4 hours ago
Today's evidence resumes after delay
The jury has been brought into the courtroom after a morning delay.
“We’ve been dealing with an issue this morning and that might occupy some more time this afternoon, but we’ll press on with the witness list,” Justice Christopher Beale told the jurors.
“Yesterday, you heard from police officer Tran, we’re going to interpose a different witness.”
Senior digital forensics officer Shamen Fox-Henry, from the Victoria Police cybercrime squad, has now entered the witness box.
The court heard he started working for Victoria Police in October 2020 and joined the cybercrime squad in July 2023.
4 hours ago
Highlight
'What is a computer?': Jury taken back to basics
The jury has been shown a slide show about digital forensics, prepared by Mr Fox-Henry.
“What is a computer?” the first slide reads.
“A computer is a device that takes a user input, processes/interprets it then returns a result.
“Central processing unit … is the brain and controller of the computer.”
Mr Fox-Henry is now explaining to the jury the world of digital forensics.
He told the court when extracting data from a computer, he would remove the internal storage of the computer, connect a Write Blocker to avoid damaging the data, create a “digital copy” of the data, process the “digital copy” to interpret the data and then export the interpreted data as a non-editable format.
2 hours ago
A lesson in computer terminology
Mr Fox-Henry has returned to the witness box after the lunch break.
After extracting data from a computer, he told the court he could use software to generate a report of “tagged items”, which includes information about that data for analysis.
He explained to the jury the term “artifacts” encompasses a file, a folder or an internet search.
But he told the court there were other types of artifacts, such as autofill artifacts (an autofill record, like a username or password), a favicon artifact (the icon associated with a website) and a cookie artifact.
“Cookies are small files of information that web servers generate to inform websites about the user to allow for personalisation of the users’ experience, typically used for ads,” the slide reads.
He also explained the terms created date/time, modified date/time and accessed date/ time.
Mr Fox-Henry also said thumbnails were “small images that represent larger images designed to speed up processing and allow for faster review of photos”.
2 hours ago
Highlight
'Death cap', 'poison': Keyword searches conducted on computer files
The court heard a number of “digital devices” were seized by investigators in this case.
In its opening address to the jury, the prosecution said search warrants were executed at the accused’s house in Leongatha on August 5 and November 2.
Mr Fox-Henry confirmed he examined some of these devices, while one of his colleagues examined several “portable handheld devices”.
Crown prosecutor Jane Warren is asking Mr Fox-Henry about a Cooler Master computer, which was seized on August 5 and examined by him on August 15.
He confirmed the examination involved “extraction processing”.
Mr Fox-Henry said “three storage devices” were found in the computer.
He said he created copies of them called “cases”, before running a keyword search.
The court heard the five keywords were: death cap, death cap mushroom, death cap mushrooms, mushrooms and poison.
2 hours ago
Highlight
Seized device used to look up iNaturalist website: Expert
The jury is now being shown the results of a forensic examination report relating to the three storage devices.
One page of the report shows four “search query” records relating to the search term “iNaturalist” on May 28, 2022, about 7.20pm.
The jury has previously heard iNaturalist is a citizen science website where members of the public post sightings of plants, animals and fungi, including death cap mushrooms.
When asked about the records, Mr Fox-Henry said they “confirmed a Bing search was done for iNaturalist”.
Ms Warren asked: “In simple terms, does this record indicate that the search engine Bing accessed that URL on the 28 May, 2022?”
Mr Fox-Henry replied: “Yes.”
The court heard there was another record relating to
inaturalist.org that same day at 7.21pm.
“That URL was visited by the Edge browser,” Mr Fox-Henry said.
The report, which is being shown to the jury on a screen, also shows another search-term record for “Korumburra middle pub”at 7.23pm, two minutes later.
1 hours ago
Web searches under the microscope
Ms Warren is asking Mr Fox-Henry about the results of the report relating to the Google Chrome web history.
The court heard one URL was visited by the browser on May 28, 2022, at 7.23pm.
Ms Warren told the court the title of the page associated with the URL was “deathcap from Melbourne, VIC, Australia on May 18, 2022, at 2.36pm by Ivan Margitta. Bricker Reserve Moorabbin – iNaturalist”.
Ms Warren asked: “Is that the title of the page visited by this browser at this date and time?”
Mr Fox-Henry agreed, before adding that the URL had been visited twice by the browser, considering it had a “visit count” of two.
Further pages of the report have been shown to the jury, referencing records of Google Chrome cookies, favicons and shortcuts.
Mr Fox-Henry agreed with Ms Warren that these records were “supporting information” for a visit to the iNaturalist website.
Mr Fox-Henry confirmed the cybercrime team also analysed a Samsung phone belonging to Gail before court was adjourned for the day.
He will continue his evidence on Thursday.
