Brad Cooper: Appeal info

[Madeleine74]

As I suspected. Media reports are being used as gospel. Really bad move, that. The media gets enough things wrong, I've witnessed personally. I would not use them as my de facto source of knowledge given how things gets nuanced, at a minimum. Only testimony as presented in court is the real deal. Court transcript is the bible.

 

[ncsu95]

He was referred to as an FBI agent in many threads in this forum. That is what we are talking about. Now please show me the many disparaging comments I have made about him.

 

[Madeleine74]

How someone on an Internet forum refers to these task force agents (and they are considered "agents" of their units) and how the media terms them is a label and not testimony. Only testimony counts. As for disparaging, I consider the term "fake" to be disparaging, as it is intended to minimize. I never said "many," you added that in yourself. Nuancing and expanding what was actually said. Trend continues.

 

[ncsu95]

Whatever. So since your rules now appear to be that testimony is gospel, then please refrain from dismissing the defense stance on the files and basing that on the word of an internet poster (no offense intended macd....I appreciate the efforts you went through). Since there was no testimony from the prosecution explaining the invalid time stamps other than "I don't know how they got there", then that is the gospel and we shouldn't talk about anything else. There has been no testimony explaining that it was caused by private browsing, so you should refrain from indicating that it is the cause.

 

[macd]

Since there was no testimony from the prosecution explaining the invalid time stamps other than "I don't know how they got there", then that is the gospel and we shouldn't talk about anything else.

Here's the real challenge with the timestamps. No one really knows why the enCase tool reported those fields as invalid. The master file table data format is proprietary to Microsoft. It is not a standard and is not published. Engineers working for enCase write a widely used and accepted tool that parses and formats the data, but does not necessarily understand the data.

To make matters worse, with each new version (or even each update) of Windows, Microsoft may change how each field is used. Some versions of Windows update the "last access" time. Some don't. For all we know, Microsoft may store non-time information in certain fields at certain times.

Cyber Task Force Member Chappel was at least honest when he said he didn't know why enCase reported the FN Info Entry Date as invalid on most of Brad's files stating in June. That's honest (and expected). There are 52 fields in the MFT for each file. The use of each of these fields at any given time is not published by Microsoft.

Kurtz's theory (the claim originated from Kurtz himself, not a computer expert) is (at best) a guess. It is simply grasping at straws, trying to find something to discredit this information.

He makes three main claims:
1) That when creation time, modify time, acccess time, and entry time are all the same that is evidence of something wrong. He implies that when Windows makes a new entry in the MFT, it "checks the time" eight different times over several milliseconds while making the table entry. This is easily proven false. The OS "checks the time" once and enters the identical value in all eight timestamp fields.
2) That the access time to the cursor BMP is updated whenever someone click their mouse. Again, this is easily proven false.
3) That having a value in the "FN Info Entry Date" reported by enCase as invalid is proof of tampering. Really, we need to ask a Microsoft engineer that worked on Windows in 2008 (if he remembers) what that field means for that exact version of Windows. Kurtz's pie chart said that most of Brad's files created, starting in June, had a value reported as invalid. To me, this means something happened in June. A new OS, a new browser, a new way of surfing the web, who knows? Remember that seven different timestamps show that the search happened Friday afternoon, while Brad was logged into his computer at work. One timestamp has an anomaly (as reported by enCase) that is shared with many, many other non-related files on Brad's computer.

Kurtz is very persuasive, but in this case his theory does not hold up to scrutiny.

 

[macd]

Who want to play along? Search your computer for the cursor BMP, the much talked about file in the trial.

Google "find temporary internet files" and the version of Windows and browser you are using. You should get a pointer to the right directory. Then look for the file openhand_8_8[1].bmp. If you click right on it and select properties, you should be able to see some of the timestamps.

Post the timestamps here, and we can compare them to see if we find a pattern.

 

[otto]

Who want to play along? Search your computer for the cursor BMP, the much talked about file in the trial.

Google "find temporary internet files" and the version of Windows and browser you are using. You should get a pointer to the right directory. Then look for the file openhand_8_8[1].bmp. If you click right on it and select properties, you should be able to see some of the timestamps.

Post the timestamps here, and we can compare them to see if we find a pattern.

I tried it, but there are no files named: openhand_8_8[1].bmp
Suggestions?

 

[Madeleine74]

I was just on a flight and sitting next to me was a now-retired Durham officer. Small world. He was with the DPD for 20 yrs and retired. He looks so youthful, he could pass for 40. You can probably imagine we had lots to talk about. He found a few things amusing in an eye-rolling way. He was so nice & offered to help my mom, who's in her 80's, with her bags. He managed to control himself from planting evidence on my mom, so hey, bonus!

 

[Madeleine74]

Sorry MacD , I switched to a new macbook air as my laptop of choice and avoid windows when possible.

 

[Just the Fax]

Snipped~~~

Kurtz is very persuasive, but in this case his theory does not hold up to scrutiny.

At the end of the day, common sense should prevail.

It's amazing how the spin and chaos over the map search, put forth by Mr Kurtz and the Cooper obsessed, Ms. Blanchard, has swayed some to believe Cooper is innocent. Give them credit. The more they spin, the more potential jurors they reach.

 

[seattlechiquita]

Very, very stupid question: who is Ms. Blanchard?

 

[jilly]

I was just on a flight and sitting next to me was a now-retired Durham officer. Small world. He was with the DPD for 20 yrs and retired. He looks so youthful, he could pass for 40. You can probably imagine we had lots to talk about. He found a few things amusing in an eye-rolling way. He was so nice & offered to help my mom, who's in her 80's, with her bags. He managed to control himself from planting evidence on my mom, so hey, bonus!

Obviously, the "split-up" was beneficial!:

 

[ncsu95]

Here's the real challenge with the timestamps. No one really knows why the enCase tool reported those fields as invalid. The master file table data format is proprietary to Microsoft. It is not a standard and is not published. Engineers working for enCase write a widely used and accepted tool that parses and formats the data, but does not necessarily understand the data.

To make matters worse, with each new version (or even each update) of Windows, Microsoft may change how each field is used. Some versions of Windows update the "last access" time. Some don't. For all we know, Microsoft may store non-time information in certain fields at certain times.

Cyber Task Force Member Chappel was at least honest when he said he didn't know why enCase reported the FN Info Entry Date as invalid on most of Brad's files stating in June. That's honest (and expected). There are 52 fields in the MFT for each file. The use of each of these fields at any given time is not published by Microsoft.

Kurtz's theory (the claim originated from Kurtz himself, not a computer expert) is (at best) a guess. It is simply grasping at straws, trying to find something to discredit this information.

He makes three main claims:
1) That when creation time, modify time, acccess time, and entry time are all the same that is evidence of something wrong. He implies that when Windows makes a new entry in the MFT, it "checks the time" eight different times over several milliseconds while making the table entry. This is easily proven false. The OS "checks the time" once and enters the identical value in all eight timestamp fields.
2) That the access time to the cursor BMP is updated whenever someone click their mouse. Again, this is easily proven false.
3) That having a value in the "FN Info Entry Date" reported by enCase as invalid is proof of tampering. Really, we need to ask a Microsoft engineer that worked on Windows in 2008 (if he remembers) what that field means for that exact version of Windows. Kurtz's pie chart said that most of Brad's files created, starting in June, had a value reported as invalid. To me, this means something happened in June. A new OS, a new browser, a new way of surfing the web, who knows? Remember that seven different timestamps show that the search happened Friday afternoon, while Brad was logged into his computer at work. One timestamp has an anomaly (as reported by enCase) that is shared with many, many other non-related files on Brad's computer.

Kurtz is very persuasive, but in this case his theory does not hold up to scrutiny.

I just want to reiterate again that my comment was in no way intended to offend you. I was simply making a comment about the absurdity of not being able to say something or discuss something unless it was from the gospel of a transcript from testimony. I actually appreciate what you have attempted to show and hope the prosecution is able to show the same thing at trial.

 

[Madeleine74]

You missed the point completely. You kept saying Agents Chappell & Johnson were 'fake' FBI agents but neither one claimed to be from the FBI and only the FBI & both testified about their CART work. You were corrected a couple times by JTF and told what they called themselves in court. You used media reports to make the claims of their titles and pointed out the Durham affiliation. That's the long & short of it.

 

[oenophile]

Kurtz's theory (the claim originated from Kurtz himself, not a computer expert) is (at best) a guess. It is simply grasping at straws, trying to find something to discredit this information.

What is your basis for saying that the claim originated with Kurtz?

I think it's pretty simple: Brad denied that he made the Google search, and Kurtz sought an explanation. There are only three valid explanations:

1. Brad made the Google search for an innocent reason (and there are lots of potential reasons) and forgot that he made it. It is reasonable that he forgot if he did so for an innocent reason.
2. Brad made the Google search for an incriminating reason (to plan to kill Nancy) and he lied to his lawyers about this.
3. Brad didn't make the search, in which case the search was planted by someone else.

I have a technical question: what would happen if you were to change the time on the clock, do a search, then change the time back? What time would the timestamps reflect?

 

[gitana1]

Based on the issues brought up in the appeal, I think it is highly likely that Brad gets a new trial.

You were sure right!

I won't be able to follow the trial, but will catch the updates at the end of the day. Hopefully people here will post the highlight ... and any irregularities that happen.

If he is granted bail and if he's able to come up with the amount, will there also be a ruling that he should have access to his daughters? Regarding bail, isn't there some law about a bail amount being reasonable in terms of the suspect's ability to pay? That is, if the amount is ridiculously high, and bail should be granted, isn't that the same as denying bail?

Bail is made high when the court wants to make it harder to make bail and get out. It's not the same as a denial because if they can raise the money, they can get out. But the stakes will be higher which it less likely they will run.

 

[gitana1]

I want to state up front to Just the Fax that I'm not trying to pick on you specifically, but want rather to illustrate a point from an earlier post.

You said the following in this thread:



Unrelated to this post, I went back to the original thread on Nancy because I was curious how Brad was being portrayed and what was being said by people about the murder. Ironically, I stumbled on this post:

Websleuths Crime SlCheck out this video on YouTube:

http://www.youtube.com/watch?v=Bpu0TIXzI1w&feature=youtube_gdata_player


Sent from my iPhoneeuthing Community - View Single Post - Nancy Cooper, 34, of Cary, N.C.



My point is that people will create a narrative to fit the suspect to the facts, rather than the other way around. And this whole case is about creating a narrative to fit Brad to the facts, even when the facts are wrong. He must have done it because there are missing shoes. He must have done it because there aren't missing shoes. Etc. Etc.

There are many people here who were and are clearly predisposed to his guilt (even though they deny this) and will fit the narrative to the facts. Here's another example from that same thread:

Websleuths Crime Sleuthing Community - View Single Post - Nancy Cooper, 34, of Cary, N.C.



The ME did determine that her stomach was nearly empty, and that the alcohol tests were consistent with decomposition following sobriety, not decomposition following medium drinking. But again, people found a way to suggest that this showed his guilt via a piece of onion and brown liquid.

The reason why I am convinced of Brad's innocence is because I never had an assumption of his guilty, and all the evidence except for the google search is either neutral or points to his innocence. I then look at the google search, consider the defense's arguments and experts (which I admit sound a bit far fetched), and ask: did the Cary PD or others have motive and opportunity to plant this evidence? And the overwhelming answer is yes.

I realize that this is just an internet BB, and that we are all equal here and entitled to our own opinions. But I have difficulty understanding how an informed opinion can result in such absolute belief in his guilt.

I am predisposed to thinking he's guilty as sin. I never watched the trial and only heard a few things here and there. I watched a Dateline special tonight. It made me convinced of his guilt. However, the guy has a chance at getting off. The evidence against him that was reported on the show is incredibly thin.

But, it cracks me up, all these men and women in very troubled relationships who just coincidentally turn up missing or dead. And each one of their significant others tries so hard to convince us that their mate just happened to be killed by someone else with no relation to the disintegrating relationship.

Sure thing, right? Nah, I wasn't born yesterday.

 

[Madeleine74]

was simply making a comment about the absurdity of not being able to say something or discuss something unless it was from the gospel of a transcript from testimony.

Please show exactly where anyone has said something not from testimony transcript cannot be discussed? I can find no such reference. Anything within the TOS of WS can be discussed, to my knowledge.

However, if something is posted and it's factually incorrect, chances are it will probably be noticed and corrected. And, when the media writes something it may not be entirely accurate; we know from prior experience the media can and does get things wrong.

 

[macd]

What is your basis for saying that the claim originated with Kurtz?

Kurtz's blog on his website. He details how he and an assistant "discovered" the timestamp "issues" and then went searching for an "expert" to testify to it.

I have a technical question: what would happen if you were to change the time on the clock, do a search, then change the time back? What time would the timestamps reflect?

I pretty sure the timestamps would reflect the changed time.

 

[Just the Fax]

"Casey Francis and I are both possessed of considerable technical skill sets. However, given the complexity of the evaluation required, we embarked on a quest to find the best and brightest expert possible. We consulted with true titans of the computer security field in an attempt to identify such an individual. After describing the anomalies that we ourselves had found and after pinpointing the type of anti-forensics detection we required, we were given the name Jay Ward without reservation. Jay's credentials were impeccable and his expertise unassailable. He could not have been recommended more highly.

And so it was that Casey and I arranged to meet with Jay. After a lengthy explanation of our own findings and after we detailed the type of evaluation that would be required of him, Jay readily accepted the challenge. "

====================================================
WOW, you were right macd.

http://www.kurtzandblum.com/blog/cooper-case