Twitter is definitely not the way to follow something technical like computer forensics. Right now, we only have tech talk from the defense expert, so there is a lot of info that still needs to be cleared up.
I don't get it with these defense "experts". Seems like most of them so far have been long on ego and short on knowledge in their field. For example, BN saying that the three phones were missing SIM cards. Travis used Verizon and at that time, all of their devices were CDMA, which means they never had SIM cards. Same thing for Arias' Helio phone. BN also linked the Zblog virus with a media player for *advertiser censored* sites, with the implication that was the only source of the virus. Another false statement was that Apple QuickTime and Itunes cannot update automatically.
BN, like Dr. Samuels, was not well prepared and could not answer technical questions. But he certainly made some strong claims and used emotional language in delivering his message. He is unequivocal that Travis purposefully visited *advertiser censored* sites. In both hearings, he has made statements by which
he appears to be saying he can identify certain entries in the registry as automatic files vs. keystroke files. I have been researching this and cannot find the basis for him to be able to state this so clearly, unless TA's computer had a key stroke logger program installed on it. Last week, BN testified that Travis had 19 AV/scrubber programs on his computer and yesterday that number went up to 22, without any explanation for the difference.
I'm also confused by BN saying that he has not touched Travis' hard drive. Surely he is not playing games up there trying to say that he personally did not touch the drive when his agents may have? Willmott wrote the 11/20/14 Defendant's Response to State Motion...and included a picture of the hard drive after pins had been straightened so that the expert could access the drive.
View attachment 64937
Mr. Expert called previous experts grossly incompetent for not having found *advertiser censored*. It had been previously suggested that the first defense expert, Dworkin, did not find anything because he had been given a tampered copy of the drive. Yesterday it was learned that on 6/3/2008 a newer version of SpyBot was installed and then run on 6/4/08 at a corrected time of 2:44 pm. It may be that because SpyBot was run on 6/4/08, it did quarantine any active virus exe program on the computer, thus leading to Melendez answer on the stand. It may also be that the *advertiser censored* files were encrypted and coded, and as such, did not qualify as *advertiser censored* by forensic examination standards. BN had to do a lot of work to recover these files, and the type of work may not be accepted practice. We have to wait and see.
To me, this is quite simple. There are three distinct dates in question with this computer. By using the same software, a qualified examiner should be able to work from copy A to copy B and finally to copy C, producing the same results. For some reason, the defense expert is balking at providing the State with the unaltered copy, which presumably should be B.
