Australia - 3 dead after eating wild mushrooms, Leongatha, Victoria, Aug 2023 #10 *Arrest*

[drsleuth]

Jury enters court​

The jury has entered the court after a lengthy delay on Wednesday morning.

Digital forensics expert takes the stand​

The jury has heard Fox-Henry has worked for Vic Police, helping to recover files, since 2020.

He joined the Cyber Crime Squad in July 2023.

Since joining Vic Police, Fox-Henry estimates he has worked on “hundreds” of cases and examined more than 1000 devices.

How does digital forensics work?​

The court has been shown powerpoint notes on how digital forensics are carried out on computers and phones.

The notes are as follows:

Digital forensics - computers

• Take details -> remove internal storage -> connected to computer via a Write Blocker -> image -> process image, export portable case -> then return to investigator.
• Write Blocker - stops any data being changed on the device
• Image - a digital copy (file) of the hard drive
• Processing the image refers to importing the image and software interpreting the data
• Portable case - is the interpreted data in a non-editable form for the investigators

Digital forensics - phones

• Take details -> extract digital data via an extraction tool -> process data -> export portable case -> return to investigator
• Extractions of mobile phones require specialised extractions generating a digital copy
• Processing the data refers to importing digital copy and software interpreting the data
• Portable case - in the interpreted data in non-editable form for the investigators

Fox-Henry has told the court that files are examined via keyword searches or by narrowing down activity over a timeframe of interest.

He said data in digital forensics is referred to as “artefacts”, which can include files, folders, and internet searches.

Fox-Henry said specific forensic software programs can then be used to generate information about artefacts, such as when they were created or last accessed.

Magnet Axiom and Cellebrite are the software programs used within his department to analyse computers and phones, respectively, Fox-Henry said.

Different types of artefacts​

The prosecution have asked Fox-Henry to explain different types of data commonly found on computers.

Fox-Henry earlier told the court that pieces of data, in digital forensics, are called “artefacts”.

Here are the descriptions of artefacts that can be contained on computers as shown on a powerpoint presentation presented in court:

Files and Folders

• A file is the common storage unit in a computer. Programs and data are “written” into a files and “read” from a files.
• An example - word document - contains data that a user types that can be opened and read by the user later with an applications that supports it
• A folder holds one or more files and a folder can be empty until it is filled.

The court heard files and folders have information about when they were created, modified, or accessed.

Thumbnails

• Smaller images that represent larger images designed to speed up processing and allow for faster review of photos and media.

EML (X) file artefacts

• Email files. Generally comprised of three parts - header, message body, and attachment.

History artefacts

• Records of the local user visiting a site/file path/website

Autofill artefact

• Is a record of the autofill values that browsers save for different types of text fields across different webpages. The main value is the saved autofill value for specific fields. This value can track when it was created and when it was last used in a field.

Favicon artefacts

• This artefact contains the favicons that browser displays in the title/address bar. A favicon is the icon associated with a website displayed

Google searches artefacts

• Is an artefact that contains the URL that is associated with the Google search engine

Parsed search queries

• Is an artefact that contains the URL that is associated with search engines, except Google

Cookie artefacts

• Cookies are small files of information that web servers generate, to inform websites about the user, to allow for personalisation of the users’ experience, typically for ads.

Keyword search terms

• Are keywords that were searched for on the system

Edge/Internet Explorer 10-11 content

• Is an artefact that contains the content that Edge/Internet Explorer 10-11 caches, this can include webpages, pictures and other resources

The court heard caches are storage areas for data that allow for easier retrieval when that data is re-accessed.

IE InPrivate Recovery URLs

• Is an URL that is recovered from somewhere on the device
• These URLs can be located anywhere on a user’s system
• For example:

-From an old DB that has been deleted by software

-Can also be recovered or extracted from PDFs of manuals of software

Windows Timeline Activity

• Contains information about application usage
• Can hold information such as start and end times, duration, and the number of seconds that device was engaged within the application
• Example:

-How long the Word application was open and in focus

-Or when a browser (Edge) was opened and when it was closed

Searches on Patterson’s laptop shown to the court​

Fox-Henry has told the court there are two types of storage devices in a computer - a Solid State Drive (SSD) and Hard Disk Drive (HDD).

He said SSDs function on electricity, while HHDs operate using spinning disks.

Fox-Henry said he was given three storage devices to analyse in relation to Patterson’s case: a 120GB Samsung Vivobook SSD, a 250GB Hitachi hard drive, and a 120GB silicon powered SSD.

Fox-Henry told the court he searched for artefacts using the keywords “death caps,” “mushrooms” and “poisons”.

The court was then shown a report compiled of artefacts found on Patterson’s computer.

The report indicated software identified several records of Bing searches that linked to citizen science website iNaturalist on the evening of 28 May, 2022.

Those records were stored on the Samsung SSD.

According to the report, the term “inaturalist” was entered into Bing at 7:20pm.

At 7:21pm, the iNaturalist website was then visited.

The court was then shown four records of website activity on iNaturalist between 7:22pm and 7:23pm that same night.

They included visits to three URLs on the iNaturalist website. Two of those URLs were titled “observations iNaturalists” and were each visited once.

The third URL visited was titled “Deathcap from Melbourne VIC Australia on May 18, 2022 at 2:36pm by Ivan Margita Bricker Reserve Moorabbin”.

The last URL was visited twice.

The records show, moments later, a Google Chrome search was then made for the term “Korumburra middle pub”.

Jury told not to look up the search URLs​

Justice Christopher Beale has warned the jury not to seek out the URLs identified in the search records.

Patterson’s personal autofill information used on laptop moments after searches​

The court has been shown records that indicate Patterson’s personal information was logged into her laptop moments after visits were made to iNaturalist.

The two records indicate that Chrome autofill entered Patterson’s saved mobile number and her name into a website or websites at 7:24pm and 7:25pm, respectively, on 28 May 2022.

Fox-Henry said there was not enough information in the record to ascertain which websites were accessed during those instances.

Further data records support iNaturalist visits​

The court has been shown other artefacts that support the notion that visits were made to iNaturalist on Patterson’s computer on the evening of 28 May, 2022.

The artefacts include data records from Chrome Cookies, Chrome Favicons, Chrome Shortcuts, Edge Internet Explorer, and Windows Timeline Activity, which all link to iNaturalist during the same timeframe.

Digital forensics experts extracted messages between Patterson and mother-in-law Gail​

The court has heard a Cellebrite extraction was performed on Gail Patterson’s phone on 20 November 2023.

Several messages between Patterson and Gail will be shown to the jury at a later date.

Court wraps up for the day​

Court has finished for the day.

Follow along tomorrow for more updates.

Searches on Patterson’s laptop shown to the court

Erin Patterson is accused of killing three people with poisonous death cap mushrooms.

7news.com.au

 

[drsleuth]

Maybe to affirm texts sent to and received from Erin's factory-reset phone?

"The prosecution makes mention of messages sent and received by Gail Patterson's phone."
(from @MsMarple's link just above)

Yep IMO

Digital forensics experts extracted messages between Patterson and mother-in-law Gail​

The court has heard a Cellebrite extraction was performed on Gail Patterson’s phone on 20 November 2023.

Several messages between Patterson and Gail will be shown to the jury at a later date.

Searches on Patterson’s laptop shown to the court

Erin Patterson is accused of killing three people with poisonous death cap mushrooms.

7news.com.au

 

[BreakingNews]

Thanks for posting the updates. Appreciate it.

 

[drsleuth]

https://www.news.com.au/national/victoria/courts-law/erin-patterson-trial-jury-shown-2-minute-visit-to-bp-service-station-in-caldermeade/news-story/1e0f47969b1f65664d6a8ff4f5896f0c

Asked to explain what that meant, Mr Fox-Henry said: “The search term iNaturalist was conducted by Bing using the Edge browser.”

Another record captures a visit to the iNaturalist web page at 7.20.42pm through the Microsoft Edge browser.

Quizzed by Justice Christopher Beale about whether a visit count located in the record indicated this was the first visit to that specific URL, Mr Fox-Henry said “it should be”.

Mr Fox-Henry said another record captured a visit to a iNaturalist webpage at 7.23pm.

“Deathcap from Melbourne, Vic, Australia on May 18 2022 … Bricker Reserve, Moorabbin - iNaturalist,” the headline for the page captured reads, the jury was told.

 

[Ellery84]

Searches on Patterson’s laptop shown to the court​

Fox-Henry has told the court there are two types of storage devices in a computer - a Solid State Drive (SSD) and Hard Disk Drive (HDD).

He said SSDs function on electricity, while HHDs operate using spinning disks.

Fox-Henry said he was given three storage devices to analyse in relation to Patterson’s case: a 120GB Samsung Vivobook SSD, a 250GB Hitachi hard drive, and a 120GB silicon powered SSD.

Fox-Henry told the court he searched for artefacts using the keywords “death caps,” “mushrooms” and “poisons”.

The court was then shown a report compiled of artefacts found on Patterson’s computer.

The report indicated software identified several records of Bing searches that linked to citizen science website iNaturalist on the evening of 28 May, 2022.

Those records were stored on the Samsung SSD.

According to the report, the term “inaturalist” was entered into Bing at 7:20pm.

At 7:21pm, the iNaturalist website was then visited.

The court was then shown four records of website activity on iNaturalist between 7:22pm and 7:23pm that same night.

They included visits to three URLs on the iNaturalist website. Two of those URLs were titled “observations iNaturalists” and were each visited once.

The third URL visited was titled “Deathcap from Melbourne VIC Australia on May 18, 2022 at 2:36pm by Ivan Margita Bricker Reserve Moorabbin”.

The last URL was visited twice.

The records show, moments later, a Google Chrome search was then made for the term “Korumburra middle pub”.

Searches on Patterson’s laptop shown to the court

Erin Patterson is accused of killing three people with poisonous death cap mushrooms.

7news.com.au

By Tita Smith

 

[Kemug]

I have learned so much today - sadly it is how much I don't know!

 

[Whirligig]

Wonder what the relevance of this is "Korumburra middle pub"?

 

[ch_13]

Thank you so much for the response. According to American law, Google would be legally obligated to keep the data for 10 years. So I am puzzled as to why the police have not done so already, they can even get the data under exigent circumstances.

Maybe they did subpoena Google, but didn't get back anything relevant. If Erin was familiar with the locations she wouldn't have needed to use Maps to get there. Or, I'm sure the defense would argue that she never went there at all.

Also, I don't think you're correct about the 10 year retention of user data. Do you have a link? As far as I know, those data retention requirements only pertain to certain financial and tax docs. In fact, you can delete your own location history if you don't want Google to keep it: Manage your Location History - Google Account Help

 

[Kemug]

Wonder what the relevance of this is "Korumburra middle pub"?

The only reason I look up pubs/clubs/restaurants is to look at the menu before I go there, and pretty much decide what I'm going to order.

 

[Eloise]

Maybe they did subpoena Google, but didn't get back anything relevant. If Erin was familiar with the locations she wouldn't have needed to use Maps to get there. Or, I'm sure the defense would argue that she never went there at all.

Also, I don't think you're correct about the 10 year retention of user data. Do you have a link? As far as I know, those data retention requirements only pertain to certain financial and tax docs. In fact, you can delete your own location history if you don't want Google to keep it: Manage your Location History - Google Account Help

Enabling safe and complete deletion​

When you delete data in your Google account, we immediately start the process of removing it from the product and our systems. First, we aim to immediately remove it from view and the data may no longer be used to personalize your Google experience. For example, if you delete a video you watched from your My Activity dashboard, YouTube will immediately stop showing your watch progress for that video.

We then begin a process designed to safely and completely delete the data from our storage systems. Safe deletion is important to protect our users and customers from accidental data loss. Complete deletion of data from our servers is equally important for users’ peace of mind. This process generally takes around 2 months from the time of deletion. This often includes up to a month-long recovery period in case the data was removed unintentionally.

Each Google storage system from which data gets deleted has its own detailed process for safe and complete deletion. This might involve repeated passes through the system to confirm all data has been deleted, or brief delays to allow for recovery from mistakes. As a result, deletion could sometimes take longer when extra time is needed to safely and completely delete the data.

Our services also use encrypted backup storage as another layer of protection to help recover from potential disasters. Data can remain on these systems for up to 6 months.

As with any deletion process, things like routine maintenance, unexpected outages, bugs, or failures in our protocols may cause delays in the processes and timeframes defined in this article. We maintain systems designed to detect and remediate such issues.

BBM: if she deleted things like that in a panic, it might disappear on her side immediately, but it doesn't mean its gone from Google's servers.

She was using Bing - looks like she never deleted it from her PC anyway, so cloud deletion doesn't really matter too much it would appear for some stuff, but about Bing:

Please note that removing your history removes it from the Search History service and prevents that history from being displayed on the site, but it does not delete information from our standard search logs. These logs are used to operate and improve our products and services, and are retained and anonymized as described in the Bing Supplement to the Microsoft Online Privacy Statement. We store the searches you make separately from any account information that directly identifies you, such as your email address or phone number. For more information, see Microsoft Online Privacy Statement.

BBM: about that last bolded bit by Microsoft: I'm guessing this simply means they'll delete personal info but keep IP addresses etc

 

[tmar]

You could argue that it was a bold move, made by somebody who felt they were in control, or above the law. Someone who felt many were beneath them and that they was smarter than the average bear, able to talk, beg, plead or cry their way out of a situation. Someone used to manipulating things to suit their narrative.
All allegedly of course.

Would this be 'obstructing the investigation"?

 

[ch_13]

Enabling safe and complete deletion​

BBM: if she deleted things like that in a panic, it might disappear on her side immediately, but it doesn't mean its gone from Google's servers.

She was using Bing - looks like she never deleted it from her PC anyway, so cloud deletion doesn't really matter too much it would appear for some stuff, but about Bing:


BBM: about that last bolded bit by Microsoft: I'm guessing this simply means they'll delete personal info but keep IP addresses etc

Right, I was actually referring to location data (e.g. GPS), not search data. But either way, I don't believe there's a mandate that user data needs to be retained for 10 years as was claimed.

 

[Scooby-Doo]

I just want to hear the results. It has been 11 minutes. This is torture!

Hahah. Yes, just get to the point, the juicy parts

 

[Eloise]

Right, I was actually referring to location data (e.g. GPS), not search data. But either way, I don't believe there's a mandate that user data needs to be retained for 10 years as was claimed.

I think it would be similar regardless of what you've searched for though - deleting it on your side (or choosing not to retain that info at all) doesn't mean its not retained on their side. Especially if you're talking about panic deleting rather than keeping stuff deleted for years. As for years, in Australia our data retention laws (two years required) pertain to metadata. While they don't keep content (the storage that would require would be insane) they do keep data like phone numbers, IP addresses etc

 

[BreakingNews]

Maybe they did subpoena Google, but didn't get back anything relevant. If Erin was familiar with the locations she wouldn't have needed to use Maps to get there. Or, I'm sure the defense would argue that she never went there at all.

Also, I don't think you're correct about the 10 year retention of user data. Do you have a link? As far as I know, those data retention requirements only pertain to certain financial and tax docs. In fact, you can delete your own location history if you don't want Google to keep it: Manage your Location History - Google Account Help

Great info in the link. Lots to learn about computers from this case. Everyone wants you to connect to the cloud, like it or not. MOO

 

[HoneyBunOne]

Would this be 'obstructing the investigation"?

I'd argue yes.

 

[Neet_Mc]

"Don't be tempted to put these URL searches into Google and conduct your own investigations,' the judge warns.

Too late!

 

[Neet_Mc]

Looks like more case-building from the prosecution side. Interested to see further digital forensic evidence tomorrow.

I’m here for it

 

[Vortexaire]

Maybe they did subpoena Google, but didn't get back anything relevant. If Erin was familiar with the locations she wouldn't have needed to use Maps to get there. Or, I'm sure the defense would argue that she never went there at all.

Also, I don't think you're correct about the 10 year retention of user data. Do you have a link? As far as I know, those data retention requirements only pertain to certain financial and tax docs. In fact, you can delete your own location history if you don't want Google to keep it: Manage your Location History - Google Account Help

Ok I did a check, you are correct that the retention thing applies as according to Google's TOS:





However the it seems like the Department of Home Affairs can order that a Data Disruption Warrant can be issued as shown here: https://www.homeaffairs.gov.au/abou...and-disrupt-act-2021/data-disruption-warrants

So forget the 10 year thing, I believe Australia can make that data last forever. Depending on statute of limiations if Australia has any. I know Canada doesn't but I am not sure about the AU front.

 

[Eloise]

Too late!

ahaha. He means the jury... you're free to research death caps and iNaturalist as much as you want, so long as you're not planning any lunches for your inlaws...