Anthony's Computer Forensics

[benjaminfpierce]

I'm confused why anyone would think the julian date would have anything to do with this. Bradley did not say the chloroform site was searched 84 times in one day. Bradley was testifying about the deleted dates on the owner account using Firefox which is why cash backe was needed to recover the data. CA probably doesn't know how to delete history. Bradley said "how to make chloroform" was searched, bookmarked then visited 84 times over several days not one date. Then those specific dates were deleted.

I agree, also Bradley said that the sci-spot page was accessed without a REFERER.

But my issue is that the other report showed Myspace being hit ±80 times. So maybe he wrote his Mork parser incorrectly? Maybe his index was off by 1? Maybe his loop was zero based and he used an index off by 1?

His report could be wrong about it being Sci-Spot or Myspace if they were right next to each other sequentially.

 

[GeekyGirl]

Hi geekygirl was the trunk not tested for chloroform before the computer searches were found im gonna have to go look this up now x a

also wasnt the chloroform searches deleted on the morning of the 16th july 2008, Id have to ask WHY?

I seem to recall one of the experts testifying that they were specifically instructed to look for chloroform, which would suggest that the search info came first. I could be wrong though... So much testimony, it's turning my brain to mush.

 

[mydailyopinions]

I may not understand all this technical stuff with the files, but I did hear the testimony today and IMHO something is not right with the number 84.

No matter how many searches was done, I do think that placing Cindy at work during these times will still do Casey in, however must admit that If I were on the jury I would like to have this 84 number more thoroughly explained. I also agree that if this number has something to do with the file, or the date, it should not be expressed to the jury as it has.

At this point, I am waiting on solid proof that the site was looked at 84 times and I don't think I'll see it anytime soon. I believe it was an honest mistake on the part of the state, and heck yeah, they ran with it, just like the defense did with the Thompson guy.

 

[benjaminfpierce]

No, I am not assuming that. The forensic guy said he was able to recover everything that had been deleted.

He said that the history.dat file covered from January 1, 2, 3, 4? I don't recall the date range he said but I don't think it covered that much time. I could be wrong!

 

[hpvdr]

One juror is an IT person.......he's gonna be able to explain even the most obvious things like if house hold weapons and chloroform were searched simultaneously, regardless of how many times, they were searched by the same user. Cindy said she did NOT search house hold weapons.

He will show them how google works and that computers do not just search things by them self as Cindy wanted us to believe today.

 

[angeldust]

And what a coinky dink that these searches were done around the time that Ricardo had "Win her over with Choloform" on his computer while KC was dating him. Password on the A's computer during this time is Rico234(?) which stood for Ricardo and his apartment number, another coinky dink. It surely wasn't CA's because she did not know Ricardo existed. jmo

and they had to ask kc for the password for the computer that she claimed today didnt have A password remember the rico 234 then it turned out to be rico 23 oops another slip of the memory x a

 

[GeekyGirl]

I'm having an issue if John Bradley wrote his own parse and had an error with it. Much of his data could be wrong if he did this.

The original unallocated file should be parsed with Dork.exe and checked against Cacheback.

Can anyone pass this information along to Ashton or Yuri? Anyone else on the board from the prosecution? I'm not often on this board. If I don't respond, you can reach me on Facebook: http://on.fb.me/k25gNy

You might find http://www.jonesdykstra.com/blog/201-caseyanthony-part2 interesting...

 

[Chilly Willy]

He said that the history.dat file covered from January 1, 2, 3, 4? I don't recall the date range he said but I don't think it covered that much time. I could be wrong!

No, he said that everything that had been deleted was recovered. I'm assuming that what wasn't deleted was still available. If there were 84 searches for chloroform since the beginning of the year, why are we only focused on those 2 particular days? The DA has not mentioned any other days that searches containing the word chloroform were done or that the how to make chloroform site was visited.

 

[Tuffy]

I'm having an issue if John Bradley wrote his own parse and had an error with it. Much of his data could be wrong if he did this.

The original unallocated file should be parsed with Dork.exe and checked against Cacheback.

Can anyone pass this information along to Ashton or Yuri? Anyone else on the board from the prosecution? I'm not often on this board. If I don't respond, you can reach me on Facebook: http://on.fb.me/k25gNy

Since you're a programmer, could you answer the date format question? It wouldn't be stored in Julian calendar form, so would it be in Unix time? I'm not sure if that is just OS related or in most files?

 

[angeldust]

I seem to recall one of the experts testifying that they were specifically instructed to look for chloroform, which would suggest that the search info came first. I could be wrong though... So much testimony, it's turning my brain to mush.

lol my brain is mush too but I was thinking what prompted them, the police, to ask about those searches I thought it was because of the levels of chloroform that were found. eek see what i mean overload of information and it will probably take me a week now to find out just how confused I am lol then back to square one x a

 

[Chilly Willy]

I'm confused why anyone would think the julian date would have anything to do with this. Bradley did not say the chloroform site was searched 84 times in one day. Bradley was testifying about the deleted dates on the owner account using Firefox which is why cash backe was needed to recover the data. CA probably doesn't know how to delete history. Bradley said "how to make chloroform" was searched, bookmarked then visited 84 times over several days not one date. Then those specific dates were deleted.

I believe he said that he could not tell whether it had been bookmarked and he only told us of 2 dates that the chloroform searches were performed, the 17th and the 21st, which is why the state is trying to show who was on the computer on those two days.

I don't know what the 84 (83, 82, 81...) numbers mean, but I'm positive they are NOT the number of hits on the 'how to make chloroform' website. The jury has been fed some garbage information.

 

[Fluffy Puppy]

Right now I've got the net analysis program running on my computer and I'm looking thru one of my history files.

This shows hits. It's got a column named hits. It's a very thorough program.
Shows all kinds of stuff.

This is one line from the file I'm looking at. Remember: it's the Net Analysis Program.

Look at the hits line. 333 hits. Now. In web terms, when you hit a web page- everything on that page counts as one hit.

So if you hit a page, say it's got 10 images, the html file itself, and a video, this will count as 12 hits. 10 for the images, 1 for the html file and one for the video.

The record below is for my google adsense account. This was at a time when I was literally sitting on it - kept it open and refreshed the page obsessively. This program is picking up everytime I refreshed the page over a period of time, which looks like the Last Visited [UTC]: Last Visited [Local]:



This is where I believe the 84 number is coming from. She didn't visit it 84 times, but the program is picking up the hits on the page - she could have been sitting there and refreshed it several times.

Am I making sense?

The hits column is somewhat deceiving. Counters on a web page are deceiving because of this. A computer person - who may be excellent at their job, may not have a clear understanding of how hits on a page works.
I've worked in web hosting for years and this is one of the first things we were taught.

Gonna see if I can check out the cacheback program.

Could this also come from link prefetching?

 

[GeekyGirl]

lol my brain is mush too but I was thinking what prompted them, the police, to ask about those searches I thought it was because of the levels of chloroform that were found. eek see what i mean overload of information and it will probably take me a week now to find out just how confused I am lol then back to square one x a

Again, I could be totally wrong, but I think the search info came before the air space testing of the trunk. Didn't the FBI expert testify that they didn't find unusual level of chloroform in the trunk liner? So they contacted Dr. (he is so a chemist) Vass at the Body Farm for the specialized testing when they were looking for evidence of chloroform? Please correct me if I'm wrong... As I said, brain is mush.

 

[3doglady]

I believe he said that he could not tell whether it had been bookmarked and he only told us of 2 dates that the chloroform searches were performed, the 17th and the 21st, which is why the state is trying to show who was on the computer on those two days.

I don't know what the 84 (83, 82, 81...) numbers mean, but I'm positive they are NOT the number of hits on the 'how to make chloroform' website. The jury has been fed some garbage information.

Yes the searches were done on those dates, but he also said the chloroform site was bookmarked. He did not say the 84 visits took place on those 2 dates. The chloroform site owner posted more info on www.thehinkymeter.com

 

[benjaminfpierce]

IIRC wasn't he contacted by LE because there was a bug in his program that affected the parsing?

Cacheback was not originally written to parse Firefox 2.0. He added it as a feature after figuring out the Mork format, according to his testimony.

But apparently he stayed up to 3a doing this when he could have done it in under 10m doing what I just did. The utility is available from modzilla.

You do not need Cacheback. The computer expert at OSCO was dependent on. He looked at the file and it looked unreadable to him so he used his programs but since Firefox was mork, they had issues.

 

[benjaminfpierce]

Yes the searches were done on those dates, but he also said the chloroform site was bookmarked. He did not say the 84 visits took place on those 2 dates. The chloroform site owner posted more info on www.thehinkymeter.com

You can also access the original sci-spot.com page using the way back machine.

See:
http://www.facebook.com/media/set/?set=oa.154266401309724

http://web.archive.org/web/20080406025700/http://www.sci-spot.com/Chemistry/chloroform.htm

http://web.archive.org/web/20080404013840/http://www.sci-spot.com/Chemistry/chloro2.htm

These are the pages as they were on the dates Casey would have looked at them. Sci-spot removed them because of the bandwidth.

 

[1tasha]

I'm surprised this isn't eclipsing the Cindy testimony because this, I thought, was a pretty big deal. You can rightly say that even 2 or 3 hits for chloroform when combined with other evidence is very strange. But when you go from 84 hits to 2 or 3 hits to me it negates almost all of the impact. And I'm saying this as a person still completely confused about the findings from both sides. I really hope this can be cleared up.

 

[GeekyGirl]

Cacheback was not originally written to parse Firefox 2.0. He added it as a feature after figuring out the Mork format, according to his testimony.

But apparently he stayed up to 3a doing this when he could have done it in under 10m doing what I just did. The utility is available from modzilla.

You do not need Cacheback. The computer expert at OSCO was dependent on. He looked at the file and it looked unreadable to him so he used his programs but since Firefox was mork, they had issues.

So I guess my question is, the file you posted earlier referenced a field for visit count, but didn't actually give you the visit count, correct? Is that information contained in another part of the file? I'm just having trouble wrapping my mind around this. TIA

 

[benjaminfpierce]

Since you're a programmer, could you answer the date format question? It wouldn't be stored in Julian calendar form, so would it be in Unix time? I'm not sure if that is just OS related or in most files?

I'm currently trying to determine the exact field and format of the dates in the original Mork file. I think they're in julian seconds not since the beginning of the year but from the standard julian start datetime the operating system uses. I'll let you know.

 

[benjaminfpierce]

So I guess my question is, the file you posted earlier referenced a field for visit count, but didn't actually give you the visit count, correct? Is that information contained in another part of the file? I'm just having trouble wrapping my mind around this. TIA

It did give me the VisitCount properly. I had not visited any pages except the default pages which contained additional images, etc. that were loaded.

ID VisitCount FirstVisitDate LastVisitDate URL
2 1 2011-06-24 00:25:33 2011-06-24 00:25:33 http://en-us.start.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:en-US:official
3 1 2011-06-24 00:25:33 2011-06-24 00:25:33 http://en-us.www.mozilla.com/en-US/firefox/2.0/firstrun/
4 1 2011-06-24 00:25:33 2011-06-24 00:25:33 http://www.google.com/firefox?client=firefox-a&rls=org.mozilla:en-US:official
5 1 2011-06-24 00:25:33 2011-06-24 00:25:33 http://www.google.ca/firefox?client=firefox-a&rls=org.mozilla:en-US:official