Australia - 3 dead after eating wild mushrooms, Leongatha, Victoria, Aug 2023 #10 *Arrest*

[Detechtive]

oooh exciting!

 

[MsMarple]

Erin Patterson's alleged internet history shown to jury — as it happened

The Leongatha mother is charged with murdering three relatives by serving them a beef Wellington meal that contained poisonous death cap mushrooms.

www.abc.net.au

Witness shows PowerPoint presentation to court​

By Kristian Silva​

To get through the basics of digital forensics, Mr Fox-Henry has prepared his own slideshow for the court.

Mr Fox-Henry’s powerpoint presentation is flashed up on the screen, titled “Digital Forensics”.

The title of the first slide is "What is a computer?".

The prosecution asks Mr Fox-Henry what a computer is, and he begins explaining the intricacies of how data is processed and interpreted by computers.

 

[katydid23]

Yes, i agree @katydid23 . Perhaps that is the main reason the prosecution were showing it - to show the stark differences.

Could Erin being seen to act quite normal and calm, as you say, play into the defence's hand? We'll never know.

JMO

I don't see how it helps the defense that she was normal and calm because it tends to show that she was not 'unwell', like they are trying to show. She told people she was unwell at that time but it doesn't really look like it here, nor did she seem unwell when the ambulance transferred her to the other hospital. Nor while she was in the hospital.

The 4 other victims were sliding into comas and she was perfectly fine.

So I am not sure this clip helps the defense too much. Buying sandwiches at a gas station is not indicative of someone who fears they have food poisoning already, imo.

 

[MsMarple]

Court hears how digital forensics works​

By Judd Boaz​

Mr Fox-Henry details how data recovery works off a seized computer.

Authorities will take a hard drive, create a digital copy of the contents and then run the copy through analysis and recovery software.

This software is built to extract data, media and files and put it into a format readable by humans.

Once the data is in a readable form, it is exported to another external hard drive and given to investigators.

 

[Detechtive]

The title of the first slide is "What is a computer?".

Just quietly, I think we are in for another long day.

 

[BreakingNews]

This pause without the jury is great. The jury will currently be in the jury room with nothing to do but to debate points to date. Most days, they only have short recesses to do this, as they are let out for lunch to do what they want.
Already, there will be some "friendships" or natural alignment between some people, yet usually only with those seated close to you - or, if someone is presenting information and debate in a way that resonates with some other jurors. In the jury room, you sit in the same seat as your first day, around a boardroom type table, every day. The only one that is moved on day one is the elected jury chair.
This extended break and lock-in will naturally bring about greater conversation than they have had the opportunity to do thus far.

I respectfully disagree. When I was on a murder jury, very little discussion took place until after both sides summed up and the judge gives you his/her lengthy instructions. Believe me, once in the jury room, I believe they would be talking about anything other than mushroom varieties and phone pings.

 

[iamshadow21]

Just quietly, I think we are in for another long day.

When you don't know your audience's baseline knowledge, you start at the beginning, I guess?

 

[Detechtive]

When you don't know your audience's baseline knowledge, you start at the beginning, I guess?

Yes, I just assumed that most people over the age of 3 in Australia know what a computer is

 

[MsMarple]

Programs used to recover data outlined​

By Kristian Silva​

Mr Fox-Henry takes the jury through some more of the basics of digital forensic work.

The data is then provided in a non-editable form to police investigators, he says.

We move onto digital forensics for phones. He says a similar process is followed to extract data.

Two software programs are used to recover data: Cellebrite from phones and Magnet Axiom for computers.

"What is software?" Justice Beale asks.

"It is an application or program we use to examine or interpret the data," Mr Fox Henry replies.

 

[katydid23]

She knew she foraged for mushrooms. Even if we say she only accidentally picked Death Cap mushrooms, and she felt even the tiniest real bit sick, with her knowledge of mushrooms, good think she'd tear away to an ER in case she accidentally poisoned herself -- and while tearing away to an ER using BOTH of her cell phones to warn her guests.

Instead she was buying a sammich at the 5 star gastaurant. In her cream pants.

How could she be so sure her liver wasn't shutting down?

JMO

Exactly, good question.

If she was told at the hospital that her lunch guests were seriously ill, I'd think she'd be worried about herself and her kids, even if this was accidental. She'd have to worry at that point, about the mushrooms she picked, and if she is going to get sick now because she ate the same thing as her guests, RIGHT? I mean, why wouldn't she eat the same food ?

 

[Detechtive]

Programs used to recover data outlined​

By Kristian Silva​

Mr Fox-Henry takes the jury through some more of the basics of digital forensic work.

The data is then provided in a non-editable form to police investigators, he says.

We move onto digital forensics for phones. He says a similar process is followed to extract data.

Two software programs are used to recover data: Cellebrite from phones and Magnet Axiom for computers.

Cellebrite: Mobile Device Data Recovery​

Cellebrite's Universal Forensic Extraction Device (UFED) suite, including the Physical Analyzer, offers multiple extraction methods:

Logical Extraction: Retrieves active data such as contacts, messages, and call logs.

File System Extraction: Accesses the device's file system to recover hidden or system files.

Physical Extraction: Captures a bit-by-bit image of the device's storage, enabling deep-level access to deleted data.

Deleted data recovery is influenced by factors like encryption type (e.g., Full Disk Encryption, File-Based Encryption) and whether the data has been overwritten. Data marked for deletion may still reside in unallocated space or database journals, making recovery possible if the data hasn't been overwritten.

Cellebrite's Physical Analyzer includes features like deep carving of SQLite databases, allowing investigators to recover deleted records from apps that use such databases.

Magnet AXIOM: Computer and Cloud Data Recovery​

Magnet AXIOM is designed to recover and analyze data from computers, cloud services, and mobile devices. Its capabilities include:

Artifact Recovery: Extracts data artifacts from various sources, including deleted files, browser history, and system logs.

Deleted Data Analysis: Recovers deleted files and metadata, even if partially overwritten, by analysing file system artifacts and unallocated space.

Cloud Data Acquisition: Retrieves data from cloud services, providing a comprehensive view of user activity.

AXIOM's artifact-first approach enables investigators to quickly identify and analyze relevant data, streamlining the investigative process.

Summary​

Both Cellebrite and Magnet AXIOM offer robust solutions for recovering deleted data:

Cellebrite: Excels in mobile device data extraction, including deep-level recovery of deleted data through physical extraction and database analysis.

Magnet AXIOM: Provides comprehensive recovery and analysis of deleted data across computers, cloud services, and mobile devices, with a focus on artifact correlation.

The effectiveness of data recovery depends on factors such as the type of deletion, device encryption, and whether the data has been overwritten.

Cellebrite Sources:

Deleted Data - Mobile Device Forensics Archives - Cellebrite

Different Ways to Interact with a Database within Cellebrite Physical Analyzer

Recovering Deleted Messages to Help Uncover the Criminal Mindset

Digital forensics: Cellebrite software - what can it do?

Magnet AXIOM Sources:

Tips & Tricks // Recovering and Analyzing Deleted Data in AXIOM

Magnet Axiom | Digital Forensic Software | Magnet Forensics

Magnet Axiom - CDFS - Digital Forensic Products, Training & Services

Magnet AXIOM - esecurityinstitute.com

 

[ch_13]

I respectfully disagree. When I was on a murder jury, very little discussion took place until after both sides summed up and the judge gives you his/her lengthy instructions. Believe me, once in the jury room, I believe they would be talking about anything other than mushroom varieties and phone pings.

I agree. Juries are told that they are not to discuss the case with anyone, even their fellow jurors, until the judge has given instructions and deliberations begin. They shouldn't even be forming an opinion until all the evidence has been presented.

Jurors prematurely discussing about the case amongst themselves would likely be grounds for a mistrial.

At least that was my experience on a New York jury. I'm sure it's the same in Victoria.

 

[Bats]

I don't see how it helps the defense that she was normal and calm because it tends to show that she was not 'unwell', like they are trying to show. She told people she was unwell at that time but it doesn't really look like it here, nor did she seem unwell when the ambulance transferred her to the other hospital. Nor while she was in the hospital.

The 4 other victims were sliding into comas and she was perfectly fine.

So I am not sure this clip helps the defense too much. Buying sandwiches at a gas station are not indicative of someone who fears they have food poisoning already, imo.

It depends on how the 2 sides use the evidence to fit the narrative doesn't it?
How are you expecting the defence would summarize that evidence?

 

[katydid23]

Did she buy anything? I can’t recall. Might have been perusing to appear to enter the service station to purchase rather than just use the bathroom. Generally sign posted for ‘customers only’.

I do know that salty biscuits or chips work well if your desperate to settle your stomach outside the house (yes, gas station food) but leaving the house for a long journey plus wearing white pants does seem odd. It was 24+ hrs after lunch, her symptoms might have settled whereas her guests were deteriorating. I realise that these points all suggest she was perfectly fine and free of toxins but I don’t think every action screams guilt either.

She bought two sandwiches and some sour candy, I believe. A tomato and cheese sandwich but I don't remember the other kind.

ETA--Chicken and Chilli wrap----not something I'd buy if my stomach was queasy

 

[MsMarple]

Digital forensic 'artefacts' explained​

By Judd Boaz​

Mr Fox-Henry says police can search for files of interest by looking for keywords, or narrowing down activity over a period of time.

He says the individual segments of data are known in the digital forensic's space as "artefacts".

The court hears that files, folders and data such as internet searches are considered artefacts, and can be copied and analysed by recovery software.

The software will generate information about artefacts, such as when it was created or last accessed.

“Is that a convenient time?” Justice Beale interjects, calling the lunch break.

Proceedings will continue at 2.15pm.

 

[BreakingNews]

I don't see how it helps the defense that she was normal and calm because it tends to show that she was not 'unwell', like they are trying to show. She told people she was unwell at that time but it doesn't really look like it here, nor did she seem unwell when the ambulance transferred her to the other hospital. Nor while she was in the hospital.

The 4 other victims were sliding into comas and she was perfectly fine.

So I am not sure this clip helps the defense too much. Buying sandwiches at a gas station are not indicative of someone who fears they have food poisoning already, imo.

We don't know that the food was for her.

 

[Deleted member 363451]

It sounds like on the way they bought:

On the journey, she stopped at a BP service station in Caldermeade, where Ms Patterson purchased sour confectionery, a ham, cheese and tomato sandwich and a sweet chilli chicken wrap, after stepping into the bathroom for 9 seconds.

On the way back they got the dimsims, coffee, etc.

A lot of food for a sick person.

Yes, it is...

 

[Doesitmakesense]

Digital forensic 'artefacts' explained​

By Judd Boaz​

Mr Fox-Henry says police can search for files of interest by looking for keywords, or narrowing down activity over a period of time.

He says the individual segments of data are known in the digital forensic's space as "artefacts".

The court hears that files, folders and data such as internet searches are considered artefacts, and can be copied and analysed by recovery software.

The software will generate information about artefacts, such as when it was created or last accessed.

“Is that a convenient time?” Justice Beale interjects, calling the lunch break.

Proceedings will continue at 2.15pm.

I just want to know what data they found

 

[Detechtive]

Yes, it is...

I also recall mention of a "donut van" stop?

 

[Deleted member 363451]

I also recall mention of a "donut van" stop?

To the wayside 'doughnut stop' at Koo Wee Rup where Erin Patterson and her children stopped for dim sims, a hot dog and coffee on a trip to the Tyabb airport the day after the fateful lunch…