Trying to tie a bunch of random conclusions I am drawing together in one neat package. Not sure if it is "neat" to anyone but me.
As I mentioned previously, the absence of KC surfing history in the internet history file was quite noticeable and seemed to indicate that KC deliberately tried to cover her tracks when surfing the web. George, on the other hand, made no attempt whatsoever - otherwise he would have eliminated evidence he was viewing escort sites.
Although KC covered her tracks, it is likely she took the easy route in doing so. This amounts to hiding her activities from her parents, but it was not enough to hide it from LE.
URL history
If you open either Internet Explorer or Firefox and press CTL-H, you will get the surfing history for that user on that browser. Both organize the history in "folders". Firefox has separate folders for the current and previous six days, as well as a single folder for all activity older than six days. IE has separate folders for the current day, the past week, 2 weeks ago, and 3 weeks ago.
What I believe KC does to cover her tracks is, quite simply, at the end of a surfing session she:
- Presses CTL-H to bring up the IE history sidebar
- Right-clicks on the Today folder
- Presses delete
- Presses CTL-H to hide the IE history sidebar
The above will erase all surfing activity from 12AM to the current time. This is why I am inclined to believe that KC is responsible for the June 16 2-3PM activity on the home computer. We know from one of the document dumps that someone was on the computer doing quite a bit during that time period, yet the history file shows no activity until 10PM. Someone erased the June 16 history earlier in the day, but not after 10PM. George did not have a habit of erasing his surfing history (such as visits to escort sites), but KC did.
FWIW, I would not be surprised if KC periodically looked at the contents of the history file to see where George was surfing, and noticed the visits to escort sites. It could be why she spread the story that her parents were getting divorced because of alleged infidelity on George's part.
Cookie history
Note that deleting the history does not delete the cookies - it only deletes the visited URLs.
Cookies can be deleted in IE by clicking
Tools then
Internet Options on the menu bar. A multi-tabbed window will open, and you would select the
General tab. In the middle of that window you will see a
Delete Cookies button.
Unfortunately, pressing that button deletes
all cookies collected up to that date. There is no evidence this is ever done because cookies are scattered all through the home computer's internet history file.
While not all sites visited on the web leave cookies, many sites KC visited do, such as Facebook, Myspace, Photobucket, and Yahoo. Yet, no cookies from those sites can be found. How did she delete them? :waitasec:
Deleting them selectively is very time-consuming, so
I believe that instead she disabled cookies whenever she surfed, then re-enabled them when she finished. This is very simple. Going back to the multi-tabbed window mentioned above, if you click on the
Privacy tab you will see a slider that is set to
Medium as the default. Sliding it to the top enables the
Block All Cookies setting. When done with surfing, she only had to go back to that tab and press Default. It is that simple. :thumb:
The internet cache
As we surf, files used to build web pages are stored on the computer in the
Temporary Internet History folder. This mostly consists of images on a web page but can also include style sheets and shockwave files. These files are automatically deleted after some period of time, the default being 20 days in Internet Explorer. The files can also be cleared manually by clicking the
Delete Files button on the
General tab mentioned above.
It is unknown if KC deleted the cached files, because the computer was seized more than 20 days after her last activity, and the cached files would have been automatically deleted anyway. :banghead:
How did LE recover the deleted history?
As several people have pointed out, when files are deleted, they are not really erased from the hard drive.
Think of your hard drive as a giant library with hundreds of thousands of books (files). Just as you need a simple and fast way to find a specific book in the library, Windows needs a simple and fast way of finding a file on the hard drive. Windows has the equivalent of a card catalog that points to the location on the hard drive of each file. When a file is deleted, windows does nothing more than erase the catalog entry - the file itself remains.
The space where the deleted file resides is added to the "unallocated sectors" list, meaning it can be used to store a new file or files. Over time, the original file might be partially or completely over-written by one or more other files, but this is not guaranteed. What forensic computer specialists do is use special software to search unallocated space for complete or partial files. This is how KC's Google searches were found. While she may have deleted them, they went into unallocated space and were never over-written. :dance:
KC's chloroform and weapons search
We know KC searched for chloroform, household weapons, and the like between 1:30 and 2:30 PM on March 17 and 21 (Caylee's nap time
). We know the history of these searches had been deleted, as the record was found in the unallocated space.
What I find interesting is that there
are cookies present for both days in the internet history file,
but none during the search period. Given that George never appears to have turned cookies off when he surfed,
this is a strong indication that KC performed the searches and that her standard operating procedure was to turn cookies off.
Of course, the searches may not have been motivated by anything other than curiosity and stream-of-consciousness surfing behavior, but I am pretty confident at this point that it was KC and not George.