wenwe4
Well-Known Member
- Joined
- Oct 6, 2008
- Messages
- 9,500
- Reaction score
- 7,367
Sandra Osborne-OCSO 21 years this year - computer
patrol, crime scene, sex crimes, child abuse, homicide and now computer crimes
college business degree - 700 hours training and 2 certifications for forensic computer examiner ...IASIS certification process ....2 week classroom...peer review phase.....practical exam problems....100 question practical knowledge exam successful completed.....classroom instruction and proficiency tests.....computer forensic exam...basic computers...where to locate on computer ..document those finding accurately
practical experience - several hundred exams..computers/cell phone/pda - anything with a digital file....expert witnesss in OC in FL - explained issues re: computer forensics.....no object - expert witness in area of forensic computer anaylsis
title? Detective Osborne.....received several items in disappearance of Caylee...first item cell phone belong to kc, envelope - label, reseal package, date and initials confirmed....item inside Nokia cell phone (is this the missing Nokia cell?)....received into evidence....forensic applications to utilize to retrieve data from cell ...process available ...cellbrite - tool ...able to give reliable data premier in field...contact list, text, incoming outgoing, voice message, audio and pic files, anything phone does......service provider can extract data can be hampered.....manufacturer of phone doesn't allow 3rd party tool....plug in port could be disabled from software....some data not available on that particular phone.....cellbrite updates software periodically...receive phone look for ZFG locate? initial data extrated contact list and music files...limits of cellbrite was not capable of fully extracting data on the phone....sim card little card chip allows phone to connect to network....sim cards interchangable in different phones attempt to contact ....don't recall if sim card was in kc's phone - look @ report to refresh recollect for sim card....it did have a sim card...use different forensic applications other cellbrite to retrieve data from sim card? put sim card into cellbrite device.....sim card have any more info than the cellbrite extractions from the cell? simcard was same info as device.....locate any info about ZFG? didn't notice any.....not her function ....didn't see any but she handed data extracted to detectives in the case....cellbrite does nice job in reporting data that is easy to read...eventually received other evidence items to initially locate ZFG....computer, laptop computer....from Det. Beasely brought in laptop serial #, desktop computer serial number# HP home computer....received this computer from Awilda McBride from missing persons unit - on 7/17/08 1:30 pm....laptop received on 7/16/08 8:00 pm ....cameras? yes....polaroid T730 digital camera 7/17/08 and Nikon coolpix on 7/21/08.....forensic tool to examine camera - endcase by guidance software - digital camera...didn't plug Nikon camera but pulled the SD card into the adapter and used endcase to view contents of the card.....locate any video files of Caylee? yes....using that tool able to determine date of video files generated....dates on the files from Nikon coolpix 6/15/08 - reviewed the video....video from nursing facility....appeared to be yes....date and time accurate when actual image was captured....most cameras or videocameras will imbed information date and time of pic taken. gps coordinates if it is a newer device ....shutter speed, etc.....Nikon coolpix ....date and time setting the camera set to @ the time video was taken....when she received it compared date and time setting w/current date and time 7/21/08 10:54 am, and setting on camera 7/21/08 10:56 am - 2 min difference....
laptop received from Det. Beasley....what condition was it when provided? on/off?
laptop was? doesn't recall if powered on or off @ time received it....make a difference for retrieving data? document condition @ the time....word doc open, on the internet...power it down and remove the battery.....methodology to make sure it is off before any attempt to retrieve data? Yes in lab setting power it off and remove hard drive from the machine...
Desktop floor model - HP 520 N...hard drive 160 gigbytes ....item powerd down not on @ time of receipt...different tools evaluate contents of computer vs....used the endcase software....standard tool in industry....don't know when endcase started ....she's been using since 2006..a dacade or more....industry standard reliable software tool...
endcase tool can examine every bit every zero and every one on the harddrive....whether user can see that info or not.....what did with HP to ensure data as it existed was not changed/altered standard practice to maintain evidence as received....harddrive ...condition of computer removed....rightblocker....prevents forensic machine from taking ahold of it....don't want that to happen....windows wants to reach out and touch others....right blocker holds that original harddrive....put the orig. back into evidence and work on the copy that right blocker made.....returned hard drive .....she stored data on another hard drive and brought with today
with a cellphone ....
15 min recess
