: ?timePeriod=today
Fragment:
Port: 443
URL Category:
Logon User:
Logon Password:
Redirect URL:
Feed URL:
Referral URL:
Fav Icon URL:
Cache Folder:
Cache File:
Extension:
Length: -
Exists: -
HTTP Reponse:
Cache Entry Type Flag:
Content Type:
Content Length: -
Content Encoding:
ActiveBias:
Date First Visited [UTC]: 2007-09-29 16:00:57 Sat
Date Expiration [UTC]:
Date Last Modified [UTC]:
Date Index Created [UTC]:
Date Added [UTC]:
Date Last Synch [UTC]:
Source File: C:\Documents and Settings\j\Desktop\New Folder (2)\history.dat
Source Offset: FO: 12115554
Index Type: History
Browser Version: Firefox v1-2 (History)
IE Type:
Status: Mork Record: -C5B0, Typed URL
Bookmark:
URN: 44239

This is where I believe the 84 number is coming from. She didn't visit it 84 times, but the program is picking up the hits on the page - she could have been sitting there and refreshed it several times.

Am I making sense?

The hits column is somewhat deceiving. Counters on a web page are deceiving because of this. A computer person - who may be excellent at their job, may not have a clear understanding of how hits on a page works.
I've worked in web hosting for years and this is one of the first things we were taught.

Gonna see if I can check out the cacheback program.

 

[Turnadot]

Not if she actually visited both of those pages on average 1 time a day since January. It wouldn't be that big of a coincidence. The hard drive is there, they will recheck the data and see. John Bradley has probably already looked at it to see if there is an error. He could find even more information harmful to Cindy and Casey based on the information they have now.

I'm incredulous, and pretending to be a juror, I don't by this explanation for a second, because it looks like something tossed out to cover the State's rear.

 

[ohiogirl]

An RN wouldn't, but google search combined with enabled auto-fill would.

As to the nurse part, CA says she misspelled chloraphyll, but she did not say that she typed in to the search bar how-to-make-chloroform.
Seriously, does anyone this she wanted to type in how-to-make-chlorophyll?
IF she did, she certainly would have said so.And the chloroform search was done within 20 sec of Myspace.
AND, big AND, this is the first time that she has brought up the fact that she could have been on the clock at work but not really been there.
IMO, she is only trying to cover her butt because she knows she has said in the past that the computer search for chloroform was her. If it helps KC along the way, she would be thrilled, imo.
Also, imo, she has lied so much in the past she doesn't know which end is up.
That's my :twocents: Thanks for listening.

 

[Hot Dogs]

Not if she actually visited both of those pages on average 1 time a day since January. It wouldn't be that big of a coincidence.

But it is my understanding that no search for chloroform was done prior to that date.

On the 84th Julian Day, somebody views a chloroform site 84 times and also views MySpace 84 times.

Is that correct? :waitasec:

 

[benjaminfpierce]

Right now I've got the net analysis program running on my computer and I'm looking thru one of my history files.

This shows hits. It's got a column named hits. It's a very thorough program.
Shows all kinds of stuff.

This is one line from the file I'm looking at. Remember: it's the Net Analysis Program.

Look at the hits line. 333 hits. Now. In web terms, when you hit a web page- everything on that page counts as one hit.

So if you hit a page, say it's got 10 images, the html file itself, and a video, this will count as 12 hits. 10 for the images, 1 for the html file and one for the video.

The record below is for my google adsense account. This was at a time when I was literally sitting on it - kept it open and refreshed the page obsessively. This program is picking up everytime I refreshed the page over a period of time, which looks like the Last Visited [UTC]: Last Visited [Local]:



This is where I believe the 84 number is coming from. She didn't visit it 84 times, but the program is picking up the hits on the page - she could have been sitting there and refreshed it several times.

Am I making sense?

The hits column is somewhat deceiving. Counters on a web page are deceiving because of this. A computer person - who may be excellent at their job, may not have a clear understanding of how hits on a page works.
I've worked in web hosting for years and this is one of the first things we were taught.

Gonna see if I can check out the cacheback program.

I don't think that hits means how many urls where subsequently hit from the HTML urls loaded. The hits ties to the url of the html index or page and is a counter.

Are you able to delete this and hit a url one time only with images, etc. on it?

 

[technicalconfusion]

I don't think that hits means how many urls where subsequently hit from the HTML urls loaded. The hits ties to the url of the html index or page and is a counter.

Are you able to delete this and hit a url one time only with images, etc. on it?

I should. I'm working with old history files. Give me a few.

 

[benjaminfpierce]

I should. I'm working with old history files. Give me a few.

I'm on a Mac, but I've almost finished downloading Cacheback and I've got Firefox 2.0. I'm going to boot up VMWare and test it out myself.

I should also be able to parse the mork file myself to see exactly how it's working.

 

[OneLostGrl]

So why is Linda asking Cindy if she searched for something 84 times? How could the State get that so wrong?

Because they don't understand it. I don't think they are doing it on purpose.

 

[Hot Dogs]

I should also be able to parse the mork file myself to see exactly how it's working.

Nanu Nanu

 

[benjaminfpierce]

Nanu Nanu

Shazbutt!

 

[OneLostGrl]

Nanu Nanu

 

[Tuffy]

Nanu Nanu

There is a parser for Mork, called Mindy. Seriously, I'm not joking.

 

[benjaminfpierce]

Well I just did a new install and did hit any page other than the default page. This is what the history contained in ascii:

// <!-- <mdb:mork:z v="1.4"/> -->
< <(a=c)> // (f=iso-8859-1)
(8A=Typed)(8B=LastPageVisited)(8C=ByteOrder)
(80=ns:history:db:row:scope:history:all)
(81=ns:history:db:table:kind:history)(82=URL)(83=Referrer)
(84=LastVisitDate)(85=FirstVisitDate)(86=VisitCount)(87=Name)
(88=Hostname)(89=Hidden)>
{1:^80 {(k^81:c)(s=9u)[1]} }

@$${1{@

<(80=LE)(81
=http://en-us.start.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:e\
n-USfficial)(82=1308875133280946)(83=en-us.start.mozilla.com)(84=1)
(85=http://en-us.www.mozilla.com/en-US/firefox/2.0/firstrun/)(86
=en-us.www.mozilla.com)(87=Y$00o$00u$00$19 r$00e$00 $00a$00l$00m$00o$00s$00\
t$00 $00t$00h$00e$00r$00e$00!$00)(88
=http://www.google.com/firefox?client=firefox-a&rls=org.mozilla:en-USffi\
cial)(89=google.com)(8A
=http://www.google.ca/firefox?client=firefox-a&rls=org.mozilla:en-USffic\
ial)(8B=google.ca)(8C=M$00o$00z$00i$00l$00l$00a$00 $00F$00i$00r$00e$00f$00o$00\
x$00 $00S$00t$00a$00r$00t$00 $00P$00a$00g$00e$00)>
{-1:^80 {(k^81:c)(s=9)[1(^8C=LE)]}
[-2(^82^81)(^84^82)(^85^82)(^88^83)(^89=1)]
[-3(^82^85)(^84^82)(^85^82)(^88^86)(^87^87)]
[-4(^82^88)(^84^82)(^85^82)(^88^89)(^89=1)]
[-5(^82^8A)(^84^82)(^85^82)(^88^8B)(^87^8C)]}
@$$}1}@

You can see that one of the fields is clearly "VisitCount"

 

[GeekyGirl]

I'm on a Mac, but I've almost finished downloading Cacheback and I've got Firefox 2.0. I'm going to boot up VMWare and test it out myself.

I should also be able to parse the mork file myself to see exactly how it's working.

Thanks to you (and technical confusion) for doing this. I'm itching to play, but I'm sitting here without power and running off my 3G hotspot, hoping for the battery to last until the storm is over.