Anthony's Computer Forensics

DNA Solves
DNA Solves
DNA Solves

New Posts

1tasha said:
I'm surprised this isn't eclipsing the Cindy testimony because this, I thought, was a pretty big deal. You can rightly say that even 2 or 3 hits for chloroform when combined with other evidence is very strange. But when you go from 84 hits to 2 or 3 hits to me it negates almost all of the impact. And I'm saying this as a person still completely confused about the findings from both sides. I really hope this can be cleared up.
Click to expand...

this confuses me as well. the fact that the search was there at all was hinky to me. when they said 84 times, i was shocked! but i am confused if this was a lie, or intentional misleading, or an error, OR if it actually maybe was 84 times and some kind of weird coincidence or something? :waitasec:

i am really sorry to keep posting stupid questions, but i am still unclear on whether there is something to show that it definitely WAS a mistake/intentional misleading and that it definitely was NOT 84 searches, and what it is exactly that calls it into question considering that neither of the two search dates mentioned was the 84th day of the year. can anyone out there clarify for me pretty please?
 
benjaminfpierce said:
It did give me the VisitCount properly. I had not visited any pages except the default pages which contained additional images, etc. that were loaded.

ID VisitCount FirstVisitDate LastVisitDate URL
2 1 2011-06-24 00:25:33 2011-06-24 00:25:33 http://en-us.start.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:en-US:official
3 1 2011-06-24 00:25:33 2011-06-24 00:25:33 http://en-us.www.mozilla.com/en-US/firefox/2.0/firstrun/
4 1 2011-06-24 00:25:33 2011-06-24 00:25:33 http://www.google.com/firefox?client=firefox-a&rls=org.mozilla:en-US:official
5 1 2011-06-24 00:25:33 2011-06-24 00:25:33 http://www.google.ca/firefox?client=firefox-a&rls=org.mozilla:en-US:official
Click to expand...

Gotcha... Thank you. Was just trying to visualize it. Appreciate all your hard work.
 
ladylurker said:
this confuses me as well. the fact that the search was there at all was hinky to me. when they said 84 times, i was shocked! but i am confused if this was a lie, or intentional misleading, or an error, OR if it actually maybe was 84 times and some kind of weird coincidence or something? :waitasec:

i am really sorry to keep posting stupid questions, but i am still unclear on whether there is something to show that it definitely WAS a mistake/intentional misleading and that it definitely was NOT 84 searches, and what it is exactly that calls it into question considering that neither of the two search dates mentioned was the 84th day of the year. can anyone out there clarify for me pretty please?
Click to expand...

I think we're still trying to figure that out... BenjaminFPierce is currently testing some theories for us....
 
GeekyGirl said:
I think we're still trying to figure that out... BenjaminFPierce is currently testing some theories for us....
Click to expand...

thanks GG, you are uber helpful as always!

another question: what exactly did this confusion stem from? it seems like people on other sites are saying "since it was the 84th day of the year it is probably an error," but it was not the 84th day of the year, so was there anything else besides that which made it seem like an error? or was that the only red flag about this? i suppose i don't quite grasp where this came from.

again, sorry if i'm dumb, today i feel like an uber-newb (which is super fun to say).
 
ladylurker said:
this confuses me as well. the fact that the search was there at all was hinky to me. when they said 84 times, i was shocked! but i am confused if this was a lie, or intentional misleading, or an error, OR if it actually maybe was 84 times and some kind of weird coincidence or something? :waitasec:

i am really sorry to keep posting stupid questions, but i am still unclear on whether there is something to show that it definitely WAS a mistake/intentional misleading and that it definitely was NOT 84 searches, and what it is exactly that calls it into question considering that neither of the two search dates mentioned was the 84th day of the year. can anyone out there clarify for me pretty please?
Click to expand...

Honestly, it makes a bit more sense that the 84 was for Myspace. Why would someone search "How to" if they had a bookmark to the sci-spot page?

However, I often use Google to search just to navigate to a page. It may have been her top visited link from Google's index during that time and that's how she navigated to the page even though maybe she had a bookmark too.

But it sorta makes more sense it is a Myspace count from what I heard today.

The state and the OSCO computer guy sounds like they could have made a mistake. Or, the other program could be wrong. But using the Dork.exe you can easily tell which one is correct.

Ashton should be made aware of this information. I've emailed John Bradley about it but I don't know if anyone is going to listen to me. Mr. Bradley probably doesn't want to know how easy it would have been to find this information. He could be embarassed, especially if he coded his parser wrong.
 
benjaminfpierce said:
Honestly, it makes a bit more sense that the 84 was for Myspace. Why would someone search "How to" if they had a bookmark to the sci-spot page?

However, I often use Google to search just to navigate to a page. It may have been her top visited link from Google's index during that time and that's how she navigated to the page even though maybe she had a bookmark too.

But it sorta makes more sense it is a Myspace count from what I heard today.

The state and the OSCO computer guy sounds like they could have made a mistake. Or, the other program could be wrong. But using the Dork.exe you can easily tell which one is correct.

Ashton should be made aware of this information. I've emailed John Bradley about it but I don't know if anyone is going to listen to me. Mr. Bradley probably doesn't want to know how easy it would have been to find this information. He could be embarassed, especially if he coded his parser wrong.
Click to expand...

Silly question, but how long has dork.exe been available? BTW I keep meaning to tell you that I love your sn, I'm a M**advertiser censored*S*H fanatic.
 
benjaminfpierce said:
I don't think that hits means how many urls where subsequently hit from the HTML urls loaded. The hits ties to the url of the html index or page and is a counter.

Are you able to delete this and hit a url one time only with images, etc. on it?
Click to expand...

My theory is wrong about the images being included as hits.

This is from a freshly-cleaned-history Firefox session. 1 hit. I typed in the websleuths url. Websleuths has never been accessed from the test computer.

Type: http
Tag: 0
Last Visited [UTC]: 2011-06-24 01:43:00 Fri
Last Visited [Local]: 2011-06-23 21:43:00 Thu
Hits: 1
User:
URL: http://www.websleuths.com/forums/home.php
Host: www.websleuths.com
Page Title: Websleuths Crime Sleuthing Community
Absolute Path: /forums/home.php
Query:
Fragment:
Port: 80
URL Category:
Logon User:
Logon Password:
Redirect URL:
Feed URL:
Referral URL: http://websleuths.com/
Fav Icon URL:
Cache Folder:
Cache File:
Extension:
Length: -
Exists: -
HTTP Reponse:
Cache Entry Type Flag:
Content Type:
Content Length: -
Content Encoding:
ActiveBias:
Date First Visited [UTC]:
Date Expiration [UTC]:
Date Last Modified [UTC]:
Date Index Created [UTC]:
Date Added [UTC]:
Date Last Synch [UTC]: 2011-06-24 01:43:00 Fri
Source File: C:\Documents and Settings\j\Desktop\places\places.sqlite
Source Offset: Index: 3
Index Type: History
Browser Version: Firefox v3 (History)
IE Type:
Status: From: Permanent Redirect | Typed: 0 | Session: 3 | Hidden: 0 | Frecency: 2000 | place_id: 1811
Bookmark:
URN: 3
Click to expand...

Why doesn't this show typed?

But I got curious about refreshes. Cleared the history again (closing the browser after I did so both times.) I refreshed the browser (I thought) 5 times- once per minute. Even wrote down the times.

Type: http
Tag: 0
Last Visited [UTC]: 2011-06-24 01:51:26 Fri
Last Visited [Local]: 2011-06-23 21:51:26 Thu
Hits: 2
User:
URL: http://www.websleuths.com/forums/home.php
Host: www.websleuths.com
Page Title: Websleuths Crime Sleuthing Community
Absolute Path: /forums/home.php
Query:
Fragment:
Port: 80
URL Category:
Logon User:
Logon Password:
Redirect URL:
Feed URL:
Referral URL: http://websleuths.com/
Fav Icon URL:
Cache Folder:
Cache File:
Extension:
Length: -
Exists: -
HTTP Reponse:
Cache Entry Type Flag:
Content Type:
Content Length: -
Content Encoding:
ActiveBias:
Date First Visited [UTC]:
Date Expiration [UTC]:
Date Last Modified [UTC]:
Date Index Created [UTC]:
Date Added [UTC]:
Date Last Synch [UTC]: 2011-06-24 01:51:26 Fri
Source File: C:\Documents and Settings\j\Desktop\places\places.sqlite
Source Offset: Index: 5
Index Type: History
Browser Version: Firefox v3 (History)
IE Type:
Status: From: Typed URL | Typed: 1 | Session: 5 | Hidden: 0 | Frecency: 4000 | place_id: 1811
Bookmark:
URN: 5
Click to expand...

At 9:55, I right clicked on a link to open in a new tab and went to a forum on Websleuths:

Type: http
Tag: 0
Last Visited [UTC]: 2011-06-24 01:55:20 Fri
Last Visited [Local]: 2011-06-23 21:55:20 Thu
Hits: 1
User:
URL: http://www.websleuths.com/forums/forumdisplay.php?f=60
Host: www.websleuths.com
Page Title: Missing Forum Discussion - Websleuths Crime Sleuthing Community
Absolute Path: /forums/forumdisplay.php
Query: ?f=60
Fragment:
Port: 80
URL Category:
Logon User:
Logon Password:
Redirect URL:
Feed URL:
Referral URL: http://www.websleuths.com/forums/home.php
Fav Icon URL:
Cache Folder:
Cache File:
Extension:
Length: -
Exists: -
HTTP Reponse:
Cache Entry Type Flag:
Content Type:
Content Length: -
Content Encoding:
ActiveBias:
Date First Visited [UTC]:
Date Expiration [UTC]:
Date Last Modified [UTC]:
Date Index Created [UTC]:
Date Added [UTC]:
Date Last Synch [UTC]: 2011-06-24 01:55:20 Fri
Source File: C:\Documents and Settings\j\Desktop\places\places.sqlite
Source Offset: Index: 27
Index Type: History
Browser Version: Firefox v3 (History)
IE Type:
Status: From: Link | Typed: 0 | Session: 5 | Hidden: 0 | Frecency: 100 | place_id: 1831
Bookmark:
URN: 6
Click to expand...

So refresh doesn't cause another hit to record but right clicking in a new tab will in the same session.
 
technicalconfusion said:
My theory is wrong about the images being included as hits.

This is from a freshly-cleaned-history Firefox session. 1 hit. I typed in the websleuths url. Websleuths has never been accessed from the test computer.



Why doesn't this show typed?

But I got curious about refreshes. Cleared the history again (closing the browser after I did so both times.) I refreshed the browser (I thought) 5 times- once per minute. Even wrote down the times.



At 9:55, I right clicked on a link to open in a new tab and went to a forum on Websleuths:



So refresh doesn't cause another hit to record but right clicking in a new tab will in the same session.
Click to expand...

I wouldn't use those programs with Mork db. They will probably produce odd results. They're assuming the history.dat for sqlite db I think?
 
benjaminfpierce said:
I wouldn't use those programs with Mork db. They will probably produce odd results. They're assuming the history.dat for sqlite db I think?
Click to expand...

I don't know. I'm using the program NetAnalysis mentioned by the computer guy today.

They used NetAnalysis and Cacheback. I haven't gotten to cacheback yet.

I also don't know what version the Anthony's were using for Firefox. When I started this tonight, I just grabbed old history.dat files off my harddrive. I just kind of assumed it was around 2.0 - 3 years ago.

To test the above, I had to move to another computer and use Firefox 3. I've only recently updated my browsers - I had Firefox 2 for like *ever* lol.
 
All this due to the dangers of...Hand Sanitizer! I wonder if those key words are also included since Cindy claims to have been sooo concerned about it!
 
technicalconfusion said:
I don't know. I'm using the program NetAnalysis mentioned by the computer guy today.

They used NetAnalysis and Cacheback. I haven't gotten to cacheback yet.

I also don't know what version the Anthony's were using for Firefox. When I started this tonight, I just grabbed old history.dat files off my harddrive. I just kind of assumed it was around 2.0 - 3 years ago.

To test the above, I had to move to another computer and use Firefox 3. I've only recently updated my browsers - I had Firefox 2 for like *ever* lol.
Click to expand...

It was established that the deleted history.dat file recovered from unallocated space was from Firefox 2.0. 2.0 uses mork.
 
All I can say is that I truly hope the state is looking into it, and that if there was an honest error, they correct it. I know if I were a juror and I found out after the trial was over that some of the evidence I based my decision on was questionable, I would be extremely upset.
 
GeekyGirl said:
All I can say is that I truly hope the state is looking into it, and that if there was an honest error, they correct it. I know if I were a juror and I found out after the trial was over that some of the evidence I based my decision on was questionable, I would be extremely upset.
Click to expand...

Well, I emailed Kathi @ WFTV so she might pass info along if she reads her email and it's not too spammed.
 
RiverRat said:
All this due to the dangers of...Hand Sanitizer! I wonder if those key words are also included since Cindy claims to have been sooo concerned about it!
Click to expand...

yes i wonder too. she seemed to have a round-about way of googling things.
 
Sandra Osborne and Kevin Stenger were prosecution witnesses on June 8 and and John Dennis Bradley was a prosecution witness on June 8 and June 9. For an easy to follow witness list, channel 13's website has a good one that lists by chronologicial order that the witnesses appeared:

http://www.cfnews13.com/article/news/2011/may/251421/

WFTV has a Casey trial archive, go to their archive page:

http://www.wftv.com/caseyanthony/28083402/detail.html

The computer forensic testimony on WFTV goes from part 3
http://www.wftv.com/video/28170916/index.html

through part 12 on June 8.
Part 11 is the one where LKB asks JDB in her re-direct about how may visits there are to the sci-spot website:

http://www.wftv.com/video/28175188/index.html

go to the 28:17 mark, Linda Drane Burdick asks John Dennis Bradley about ths sci spot site number of visits.

LDB: Entry number three, the w w w dot chemistry dot com slash chloroform. How many times was that site visited?
JDB: According to the history, eighty four times.
LDB: Thank you. That’s all I have your honor.
HHBP: Re-cross as to those issues and those issues alone.

In part 12
http://www.wftv.com/video/28175466/index.html

of the video Jose shows JDB a report that isn't his, so LKB objects to his tesitfying about a report that isn't his, HHJP asks JDB if the report is his, JDB says no, so the objection is sustained. Jose does get a question in about the visit to the sci spot site only being once but that never gets answered by JDB, then there a lengthy sidebar, then the judge dismisses the jury for the day.
June 9, go to part 1 of the raw video WFTV
http://www.wftv.com/video/28182152/index.html

to the 12 minute mark to watch the re-cross of John Dennis Bradley by Jose Baez.

Jose still doesn't show JDB his own report, so the issue of the number of visits to the sci spot web site isn't really cleared up during the re-cross by Jose.
 
Hoping maybe someone here can answer this question. Is there any evidence that the word "Chlorophyll" was ever searched on the A's computer? I don't remember seeing it in any of the released documents.
 
"Thanks to all the techies on here for your efforts to unravel the "84 visits mystery". So, either there WERE 84 visits, which looks like it could have been possible and which is what was testified to. Or there were not, which is what Jose Baez was dancing around.

The man who wrote the program seems pretty darn sure of the number of visits to the site. He was questioned closely about the 84 number.

Jose had nothing to back up his "something's hinky here" claim today. The man he was questioning was not qualified to answer the question.

My question: If the Defense had questions about this item, why did they not ask about them when the man who wrote the program was on the stand? They've had the evidence for a long time now, so this is not something "new". Jose even stated in his whine the other day that they thought they were finished with their computer expert so they had "let him go".

Could it be they did not want to ask the guy who wrote the program these questions because he would likely be able to ANSWER them? And that answers are not what they really wanted?

I am not saying that there are never any errors made within the coding of a program. We all know there are. And many here seem to have fallen for the "something's hinky here" line that Jose presented.

I think the search terms found are incriminating, whether a site was visited once or 84 times. And I don't think Cindy did those searches.

All IMO
 
You must log in or register to reply here.

DNASolves

Who is Escambia County John Doe (1989)?

Staff online

Members online

... and 191 more.
Total: 2,251 (members: 192, guests: 2,059)

Online statistics

Members online
192
Guests online
2,059
Total visitors
2,251
Totals may include hidden visitors.

Forum statistics

Threads
600,977
Messages
18,116,452
Members
230,994
Latest member
satchel7
Back
Top