April 15th wknd of Sleuthing

[Star12]

Another article from WRAL indicates that the files weren't "tampered with".

Chappell testified Wednesday that when he examined the computer in September 2008, he found multiple satellite photos from Google Maps on Brad Cooper's password-protected work laptop from July 11, 2008 – nearly 24 hours before Nancy Cooper was reported missing.
The user also zoomed in on the map for multiple views of the area.
"There were magnifications of two (areas), including the area where Nancy Cooper’s body was found," Chappell said Thursday.The search lasted 41 seconds, he said.
Defense attorneys also claim that 692 files on Brad Cooper's laptop were changed during a 27-hour period while the computer was in Cary police's possession when it should have been powered down.
Chappell said he examined every one of the files that the defense says were modified and that the changes were all operating system or security updates. There was also no evidence that the computer was hacked, he added.Prosecutors objected to a line of questioning by Kurtz about why someone knowledgeable about computers, like Brad Cooper, would leave a piece of evidence like the Google Maps search on a laptop and not leave any other evidence.
http://www.wral.com/specialreports/nancycooper/story/9440639/

That was the testimony I heard, and I was there. (There were litter boxes all around the defense table for Kurtz' kittens).

The storms last night were so frightening. I live in a highrise in Raleigh,and fortunately we had no damage in our area. My heart goes out to the many many who will continue to suffer through this. I thought the '88 tornado was horrible, but this was truly devestating. God be with them all.

 

[WolfpackWoman]

The fact that that particular google map cookie was deleted and not others, is even more compelling evidence.

Why is that? Do you believe BC deleted one google cookie in the history or his computer, and none of the actual tiles?

Because I (big surprise here) tend to see it another way. I think the cookie is the only thing that verifies the actual time, and the fact that it's not there is pretty compelling for me.

 

[Danielle59]

This is from the WRAL article about the search. It indicates that the satellite view was discussed.

Chris Chappell, a Durham police detective assigned to the FBI's Cyber Task Force, said that multiple aerial photos were accessed from Google Maps on Brad Cooper's laptop computer at 1:15 p.m. on July 11, 2008, while he was at work.
"It appears to be from the area of Fielding Drive," Chappell said. "It is my understanding (that’s) where Nancy Cooper's body was found."
Chappell said that Brad Cooper's computer files showed that someone searched for the ZIP code 27518 and determined, based on the latitude and longitude, that the center of that area was Fielding Drive.
Through a more in-depth examination, Chappell said, he found that the user zoomed in on the map for multiple views of the area.

http://www.wral.com/specialreports/nancycooper/story/9435025/

I still don't understand how a search on 27518 would show Fielding Drive as the center of that area. Fielding Dr has always had a Raleigh zip code. And no where on USPS is there indication that the 27518 area code boundaries changed after 2008 as was testified, the USPS would have to put out notice since some people's zips would change.

 

[Just the Fax]

This deserves more than a thanks. IMO, this is the "smoking gun."

Kurtz and his hired guns will try to totally confuse the jury on this.
However, Brad's fate is now sealed. The Friday afternoon time stamp of the search / zoom makes it impossible to be CPD corruption or cracked by neighbors within the hours the computer was at home on his wireless network.
Frankly, I am shocked there are posters that still say they are on the fence.:waitasec:

 

[Just the Fax]

Why is that? Do you believe BC deleted one google cookie in the history or his computer, and none of the actual tiles?

Because I (big surprise here) tend to see it another way. I think the cookie is the only thing that verifies the actual time, and the fact that it's not there is pretty compelling for me.

Yes, the cookie was deleted.
Open google maps, then open cookies...delete that tag only

 

[Tink56]

I still don't understand how a search on 27518 would show Fielding Drive as the center of that area. Fielding Dr has always had a Raleigh zip code. And no where on USPS is there indication that the 27518 area code boundaries changed after 2008 as was testified, the USPS would have to put out notice since some people's zips would change.

It was testified that the zip codes in the area have changed since 2008.

 

[SleuthinNC]

<Snipped>
Chappell said that Brad Cooper's computer files showed that someone searched for the ZIP code 27518 and determined, based on the latitude and longitude, that the center of that area was Fielding Drive.
Through a more in-depth examination, Chappell said, he found that the user zoomed in on the map for multiple views of the area.

http://www.wral.com/specialreports/nancycooper/story/9435025/

Purple bolding by me.

This is the part that really does not make any sense.

Fielding Dr.: Latitude: 35.72609 / Longitude: -78.748389

27518: Latitude: 35.730119 / Longitude: -78.773559

In order for Fielding Dr. to be the center of 27518, the 27518 Zip Code would have to extend several mile east of Fielding Dr.

Fielding Dr. is located East of 27518 within Zip Code 27606

I realize there has been testimony that the 27518 Zip Code "grew" however that would require notification and would have to again had to "shrink" such that Fielding went into the center of 27518 and then was moved back out to 27606. None of this happened.

 

[sunshine05]

Good morning all. Glad to read you locals are all safe. Sounds pretty scary out there. When we first moved to NC, I was always confused with the tornado watches and warnings (couldn't remember which was more serious). But they both scared the heck out of me (being from CA I had never been in one). So I can imagine how scary last night must have been for you!

This post is directed mostly to the people still on the fence (and if you're not on the fence, please don't respond with sarcasm). Why is the Google Map not your smoking gun? What is the theory YOU think the defense is going to use with their Google witness? Could the date have been off (he searched after the body was found)? Could he have NOT zoomed in to Fielding Dr - let's say he was searching for a new shoe store and it was 3 miles from Fielding Dr, but when zoomed out Fielding Dr (and 1000 other streets) was on the map?

The map testimony just added confusion for me. I was strongly on the fence before because I just couldn't (and don't) see this crime being planned. He was too smart - especially to leave a google map on the computer. Even I know that. But if the defense cannot come up with a sensible, logical theory about the map (that doesn't make you roll your eyes), I'm off the fence.

Thoughts?

One thing I was thinking about last night.....remember in testimony it came up that he did a search for a specific address on Greenstone Lane? That was noted in the defense petition too. The exact address doesn't appear to exist (178), but the street does. If you look up Greenstone Lane on google maps, it's not very far from Fielding and I believe Fielding shows up on that first screen. It is on the right. I don't know if it means anything at all (probably doesn't) but I wonder what that was all about and if defense will show that he was searching that nearby street.

Otherwise, I think it will be shown that some of the date stamps were off and suggest that if some were off, any could be off and they will show that it's possible the searching and zooming in was done on the 14th or 15th.

I really think if it the defense can't disprove this (and the zoom-in of Fielding Drive IS a smoking gun), why wouldn't he have taken the plea arrangement. That is true, he was offered a plea, right?

 

[Danielle59]

The fact that that particular google map cookie was deleted and not others, is even more compelling evidence.

There wouldn't have been a cookie for Fielding Dr since his search was on 27518.

 

[Just the Fax]

Well SNC, kurtz was not questioning what you say doesn't make sense.

 

[Just the Fax]

There wouldn't have been a cookie for Fielding Dr since his search was on 27518.

Huh???

 

[Palomine]

Nope not a factor.

wral WRAL NEWS in NC
Det. Chappell: Brad was at Cisco on July 11 when he looked at Fielding Drive images on his work laptop. #coopertrial

wral WRAL NEWS in NC
Det. Chappell: Brad spent 1 min. creating temporary internet files (TIFS) picture of Fielding Drive. It was an aerial photo. #coopertrial
wral WRAL NEWS in NC

Det. Chappell: Brad zoomed in on aerial photos of Fielding Drive at exactly 1:15:27 p.m. on July 11, 2008. #coopertrial

the tifs is what I refered to as tmps

 

[Danielle59]

It was testified that the zip codes in the area have changed since 2008.

If zip codes change boundaries the USPS puts out a notice, you can pull them up from their site, there is no notice of boundary changes for 27518.

 

[SleuthinNC]

Another article from WRAL indicates that the files weren't "tampered with".

Chappell testified Wednesday that when he examined the computer in September 2008, he found multiple satellite photos from Google Maps on Brad Cooper's password-protected work laptop from July 11, 2008 – nearly 24 hours before Nancy Cooper was reported missing.
The user also zoomed in on the map for multiple views of the area.
"There were magnifications of two (areas), including the area where Nancy Cooper’s body was found," Chappell said Thursday.The search lasted 41 seconds, he said.
Defense attorneys also claim that 692 files on Brad Cooper's laptop were changed during a 27-hour period while the computer was in Cary police's possession when it should have been powered down.
Chappell said he examined every one of the files that the defense says were modified and that the changes were all operating system or security updates. There was also no evidence that the computer was hacked, he added.Prosecutors objected to a line of questioning by Kurtz about why someone knowledgeable about computers, like Brad Cooper, would leave a piece of evidence like the Google Maps search on a laptop and not leave any other evidence.
http://www.wral.com/specialreports/nancycooper/story/9440639/

Det. Chappell made have said he examined the files and determined they were automatic updates (which should not have happened because the laptop was powered off right?) the previous agent testified he saw the files and didn't know how or why there were changes and inconsistencies. Not enough information for me to say what happened to these files. I will wait to hear the defense side and see where all the evidence leaves me.

 

[Just the Fax]

.

~~~snipped

I really think if it can't be shown that it IS a smoking gun and if it is a smoking gun, why wouldn't he have taken the plea arrangement. That is true, he was offered a plea, right?

Why do you keep saying he was offered a plea of 2nd degree murder????
That is simply not true.

 

[SleuthinNC]

wral WRAL NEWS in NC
Det. Chappell: Brad was at Cisco on July 11 when he looked at Fielding Drive images on his work laptop. #coopertrial

wral WRAL NEWS in NC
Det. Chappell: Brad spent 1 min. creating temporary internet files (TIFS) picture of Fielding Drive. It was an aerial photo. #coopertrial
wral WRAL NEWS in NC

Det. Chappell: Brad zoomed in on aerial photos of Fielding Drive at exactly 1:15:27 p.m. on July 11, 2008. #coopertrial

the tifs is what I refered to as tmps

And I am saying there is no Cisco policy or otherwise preventing the deletion of said tmp files or TIF.

 

[Danielle59]

wral WRAL NEWS in NC
Det. Chappell: Brad was at Cisco on July 11 when he looked at Fielding Drive images on his work laptop. #coopertrial

wral WRAL NEWS in NC
Det. Chappell: Brad spent 1 min. creating temporary internet files (TIFS) picture of Fielding Drive. It was an aerial photo. #coopertrial
wral WRAL NEWS in NC

Det. Chappell: Brad zoomed in on aerial photos of Fielding Drive at exactly 1:15:27 p.m. on July 11, 2008. #coopertrial

the tifs is what I refered to as tmps

If he was making TIFs of the area for one minute, why did Chappel also say he was only on google maps for for 41 seconds. You can't take a minute making tifs of something you were only on for 41 seconds.

 

[SleuthinNC]

Well SNC, kurtz was not questioning what you say doesn't make sense.

Kurtz was questioning the "how" of the search which is when the Det. gave his CYA response of "You can't do the same search now as was done in 2008" and the 27518 Zip Code changing story.

 

[Madeleine74]

I did a search on 27518 and the center of that is Kildare Farm Rd. Magnification level starts out in the middle so I have to zoom in to the area by about 3 or 4 clicks. To see Fielding Dr at that zoomed in level I have to scroll the map to the right. And then to see the dump site in detail I have to zoom in a couple more clicks. My computer is slow and I can see the the tiles as they render the image.

As I move the image around I see the closed fist icon the FBI expert talked about.

 

[grommet]

Another article from WRAL indicates that the files weren't "tampered with".

Chappell testified Wednesday that when he examined the computer in September 2008, he found multiple satellite photos from Google Maps on Brad Cooper's password-protected work laptop from July 11, 2008 – nearly 24 hours before Nancy Cooper was reported missing.
The user also zoomed in on the map for multiple views of the area.
"There were magnifications of two (areas), including the area where Nancy Cooper’s body was found," Chappell said Thursday.The search lasted 41 seconds, he said.
Defense attorneys also claim that 692 files on Brad Cooper's laptop were changed during a 27-hour period while the computer was in Cary police's possession when it should have been powered down.
Chappell said he examined every one of the files that the defense says were modified and that the changes were all operating system or security updates. There was also no evidence that the computer was hacked, he added.Prosecutors objected to a line of questioning by Kurtz about why someone knowledgeable about computers, like Brad Cooper, would leave a piece of evidence like the Google Maps search on a laptop and not leave any other evidence.
http://www.wral.com/specialreports/nancycooper/story/9440639/

I know we've gone over this before - but I find it incredible that the CPD powered up the laptop as-is. You don't have to be forensic computer expert to know that you pull the original hard drive and work off of a CLONE in these types of situations. I'm sorry - these guys are technical buffoons and need remedial training ASAP on how to conduct criminal investigations in the 21st century.