Retrial for Sentencing of Jodi Arias - 12/05-08 In recess

[geevee]

Ahh but remember the bent pins, was that TA's HD or this external HD that was, according to Dworkin, an internal HD with a bag of parts for an external case that he received on Oct,25, 2012 that I suspect may have been JA's? When and how and on what was the original mirror image done for the PT and did they make more than the first original, if so why and when? Same for this HD that Dworkin had sent out to some un-named third party. Who used the incinerator and on which HD, if there was more than one(TA and JA's) being "worked" on?

I don't recall any mention of TA's hd being sent out for any repairs (or not until the motion with the pic showing the bent pins lol). Yes, the internal hd with the bag of external parts was JA's hard drive. Don't know if PT made more than one mirror originally. Don't think the incinerator was used on Travis' hard drive, only on the mirror image that BN supplied to PT (according to tweets), after he straightened the pins and could make a mirror image. All to the best of my recollection. lol

 

[Dmacky]

Paul Stern is the one that loaned her money. Not sure if he knew MM or not.

http://www.hlntv.com/video/2013/02/06/man-who-gave-jodi-money-visit-travis-speaks-out

Here are the transcripts from that interview. I am confused. Didn't JA live with her grandparents in Yreka before she went on her killing mission? In this interview with Paul Stern, it sounds like she was working at the Ventana Inn.? But that is located in Big Sur and almost
7 hours away

PAUL STERN, KNEW JODI ARIAS (via telephone): I own a house there. So, she frequented a bar and grill and restaurant every night to get on the computer.

PINSKY: So, she was not -- well, hold on a second. So, she was not an employee of this place. You guys both just went to this inn, this restaurant?

STERN: Yes. She was an employee of Ventana but I wasn`t. I just lived there.

PINSKY: I see. And you actually loaned her the money that ended up on the trip where she actually killed Travis?

STERN: Well, the day before she left, she was pretty frantic that she had to go back and see Travis, and she talked about how he was seeing other people and she asked to borrow money and I gave her money.

PINSKY: Paul, when you say she was frantic, describe how you -- who you thought she was and what you mean by frantic.

STERN: Well, I spent a lot of hours with Jodi. She would sit right next to me.

And you know more about Jodi by what she doesn`t say. She never talked about her family, her friends, her boyfriends, her hobbies. And she never talked about her feelings or emotions.

WALSH: What did she talk about?

STERN: But she was on the computer constantly and she kept a journal. She would show me pictures on the computer. There had to be thousands of them. I only looked at a few.

But I really wasn`t interested in time that much in her pictures.

PINSKY: In spite of her talking about her obsessions -- by the way, did she pay you back?

STERN: She did pay me back.

PINSKY: OK. And despite her talking about the obsessions about the boyfriend, was she sexually provocative with you?

STERN: No. No. I have a girlfriend that I`m still with at that time. And I`m not available. And I think she sensed that.

PINSKY: OK, so fair enough.

STERN: She would come and sit next to me whenever she was in there.

PINSKY: OK. Casey --

STERN: And --

PINSKY: What, Paul? Finish that up.

STERN: When you engage in conversation with Jodi and look into her eyes, it`s like looking in a two-way mirror. But Jodi`s looking at the reflective part of the mirror. And her eye beams never really meet your eyes.

And she`s very coy, enigmatic, and very articulate. And she`s also the same way about how she dresses, postures herself, and what she does without saying any words.

PINSKY: OK, Paul, I`m going to put you on hold for a second.

Casey, I see you shaking your head. What are your thoughts on this?

CASEY JORDAN, CRIMINOLOGIST: Well, a few things. First of all, it`s great to hear from Paul Stern the fact that she had to borrow the money because she was obsessed about getting to Travis Alexander because she was in the middle of a terrible break-up and this was simply not acceptable to her. So his description of her obsession is really on cue with what we know happened thereafter.


http://edition.cnn.com/TRANSCRIPTS/1302/06/ddhln.01.html

 

[daisydomino]

Yes, in the YT you linked Dworkin says Encase provides a read-only mirror image of a hard drive so when it's forensically examined changes cannot be made to it (must be why BN wanted the actual hard drive). We're way in the mire, even the prosecution can't change anything on the original mirror image as Encase makes it in read-only, JSS should have long ago ruled on this whackery.

I'm reading like crazy to understand the typical process. I have been going by Lonnie Dworkin's detailed testimony from day 12, but it sounds to me (and it's really hard to tell since we must rely on Twitter and liveblogged translations of testimony) that BN is doing something different than what Det. Melendez and Dworkin did. This may be why he is finding stuff that the other two did not.

From what I've read, the process is not standard and even in law enforcement, each investigator seems to have his own work method. However, there are some standards that are required, especially in capital criminal cases.

National Institute of Standards and Technology requires that the investigator:
1. Write block the original disk
2. Make a full-volume, bit stream, bit-for-bit, sector by sector forensic image of the original disk, copying onto a new or sanitized re-used blank hard drive
3. Verify that it is an exact copy by comparing checksum MD5 or SHA-1 hash values
4. Return the original disk to evidence
5. Document everything he does

After that, it looks like there are a zillion forks. I can't find anywhere that the forensic copy must be read-only, but I'm sure that's what Lonnie Dworkin testified that EnCase does. It makes sense to me.

From what I've read of BN's testimony, he is working on a live, writable clone of TA's drive and he's removing software (viruses, for instance) as he examines it. This is why his copies are not the same capacity in GB as TA's original drive any more. He has given the prosecution at least one copy of his work materials—I have completely lost track of who has what now.

Evidently BN did not give the prosecution the forensic image (the one that should be exactly the same as TA's hard drive in evidence) that he started with? I did read somewhere that he wanted to know if Juan wanted the image, not the clone, and then BN tried to tell him that he already had what he was asking for.

Sorry if I took this on a bit of a tech tangent. It's technical stuff—like legalese—we have to use the lexicon that comes with it or we'll get even more confused. If I'm misusing terms, let me know. I'm trying to be careful, but I don't know...

 

[Val1]

The third party is a company owned by Tony Klump called AZ Computer Lab.

http://www.azcomputerlab.com/

It is a run of the mill IT company. Certainly not qualified in computer forensics.

We've seen this kind of thing again and again and again with this defense where they cannot bring highly qualified and recognized experts in any given field of discipline. BN has already made a number of factually incorrect statements on the stand, showing his lack of knowledge when it comes to digital devices and computer forensics.

Rather than fight this on a charge by charge level, IMO it would be best for Martinez to have his expert put together some kind of powerpoint presentation, showing generally accepted principles and practices of computer forensics which will explain the initial findings of both Dworkin and Melendez, who used EnCase for their review. Then blow apart the junk science findings of the supposed experts hired by the defense.

Yes, the computer had a lot of virus related *advertiser censored* on it. This would not fit the definition of *advertiser censored* and there are many legal cases that set a precedent for this. I seriously doubt that they are going to find user accessed *advertiser censored* in the magnitude that BN is suggesting. There may be a few hits, such as when I looked for hot rods for my son when he was about 10 years old.

Hmm, I find it interesting that in the pic I posted here in relation to what I think is TA's anger over being hacked:
http://www.websleuths.com/forums/showthread.php?264195-Retrial-for-Sentencing-of-Jodi-Arias-12-05-08-In-recess&p=11276115#post11276115

that the person TA seems to be asking about is a Michelle K or something like that(can't quite make it out)... and where have I heard the name Michael Musack before? He appears to be related to this Tony...

 

[ShadyLady]

I don't think so, though perhaps it's Steve or whoever it was that TA was talking about in that password related message?

View attachment 64982
View attachment 64984

Can't read the first pic....what video does it come from??? Micheal K...maybe you are on to something!

 

[Val1]

I'm reading like crazy to understand the typical process. I have been going by Lonnie Dworkin's detailed testimony from day 12, but it sounds to me (and it's really hard to tell since we must rely on Twitter and liveblogged translations of testimony) that BN is doing something different than what Det. Melendez and Dworkin did. This may be why he is finding stuff that the other two did not.

From what I've read, the process is not standard and even in law enforcement, each investigator seems to have his own work method. However, there are some standards that are required, especially in capital criminal cases.

National Institute of Standards and Technology requires that the investigator:
1. Write block the original disk
2. Make a full-volume, bit stream, bit-for-bit, sector by sector forensic image of the original disk, copying onto a new or sanitized re-used blank hard drive
3. Verify that it is an exact copy by comparing checksum MD5 or SHA-1 hash values
4. Return the original disk to evidence
5. Document everything he does

After that, it looks like there are a zillion forks. I can't find anywhere that the forensic copy must be read-only, but I'm sure that's what Lonnie Dworkin testified that EnCase does. It makes sense to me.

From what I've read of BN's testimony, he is working on a live, writable clone of TA's drive and he's removing software (viruses, for instance) as he examines it. This is why his copies are not the same capacity in GB as TA's original drive any more. He has given the prosecution at least one copy of his work materials—I have completely lost track of who has what now.

Evidently BN did not give the prosecution the forensic image (the one that should be exactly the same as TA's hard drive in evidence) that he started with? I did read somewhere that he wanted to know if Juan wanted the image, not the clone, and then BN tried to tell him that he already had what he was asking for.

Sorry if I took this on a bit of a tech tangent. It's technical stuff—like legalese—we have to use the lexicon that comes with it or we'll get even more confused. If I'm misusing terms, let me know. I'm trying to be careful, but I don't know...

Ok, now I get why he didn't want to hand over his HD, or the mirrors he was working on... I think. The 500gb HD he had copied the mirror onto probably hadn't been sanitized... so technically he was reading stuff that was showing up from whatever had been on that 500gb HD before too, right? At least I'm betting that could be one of JM's arguments.

 

[daisydomino]

The third party is a company owned by Tony Klump called AZ Computer Lab.

http://www.azcomputerlab.com/

It is a run of the mill IT company. Certainly not qualified in computer forensics.

We've seen this kind of thing again and again and again with this defense where they cannot bring highly qualified and recognized experts in any given field of discipline. BN has already made a number of factually incorrect statements on the stand, showing his lack of knowledge when it comes to digital devices and computer forensics.

Rather than fight this on a charge by charge level, IMO it would be best for Martinez to have his expert put together some kind of powerpoint presentation, showing generally accepted principles and practices of computer forensics which will explain the initial findings of both Dworkin and Melendez, who used EnCase for their review. Then blow apart the junk science findings of the supposed experts hired by the defense.

Yes, the computer had a lot of virus related *advertiser censored* on it. This would not fit the definition of *advertiser censored* and there are many legal cases that set a precedent for this. I seriously doubt that they are going to find user accessed *advertiser censored* in the magnitude that BN is suggesting. There may be a few hits, such as when I looked for hot rods for my son when he was about 10 years old.

Wow. In my reading on computer forensics, I keep reading over and over that while many many people have the tools and knowledge to perform e-discovery and examination, an investigator has to have all kinds of licenses and credentials to present his work in court as expert testimony. This is a capital case, sheesh! Nurmi, being as anti-death penalty as he appears to be, should really be more careful with his experts!

 

[daisydomino]

Ok, now I get why he didn't want to hand over his HD, or the mirrors he was working on... I think. The 500gb HD he had copied the mirror onto probably hadn't been sanitized... so technically he was reading stuff that was showing up from whatever had been on that 500gb HD before, right? At least I'm betting that could be one of JM's arguments.

That's possible, but it's unlikely. Computer forensic examiners call what you're talking about "slack space" and they are really really careful to sanitize.

ETA: JM's expert will be able to tell if this did happen.

 

[fran]

Attention Please!

Rules Reminder:

Organized Efforts- Email Campaigns-Boycotts-Petitions:

Obviously members are free to take up any and all causes that are important to them in an effort to bring about change. But using Websleuths as a platform to promote organized efforts such as email campaigns, boycotts, letter writing,etc. are strictly forbidden without the consent of the forum owners.If you have written a letter or taken any action in support of a cause, please refrain from posting about it. Support of a particular cause must be approved by the owners prior to posting links or information regarding any such effort. Causes can be questionable in nature, even though they appear to be honorable on the surface.As it relates to using WS as a platform for promotion,the owners investigate the nature and source of such campaigns and make their own decisions as to the legitimacy of each cause. Please do not suggest,directly or indirectly, that members support any type of organized effort without getting approval from forum owners first.

http://www.websleuths.com/forums/showthread.php?65798-Etiquette-amp-Information

tia for your cooperation
fran
:seeya:

 

[Hatfield]

A thought just occurred to me.....what if Travis was aware of the viruses, and that is why he downloaded so many security programs; for all we know, Jodi sent them in an email to him and this could have been at least one of their fights. Another reason Jodi had to destroy her computer. AND that is why Jodi knew that Travis had problems with *advertiser censored* viruses.

I remember Jodi repeatedly telling Flores she had NO MOTIVE to kill Travis, "what was her motive"....I think motive had to be included in Jodi's planning....and the she intended the *advertiser censored* to be motive. Someone else's motive.

Maybe Nurmi's guy was unable to find anything, I think they had several disagreements on her defense, and that was one. She wanted something found on Travis' machine.

Re BBM
This is an excellent theory I had never considered before. What if she was trying to setup someone who had a child and was supposed to be mad at Travis about the alleged child *advertiser censored*?

That guy that she told Flores to go check out...Did that guy have a child?

What about the boy who is allegedly in the picture with Travis chasing? Who was his parents?

Was Jodi trying to make it look like some parent got really mad at Travis and they would have been the killers ?

Jodi's whole defense is so much intertwined with his computer, alleged *advertiser censored* pictures that are never found, *advertiser censored* site viruses, and lots of allegations from Jodi. And since she killed him so brutally maybe she was trying to make it look like an enraged person that had a motive.

She already admitted to killing him so it seems so stupid for the defense to keep alleging the *advertiser censored* stuff. So far its nothing more than viruses that Jodi herself planted on his machine from what we can tell. She already admitted to having his passwords and she had the camera in washing machine.

 

[daisydomino]

A thought just occurred to me.....what if Travis was aware of the viruses, and that is why he downloaded so many security programs; for all we know, Jodi sent them in an email to him and this could have been at least one of their fights. Another reason Jodi had to destroy her computer. AND that is why Jodi knew that Travis had problems with *advertiser censored* viruses.

I remember Jodi repeatedly telling Flores she had NO MOTIVE to kill Travis, "what was her motive"....I think motive had to be included in Jodi's planning....and the she intended the *advertiser censored* to be motive. Someone else's motive.

Maybe Nurmi's guy was unable to find anything, I think they had several disagreements on her defense, and that was one. She wanted something found on Travis' machine.

:goodpost:

She could have "scammed him" by sending him some fake anti-virus to help him get all those gross *advertiser censored* viruses off of his computer and it could have been a RAT or something.

 

[Val1]

Can't read the first pic....what video does it come from??? Micheal K...maybe you are on to something!

I'm guessing it came from sometime during JA's cross... it was posted in the same bunch as the ones(thanks to tabularasa6) where TA is talking about telling everyone about how horrible JA is.

 

[Dr. Know?]

Not sure if anyone has already posted this about Monday's court calendar.

Media Relations Department

High Profile List

High Profile List Results

Court date: 12/8/2014 @ 1:30 Case #: CR2008031021
Case event: Trial - Penalty Phase Camera ruling: Pool Camera (no footage aired until trial is compl
Judge: Sherry Stephens Prosecutor: Juan Martinez
Defendant: Jodi Ann Arias Defense attorney: Kirk Nurmi/Jennifer Willmott

Case notes: Jury hung on penalty phase of trial. Found guilty of 1st degree murder. Ex-girlfriend charged with the murder of former boyfriend Travis Alexander in Mesa.

https://www.superiorcourt.maricopa.gov/MediaRelationsDepartment/HighProfileList/hplSelectItem.asp

 

[geevee]

Not sure if anyone has already posted this about Monday's court calendar.

Media Relations Department

High Profile List

High Profile List Results

Court date: 12/8/2014 @ 1:30 Case #: CR2008031021
Case event: Trial - Penalty Phase Camera ruling: Pool Camera (no footage aired until trial is compl
Judge: Sherry Stephens Prosecutor: Juan Martinez
Defendant: Jodi Ann Arias Defense attorney: Kirk Nurmi/Jennifer Willmott

Case notes: Jury hung on penalty phase of trial. Found guilty of 1st degree murder. Ex-girlfriend charged with the murder of former boyfriend Travis Alexander in Mesa.

https://www.superiorcourt.maricopa.gov/MediaRelationsDepartment/HighProfileList/hplSelectItem.asp

So does this mean a status conference at 9:30 (per docket) and trial in the afternoon?

 

[Val1]

That's possible, but it's unlikely. Computer forensic examiners call what you're talking about "slack space" and they are really really careful to sanitize.

ETA: JM's expert will be able to tell if this did happen.

Perhaps they have, re JM's adamant assertion that things can be proved and BN's indignant slime remarks, after all, we have seen no evidence that BN is a licensed computer forensic examiner.

 

[daisydomino]

Can't read the first pic....what video does it come from??? Micheal K...maybe you are on to something!

It says:

Do not call me. And do not text me anything. The next thing I want is this michelle K that is friends with Elena(?) that nobody knows but knows details about my life. Not one other thing ever. Until you have that information. Its 15 minutes it would take to get the info. But you won't take 15 minutes. Why because it is an Fing lie. So either text me you that you are ready to tell the truth or give me your imaginary friend with the worst BS story you have ever told or leave me alone. its a lie like no other. It's freaking foolish. There is no way out of it, you have screwed up your story so bad you can't mend it. You are caught. When you will realize that. I do not know. You have til tomorrow. To have me this persons information before I tell all the hughes' leslie udy, the freemans, your parents and anyone else that matters all the crazy things you have done. So either fess up or feel the wrath. No matter how bad the truth is the punishment will be better than the lie. This is worse than your magical email that a mysterious man you've never seen before wrote for you. You insult me by thinking ill believe such crap. Nothing else from you til the truth. I already know your lying so why continue. After tomorrow, its gonna get real bad for you. Time to spit it out.

 

[geevee]

It says:

Do not call me. And do not text me anything. The next thing I want is this michelle K that is friends with Elena(?) that nobody knows but knows details about my life. Not one other thing ever. Until you have that information. Its 15 minutes it would take to get the info. But you won't take 15 minutes. Why because it is an Fing lie. So either text me you that you are ready to tell the truth or give me your imaginary friend with the worst BS story you have ever told or leave me alone. its a lie like no other. It's freaking foolish. There is no way out of it, you have screwed up your story so bad you can't mend it. You are caught. When you will realize that. I do not know. You have til tomorrow. To have me this persons information before I tell all the hughes' leslie udy, the freemans, your parents and anyone else that matters all the crazy things you have done. So either fess up or feel the wrath. No matter how bad the truth is the punishment will be better than the lie. This is worse than your magical email that a mysterious man you've never seen before wrote for you. You insult me by thinking ill believe such crap. Nothing else from you til the truth. I already know your lying so why continue. After tomorrow, its gonna get real bad for you. Time to spit it out.

And Fonseca said even JA didn't know what Travis was angry about. :facepalm:

 

[ShadyLady]

It says:

Do not call me. And do not text me anything. The next thing I want is this michelle K that is friends with Elena(?) that nobody knows but knows details about my life. Not one other thing ever. Until you have that information. Its 15 minutes it would take to get the info. But you won't take 15 minutes. Why because it is an Fing lie. So either text me you that you are ready to tell the truth or give me your imaginary friend with the worst BS story you have ever told or leave me alone. its a lie like no other. It's freaking foolish. There is no way out of it, you have screwed up your story so bad you can't mend it. You are caught. When you will realize that. I do not know. You have til tomorrow. To have me this persons information before I tell all the hughes' leslie udy, the freemans, your parents and anyone else that matters all the crazy things you have done. So either fess up or feel the wrath. No matter how bad the truth is the punishment will be better than the lie. This is worse than your magical email that a mysterious man you've never seen before wrote for you. You insult me by thinking ill believe such crap. Nothing else from you til the truth. I already know your lying so why continue. After tomorrow, its gonna get real bad for you. Time to spit it out.

Thanks!

So Jodi is telling Travis that someone else has some incriminating "something" on Travis....and he is demanding to know who it is.

And second part is about magical email Jodi got about Travis.....sounds like the story were someone came into the restaurant where she worked to tell her about Matt's new girl friend.....or the story where someone came into the restaurant to tell her the world was ending and that gave her an excuse to bug another ex-boyfriend [Bobby?].

My god this person can make up sh**. Does she EVER live in the real world??

On another note regarding *advertiser censored*.....wish Juan had pulled Darryl's computer since he admitted she used it on her way to Meza.

 

[ElleElle]

As I understand it, not if they'd already been contained(encoded and contained) by the anti-malware programs and not still "live" hits. As for the registry, doesn't that only hold live exe files? I think most anti-malware programs are able to remove these exe files from your registry when they quarantine them, so only if new ones were activated by trojans or keylogger programs that are usually buried deep in obscure files would they be visible on a cursory look.

I would like to see a comparison of any of these malware/*advertiser censored* hits that were supposedly on TA's laptop compared to the "external" HD that I believe was from JA(not TA/Deanna's laptop) that the defense received on Oct.25, 2012 and subsequently used a mirror image they got from it on Nov.5, 2012 to retrieve the penis pics, etc.

Also, what's with this whole 1:44pm time stamp that shows as the anti-malware(Spybot iirc) on TA's laptop that somehow is also the timestamp on one of JA's nasty photo shoot pics? For me, that just firms up my suspicions about JA either planting or "accidentally" leaving the sd card(ie. she probably loaded malware/*advertiser censored* programs onto TA's laptop from her sd card that somehow then recorded the time back onto the meta data on her card and after deleting the pics she had taken of TA in the shower, not realizing the photo shoot was(or had been) on it, she either tossed it with the camera thinking it would be safe or accidentally dropped it and didn't realize it was missing until it was too late to go looking for it).

The registry holds every piece of information until Windows is formatted. not just excutables.

http://en.wikipedia.org/wiki/Windows_Registry

 

[daisydomino]

The registry holds every piece of information until Windows is formatted. not just excutables.

http://en.wikipedia.org/wiki/Windows_Registry

If the Twitterers and BK have accurately relayed BN's testimony in the hearings so far, he is saying that Mesa PD and Lonnie Dworkin didn't look at the registry. That's crazy, I cannot imagine that they didn't. I would so love to hear from Lonnie Dworkin.

ETA: Do note that the Windows registry can be edited. It can even be edited by viruses and malware.