April 29 weekend of Sleuthiness

[ncsu95]

What was the defense point in bringing up the size of the router required to operate with an FXO port?

It was rebuttal to the prosecutions assertion that the FXO card could fit in a pocket. The Cisco expert testified that a router was also required. Yet the prosecutor kept going on and on about how small the card was. So the defense physically showed the size of a router that the prosecution witness said would be required to run an fxo card. That was the point of it. The prosecution mislead the jury by suggesting the evidence could fit in his pocket.

 

[ncsu95]

On Cisco's own network, yes. Just as the AT&T guy was able to testify to his company's log's and records.

He's not talking about logs on his network. He's talking about logs on BCs hard drive, which wasn't restricted to Cisco's network. That PC was allowed to connect to any network, not just Cisco's. And the stuff he is testifying to supposedly didn't happen on Cisco's network, not even through the VPN. So at that point, it is just a computer (owned by Cisco) on a home network.

 

[Cheyenne130]

It was rebuttal to the prosecutions assertion that the FXO card could fit in a pocket. The Cisco expert testified that a router was also required. Yet the prosecutor kept going on and on about how small the card was. So the defense physically showed the size of a router that the prosecution witness said would be required to run an fxo card. That was the point of it. The prosecution mislead the jury by suggesting the evidence could fit in his pocket.

And the defense wanted to point out that it could not be so easily hidden so if he had an FXO port capable router it should have been found?

 

[SleuthinNC]

Watch that part again. Judge was looking at the JW transcript and saw what JW testified to. The judge prompted Trenkle to come clean that routers were discussed in the defense case.

Excellent example of pro-prosecution redaction! Now let that conversation play through to Trenkle saying "I'm getting to that" and explaining exactly what he meant.

 

[ncsu95]

And the defense wanted to point out that it could not be so easily hidden so if he had an FXO port capable router it should have been found?

Basically, yes. Or at least it wasn't something he could have hidden easily. There is a big difference between something the size of a large pizza box versus a card that can fit in your pocket.

 

[Cheyenne130]

He's not talking about logs on his network. He's talking about logs on BCs hard drive, which wasn't restricted to Cisco's network. That PC was allowed to connect to any network, not just Cisco's. And the stuff he is testifying to supposedly didn't happen on Cisco's network, not even through the VPN. So at that point, it is just a computer (owned by Cisco) on a home network.

When I was in charge of a network, all of the computers on that network were part of that. The antivirus/antispyware on all the computers was installed by me. If something went wrong with the computer, even if had been taken home, it was still part of my job to find out what the problem was and fix it or clean it up.

 

[Cheyenne130]

Basically, yes. Or at least it wasn't something he could have hidden easily. There is a big difference between something the size of a large pizza box versus a card that can fit in your pocket.

So to rebut that, they are able to show that he did actually have a router the size of a large pizza box in his house on 7/11.

 

[ncsu95]

When I was in charge of a network, all of the computers on that network were part of that. The antivirus/antispyware on all the computers was installed by me. If something went wrong with the computer, even if had been taken home, it was still part of my job to find out what the problem was and fix it or clean it up.

Then why didn't he testify about this instead of the "FBI" witness? Why didn't he do the forensic analysis on the PC since he would know what wasn't right or wasn't supposed to be there, or what was missing?


ETA: And where does the distinction end of what he is qualified to testify about and what he is not?

 

[Cheyenne130]

Then why didn't he testify about this instead of the "FBI" witness? Why didn't he do the forensic analysis on the PC since he would know what wasn't right or wasn't supposed to be there, or what was missing?


ETA: And where does the distinction end of what he is qualified to testify about and what he is not?

Now that's something entirely different. I wouldn't recognize an MFT if it was sitting in front of my face. I have no idea how to analyze all those files. I do know how to look at event logs because that was part of my job.

 

[ncsu95]

So to rebut that, they are able to show that he did actually have a router the size of a large pizza box in his house on 7/11.

No. Rebuttal would be showing the 18xx one (I can't remember the number) is much smaller and can house an fxo card.

 

[Cheyenne130]

No. Rebuttal would be showing the 18xx one (I can't remember the number) is much smaller and can house an fxo card.

This is the sequence as I see it:
The prosecution puts on a witness to tell the court how small an FXO card is.
(Implication: easily hidden)
The defense puts on a witness to show how large the router is that is needed to house that FXO card.
(Implication: not easily hidden, would have been found)
The prosecution wants to rebut that with he did have a router that size and records show that it was in his house as late as 10:21 on 7/11.

 

[CrimeAddict]

First, she had not been buying groceries for four for a long long time, she was only buying groceries for her and the children and BC was still picking up incidentals. Her Divorce attorney testified that NC wrote her many months back and said BC bought his own groceries.

She was at the store just before 3PM, she had been calling BC all day before that because of no money is the understanding, so why would she do that if she had money?

I also doubt that she spent less than $20 on what she bought considering she was buying ribs for a party full of people and we also saw she bought wine during that trip plus some other items.

I know many think he is guilty, but I think it is important that we don't embellish evidence that is before us to make the case.

I used $20 as an example or guess earlier. No one knows how much left of the $240 or so she got from painting at ja's she still had. I agree she had more than 20, obviously to buy those few items she needed more than that. One could assume she didn't have much to cover until the following Friday and needed her allowance and called him a few times that day because she knew once she went to the store she would be broke later. No one is embellishing anything as far as I can tell.

Beautiful day in nc today, I assume you all are walking away soon and enjoying some fresh air, remember bc is in jail, not us!

 

[SleuthinNC]

No, it sounded (from the little that was broadcast) like an IP address confliction. The thinkpad would be set to use dhcp, which means it is dynamically assigned an IP address by the home router (not the 3825). If the 3825 was connected when the thinkpad wasn't, it could have been assigned the IP address the thinkpad usually gets. Then the thinkpad, when it connects, could try to obtain the same IP address, but would be told that there is a conflict with the 3825 since it already has that address. Of course, I could be way off on this, so somebody please correct me if I am wrong.

If this is what happens, it would explain why there was only 1 event log. Since the thinkpad would then get a different IP address, there wouldn't be future conflicts with the 3825. So, theoretically (again, someone correct me if I am wrong), he plugged the 3825 into the network the night of the 11th, then turned his laptop on, which had the conflict and needed to get a new IP address via dhcp. Then you wouldn't see anything else about the 3825 because both would now have valid IP addresses.

I don't actually think the 3825 has to be connected to return the IP address conflict if the IP address of the router is statically configured in the hostname table. Which it would be since you don't want your router IP address to remain static and not use DHCP.

And, unless I am completely mistaken I was under the impression that when an IP address mismatch is returned it returns that MAC address of the device it believes the IP address to belong to not the device that is trying to now use the IP address.

If somebody could clarify that it would be great because I'm not completely positive about that part.

 

[Cheyenne130]

I don't actually think the 3825 has to be connected to return the IP address conflict if the IP address of the router is statically configured in the hostname table. Which it would be since you don't want your router IP address to remain static and not use DHCP.

And, unless I am completely mistaken I was under the impression that when an IP address mismatch is returned it returns that MAC address of the device it believes the IP address to belong to not the device that is trying to now use the IP address.

If somebody could clarify that it would be great because I'm not completely positive about that part.

The conflict occurs on the device trying to use an IP address already in use by another device. The error report should reflect the one trying to use it.

 

[SleuthinNC]

I don't actually think the 3825 has to be connected to return the IP address conflict if the IP address of the router is statically configured in the hostname table. Which it would be since you don't want your router IP address to remain static and not use DHCP.

And, unless I am completely mistaken I was under the impression that when an IP address mismatch is returned it returns that MAC address of the device it believes the IP address to belong to not the device that is trying to now use the IP address.

If somebody could clarify that it would be great because I'm not completely positive about that part.

Quoting myself say scratch the previous info. That is a duplicate IP error not IP mismatch

 

[gracielee]

macd said:


I see a legal system (police, lawyers, judges, witnesses) that is ill equipped to deal with digital evidence.
For the sake of our future, I hope that changes quickly.
In this case, I have been convinced beyond a shadow of a doubt.
I don't know about the jury. If it is a jury that distrusts computers and law enforcement, then we might have another OJ verdict.


Back when the O.J. trial took place, the *system* the advent of DNA was just at it's beginnings. I feel today, is the birth of digital technology being used in legal cases. I've seen great things happening using digital technology in the investigation of kiddie *advertiser censored* online, trafficking of humans, online rape shows, and pedophiles using the internet to get young kids, boys and girls. Local LE is beginning to attempt to find the money, in this ravaged economy, to train members of their own units to deal with these issues. But IIRC, is it Chappel who is so widely scorned here because he's not 'really FBI'. You can't have it both ways. Yes, FBI is by far the best we have in the U.S. for dealing with digital crime, but they are attempting to train individuals within local LE's across the country, to understand and grasp the new digital crimes they are facing. I think to call Boz a liar is petty and childish and amatuer. Watch 20 years of trials, opening statments to closing arguments. You will see this trial doesn't differ any from the norm. If anything, this trial was exceedingly *polite* if you will. Far less theatrics than normally go on in the courtroom, from both sides. If you want to *fear* for anyone, 'fear for the victims', because they criminals 'out-gun' the good guys.' Fear for yourself or one of your family members being a victim of crime. It's far more likely for that to happen, than for you to be mistaken as a 'bad guy.' MOO MOO MOO Any maybe go back and familiarize yourself with some 'other' trials, to see how things work besides this trial and O.J. Familiarize yourself with the kinds of horrific crimes are being committed against our children, women, and the weakest members of our society. JMO

 

[SleuthSayer]

Great point you bring up about JW being discredited because of the information on his Facebook page! If that is a valid reason for disqualification it would seem CF should be discredited as well since they clearly run in the same circles and share similar beliefs. Either that or JW's good name should be restored.

But again, that would be the court acting fairly so doubt we will see that.

Yeah, the FB stuff was bush league and was a shameful move by the prosecution.

However, it's worth pointing out that JW's expertise was somewhat discredited by the defense's forensics guy that was not allowed to testify. JW testified that the cursor files in the TIF would be .cur files and not .bmp files. The other guy testified that this was not true. So, that demonstrated that at least one of these guys was outside of his area of expertise.

 

[gracielee]

Thank you Otto for that synopsis! Helps a great deal. It has been an interesting week it appears. From the surface it appears that nothing has been confirmed that BC DID or DID NOT spoof the calls? The rebuttal phase and closing arguments will be very interesting in this trial. I hope that I have the opportunity to listen live.

With what little I have been able to actually get into it still sounds like it could go just about any which way, G, NG or hung jury. I would imagine, at this point, a lot depends on those closing arguments, tying things together, and of course, what can of worms the new expert brings to the mix.

Thanks again for keeping me in the loop!

Kelly

If the necklace was found on the front hall table, why isn't it in any of the photos taken the day nancy 'went missing'?

 

[gracielee]

If I'm understanding this correctly, what some are saying here is that because the police left the computer on for 27 hours after the search warrant was served any evidence found on the computer should be thrown out because of "spoilage"? I can't say that I would be able to accept that if I was on the jury.

I didn't think it was from the time the search warrant was served, I thought it was from the time the house was sealed, awaiting a search warrant to be obtained and served???

 

[gracielee]

It's not a matter of a "belief". I saw it with my own eyes. From the video, it looks like she doesn't have a chin either.

I believe it was me who brought that up, lack of chin and lack of jaw and lack of cheek bones. And the fact that we'd previously seen a photo of nancy supposedly without the necklace. But that was a real photo, good quality, that could be enlarged and enhanced to make it's definition clearer rather than more distorted. On that prior photo the necklace could quite clearly be seen on the enlargement. The very FINE gold chain is almost the color of nancy coopers skintone, and blends right in unless it is seen from very close up and either with the naked eye, or with a good camera, not a store video there for the purpose of catching shoplifters and not to catch good quality photos of individuals. IMO If anyone is trying to 'pull a fast one', it's the defense, trying to pass of JW as an expert in forensics, trying to pass off yet a second image of nancy 'with a necklace' as being nancy without a necklace, and coming up with the *ducks* at the last moment, much like Michael Petersons 'sudden discovery of the infamous blow-poke'. If you guys want to fault someone for nefarious courtroom antics, how about placing the blame in the proper corner then? MOO