On pages 2844 and 2845 are two screen shots of a computer forensic application called
Encase Law Enforcement. It appears that this program is reporting the number of files that were created / written / accessed / modified / deleted. The data is summarized to show hourly activity on the HP desktop and Compaq laptop by hour for the days of June 16 and June 17. Although we do not know exactly what each "dot" means in the plot, we can use the information to see a relative usage pattern.
I am going to make the following assumptions:
1) The HP desktop always stays in the Anthony home
2) The Compaq laptop traveled around with Casey
3) Cindy's working hours ~ 8-5 PM so not at home during that time
4) George's working hours ~ 2-10 PM so not at home during that time
5) Cindy clearly used computer for email and managing social networking page
6) Not sure what George's usage of computer was, but reasonable to assume he surfed as well.
Looking back at the screen shot, although we do not know exactly what each "dot" means in the plot, we can use the information to see a relative usage pattern. What I have done below is show the
relative usage of the two computers, as reported by EnCase. The 100% from 9-10 PM on the 17th for the Compaq computer means that was the most active computer usage for either computer during the two days. A 49% from 12-1 AM on the 16th for the desktop means the computer was roughly half as active as the previous example.
Code:
[FONT=Courier New]HP Desktop Compaq Laptop
16-Jun
12AM 1AM 49% *****
7AM 8AM 74% *******
8AM 9AM 15% **
10AM 11AM 80% ********
11AM 12PM 49% ***** 0%
1PM 2PM 1%
2PM 3PM 82% ******** 1%
4PM 5PM 1%
11PM 12AM 23% **
17-Jun
12AM 1AM 3%
1AM 2AM 6% *
3AM 4AM 36% ****
4AM 5AM 5% *
8AM 9AM 5% *
12PM 1PM 26% ***
1PM 2PM 3%
2PM 3PM 80% ********
4PM 5PM 13% *
7PM 8PM 54% *****
8PM 9PM 44% ****
9PM 10PM 100% **********
10PM 11PM 65% *****
11PM 12AM 6% * [/FONT]
My interpretation is as follows:
The HP computer had relatively light usage on the 17th. I believe this was likely indicative of the parent's computer usage. The 11PM to 1AM usage into the 17th is probably Cindy, and after that is probably George - based on when each has to get up for work in the AM. Yes, seems odd for George, but maybe he was surfing Websleuths. :waitasec:
KC was a very active user, based on what we see with the Compaq on the 17th. Thus, based on the level of activity and the assumptions I listed above, I humbly conclude the following:
KC spent the night of the 15th / morning of the 16 at her parents. She is very active on the HP in the morning, probably before Caylee gets up. Caylee gets up between 8 and 9, usage drops. Caylee then plays or watches TV from 9-10 while Casey gets back on the computer until noon.
From noon to 2 PM there is no HP activity, supporting George's statements he saw the two and they left around 1 PM. However, from 2 to 3 - after George has left for work - the usage goes way up. This is the second most active period of either computer during this time.
Usage abruptly ends at 3 PM. I suspect Casey was preoccupied from 2 to 3 and not paying attention to Caylee.
Around 3 PM, I submit, is when Casey discovers something awful happened to Caylee. 
The minimal activity seen on the Compaq (and I do mean minimal) can easily be explained by the laptop being powered on and open and connected to the internet. This alone will cause some small number of files to be accessed and modified. Casey did not really need to be doing anything on the computer.
