Terri's Computer forensics

[ElizaAvalon]

Okay, Kaine stated that TH's favorite medium of communication was electronic. Certainly LE has her laptop, right, and her phone? Isn't it true that everything on a computer or SIM chip in a phone is never "completely" erased?

I remember with Scott Peterson, that was one of the circumstantial evidence that brought him down...his searches, etc.

Anyone care to shed some light on this for me? I don't really know too much about it. Looks like TH's achilles heel will be her love for all things electronic.

It is not true that everything on a computer is never completely erased.

Your data is stored on your hard drive in blocks. If you delete a file, your operating system simply resets the flag for the blocks that the file takes up as "free" so that they can be reused. Your operating system can overwrite those blocks with other data, which would have the effect of erasing the previous data forever.

There are programs out there that can completely erase a hard drive by overwriting "free" blocks. Just take a look at a product called killdisk and you'll see what I mean.

 

[Mrs G Norris]

Great show from Blog Talk Radio which focuses a lot of discussion on computer forensics http://www.blogtalkradio.com/talkfo...e-presentation-larry-daniel-high-profile-comp the host, Larry Daniel is now expert witness in Casey Anthony case so the show is in hiatus.

 

[eaglemom]

At our library you have to use a library card number to log in before using the internet.

However, if a librarian caught someone looking at a suggestive picture they would throw them off, so Terri would have been taking a big risk. My gut feeling is that she wouldn't do that at a library.

Most adult content or websites are blocked on library computers. But emails would go through and she could read them on a library computer. I've had to do that when my computer was on the fritz.

Kaine may be like my husband who knows almost nothing about email or ways to send images. Not everyone is proficient with technology. So maybe Terri counted on the fact that he wasn't going to look back through the emails. She might have also had an email account he didn't know about, or had her own with a password, while he used another for family email.

It really varies by library.... All internet policies and PC access is totally devised by the individual libraries themselves. In our local area we have some libraries that require a library card, we have some that will let patrons sign up for internet use with nothing but putting their name on a list (and they could use any name they wanted), we have some libraries that assign patrons a 'guest pass internet only' library card from a stack that resides at the desk they change the password on daily. I am sure there are probably as many ways of doing it as there are libraries.

Most of the libraries have a programs that block internet access to 'inappropriate' sites and will also take the PC's back to a specific 'ghost' image setup wiping out any viewable history, etc overnight (this program also prohibits the installation of software on the PC so patrons can't download onto the PC's). That isn't to say that LE couldn't get the info by getting at the hard drive but the hard drive portions are basically wiped and resinstalled every night so the overwriting of files occurs all the time, thus increasing the chances that more info is overwritten.

To top it off, we even have libraries that 'loan' laptops for use within the library by the hour....

So I guess it would depend on the LOCAL libraries policies......specifically

 

[liz b.]

At our library you have to use a library card number to log in before using the internet.

However, if a librarian caught someone looking at a suggestive picture they would throw them off, so Terri would have been taking a big risk. My gut feeling is that she wouldn't do that at a library.

Most adult content or websites are blocked on library computers. But emails would go through and she could read them on a library computer. I've had to do that when my computer was on the fritz.

Kaine may be like my husband who knows almost nothing about email or ways to send images. Not everyone is proficient with technology. So maybe Terri counted on the fact that he wasn't going to look back through the emails. She might have also had an email account he didn't know about, or had her own with a password, while he used another for family email.

Yes, but I don't think she would have been looking at *advertiser censored* ; I think more likely it would have been an email relationship,which may have led into an in person thing. Especially if a pedophlie wanted Kyron,and she had shared details of her life. If it became an in person thing, I do not see her using her own computer to set up dates. And I really doubt that KH was as oblivious as we think...

Also, IDK about KH knowing almost nothing about email ; IIRC, he works in the IT industry,for Intel....

All JMO

 

[JustToSeeYouSmile]

This thread (and the references to her liking CSI and Dexter, as well as Kyrons' CSI teeshirt) makes me wonder....was TH a member of WS or other crime boards prior to Kyron's disappearance?
Hmm.
I know that answer can't be had on the board...but.... could be had.

 

[xabigailx]

At our library you have to use a library card number to log in before using the internet.

However, if a librarian caught someone looking at a suggestive picture they would throw them off, so Terri would have been taking a big risk. My gut feeling is that she wouldn't do that at a library.

Most adult content or websites are blocked on library computers. But emails would go through and she could read them on a library computer. I've had to do that when my computer was on the fritz.

Kaine may be like my husband who knows almost nothing about email or ways to send images. Not everyone is proficient with technology. So maybe Terri counted on the fact that he wasn't going to look back through the emails. She might have also had an email account he didn't know about, or had her own with a password, while he used another for family email.

BBM
I doubt that since IIRC Kaine is an engineer with Intel. I suspect he knows a LOT about computers.

 

[21merc7]

xabigailx

Welcome to WS!

 

[Tuffy]

In the days immediately after Kyron's disappearance one of the local media outlets - don't remember which one - was fairly certain the TH was posting comments on their website. This led me to wonder exactly when LE grabbed her computer. About five years back I spent an afternoon interviewing the principals of a small consulting company that did computer forensics. Most of their business was contract work for local LE. They were working on a child *advertiser censored* case at the time. With PCs you never really erase anything - you just write over information that is no longer needed. And even if information has been written over, computer forensics can sometimes still figure out what was underneath. Even when you "wipe" a hard drive by writing over data multiple times, information is sometime still left behind. The folks I talked to used an analogy to explain to me how they could sometimes extract information from a disk that had theoretically been wiped clean. Assume you have an old fashioned tape cassette, and you tape over what was originally on the cassette. If alignment of the tape and the recorder is not absolutely perfect, a tiny bit of what was originally recorded would remain along the edges of the tape. All information on a computer is stored digitally, so if computer forensic analysts can reconstruct a pattern of ones and zeros from “ghost” information left on the hard drive, they have a chance of figuring out what was on the computer. My best guess is that TH’s computer was turned over to the FBI. Moral of the story: If you have incriminating info on your computer, take a sledge hammer to it and then toss it in a very hot fire.

I used to do this for a bank. Wipe the old drives from computers. We used a program that was the DoD equivalent. The theory was that it was equal to what the DoD did to their old hardware to ensure data couldn't be recovered from it.

It was essentially what you said writing over the drive with 1s and zeros. Then re-writing it several times, over and over. This was phased out as it was found to be possible to still recover data, and we went to physically destroying the hard drives.

 

[SurfieTX]

I used to do this for a bank. Wipe the old drives from computers. We used a program that was the DoD equivalent. The theory was that it was equal to what the DoD did to their old hardware to ensure data couldn't be recovered from it.

It was essentially what you said writing over the drive with 1s and zeros. Then re-writing it several times, over and over. This was phased out as it was found to be possible to still recover data, and we went to physically destroying the hard drives.

I've heard that a magnet works as well.

 

[21merc7]

Ok, hard drives. Nothing wipes them completely unless you drill holes, throw on acid, burn in crematorium, spit, poo, throw in river with magnets and rocks, grind to a pulp.

And do not forget, every service you pay for has a record of everything stored in a server (big computer) somewhere in some sort of storage. Trust me. Murder cases, every email, every instant message, every single thing is right there waiting. Even all of this at WS.

Only one person has had something not touchable yet. (Maybe by now, it was part of a death penalty bargain, even though he accepts the death penalty now.) Joseph Edward Duncan, III. He wrote his own encryption for what he says is diaries. I don't think those have been accessed yet. Even Reiser couldn't do it. Doubt there is much on Duncan's we need to know here, lots of child rapes, tortures, murders.

TH, nadda clue. JED was a lifelong criminal and learned computers in jail and when released as a "registered sex offender."

 

[LotsaLatte]

I posted in another thread that I wondered if it's possible that IF TH had to dispose of a body, with her "knowledge" of forensics, etc. from CSI, etc. and possibly even crime forums along with her planning skills, would she would make it look like someone else was responsible for Kyron's disappearance. I mean like RSOs, other parents, school employees, etc. I wonder if she did searches on her computer (or other computers) for RSO's, etc. in order to decide how/where to get rid of a body.
Hopefully, if she did anything like this it will be found out. She may have asked or answered a question somewhere along the way on a forum or via email. I think she really never expected anyone to even take a second look at her as anything more or less than a victim. Of course, this is only if she is involved. I would love to know if she did searches for the best criminal defense attorney in the Portland area. And if so, what search words she used.

 

[gardeness]

But...if they have her computer, why are they asking people specifically for email communication? It just sounds to me like they have been unable to find any evidence on her computer...

 

[Tuffy]

But...if they have her computer, why are they asking people specifically for email communication? It just sounds to me like they have been unable to find any evidence on her computer...

My thoughts are that the investigation is at a stand still. No new information is coming forward. They are just hoping there is someone with something, anything that will come forward.

I think that is why DY and KH seem to be much more down during today's presser.

 

[liz b.]

But...if they have her computer, why are they asking people specifically for email communication? It just sounds to me like they have been unable to find any evidence on her computer...

Nope, probably nothing to see on her own computer....

All JMO

 

[21merc7]

But...if they have her computer, why are they asking people specifically for email communication? It just sounds to me like they have been unable to find any evidence on her computer...

Well, KH and DY did say LE is not telling them what to speak about and this is all their own thoughts and feelings.

The next step is LE is not telling them that much.

The next step is _______________________________.

 

[Sherbie]

This thread (and the references to her liking CSI and Dexter, as well as Kyrons' CSI teeshirt) makes me wonder....was TH a member of WS or other crime boards prior to Kyron's disappearance?
Hmm.
I know that answer can't be had on the board...but.... could be had.

I've often wondered the same. Wouldn't surprise me a bit!

 

[Sherbie]

But...if they have her computer, why are they asking people specifically for email communication? It just sounds to me like they have been unable to find any evidence on her computer...

She could have occasionally or routinely used someone else's computer; could have had email and other online accounts she didn't access from her own computer (or from an old one no longer available for inspection); sent or received calls or text messages from the phones of others; etc.

 

[palladore]

Ok, hard drives. Nothing wipes them completely unless you drill holes, throw on acid, burn in crematorium, spit, poo, throw in river with magnets and rocks, grind to a pulp.

And do not forget, every service you pay for has a record of everything stored in a server (big computer) somewhere in some sort of storage. Trust me. Murder cases, every email, every instant message, every single thing is right there waiting. Even all of this at WS.

Only one person has had something not touchable yet. (Maybe by now, it was part of a death penalty bargain.) Joseph Edward Duncan, III. He wrote his own encryption for what he says is diaries. I don't think those have been accessed yet. Even Reiser couldn't do it. Doubt there is much on Duncan's we need to know here, lots of child rapes, tortures, murders.

TH, nadda clue. JED was a lifelong criminal and learned computers in jail and when released as a "registered sex offender."

You can buy off-the-shelf encryption software that makes use of standard encryption protocols *that if used correctly* can't be broken. There was an organized crime case some years back in which the bad guy was sending encrypted email. LE broke into his office and attached something to his computer that logged keystrokes. The keystroke logger enabled LE to figure out the password he used to access the encrypted stuff. Moral of the story: If you are using encryption make certain you have a very strong password, and keep your computer in a fortified vault. As an aside - the NSA (National Security Agency) has teams that do something called "traffic analysis." When the NSA can't access the content of commuinication because, lets say, suspected terrorists are using encryption, they look for patterns in the communication flow and attempt to deduce what the patterns might mean.

 

[21merc7]

palladore;

Oh, thanks palladore, I know about those, but I am hoping that the big groups of LE are helping in Kyron's case. Don't know if they are still in or just advised. (Doubt they are necessary, except for perhaps, logging in remotely but not being TH.)

Jed's is the only one I know of that all the big groups still cannot break in. No kidding, all have tried, no one can figure it out. Worth looking up, but you will be sick for a while if you look up too much.

Doubt TH has the capability is what I am saying.

 

[Sherbie]

That's very interesting, palladore -- thank you!