Zani Timeline- Other ZannyThoughts- Zanny Searches on Caseys computer

[treeseeker]

Ok ... the Files (Index.dat and History.dat) are like "Cookie Jars" and the searches are the cookies. Just because the "cookie jar" (file) was created on a certain date it doesn't mean that all the cookies (searches) were placed in it on that same date. We do know that for example "cookie jar", index.dat was created on 6/12/08 and we know that the last cookie was placed in it on 7/16/08 ... but we don't know when each specific cookie was placed in the "cookie jar" (because that info is missing from the full path, it was replaced with Casey's case number by the forensics guy)

Anything?

Perfect, thank you!

 

[Friptzap]

Ok ... the Files (Index.dat and History.dat) are like "Cookie Jars" and the searches are the cookies. Just because the "cookie jar" (file) was created on a certain date it doesn't mean that all the cookies (searches) were placed in it on that same date. We do know that for example "cookie jar", index.dat was created on 6/12/08 and we know that the last cookie was placed in it on 7/16/08 ... but we don't know when each specific cookie was placed in the "cookie jar" (because that info is missing from the full path, it was replaced with Casey's case number by the forensics guy)

Anything?

um, not viewed this file myself yet but don't cookies create thier own files too? so we should have cookies?

Well she probably cleared her cache for cookies but didnt clear the history.

I need to catch up on the docs!

 

[shadowraiths]

I'm not sure that we can say for sure that the search date of 6/12/08 is accurate since all we know about that search is that the file containing the data was created on 6/12/08 and Last written to on 7/16/08. Unless you have seen something different than I have ... I am happy to have a second pair of eyes ... and help in trying to aid everyone in understanding what they are reading!

That's a very good point that I missed on the scan of that file, one_hooah_wife. And yes, I agree. That search could have also been performed on July 16, 2008. Which would rule it out as being anything of real significance, since that is when KC told CA about Zenaida.

 

[one_hooah_wife]

What initiates an index.dat file? a visit to myspace in general? something else?

When you type a website into the address bar, or enter information into a textbox, the index.dat file is referenced.

 

[shadowraiths]

um, not viewed this file myself yet but don't cookies create thier own files too? so we should have cookies?

Well she probably cleared her cache for cookies but didnt clear the history.

I need to catch up on the docs!

Imho, one_hooah_wife, was using the "cookie jar" to simply explain how history files work. And clearing the cache, cookies, etcetera, is... well... meaningless anyway. Simply bc locards exchange principle works esp well for disk drives (i.e., the file headers, not the data, is deleted).

 

[one_hooah_wife]

That's a very good point that I missed on the scan of that file, one_hooah_wife. And yes, I agree. That search could have also been performed on July 16, 2008. Which would rule it out as being anything of real significance, since that is when KC told CA about Zenaida.

Thank you so much for responding ... I was afraid I was missing something in trying to make sense of all of this and the more I try to explain the more I confuse myself! :crazy:

 

[Black Magic Woman]

Ok ... the Files (Index.dat and History.dat) are like "Cookie Jars" and the searches are the cookies. Just because the "cookie jar" (file) was created on a certain date it doesn't mean that all the cookies (searches) were placed in it on that same date. We do know that for example "cookie jar", index.dat was created on 6/12/08 and we know that the last cookie was placed in it on 7/16/08 ... but we don't know when each specific cookie was placed in the "cookie jar" (because that info is missing from the full path, it was replaced with Casey's case number by the forensics guy)

Anything?

Just wanted to say that I'm blown away with how much you know about this stuff! Thank god you joined. the thing is I think you have seen now that you need to totally "dumb it down" to explain it to us, like you did above. Then you won't have to go through all those pages of us scratching our heads saying huh? and asking more questions. thanks so much for your expertise!

 

[shadowraiths]

Thank you so much for responding ... I was afraid I was missing something in trying to make sense of all of this and the more I try to explain the more I confuse myself! :crazy:

From where I sit, you're doing a rather superb job of explaining things, one_hooah_wife!

 

[one_hooah_wife]

um, not viewed this file myself yet but don't cookies create thier own files too? so we should have cookies?

Well she probably cleared her cache for cookies but didnt clear the history.

I need to catch up on the docs!

You're right and I explained that earlier about cookies being a file and each having it's own creation date as opposed to strings of data within an index or archive file ... should have used some other container than "cookie jar" like I said ... I am feeling the stress :crazy:

The index.dat and history.dat files contain information that may have been cleared when cookies, temporary internet files and other caches have been emptied.

 

[one_hooah_wife]

Just wanted to say that I'm blown away with how much you know about this stuff! Thank god you joined. the thing is I think you have seen now that you need to totally "dumb it down" to explain it to us, like you did above. Then you won't have to go through all those pages of us scratching our heads saying huh? and asking more questions. thanks so much for your expertise!

Well ... TY ... I will try to explain better!

 

[Friptzap]

Imho, one_hooah_wife, was using the "cookie jar" to simply explain how history files work. And clearing the cache, cookies, etcetera, is... well... meaningless anyway. Simply bc locards exchange principle works esp well for disk drives (i.e., the file headers, not the data, is deleted).

assuming she is not smart enough to defrag her hard drive and or clean this information through other "tools"

It can be cleaned well if you know how to do it ;-) now that said I don't think she is that smart!

 

[Black Magic Woman]

Well ... TY ... I will try to explain better!

NO... you're doing great!

 

[Black Magic Woman]

one_hooah_wife ...one question I have for you since you seem to be a computer expert. Don't you think there are Kzillions more things on that computer than that one little print out? ALL the myspace, facebook, emails, searches etc. where are they? remember lee saying all the yahoo emails had been erased when he got the computer? wouldn't they have been able to access that stuff too?

 

[monoxide]

one_hooah_wife ...one question I have for you since you seem to be a computer expert. Don't you think there are Kzillions more things on that computer than that one little print out? ALL the myspace, facebook, emails, searches etc. where are they? remember lee saying all the yahoo emails had been erased when he got the computer? wouldn't they have been able to access that stuff too?

Oh I am nearly positive there is tons more.

 

[shadowraiths]

assuming she is not smart enough to defrag her hard drive and or clean this information through other "tools"

It can be cleaned well if you know how to do it ;-) now that said I don't think she is that smart!

Even if she (or anyone else, for that matter) were "that smart," it is impossible to remove "all of the data." That is, unless one runs a hard core magnet over the thing and then breaks it into teeny tiny pieces with a hammer.

 

[McNugget]

Here's a link to an article explaining computer forensics to those who may be interested-

http://www.expertlaw.com/library/forensic_evidence/computer_forensics_101.html

And it is possible to do a complete hard drive wipe with the right tools. Some people use special programs to do this when they want to sell their old computers to avoid identity theft.

 

[one_hooah_wife]

one_hooah_wife ...one question I have for you since you seem to be a computer expert. Don't you think there are Kzillions more things on that computer than that one little print out? ALL the myspace, facebook, emails, searches etc. where are they? remember lee saying all the yahoo emails had been erased when he got the computer? wouldn't they have been able to access that stuff too?

Oh, I am sure of it ... and as far as computer forensics go ... the analysis that we have seen in these documents is very basic ... pretty much anyone with software that parses binary files could have discovered this. I can't wait to see the stuff that she really made an effort to erase or hide!

 

[one_hooah_wife]

Even if she (or anyone else, for that matter) were "that smart," it is impossible to remove "all of the data." That is, unless one runs a hard core magnet over the thing and then breaks it into teeny tiny pieces with a hammer.

Yep!

My husband, being the DOD computer genius that he is (yes, he is reading over my shoulder) says that the magnetic field on the disc stores an imprint of the last dozen or so writes, thus even the strategy of overwriting all with 101010... really only masks the contents of the disc, but it does not remove them. A highly skilled computer forensics expert would have the ability and tools needed to interpret and recreate files based on that imprint.

 

[shadowraiths]

it is possible to do a complete hard drive wipe with the right tools. Some people use special programs to do this when they want to sell their old computers to avoid identity theft.

Not to belabor this subject... but... it is physically impossible to do a "complete hard drive wipe." This is due to the laws of "electromagnetic fields theory" as it applies to disk drive technology. Of course, companies that sell "disk wiping" software are going to make such outlandish claims... bc... well, it gets them sales.

 

[shadowraiths]

Yep!

My husband, being the DOD computer genius that he is (yes, he is reading over my shoulder) says that the magnetic field on the disc stores an imprint of the last dozen or so writes, thus even the strategy of overwriting all with 101010... really only masks the contents of the disc, but it does not remove them. A highly skilled computer forensics expert would have the ability and tools needed to interpret and recreate files based on that imprint.

LOL. Well, I was a disk drive engineer before I went soft and became a technodweeb... erm... software engineer.