Anthony's Computer Forensics

[ibyoungr]

Hi Lanie,

I'm not sure it really shoots that theory down. Here's why I still think Ricardo is the source of the image:

A while back when I found out what the file name was I entered it into Google image search and saw it on a lot of myspace pages. I noticed that the majority of the ones I looked at were uploaded to myspace during January to March of 2008, which told me it was a hot / popular image around that time frame.

Also, the image was found on Ricardo's myspace and his computer, but does not appear to have ever been on any KC website or computer. Thus, I could easily be convinced that Ricardo found the image on someone else's myspace, downloaded it to his computer on one day before the 17th, then later on the 18th uploaded it to his own myspace. Prior to the upload, he showed it to KC.

It is quite possible the texts / calls earlier on Monday are Ricardo telling her about the picture on someone else's myspace and teasing her about it. I still think her searches on the 17th were KC's attempt to answer the question "what is chloroform?"

I recieved in a email around last year. Could she have received in her email, forwarded to Ric and then looked it up online? Remember her email in her email accounts were evidently deleted.

 

[~ Amy ~]

3/17/08 MON 12:50 PM 3/17/08 12:50 PM 2 INCOMING CALL Ricardo "Boyfriendizzle" Morales (Cell) Casey Anthony
3/17/08 MON 12:53 PM 3/17/08 12:53 PM 2 OUTGOING CALL Casey Anthony Ryan "Best Friend" Pasley (Cell)
3/17/08 MON 1:09 PM 3/17/08 1:09 PM 2 OUTGOING TEXT Casey Anthony Ricardo "Boyfriendizzle" Morales (Cell)
3/17/08 MON 1:35 PM 3/17/08 1:35 PM 2 INCOMING CALL Ricardo "Boyfriendizzle" Morales (Cell) Casey Anthony
3/17/08 MON 1:39 PM 3/17/08 1:39 PM 2 INCOMING TEXT Casey Anthony Casey Anthony

I am wondering if the 12 50 pm call from Ricardo to kc lasted 3 mins and then kc placed a call to Ryan at 12 53 and then she followed up with a text to ricardo at 1 09? I guess what I am asking about is the time durations of these calls / texts. Like does the time show that she talked to ricardo for 3mins or did she not answer her phone , and the phone records just show that he called her at 12 50?

 

[JWG]

3/17/08 MON 12:50 PM 3/17/08 12:50 PM 2 INCOMING CALL Ricardo "Boyfriendizzle" Morales (Cell) Casey Anthony
3/17/08 MON 12:53 PM 3/17/08 12:53 PM 2 OUTGOING CALL Casey Anthony Ryan "Best Friend" Pasley (Cell)
3/17/08 MON 1:09 PM 3/17/08 1:09 PM 2 OUTGOING TEXT Casey Anthony Ricardo "Boyfriendizzle" Morales (Cell)
3/17/08 MON 1:35 PM 3/17/08 1:35 PM 2 INCOMING CALL Ricardo "Boyfriendizzle" Morales (Cell) Casey Anthony
3/17/08 MON 1:39 PM 3/17/08 1:39 PM 2 INCOMING TEXT Casey Anthony Casey Anthony

I am wondering if the 12 50 pm call from Ricardo to kc lasted 3 mins and then kc placed a call to Ryan at 12 53 and then she followed up with a text to ricardo at 1 09? I guess what I am asking about is the time durations of these calls / texts. Like does the time show that she talked to ricardo for 3mins or did she not answer her phone , and the phone records just show that he called her at 12 50?

Hi Amy,

Sorry I did not include the call durations. The duration of the three calls listed above are as follows, in minutes: 3, 2, 1.

 

[JWG]

In today's document dump the chloroform searches are re-released - no new searches are shown in this dump. However, the spreadsheet file from which the investigative report was created is included. This means we can now see the exact URL of the syndicated (advertisement) pages that were automatically loaded when she clicked on a link that Google produced as a result of the search.

Searches from the 21st produced syndicated links. Those on the 17th did not.

Google search for: how+to+make+chloroform
She clicked on one of the links whose page produced the following Google syndicated ads (note, I do not know where on the page these ads were located):



Note the Get Your Baby to Sleep ad.

A third ad closely resembling the second was also loaded.

Google search for: self+defense
She clicked on one of the links whose page produced the following Google syndicated ads:





A third ad linking to a number of karate sites was also uploaded.

Google search for: household+weapons
She clicked on one of the links whose page produced the following Google syndicated ads:

An ad for Aether apparel.

From there she clicked on a page that took her to the following Google-hosted poll:



From there she clicked on a page that produced the following Google-syndicated ad:



Not sure how much that really adds to our knowledge. It would still be great to see all of the web surfing history from that computer's unallocated space.

 

[JWG]

Following the Google search for household weapons, KC surfed to the following two pages of a book found on books.google.com (these are the only two pages visited):

 

[Rumpole]

In today's document dump the chloroform searches are re-released - no new searches are shown in this dump. However, the spreadsheet file from which the investigative report was created is included. This means we can now see the exact URL of the syndicated (advertisement) pages that were automatically loaded when she clicked on a link that Google produced as a result of the search.

Searches from the 21st produced syndicated links. Those on the 17th did not.

Google search for: how+to+make+chloroform
She clicked on one of the links whose page produced the following Google syndicated ads (note, I do not know where on the page these ads were located):

View attachment 3203

Note the Get Your Baby to Sleep ad.
SNIP

I'd just like to throw in a word of caution about reading too much into what Google ads came up:

Personally, I almost never read or even see what they say.

 

[JWG]

I'd just like to throw in a word of caution about reading too much into what Google ads came up:

Personally, I almost never read or even see what they say.

I have not placed too much in the chloroform searches, as I still seriously doubt KC would go to the trouble of acquiring chloroform. However, I am intrigued by the little ad that popped up first as possibly planting a seed in KC's little mind ...

 

[JBean]

bumpity bump

 

[Noddy]

I have not placed too much in the chloroform searches, as I still seriously doubt KC would go to the trouble of acquiring chloroform. However, I am intrigued by the little ad that popped up first as possibly planting a seed in KC's little mind ...

JWG, do you know if the computer forensics would show the use of the various downloaded icons that KC had? Would it show who she sent them to?
Hope this question makes sense but she sure was expressing herself with those icons and I was just wondering who she was expressing herself to.

 

[DAWN TREADER]

I am very curious whether Casey might have used her mother's credit card(s) to buy things online and whether these transactions have been discovered and reveal any information that could be relevant to Caylee's murder.

 

[JWG]

JWG, do you know if the computer forensics would show the use of the various downloaded icons that KC had? Would it show who she sent them to?
Hope this question makes sense but she sure was expressing herself with those icons and I was just wondering who she was expressing herself to.

Hi Noddy :wave:

LE has clues as to where on the internet she posted them. We know for a fact that she posted them on Photobucket, because a subpoena is what made that discovery possible. Similar subpoena's to Myspace and Facebook could also reveal what use they might have been put to on those sites.

It would be pretty difficult - if not impossible - to figure out what she might have done with them by looking at her computer. If she was uploading them there is no guarantee the site she uploaded them to left a track on her computer. For example, I have posted a number of images from my computer on WS's, but there is nothing in my internet history or cookies that indicate I ever did such a thing.

The forensics could show where KC emailed them - assuming she did. They would be able to recover undeleted emails and in many cases can recover deleted ones.

Hope that answers your question!

 

[Noddy]

Hi Noddy :wave:

LE has clues as to where on the internet she posted them. We know for a fact that she posted them on Photobucket, because a subpoena is what made that discovery possible. Similar subpoena's to Myspace and Facebook could also reveal what use they might have been put to on those sites.

It would be pretty difficult - if not impossible - to figure out what she might have done with them by looking at her computer. If she was uploading them there is no guarantee the site she uploaded them to left a track on her computer. For example, I have posted a number of images from my computer on WS's, but there is nothing in my internet history or cookies that indicate I ever did such a thing.

The forensics could show where KC emailed them - assuming she did. They would be able to recover undeleted emails and in many cases can recover deleted ones.

Hope that answers your question!

Thank's JWG for the answers. I'm in awe of your forensics and computer knowledge. :bow: I'm was hoping that they may be able to see who she sent them to on Facebook or MySpace. It'll just show perhaps what type of relationship she had with those peeps. As a for instance, I know that there is a Tara K on her phone list and then there are a lot of icons and pics that are very similar on both KC's PB account and Tara's MS. The 'glow stick - love' pic was one of them. KC just kept assimilating peoples personalities. Borg!

Thanks again and actually, I'm kind of reassured by your comment that computer history or cookies won't show where pictures are posted in general. I don't know why because mine are pretty mundane but who knows, life may turn exciting! :biggrin:

 

[JWG]

Bond PM'd me about a troubling inconsistency he found in the computer forensic evidence. I'm throwing it out there to see if someone has a plausible explanation - perhaps ElizaAvalon?

I do not have one...yet.

The docdump of November 26, 2008 contained two pages of Encase Timeline graphs showing when the desktop and laptop computers were used on June 16 and 17, 2008. These are discovery pages 2844, 2845.

Page 2845 represents the laptop activity and shows no activity between 3:00 and 4:00 PM on June 17.

However, the computer / camera forensic report from the September 26 docdump shows that the movie files of Caylee's visit to Mt. Dora were created on the laptop at 3:29 PM, June 17.

Further reading of the computer forensic report implies that the camera and computer date / time stamps were in agreement on June 15 - 17, and were in agreement with OCSO time on the date of examination.

I suppose that someone could have changed the date / time of both the camera and computer between June 17 and July 16, but that flies in the face of the "keep it simple" directive one should typically follow in this case.

Thoughts?

 

[The World According]

I am very curious whether Casey might have used her mother's credit card(s) to buy things online and whether these transactions have been discovered and reveal any information that could be relevant to Caylee's murder.

I just listened to Cindy's brother Rick's five part call to police/FBI , he retells how Casey spent thousands of dollars on Cindy's cards, thousands! It is on You Tube. I want to know since she wouldn't hand them over willingly, if Yuri eventually got the records through court order.

 

[Jolynna]

Casey last text session with Alex (witeplayboi) was June 16 from 7:56 to 8:06 a.m. which is just after Casey picked up her voice mail. She told him she was not doing much, just checking on her facebook and myspace.

Then she talks about getting her house and moving in with Amy at the end of the month.

Anyway, since Casey's cell pings were by her parent's house IF the text session with Alex was from her parent's IP address, that pretty much nails down her location.

 

[spqr]

Hi Noddy :wave:


It would be pretty difficult - if not impossible - to figure out what she might have done with them by looking at her computer. If she was uploading them there is no guarantee the site she uploaded them to left a track on her computer. For example, I have posted a number of images from my computer on WS's, but there is nothing in my internet history or cookies that indicate I ever did such a thing.

Snipped and bolded by me.

Just because your internet history or cookies don't show the activity you are referring to, doesn't mean those traces don't exist. There are many storage locations deep within your computer such as in your registry. If you don't know where to look, you won't find them.

Also, those markers are usually in more than one place on your computer. It could be in 3,4,5, etc...different places on your computer. Just because someone deletes their internet history and cookies definitely doesn't mean they erased all traces. JMHO

 

[JWG]

Hi Noddy :wave:


It would be pretty difficult - if not impossible - to figure out what she might have done with them by looking at her computer. If she was uploading them there is no guarantee the site she uploaded them to left a track on her computer. For example, I have posted a number of images from my computer on WS's, but there is nothing in my internet history or cookies that indicate I ever did such a thing.

Snipped and bolded by me.

Just because your internet history or cookies don't show the activity you are referring to, doesn't mean those traces don't exist. There are many storage locations deep within your computer such as in your registry. If you don't know where to look, you won't find them.

Also, those markers are usually in more than one place on your computer. It could be in 3,4,5, etc...different places on your computer. Just because someone deletes their internet history and cookies definitely doesn't mean they erased all traces. JMHO

Thanks SPQR. The point I was trying to get across was, based on the evidence released, we cannot tell what she was doing with the files.

Also, in the case of Photobucket and Facebook (and Websleuths), it does not look like an upload leaves a trace in the Registry. I scanned mine with both the site names and IP addresses and came up empty. Doesn't mean it is not in there, but the obvious searches came up empty.

Fortunately, subpoenas of Photobucket allowed LE to determine when files on KC's account(s) were created and from which IP address they were uploaded.

 

[Duckley]

Possible Annoying Question...(PAQ)

How far do the computer forensics go... is data included regarding any searches for ZG or ZFG?

:blowkiss:

 

[BondJamesBond]

Possible Annoying Question...(PAQ)

How far do the computer forensics go... is data included regarding any searches for ZG or ZFG?

:blowkiss:

...not annoying @ all, Duckley. I don't recall if it is posted on this thread or on the Zanni thread, but, the computer forensics confirm that the media really goofed on the aspects of ZFG searches pre-7/15 and missing child website visits pre-7/15. Neither happened.

Both happened when Lee was trying to sort things out 7/15-7/16 and setting up the cayleeismissing website.

If you're interested...there's an explanation in detail back in one of the two threads, IIRC. Some of it may be bleeding over into my memory from emails w/ JWG vs. posts on the board. Lemme know if you don't find it.

Hope that helps.

 

[BondJamesBond]

OK...first things first.

A few days ago I was attempting to triangulate the cell records, the Encase activity files for the desktop & laptop, and statements...trying to learn if there was something that would help us better support that Caylee was alive or not when Casey left G&C's ~4:11PM Monday, 6/16. In doing this I made a huge gaffe reading the Encase activity report. Posted the whole stinkin' mess w/o noticing the goof. Within a minute or two I got a short PM from JWG very kindly pointing it out. Sooo...I was able to yank the post and retool. In the end, it took me in another direction. So...big TY to JWG for (a) catching the initial mistake & pointing it out so quickly, and (b) bouncing around this latest, but, not fully resolved observation. :highfive:

Alright then, onto the thing.

Conclusion/Speculation: The Encase activity reports are shifted 1 hr earlier than actual. For example, activity level shown as 2-3PM on the report ACTUALLY describes the activity level that occurred 3-4PM. I have one or two ideas on how this might've happened, but, lets save that for later.

IF this conclusion is correct, it may support the following speculation:

• 6/16 Heavy HP Desktop activity 3-4PM (shown as 2-3PM) can be attributed to Casey since George had left for work <3PM
• During Casey's first opportunity for privacy after George left for work <3PM she spent a significant amount of the time before she left ~4:11PM - on the desktop computer nline:
• Hence, Caylee was likely still alive when George left ~2:45PM 6/16

Some other potentially useful speculation w/o details that would make this even longer:

a) Caylee's naptime was typically 2-4PM based on JWG's Photobucket upload analysis, as well as Casey's recurring cell call duration pattern during this time of the day (ETA: updated time per JWG's owing to central vs. eastern time on Pb records)
b) George statement re: seeing Casey & Caylee leave @ 12:50 was a description of 6/9 vs. 6/16. George called the house 1 minute before he called Casey&#8217;s cell @ 3:04PM 6/16 indicating George knew Casey was @ the house when he left
c) The %&#8217;s shown in the Encase report may reflects the % of the hour listed during which the computer processor was active. IOW 100% = 60 minutes of activity​

OK...here's how we get there. Working backwards from Tuesday 6/17...

Observing Casey&#8217;s cell records for Tuesday, 6/17, it appears she arrived in the area of G&C&#8217;s ~2:30PM and waited to either observe George leave, or until a time when she could be confident he was gone. Between 2:30 and 2:49PM Casey placed/took calls to/from Ricardo, Tony and Clint. It appears George left ~2:49PM at which time Casey&#8217;s cell went inactive for 57 minutes.

At 3:47PM Casey resumed a light texting conversation with Tony that concluded @ 4:05PM when she called him and left sometime between 4:05-4:36PM.

In agreement with the cell activity that placed Casey @ G&C&#8217;s ~2:49PM-4:05PM we have the computer forensics report that tells us the nursing home pic of Caylee with Alex was copied onto the laptop 6/17 3:28PM. (Note: This is the pic that LE used to check the clock of the laptop vs. the camera vs. the memory card to confirm the pic was indeed taken on 6/15).

Also in agreement w/ the cell activity AND the computer forensics report, Casey sent a Facebook message to Amy, 3:15PM 6/17, "cheer up me lady! i love you and can't wait to finally get you moved in". (ETA: Updated Fb after JWG confirmed for me. :thumb

Note that the Encase report shows for the laptop on Tuesday, 6/17:
2-3PM: 80% activity (e.g. perhaps 48 minutes)
3-4PM: 0% activity

These timestamps are in direct conflict w/ the forensics report regarding the downloading of the nursing home pic AND the timeframe in which Casey was @ G&C&#8217;s per the cell pings AND the timing of Casey's Facebook message to Amy. However, they synchronize perfectly if the Encase activity report is shifted 1 hour.

On pages 2844 and 2845 are two screen shots of a computer forensic application called Encase Law Enforcement.

            [FONT=Courier New][B]HP Desktop        Compaq Laptop[/B]
 [B]Monday, 6/16:[/B]
                
[INDENT]12AM 1AM    49%   *****    
7AM 8AM     74%   *******    
8AM 9AM     15%   **    
10AM 11AM   80%   ********    
11AM 12PM   49%   *****       0%
1PM 2PM                       1%
2PM 3PM     82%   ********    1%
3PM 4PM                               0%
4PM 5PM                       1%
11PM 12AM   23%   **   [/INDENT] 


[B]Tuesday, 6/17:[/B]
                
[INDENT]12AM 1AM    3%        
1AM 2AM     6%    *    
3AM 4AM     36%   ****    
4AM 5AM     5%    *    
8AM 9AM     5%    *        
12PM 1PM    26%   ***        
1PM 2PM     3%            
2PM 3PM                       80%    ********
3PM 4PM                         0%
4PM 5PM                       13%    *
7PM 8PM                       54%    *****
8PM 9PM                       44%    ****
9PM 10PM                      100%   **********
10PM 11PM                     65%    *****
11PM 12AM   6%    *    [/INDENT] [/FONT]

*snipped for Encase data & some times w/ 0% activity added for continuity)*

Looking @ Monday, 6/16, to see if the same time shift may apply to the Desktop computer&#8230;

Casey was on the phone w/ Amy 1:44-2:20PM, and on the phone again w/ Jesse @ 2:52PM-3:03PM. Although Casey could have certainly multi-tasked, consider that this phone activity would have significantly impacted her ability to be active on the computer&#8230;leaving only 32 minutes (or ~53%) free & clear during the 2-3PM hour vs. 82% activity (49 minutes) shown on the Encase report .

In contrast, between 3-4PM Casey had almost no activity on her cell phone. She wrapped up her call w/ Jesse @ 3:04PM in order to take the incoming call from George, which lasted <1minute. She also placed one call to Tony that lasted <1minute. She did, however, receive 3 MySpace alerts to her cell phone during this period. If we continue w/ the time-based interpretation of the Encase report, the desktop was in use ~49 minutes. FWIW, if Casey&#8217;s cell MySpace alerts were directly or indirectly in response to her desktop activity, these timestamps being 3:23PM through 3:39PM, spanned 16 minutes&#8230;and left 49-16=33 minutes of activity to split before and/or after 3:23 & 3:39PM.

IMHO, the above strongly indicates the HP desktop Encase report time is also shifted by 1 hour (e.g. activity level shown as 2-3PM on the report ACTUALLY describes the activity level that occurred 3-4PM), similar to the laptop.

Now, IF one buys the conclusion, one can still interpret it to support a variety of theories. However, IMHO, the degree of usage on the desktop by Casey for what appears to have been 3-4PM, including what appears to have been MySpace activity can be factored in to support Caylee was likely still alive when George left ~2:45PM 6/16. Otherwise, Casey's first activities in private that afternoon would have more likely been consumed in dealing with something of higher priority than MySpace, etc.