ZG Hires Attorney - Lawsuit Against Casey Anthony Part 2

[IrishSweetOne]

What??? The computer forensics show that the only searching done for Zanny on any of the Anthony computers took place on 7/16. It is spelled out very clearly in the report. You are confusing the date of the cookie with the date of the file that the cookie is stored in. None the less, you have details here that are not in the forensic report. Where did you get this information? BTW, the times of the searches on 7/16 were BEFORE LE took the computers.

Chilly there are a number of computer forensic websites available if your up for the research . http://128.175.24.251/forensics/default.htm

This will explain what Created Date and Last Accessed mean

Accessed Date The last time that the cookies file was accessed by the Web site.

Modified Date The last time that the cookies file was modified by the Web site.

Created Date The time that the cookies file was originally created.

http://74.125.45.104/search?q=cache:rCiywIMXpXkJ:www.nirsoft.net/utils/internet_explorer_cookies_view.html+index.dat+file+created+Last+Accessed+Last+Written&hl=en&ct=clnk&cd=20&gl=us

*******************************

Below is what we have of KC & Cindy's computer reports in ref. to ZG . Please note that if you view the report it's pretty clear at least to me that it is incomplete, it just ends with out any signed documentation from the Orange County Sheriff’s Office Criminal Investigations Division
Computer Crimes Squad .We also know this is an incomplete report as the Cloroform searches aren't included.

( laptop )


On July 16, 2008 at approximately 2000 hours, Detective Charity Beasley of the Orange County Sheriff's Office Domestic Violence Squad on behalf of Detective Corporal Yuri Melich, submitted a Compaq Presario C300 laptop computer; serial number CND6430RKH (with the power cord)

No photographs, video, email, instant message chat or any other type of
communication with a Zenaida Fernandez-Gonzalez was discovered on either computer.

***********************************************************

The HP Pavillon Desktop computer


The Internet History for the profile "Casey" on the HP computer was extracted via Net Analysis. The History was then filtered for both "MySpace" and for"facebook."

All the Internet History files were saved to the Evidence\Internet History\Cindy Desktop computer\Casey profile folders as comma delimited files for viewing using Excel.

A keyword search for "Zenaida" revealed Web pages indicating that a user
searched the Internet for that name on July 16, 2008. Those entries were
bookmarked under the "Zenaida Fernandez Gonzalez" section of this report.





Zenaida Fernandez Gonzalez

A keyword search for "Zenaida" was conducted on the HP desktop computer. The following files are records of web pages indicating that someone was searching for that name on the Internet.

Name: casey@www.reunion[2].txt
Description: File, Archive
File Created: 07/16/08 06:21:17AM
Last Accessed: 07/16/08 06:21:27AM
Last Written: 07/16/08 06:21:27AM
Full Path: 08-069208\S013J10X237614\D\Documents and Settings\casey\Cookies\casey@www.reunion[2].txt

zenaida

Name: history.dat
Description: File, Archive
File Created: 10/22/07 01:13:21PM
Last Accessed: 07/16/08 12:03:24PM
Last Written: 07/16/08 12:03:24PM
Full Path: 08-069208\S013J10X237614\D\Documents and Settings\casey\Application
Data\Mozilla\Firefox\Profiles\mfhaxjkl.default\history.dat

http://friends.myspace.com/index.cfm?fuseaction=user.viewfriends\ =203461948897ec12-9984-4944-b65e-
6dcef3d5a590=zenaida

********************************

Name: index.dat
Description: File, Archive
File Created: 06/12/08 11:15:29PM
Last Accessed: 06/12/08 11:15:29PM
Last Written: 07/16/08 04:20:12PM
Full Path: 08-069208\S013J10X237614\D\Documents and Settings\casey\Local Settings\Temporary Internet

Files\Content.IE5\index.dat
http://clk.atdmt.com/RUC/go/whtpgreu0210000164ruc/direct;at.rucreu00001670;ct.1/01?dispatch=show
SearchRegistration&action=peopleSearch_wp_resultcount&city=&mname=&peopleSearchFrom=wp&affiliate
id=131&searchFirstName=zenaida&searchLastName=Gonzalez&searchAge=25


**********************************

Name: index.dat
Description: File, Archive
File Created: 06/12/08 11:15:29PM
Last Accessed: 06/12/08 11:15:29PM
Last Written: 07/16/08 04:20:12PM
Full Path: 08-069208\S013J10X237614\D\Documents and Settings\casey\Local Settings\Temporary Internet


Files\Content.IE5\index.dat
http://preview.ussearch.com/preview/ala/newsearch?&searchLName=Fernandez&searchState=FL&searchCi
ty=jacksonville&searchFName=Zenaida&adID=303014F936&adsource=8&TID=0&cid=people&searchtab=people
·ð-·newsearch[2]



************************************

Name: Unallocated Clusters
Description: File, Unallocated Clusters
File Created:
Last Accessed:
Last Written:
Full Path: 08-069208\S013J10X237614\D\Unallocated Clusters

http://searchservice.myspace.com/index.cfm?fuseaction=sitesearch.results&\
qry=zannie&type=People&srchBy=Name&g=F&loc=orlando%2Cfl32829&minAge=22&maxAge=\
26&d=25

**************************************

Name: Unallocated Clusters
Description: File, Unallocated Clusters
File Created:
Last Accessed:
Last Written:
Full Path: 08-069208\S013J10X237614\D\Unallocated Clusters

"http://x.myspacecdn.com/modules/sitesearch/static/js/sitesearch003.js"></script>
<!-- Search - Start -->
<div id="searchContent">
<div id="siteSearch" class="global">
<input type="hidden" id="fuseaction" queryID="fuseaction" value="sitesearch.results"/>
<div class="searchField">
<input type="text" class="searchFieldInput" maxlength="100" size="35" id="qry" name="qry" que
ryID="qry" title="Search MySpace" value="zanny" onkeypress="return keyPressHandler(event, 'searc
hButton');" />

********************************************

Name: Unallocated Clusters
Description: File, Unallocated Clusters
File Created:
Last Accessed:
Last Written:
Full Path: 08-069208\S013J10X237614\D\Unallocated Clusters

"http://searchservice.myspace.com/index.cfm?fuseaction=sitesearch.results&qry=zanie&type=People&
srchBy=Name&g=F&loc=orlando%2Cfl32829&upic=on&npic=on&minAge=22&maxAge=26&d=25

***********************************************************This below will help explain what Unallocated Clusters mean

Unallocated File Space Defined
When files are erased or deleted in DOS, Windows, Windows 95, Windows 98 and Windows NT, the content of the file is not actually erased. Unless DoD certified file deletion software is used, such as NTI's M-Sweep or DiskScrub, data from the 'erased file' remains behind in an area called unallocated storage space. The same is true concerning file slack that may have been attached to the file before it was deleted. As a result, the data remains behind for discovery through the use of data recovery and/or computer forensics software utilities.

Unallocated file space and file slack are both important sources of leads for the computer forensics investigator. The data storage area in a factory fresh hard disk drive typically contains patterns of sectors which are filled with patterns of format characters. In DOS and Windows-based computer systems, the format pattern for a floppy diskette usually consists of binary data in the form of hex F6s. The same format pattern is sometimes used in the format of hard disk drives but the format patterns can consist of essentially any repeat character as determined by the factory test machine that made the last writes to the hard disk drive. The format pattern is overwritten as files and subdirectories are written in the data area.

Until the first file is written to the data storage area of a computer storage device, the clusters are unallocated by the operating system in the File Allocation Table (FAT). These unallocated clusters are padded with format pattern characters and the unallocated clusters are not of interest to the computer forensics specialist until data is written to the clusters. As files are created by the computer user, clusters are allocated in the File Allocation Table (FAT) to store the data. When the file is 'deleted' by the computer user, the clusters allocated to the file are released by the operating system so new files and data can be stored in the clusters when needed. However, the data associated with the 'deleted' file remains behind. This data storage area is referred to as unallocated storage space and it is fragile from an evidence preservation standpoint. However, until the unallocated storage space is reassigned by the operating system, the data remains behind for easy discovery and extraction by the computer forensics specialist.

http://www.forensics-intl.com/def8.html


Chilly this little bit of research I posted above took me hours , I wanted to be sure I had my facts straight and could back it up . I hope this clears the question up .

 

[Friptzap]

Someone asked earlier about her losing her job prior to the events Casey started or after the events Casey started. I posted some information above that I could find but even on JM's website for this case they only say she "claims" she lost her job.

"She also claims that she was fired from her job as a result of all of the negative media attention given to her name."

Why not jsut say she lost her job, why the confusing "claims." I thought I heard her say in one of the interviews that she lost it prior, I am still seaking this out fully.

Also some more information on her name, people asked does she use a middle, or mentioned if it's a hyphanated last name then it's not a middle name and maybe that's why she said she had no middle name.

On JM's website they only use the Z and the G parts for her name. No middle name or hyphenated name.
http://www.forthepeople.com/Zenaida_Gonzalez_Defamation_Suit.htm

If I were Casey's lawyer I would say, "how can they claim we have caused issues when this either isn't her name or she never uses it anyway. Or somehting of that nature. Them not using her correct name on their website the full (ZFG) only makes the case weaker if you ask me. If that is her real full name, we have some conflicting information here on which to base this.

 

[Friptzap]

Chilly there are a number of computer forensic websites available if your up for the research . http://128.175.24.251/forensics/default.htm

This will explain what Created Date and Last Accessed mean

Accessed Date The last time that the cookies file was accessed by the Web site.

Modified Date The last time that the cookies file was modified by the Web site.

Created Date The time that the cookies file was originally created.

http://74.125.45.104/search?q=cache...cessed+Last+Written&hl=en&ct=clnk&cd=20&gl=us

*******************************

Below is what we have of KC & Cindy's computer reports in ref. to ZG . Please note that if you view the report it's pretty clear at least to me that it is incomplete, it just ends with out any signed documentation from the Orange County Sheriff’s Office Criminal Investigations Division
Computer Crimes Squad .We also know this is an incomplete report as the Cloroform searches aren't included.

( laptop )


On July 16, 2008 at approximately 2000 hours, Detective Charity Beasley of the Orange County Sheriff's Office Domestic Violence Squad on behalf of Detective Corporal Yuri Melich, submitted a Compaq Presario C300 laptop computer; serial number CND6430RKH (with the power cord)

No photographs, video, email, instant message chat or any other type of
communication with a Zenaida Fernandez-Gonzalez was discovered on either computer.

***********************************************************

The HP Pavillon Desktop computer


The Internet History for the profile "Casey" on the HP computer was extracted via Net Analysis. The History was then filtered for both "MySpace" and for"facebook."

All the Internet History files were saved to the Evidence\Internet History\Cindy Desktop computer\Casey profile folders as comma delimited files for viewing using Excel.

A keyword search for "Zenaida" revealed Web pages indicating that a user
searched the Internet for that name on July 16, 2008. Those entries were
bookmarked under the "Zenaida Fernandez Gonzalez" section of this report.





Zenaida Fernandez Gonzalez

A keyword search for "Zenaida" was conducted on the HP desktop computer. The following files are records of web pages indicating that someone was searching for that name on the Internet.

Name: casey@www.reunion[2].txt
Description: File, Archive
File Created: 07/16/08 06:21:17AM
Last Accessed: 07/16/08 06:21:27AM
Last Written: 07/16/08 06:21:27AM
Full Path: 08-069208\S013J10X237614\D\Documents and Settings\casey\Cookies\casey@www.reunion[2].txt

zenaida

Name: history.dat
Description: File, Archive
File Created: 10/22/07 01:13:21PM
Last Accessed: 07/16/08 12:03:24PM
Last Written: 07/16/08 12:03:24PM
Full Path: 08-069208\S013J10X237614\D\Documents and Settings\casey\Application
Data\Mozilla\Firefox\Profiles\mfhaxjkl.default\history.dat

http://friends.myspace.com/index.cfm?fuseaction=user.viewfriends\ =203461948897ec12-9984-4944-b65e-
6dcef3d5a590=zenaida

********************************

Name: index.dat
Description: File, Archive
File Created: 06/12/08 11:15:29PM
Last Accessed: 06/12/08 11:15:29PM
Last Written: 07/16/08 04:20:12PM
Full Path: 08-069208\S013J10X237614\D\Documents and Settings\casey\Local Settings\Temporary Internet

Files\Content.IE5\index.dat
http://clk.atdmt.com/RUC/go/whtpgreu0210000164ruc/direct;at.rucreu00001670;ct.1/01?dispatch=show
SearchRegistration&action=peopleSearch_wp_resultcount&city=&mname=&peopleSearchFrom=wp&affiliate
id=131&searchFirstName=zenaida&searchLastName=Gonzalez&searchAge=25


**********************************

Name: index.dat
Description: File, Archive
File Created: 06/12/08 11:15:29PM
Last Accessed: 06/12/08 11:15:29PM
Last Written: 07/16/08 04:20:12PM
Full Path: 08-069208\S013J10X237614\D\Documents and Settings\casey\Local Settings\Temporary Internet


Files\Content.IE5\index.dat
http://preview.ussearch.com/preview/ala/newsearch?&searchLName=Fernandez&searchState=FL&searchCi
ty=jacksonville&searchFName=Zenaida&adID=303014F936&adsource=8&TID=0&cid=people&searchtab=people
·ð-·newsearch[2]



************************************

Name: Unallocated Clusters
Description: File, Unallocated Clusters
File Created:
Last Accessed:
Last Written:
Full Path: 08-069208\S013J10X237614\D\Unallocated Clusters

http://[COLOR=darkred]searchservice.myspace.com[/COLOR]/index.cfm?fuseaction=sitesearch.results&\
qry=zannie&type=People&srchBy=Name&g=F&loc=orlando%2Cfl32829&minAge=22&maxAge=\
26&d=25

**************************************

Name: Unallocated Clusters
Description: File, Unallocated Clusters
File Created:
Last Accessed:
Last Written:
Full Path: 08-069208\S013J10X237614\D\Unallocated Clusters

"http://x.myspacecdn.com/modules/sitesearch/static/js/sitesearch003.js"></script>
<!-- Search - Start -->
<div id="searchContent">
<div id="siteSearch" class="global">
<input type="hidden" id="fuseaction" queryID="fuseaction" value="sitesearch.results"/>
<div class="searchField">
<input type="text" class="searchFieldInput" maxlength="100" size="35" id="qry" name="qry" que
ryID="qry" title="Search MySpace" value="zanny" onkeypress="return keyPressHandler(event, 'searc
hButton');" />

********************************************

Name: Unallocated Clusters
Description: File, Unallocated Clusters
File Created:
Last Accessed:
Last Written:
Full Path: 08-069208\S013J10X237614\D\Unallocated Clusters

"http://searchservice.myspace.com/index.cfm?fuseaction=sitesearch.results&qry=zanie&type=People&
srchBy=Name&g=F&loc=orlando%2Cfl32829&upic=on&npic=on&minAge=22&maxAge=26&d=25

***********************************************************This below will help explain what Unallocated Clusters mean

Unallocated File Space Defined
When files are erased or deleted in DOS, Windows, Windows 95, Windows 98 and Windows NT, the content of the file is not actually erased. Unless DoD certified file deletion software is used, such as NTI's M-Sweep or DiskScrub, data from the 'erased file' remains behind in an area called unallocated storage space. The same is true concerning file slack that may have been attached to the file before it was deleted. As a result, the data remains behind for discovery through the use of data recovery and/or computer forensics software utilities.

Unallocated file space and file slack are both important sources of leads for the computer forensics investigator. The data storage area in a factory fresh hard disk drive typically contains patterns of sectors which are filled with patterns of format characters. In DOS and Windows-based computer systems, the format pattern for a floppy diskette usually consists of binary data in the form of hex F6s. The same format pattern is sometimes used in the format of hard disk drives but the format patterns can consist of essentially any repeat character as determined by the factory test machine that made the last writes to the hard disk drive. The format pattern is overwritten as files and subdirectories are written in the data area.

Until the first file is written to the data storage area of a computer storage device, the clusters are unallocated by the operating system in the File Allocation Table (FAT). These unallocated clusters are padded with format pattern characters and the unallocated clusters are not of interest to the computer forensics specialist until data is written to the clusters. As files are created by the computer user, clusters are allocated in the File Allocation Table (FAT) to store the data. When the file is 'deleted' by the computer user, the clusters allocated to the file are released by the operating system so new files and data can be stored in the clusters when needed. However, the data associated with the 'deleted' file remains behind. This data storage area is referred to as unallocated storage space and it is fragile from an evidence preservation standpoint. However, until the unallocated storage space is reassigned by the operating system, the data remains behind for easy discovery and extraction by the computer forensics specialist.

http://www.forensics-intl.com/def8.html


Chilly this little bit of research I posted above took me hours , I wanted to be sure I had my facts straight and could back it up . I hope this clears the question up .

I think the key item to note here are the history.dat and index.dat file dates are onlt when they were created by other proccesses, they do not indicate that someone was in deed looking for ZFG on those dates, that information comes from the cookies themselves and thier creation dates. The History and Indez files are as a more equiped WS computer guru mentioned "containers" for the other files. Creation dates would correlate with the specific cookies stored on the initial search at that moment, from then on every other search goes in that same file or "container" So that in itself is not a clear indication of prior searches to the 7/16 search. Not that it is not possible there were searches earlier but those dates do not correlate to a specific search. If they had cookies from back then then they would have much more solid data.

If you do a search here you can probably find it by using the word container, like I said they had a better handle on this and probably explained it better than I just tried.

 

[Chilly Willy]

I think the key item to note here are the history.dat and index.dat file dates are onlt when they were created by other proccesses, they do not indicate that someone was in deed looking for ZFG on those dates, that information comes from the cookies themselves and thier creation dates. The History and Indez files are as a more equiped WS computer guru mentioned "containers" for the other files. Creation dates would correlate with the specific cookies stored on the initial search at that moment, from then on every other search goes in that same file or "container" So that in itself is not a clear indication of prior searches to the 7/16 search. Not that it is not possible there were searches earlier but those dates do not correlate to a specific search. If they had cookies from back then then they would have much more solid data.

If you do a search here you can probably find it by using the word container, like I said they had a better handle on this and probably explained it better than I just tried.

The correct information about the computer searches can be found in the Zani timeline thread, starting at about post 150. It is spelled out VERY CLEARLY in the forensic report on page 3, second paragraph, that the searches took place on 7/16.

 

[IrishSweetOne]

The correct information about the computer searches can be found in the Zani timeline thread, starting at about post 150. It is spelled out VERY CLEARLY in the forensic report on page 3, second paragraph, that the searches took place on 7/16.

Here it is
A keyword search for "Zenaida" revealed Web pages indicating that a user
searched the Internet for that name on July 16, 2008. Those entries were
bookmarked under the "Zenaida Fernandez Gonzalez" section of this report.

Where do you read NO OTHER SEARCHES WHERE DONE FOR ZG IN ANY FORM PRYOR TO JULY 16 ??????? All I see is the name was searched on July 16 , 2008

So Chilly are you saying that the information I obtained from the links I provided in my post above
University of Delaware Police
Computer Forensics Lab Resource Site
Resources for Computer Forensic Examiners .
Are incorrect ???

 

[LinasK]

So in theory the F is her married name and the G is her maiden name? Which would be the opposite of my sister who hyphenates R S-R. The S is her maiden name; the second R is her married name.

Do we know which is true? I'm asking because if divorced, she probably kept her name as it was?

Hispanics put their fathers surname first hyphenated by their mother's maiden names. At least that's how my best friend in college went by...

 

[Chilly Willy]

Here it is
A keyword search for "Zenaida" revealed Web pages indicating that a user
searched the Internet for that name on July 16, 2008. Those entries were
bookmarked under the "Zenaida Fernandez Gonzalez" section of this report.

Where do you read NO OTHER SEARCHES WHERE DONE FOR ZG IN ANY FORM PRYOR TO JULY 16 ??????? All I see is the name was searched on July 16 , 2008

So Chilly are you saying that the information I obtained from the links I provided in my post above
University of Delaware Police
Computer Forensics Lab Resource Site
Resources for Computer Forensic Examiners .
Are incorrect ???

I'm saying that you're misunderstanding the information you posted and that the dates that the "container" files were created have nothing to do with the date the search was performed.

If the professional computer forensic person found evidence of prior searches, why would she not put that information in her report?

 

[monoxide]

I wonder why she chose this particular name.........Cindy didn't like Hispanics. I wonder if that played a role in all this? Maybe Casey knew Cindy would fall for the idea if a Hispanic was the kidnapper. Just a thought

 

[IrishSweetOne]

I think the key item to note here are the history.dat and index.dat file dates are onlt when they were created by other proccesses, they do not indicate that someone was in deed looking for ZFG on those dates, that information comes from the cookies themselves and thier creation dates. The History and Indez files are as a more equiped WS computer guru mentioned "containers" for the other files. Creation dates would correlate with the specific cookies stored on the initial search at that moment, from then on every other search goes in that same file or "container" So that in itself is not a clear indication of prior searches to the 7/16 search. Not that it is not possible there were searches earlier but those dates do not correlate to a specific search. If they had cookies from back then then they would have much more solid data.

If you do a search here you can probably find it by using the word container, like I said they had a better handle on this and probably explained it better than I just tried.

I spent the better part of the day researching history.dat and index.dat , creation dates , last accessed dates etc. BEFORE I posted above ,your more then welcome to do the research your self .

This isn't the thread to debate computer forensics , I believe I saw a thread that would better suit that purpose .

 

[IrishSweetOne]

I'm saying that you're misunderstanding the information you posted and that the dates that the "container" files were created have nothing to do with the date the search was performed.

If the professional computer forensic person found evidence of prior searches, why would she not put that information in her report?

It's not a complete report

 

[Chilly Willy]

It's not a complete report

Perhaps it's not a complete report, but that doesn't mean we can just assume that there were earlier searches.

 

[IrishSweetOne]

I'm saying that you're misunderstanding the information you posted and that the dates that the "container" files were created have nothing to do with the date the search was performed.

If the professional computer forensic person found evidence of prior searches, why would she not put that information in her report?

In your own words Chilly explain what your refering to as "container" highlight it for me so there's no confusion

Name: index.dat
Description: File, Archive
File Created: 06/12/08 11:15:29PM
Last Accessed: 06/12/08 11:15:29PM
Last Written: 07/16/08 04:20:12PM
Full Path: 08-069208\S013J10X237614\D\Documents and Settings\casey\Local Settings\Temporary Internet
Files\Content.IE5\index.dat

 

[IrishSweetOne]

Perhaps it's not a complete report, but that doesn't mean we can just assume that there were earlier searches.

And we can't assume there were not

 

[Chilly Willy]

In your own words Chilly explain what your refering to as "container" highlight it for me so there's no confusion

Name: index.dat
Description: File, Archive
File Created: 06/12/08 11:15:29PM
Last Accessed: 06/12/08 11:15:29PM
Last Written: 07/16/08 04:20:12PM
Full Path: 08-069208\S013J10X237614\D\Documents and Settings\casey\Local Settings\Temporary Internet
Files\Content.IE5\index.dat

The index.dat file (red) was created on 6/12/08, it is the container. On 7/16 (blue) the search cookie was placed into that already existing container.

 

[LinasK]

I think the whole point that people such as myself think is the reason that this will fail is simply that she NEVER mentioned anything PUBLICLY she spoke with the police in PRIVATE. It was not until later that the police, after clearing this woman in fact, released this information to the press and the media went bonkers seaking to hunt out every ZFG till they found the one they thought fit the POI best and laid into her....

I think that's irrelevant. Casey still named ZF-G to police in either spoken or written statements which were a lie. She threw ZF-G under a bus to save her own hide, so then when they found ZF-G, she couldn't admit to lying, so she claimed it was another ZF-G, another lie. The media running with the story is journalistic irresponsibility, but that's a different problem. If Casey hadn't specifically named ZF-G so precisely that authorities could find her, ZF-G wouldn't have been framed. Thank goodness the police didn't first arrest ZF-G before checking out her story, but she still suffered needlessly. Casey still could have lied, but more generally, "A Hispanic/Puerto Rican nanny stole her". Something like that.

 

[princess]

Chilly this little bit of research I posted above took me hours , I wanted to be sure I had my facts straight and could back it up . I hope this clears the question up

:bowdown:

But the deabte will go on and on...ther_beatingA_Dead

 

[Chilly Willy]

And we can't assume there were not

I can, until I learn otherwise. I base my opinions on the facts that are presented and proven. Morgan can't go into court and say he assumes there were earlier searches, he'll have to provide proof.

 

[shannon718]

I can, until I learn otherwise. I base my opinions on the facts that are presented and proven. Morgan can't go into court and say he assumes there were earlier searches, he'll have to provide proof.

The fact that she searched the information AT ALL shows guilt and premeditation.

 

[Chilly Willy]

The fact that she searched the information AT ALL shows guilt and premeditation.

The search was done on Cindy's desktop computer, at the time that Casey was with LE - after Casey gave the name ZFG to the detectives.

 

[Tate]

The search was done on Cindy's desktop computer, at the time that Casey was with LE - after Casey gave the name ZFG to the detectives.

How do you know this?