K_Z
Verified Anesthetist
- Joined
- Nov 8, 2010
- Messages
- 6,657
- Reaction score
- 2,498
Quote:
Thank you--I had forgotten that Sandra had done this interview. But see, this is what confuses me. She says she was asked to construct a timeline regarding use of the computer for June 16--which is consistent with what Linda now says. (Sandra says July 16 in this interview, actually, but from context she clearly means June 16.) Then she says she looked "very closely" at this critical date as the trial neared. It sounds like she did, in fact, figure out much of the Firefox internet activity that was going on that day (although her times are off), including the shotgirl outfit searches. So why didn't she find the foolproof suffocation search?? She was so so so close. I can't understand it.
My timeline showed large gaps of time where it seemed there was no activity at all on the HP home computer. Therefore, I reported those gaps in time to detectives. They were working off the presumption that large gaps of time away from the computer could possibly mean that was the time frame when something may have happened to Caylee. I looked very closely at July 16th again just as the trial was starting. I filtered all the files on the HP computer to show only the 24 hours for that day. I sorted every file first by creation time and then by accessed time. What I learned was that the temporary Internet files were being accessed and created during some of those large time gaps when I thought nothing was going on. What I didn't think about in 2008 was that the index.dat files are stored in a database (hence the file extension .dat - DUH!). The EnCase timeline function reported the MAC times for the database itself and not for the individual records it contains. So, while the user is accessing the Internet, the index.dat file is not being updated the whole time it is in use.
BBM
Does this explain what happened?