Anthony's Computer Forensics

[GeekyGirl]

Me too.

I'm a writer, and as of right now, glancing at my search history: poison, snake bites, death via IV drip, neck breaking, smothering, blood spatter, MPD, lethal poisons, inducing cardiac arrest, beating the polygraph.

Boy would I be in a world of trouble.

Oooh... Is it bad to say that whatever it is you're writing, I'm pretty sure I want to read it? LOL

 

[Chilly Willy]

Me too.

I'm a writer, and as of right now, glancing at my search history: poison, snake bites, death via IV drip, neck breaking, smothering, blood spatter, MPD, lethal poisons, inducing cardiac arrest, beating the polygraph.

Boy would I be in a world of trouble.

You sure would, especially if someone close to you died while he (or she) was taking a lie detector test while in the hospital with a broken neck and was hooked to an IV filled with poisonous snake venom, which caused them to go into cardiac arrest and squirt so much blood out their nose that they suffocated.

 

[Jack]

So I was listening to the trial today and the computer stuff was somewhat odd, and I'm not computer illiterate, I guess it was the back and forth about the two software programs. But what stood out to me about today's testimony is that CA testified she didn't have a myspace account, then the state brought out that a page on chloroform was accessed within 20 seconds of myspace being opened. So unless CA and ICA were each using the computer at the same time there is no way around ICA accessing pages on chloroform.

 

[benjaminfpierce]

That same exact thing went through my mind, however, it came out in testimony today that the "80" numbers were going up chronologically one per day. I don't recall what the numbers were exactly, but it was something like: My Space on the 17th = 80 times, on the 18th = 81 times, on the 19th = 82 times....see what I mean? That could not be explained by the number of different 'hits' on a page.

Since there are approximately 80-84 days until that time in March, is it really not surprising that she may have visited any page around 80 times.

But the 84 number is not related to julian day, the format does not store julian days. See my other posts one page ago.

Also, does anyone know when the HP desktop was purchased? Could it have been purchased in 2007 Christmass?

 

[Chilly Willy]

Since there are approximately 80-84 days until that time in March, is it really not surprising that she may have visited any page around 80 times.

But the 84 number is not related to julian day, the format does not store julian days. See my other posts one page ago.

Also, does anyone know when the HP desktop was purchased? Could it have been purchased in 2007 Christmass?

If that were the case - for instance, if "How to make Chloroform" was visited over 80 times since January 1st, why did the Chloroform searches only show up on the 17th and 21st of March? Why not January 1, 2, 3, 4, etc?

 

[Turnadot]

Oooh... Is it bad to say that whatever it is you're writing, I'm pretty sure I want to read it? LOL

Excellent!

 

[GeekyGirl]

Well I just did a new install and did hit any page other than the default page. This is what the history contained in ascii:

// <!-- <mdb:mork:z v="1.4"/> -->
< <(a=c)> // (f=iso-8859-1)
(8A=Typed)(8B=LastPageVisited)(8C=ByteOrder)
(80=ns:history:db:row:scope:history:all)
(81=ns:history:db:table:kind:history)(82=URL)(83=Referrer)
(84=LastVisitDate)(85=FirstVisitDate)(86=VisitCount)(87=Name)
(88=Hostname)(89=Hidden)>
{1:^80 {(k^81:c)(s=9u)[1]} }

@$${1{@

<(80=LE)(81
=http://en-us.start.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:e\
n-USfficial)(82=1308875133280946)(83=en-us.start.mozilla.com)(84=1)
(85=http://en-us.www.mozilla.com/en-US/firefox/2.0/firstrun/)(86
=en-us.www.mozilla.com)(87=Y$00o$00u$00$19 r$00e$00 $00a$00l$00m$00o$00s$00\
t$00 $00t$00h$00e$00r$00e$00!$00)(88
=http://www.google.com/firefox?client=firefox-a&rls=org.mozilla:en-USffi\
cial)(89=google.com)(8A
=http://www.google.ca/firefox?client=firefox-a&rls=org.mozilla:en-USffic\
ial)(8B=google.ca)(8C=M$00o$00z$00i$00l$00l$00a$00 $00F$00i$00r$00e$00f$00o$00\
x$00 $00S$00t$00a$00r$00t$00 $00P$00a$00g$00e$00)>
{-1:^80 {(k^81:c)(s=9)[1(^8C=LE)]}
[-2(^82^81)(^84^82)(^85^82)(^88^83)(^89=1)]
[-3(^82^85)(^84^82)(^85^82)(^88^86)(^87^87)]
[-4(^82^88)(^84^82)(^85^82)(^88^89)(^89=1)]
[-5(^82^8A)(^84^82)(^85^82)(^88^8B)(^87^8C)]}
@$$}1}@

You can see that one of the fields is clearly "VisitCount"

Looking at this... It looks like the "80" series of numbers refers to... maybe line references? Not sure. It is kind of strange that you got a line that says (86=visit count). I'm guessing that doesn't mean the actual visit count, only a reference to the field that contains the visit count.

 

[mobius99]

Me too.

I'm a writer, and as of right now, glancing at my search history: poison, snake bites, death via IV drip, neck breaking, smothering, blood spatter, MPD, lethal poisons, inducing cardiac arrest, beating the polygraph.

Boy would I be in a world of trouble.

DO you have any dead bodies scattered around your house? LOL

 

[Turnadot]

DO you have any dead bodies scattered around your house? LOL

*shifty*

I can neither confirm nor deny this.

 

[technicalconfusion]

I don't think that hits means how many urls where subsequently hit from the HTML urls loaded. The hits ties to the url of the html index or page and is a counter.

Are you able to delete this and hit a url one time only with images, etc. on it?

Unfortunately, Net Analysis is not compatible with any browser on my system. It will read Firefox 3 and not 4 which is what I use, and Net Analysis can't read it. So, I tried to install Netscape 2.0, which uses the history.dat file. It insists on reading my current Firefox file.

As soon as I can get my son off my other halfs computer - I'll test there.

 

[benjaminfpierce]

If that were the case - for instance, if "How to make Chloroform" was visited over 80 times since January 1st, why did the Chloroform searches only show up on the 17th and 21st of March? Why not January 1, 2, 3, 4, etc?

You are making the assumption that they were able to recover the Firefox history.dat file that would have covered that date range.

 

[benjaminfpierce]

Unfortunately, Net Analysis is not compatible with any browser on my system. It will read Firefox 3 and not 4 which is what I use, and Net Analysis can't read it. So, I tried to install Netscape 2.0, which uses the history.dat file. It insists on reading my current Firefox file.

As soon as I can get my son off my other halfs computer - I'll test there.

Did you see my post? I was able to parse the file with Dork.exe.

See:
http://www.websleuths.com/forums/showthread.php?t=69288&page=39

 

[3doglady]

I'm confused why anyone would think the julian date would have anything to do with this. Bradley did not say the chloroform site was searched 84 times in one day. Bradley was testifying about the deleted dates on the owner account using Firefox which is why cash backe was needed to recover the data. CA probably doesn't know how to delete history. Bradley said "how to make chloroform" was searched, bookmarked then visited 84 times over several days not one date. Then those specific dates were deleted.

 

[benjaminfpierce]

Looking at this... It looks like the "80" series of numbers refers to... maybe line references? Not sure. It is kind of strange that you got a line that says (86=visit count). I'm guessing that doesn't mean the actual visit count, only a reference to the field that contains the visit count.

The 8n characters are probably just being used as delimiters or field markers.

 

[GeekyGirl]

The 8n characters are probably just being used as delimiters or field markers.

Just interesting that they come in the form of 8n...

 

[ladylurker]

That same exact thing went through my mind, however, it came out in testimony today that the "80" numbers were going up chronologically one per day. I don't recall what the numbers were exactly, but it was something like: My Space on the 17th = 80 times, on the 18th = 81 times, on the 19th = 82 times....see what I mean? That could not be explained by the number of different 'hits' on a page.

does anyone have a link to this? i am still pretty confused and cannot watch the trial during the day as i have little kids and don't like to watch videos of it just before i go to bed... so i try to get all my info through reading, but i know i miss a lot this way.

i am also unclear if this came out and WSers sleuthed that it was hinky, or if it was mentioned in court that this was what it is and that the SA made a mistake. or something else entirely. i am just... unclear in general, really!!!

also, i just wanted to say a THANK YOU to tuffy for the post written at the top of the page. i totally agree. it just keeps seeming to pop up everywhere, about how a forensic search on some of our computers might look hinky. but... i do not think most of us who believe in ICA's guilt are only looking at her chloroform searches. sure, many of us have all kinds of crazy searches. i google some crazy shiz as well, and if people were ONLY looking at people's google searches and NOTHING ELSE ABOUT THEM EVER, sure many of us might be in deeeeeeeeep doo-doo.

but i'm certainly hoping that those of you out there with hinky-looking google searches that are actually innocent don't go around "losing" your kids and not bothering to report them and not showing a drop of emotion about them being gone. no one ever arrested her for googling how to make chloroform; it was the blatant disregard to her "missing" child that aroused suspicion. it is a piece of a puzzle that may or may not be relevant, but given the fact that dr. vass found the levels of chloroform shockingly high (whether you agree or not), the chloroform searches have an added hinkiness to them then if you just consider it alone. it would be irresponsible of the SA not to include the search when 1) it is there and 2) they believe it was the murder weapon.

in the hypothetical case that soulmagent pointed out, if those google searches were the only evidence to convict you, that would be a GROSS failure of our judicial system. but if you didn't really care that he had died and there were tons of other fishy circumstances surrounding you (like the decomp smell or the banded hair or failure to report the accident until forced to by someone else), it would just be another hinky piece of the puzzle.

to me personally, the chloroform searches mean nothing. i am not entirely sure that chloroform or duct tape were the manner of death. that does not add up to me. however, the huge grin on her face when she was arrested, the lack of any even remotely negative response to the death of her daughter, the other non-chloroform circumstantial evidence, etc etc, are what convince ME that ICA murdered her daughter, didn't really care, and doesn't get why the rest of the world is making such a big deal out of it. my opinions are NOT based on the info the jury has read but the thousands upon thousands of pages of discovery i have read while being interested in this case and the demeanor of ICA from the very start. i don't give a hoot what she researched.

whoops, meant that to be simply my :twocents: but dang inflation, more like $20, sorry. i am still uber unclear about the 84 searches vs julian date and what information exactly came out, and whether the 84 searches were disproven or if this is WS speculation/opinion and if so what that is based on. maybe the time it took me to write this tome has produced some more clarification; i will stop typing now and check!

ETA: i do not mean ANY frustration or irritation or any negative emotion towards ANYONE on here, even those i disagree with. if i sound frustrated about the 84 thing it is because i do not understand it and *that* frustrates me, and i also am just frustrated/bothered by the circumstances surrounding the case. i have utmost respect for SO MANY OF YOU and this is the reason i have come out of lurkdom.... because i have no one IRL to discuss this with and i think you guys on WS are freakin awesome, even when we disagree. so i sincerely apologize if this came across as offensive to anyone as i did not intend to be. i am kind of good at offending people without meaning to, so i just wanted to add that in! thanks to all of you sleuths for being here and doing your thing and caring this much about strangers.

 

[LambChop]

Again, I think most of us are just frustrated because we want to know the truth. If it was only one search (or set of searches) for chloroform, would LE even have tested the trunk? Are we sure there's no reasonable alternative explanation for the chloroform levels in the trunk? Is it possible chloroform isn't related at all? Those are the questions that I personally want to know the answers to.

And what a coinky dink that these searches were done around the time that Ricardo had "Win her over with Choloform" on his computer while KC was dating him. Password on the A's computer during this time is Rico234(?) which stood for Ricardo and his apartment number, another coinky dink. It surely wasn't CA's because she did not know Ricardo existed. jmo

 

[angeldust]

Again, I think most of us are just frustrated because we want to know the truth. If it was only one search (or set of searches) for chloroform, would LE even have tested the trunk? Are we sure there's no reasonable alternative explanation for the chloroform levels in the trunk? Is it possible chloroform isn't related at all? Those are the questions that I personally want to know the answers to.

Hi geekygirl was the trunk not tested for chloroform before the computer searches were found im gonna have to go look this up now x a

also wasnt the chloroform searches deleted on the morning of the 16th july 2008, Id have to ask WHY?

 

[GeekyGirl]

I'm having an issue if John Bradley wrote his own parse and had an error with it. Much of his data could be wrong if he did this.

The original unallocated file should be parsed with Dork.exe and checked against Cacheback.

IIRC wasn't he contacted by LE because there was a bug in his program that affected the parsing?

 

[Chilly Willy]

You are making the assumption that they were able to recover the Firefox history.dat file that would have covered that date range.

No, I am not assuming that. The forensic guy said he was able to recover everything that had been deleted.