Tech Forensics, computers cel phones, texts,

[NoeticSoul]

I was asking myself this morning about things they may have deleted from Windows via their trash and wondered if it was retrievable..

I was glad to learn this (because I didn't know) and thought I would share for others who don't:

"Users may think that when files are deleted and the trash can is emptied, that they are permanently erased, but this isn’t so. When files are erased on DOS, Windows, Windows 95, Windows 98 and Windows NT, the data from the file remains on the unallocated storage space.

That is, unless of course, DiskScrub, M-Sweep or other DoD certified file deletion software has been used. The data that is left behind is retrievable through system recovery and computer forensics software utilities.

The data that is retrieved is coded in computer language, which must be decoded either by the system recovery or data forensic specialist."

How Unallocated File Space Can Help Your Case

http://www.expertdataforensics.com/...how-unallocated-file-space-can-help-your-case

 

[Scamperoo]

I have a feeling this will take much longer than normal because EB used a lot of different aliases so she could have signed up for the internet by any of the known names and even unknown.

This could be true too with cell phone but with cell phone they can go by phone number. If it was one of those Go Phone though, that might make it harder.

This is true but it doesn't matter as she has an Internet service provider and an IP address which can be traced back to her/him. It's very hard to hide online unless you make an effort to reduce your "footprint" and impossible to wipe your hard drive unless you overwrite the whole drive.

 

[Lera213]

well maybe they trashed the hard drive? Nah,these two are too stupid to think of that.

 

[tsisqua]

Great thread and finally something right down my alley! The computer forensics will play a huge part in this case, I have no doubt whatsoever. I am sure their ISP, etc were court ordered to turn over online activity on their account.

Once forensics copies the hard drive it could take awhile to compile all the evidence found. The device will searched with a fine tooth comb compiling deleted files, online activity such as email, websites visited, google searches and documents written.

Since it seems these two were online freaks, I believe this evidence will be a turning point as to to timeline, COD and guilt to which party. Watch closely. :angel:

ETA moo

It is down my alley as well. All the activity on the hard drive has time stamps, combing over that shouldn't take long even if they have to undelete. If they have to wait on an ISP or social network to turn over info would be where the wait comes in. That and discerning what data is actually evidence. Some web activity like searches may not seem to be evidence until other information comes to light.

I almost feel sorry for the person that had to wade through all the "this is my collector fairy picture" crap.

 

[tlcya]

tsis and sherlock, I hope ya'll hang around as this case progresses as we will surely be making use of your expertise

 

[Peliman]

Besides what's been discussed we should have some ping and texting records that may show some type of locational activity. I've become curious about clothing confiscated. Did they burn clothing in the fire? What about the shoes? Footprints taken at the recovery home or recovery sites possibly? Again the shoes, usually forgotten. Were they wearing new shoes? Bloody fingerprints? Receipts for the new mattress taken from the home? Bank records, phone records, following the money trail. Any matching tire tracks at the recovery sites?

Remembering Adam wearing the same shirt for days. Was it because the rest of his clothes were burned or because LE had them?

I remember seeing FB post from EB on her blackberry.

 

[tsisqua]

tsis and sherlock, I hope ya'll hang around as this case progresses as we will surely be making use of your expertise

Thanks, Judging by the information already posted in this thread by noeticsoul and some others I think this place has it covered. Without actually having the hard drives and devices in my hands anything that comes out is information easily interpreted by almost anyone. I'll be happy to weigh in if someone hasnt already covered something.

 

[NoeticSoul]

tsis and sherlock, I hope ya'll hang around as this case progresses as we will surely be making use of your expertise

I completely hope the same!

Thanks, Judging by the information already posted in this thread by noeticsoul and some others I think this place has it covered. Without actually having the hard drives and devices in my hands anything that comes out is information easily interpreted by almost anyone. I'll be happy to weigh in if someone hasnt already covered something.

Although I find it frustrating that we don't know much YET.. I will very much appreciate your input once the investigation reveals the actual computer forensic findings.

I would also like to call out Donjeta... for technical input

We may not be privy now.. but when we are (and OH we SO will be) I will very much appreciate the input.

I am not blessed in those technical areas..

 

[tlcya]

Yes noetic, but you bring other invaluable tools to the table. Looks like we are buiding a team of sleuths

 

[Mountain_Kat]

I'll be in charge of the stupid questions. It's my area of expertise.

 

[NoeticSoul]

Yes noetic, but you bring other invaluable tools to the table. Looks like we are buiding a team of sleuths

TYVM tlcox, I'm very grateful to be able to contribute to the insight and the poetic justice (karma) for this little Angel.

I'll be in charge of the stupid questions. It's my area of expertise.

You'll have to stand in line behind me then

ot ( it's OK though I have rice crispy treats AND Ben & Jerry's Cherry Garcia ice cream)

 

[tlcya]

Hey now, my thread! I get to ask the stupid questions!

 

[ynotdivein]

http://www.wsoctv.com/download/2011/0104/26368858.pdf

Batch one of six. If possible I will come back and create a "chapter headings" post for what-all is in this group.

 

[ynotdivein]

http://www.wsoctv.com/download/2011/0104/26368831.pdf

 

[Sherbie]

Probably has already been mentioned, but I noticed Miss Darkness managed to get a phone number with "666" in the last 4 digits of one her of cell phones. Fits her to a T!

 

[Sherbie]

I would love to see the records of calls/text messages among EB, AY and SY. Too bad we don't have Florida's Sunshine Law here in NC.

 

[tlcya]

http://www.wsoctv.com/download/2011/0104/26368858.pdf

starts page 9 EB's T-mobile phone (828-***-6664). warrant for trap and trace device. Also requests info on all accounts for numbers incoming and outgoing to her T-mobile.

Page 21 statement of Probable Cause on warrants requesting Verizon pings and cel records of "sammy" Young

page 46 statement of probable cause on T-Mobile phone number 828-***-8536 (phone seized in search of home). Texts on phone indicated they were either from or to EB

 

[tlcya]

http://www.wsoctv.com/download/2011/0104/26368831.pdf

starts page 6, page 13 is probably cause statement regarding role play

page 14 regards cel number 828-***-2677 (AY's phone number) probable cause statement begins page 19 discusses the relationships of parties involved on page 22 paragraph 11

page 32 is warrant discussing electronics seized from home, including cameras disposable and various cell phones.

 

[tlcya]

http://www.wsoctv.com/download/2011/0104/26368797.pdf

828-***-0049 page 3 is start of application affidavit

 

[tlcya]

http://www.wsoctv.com/download/2011/0104/26368824.pdf

starts page 23. Affidavit states this number was dialed by both EB and AB on their respectives cells