PDA

View Full Version : Anthony's Computer Forensics


Pages : [1] 2 3 4 5 6

DAWN TREADER
08-19-2008, 10:04 PM
http://www.sun-sentinel.com/news/local/florida/orl-caylee0808aug08,0,4938442.story

Excerpt:

Detectives obtained some of Anthony's e-mails and found one that appeared to be from a worker at Universal Studios, where Anthony said she worked as an event planner. The supposed sender of the e-mail, about an upcoming Universal event, does not work for the company and the e-mail domain of the sender's address was invalid.

I wonder if LE is investigating the origin of this email to determine who might have sent it, if not a worker from Universal Studios? Obviously they know WHEN it was sent but as far as I know, that information hasn't been released publically. (If I'm wrong - please let me know because I would love to know the date of the email)

Also, given that Casey was apparently using a computer for social networking (Myspace) I would imagine LE would want to examine all computers she might have used or had access to (e.g. parents, brother, boyfriend, girlfriend, blackberry, etc.) to gleen information helpful to the investigation and timeline.

olive
08-19-2008, 10:16 PM
Good idea for a thread. Yes, I think LE would have to have ALL the myspace and facebook records, as well as those uncovered here by our sleuthers. (you're welcome, LE :)

They are not hard to obtain by LE.

I'm sure they've traced the fake Universal email as well. You can basically find out anything through tracing web and computer records. Probably the best evidence they have. I have no doubt that if they prosecute Casey those will be a major factor in the prosecution considering how many sites she posted to and the trail she left. She may not have left much of a trail elsewhere, but she sure did love the internet.

DAWN TREADER
08-19-2008, 10:35 PM
Shouldn't be too hard to find the ISP of the email sender. Just hope we hear more about this because I do feel it's an important issue.

DAWN TREADER
08-19-2008, 10:56 PM
IIRC, emails found on Chandra Levy's computer was one of the reasons why the police searched the park where her body was ultimately found a year later by someone walking their dog.

imnotheonlyone
08-19-2008, 11:02 PM
There are many email anonymizers out there on the net - anyone can send someone an email anonymously by funneling it though the anonymizer ... the send can make it look like the email came from any given name/company, etc. that they choose...

JBean
08-19-2008, 11:03 PM
Great thread. Have we heard anything about anything on Casey's computer in general?

technicalconfusion
08-19-2008, 11:05 PM
There are many email anonymizers out there on the net - anyone can send someone an email anonymously by funneling it though the anonymizer ... the send can make it look like the email came from any given name/company, etc. that they choose...

It is extremely easy to spoof an email. Extremely easy. Right from your own mail program.

DAWN TREADER
08-19-2008, 11:08 PM
Regarding the subscriber identity module (SIM) card that Casey mentions in the interview with her brother -- there are ways to recover deleted data and text messages from celluar phones. SIM RECOVERY PRO is one way I have heard of. I need to research what exactly the nature of their conversation was about the SIM card and why they were even talking about it.

technicalconfusion
08-19-2008, 11:08 PM
http://www.sun-sentinel.com/news/local/florida/orl-caylee0808aug08,0,4938442.story

Excerpt:

Detectives obtained some of Anthony's e-mails and found one that appeared to be from a worker at Universal Studios, where Anthony said she worked as an event planner. The supposed sender of the e-mail, about an upcoming Universal event, does not work for the company and the e-mail domain of the sender's address was invalid.

I wonder if LE is investigating the origin of this email to determine who might have sent it, if not a worker from Universal Studios? Obviously they know WHEN it was sent but as far as I know, that information hasn't been released publically. (If I'm wrong - please let me know because I would love to know the date of the email)

Also, given that Casey was apparently using a computer for social networking (Myspace) I would imagine LE would want to examine all computers she might have used or had access to (e.g. parents, brother, boyfriend, girlfriend, blackberry, etc.) to gleen information helpful to the investigation and timeline.

I would bet a dime to a donut that any site she has used and registered with has been subpoenaed for all of their log files, accounts, anything pertaining to
Casey, Caylee, her family, et al. If the hosting company is on the ball, they will have kept logs for months, if not a year.

ThoughtElf
08-19-2008, 11:09 PM
It is extremely easy to spoof an email. Extremely easy. Right from your own mail program.

True, but that is beyond the capabilities of most end-users, at best most could spoof on parts of the headers. Annonymus service is a better bet.

ThoughtElf
08-19-2008, 11:10 PM
Regarding the subscriber identity module (SIM) card that Casey mentions in the interview with her brother -- there are ways to recover deleted data and text messages from celluar phones. SIM RECOVERY PRO is one way I have heard of. I need to research what exactly the nature of their conversation was about the SIM card and why they were even talking about it.

IIRC, Casey said she switched the SIM between her two cells.

DAWN TREADER
08-19-2008, 11:10 PM
There are many email anonymizers out there on the net - anyone can send someone an email anonymously by funneling it though the anonymizer ... the send can make it look like the email came from any given name/company, etc. that they choose...

Yes, good point. But even a proxy server can be subpoened.

technicalconfusion
08-19-2008, 11:11 PM
True, but that is beyond the capabilities of most end-users, at best most could spoof on parts of the headers. Annonymus service is a better bet.

Not really. Ok, someone who has issues turning on their computer might have a problem, but anyone who can setup their email in outlook or thunderbird can in fact do it.

ThoughtElf
08-19-2008, 11:14 PM
Not really. Ok, someone who has issues turning on their computer might have a problem, but anyone who can setup their email in outlook or thunderbird can in fact do it.

But would the average user either know that, know where to read up how to do it? Not arguing the point, just too jaded with years of tech support to believe that would be as likely as using a web service to do it.

technicalconfusion
08-19-2008, 11:16 PM
But would the average user either know that, know where to read up how to do it? Not arguing the point, just too jaded with years of tech support to believe that would be as likely as using a web service to do it.

If they knew what to search for. I know where you're coming from, re the tech support.

ThoughtElf
08-19-2008, 11:21 PM
If they knew what to search for. I know where you're coming from, re the tech support.

Agree on both counts.

I'd like to get my hands on any of the Anthony's pcs.

DAWN TREADER
08-19-2008, 11:23 PM
So the SIM card in the cell phone the police have is the SIM card from the lost phone?

technicalconfusion
08-19-2008, 11:26 PM
Agree on both counts.

I'd like to get my hands on any of the Anthony's pcs.

Field day!

ThoughtElf
08-19-2008, 11:29 PM
So the SIM card in the cell phone the police have is the SIM card from the lost phone?

No idea. That was where I got extremely confused during the Lee call. It didn't make sense to me that she had the SIM in the existing phone, yet she referenced a lot about the lost phone. How did the SIM card get back in the cell she was using. Wouldn't the SIM have been lost when she lost the blackjack?

Edit to clarify: she told Lee during a taped conversation that was released that she swapped the SIM back and forth between phones.

DAWN TREADER
08-19-2008, 11:36 PM
Ok, I found the transcript of the jail phone call with LEE about the cell phones and SIM Cards and all I can say is Casey seems to have an answer for everything and anything and yet at the end of the day - it seems to me she really doesn't provide any information that is particularly helpful. Is it just me, or does anyone else see it that way?

http://www.myfoxorlando.com/myfox/pages/Home/Detail;jsessionid=87C1248F64CB0E81751E49212C3D8134 ?contentId=7082866&version=1&locale=EN-US&layoutCode=TSTY&pageId=1.1.1&sflg=1

DAWN TREADER
08-19-2008, 11:41 PM
No idea. That was where I got extremely confused during the Lee call. It didn't make sense to me that she had the SIM in the existing phone, yet she referenced a lot about the lost phone. How did the SIM card get back in the cell she was using. Wouldn't the SIM have been lost when she lost the blackjack?

Edit to clarify: she told Lee during a taped conversation that was released that she swapped the SIM back and forth between phones.

It is very confusing, ITA!

It would help if we knew the DATE of that apparently bogus email as well as how much investigating LE is doing into the cell phone - e.g. are they trying to recover any deleted text messages, phone numbers, etc.

If you notice in the convo with LEE, she suggests maybe the missing cellphone is in her stuff at home or possibly TonE's. ?????:eek:

Suzette25
08-19-2008, 11:42 PM
Im sorry, kinda butting in to the topic at hand. Dont know if someones posted this yet, but since Casey is up for her arragnment(sp, I know) tomorrow morning, it maybe be when LE is going to formally charge her as a suspect in her daughter's death/dissapearance to keep her in jail.

technicalconfusion
08-19-2008, 11:46 PM
Ok, I found the transcript of the jail phone call with LEE about the cell phones and SIM Cards and all I can say is Casey seems to have an answer for everything and anything and yet at the end of the day - it seems to me she really doesn't provide any information that is particularly helpful. Is it just me, or does anyone else see it that way?


I found that, um really hard, um to read. It um gave me um a headache.

Um is in that transcript 45 times. I um counted.

ThoughtElf
08-19-2008, 11:47 PM
It is very confusing, ITA!

It would help if we knew the DATE of that apparently bogus email as well as how much investigating LE is doing into the cell phone - e.g. are they trying to recover any deleted text messages, phone numbers, etc.

If you notice in the convo with LEE, she suggests maybe the missing cellphone is in her stuff at home or possibly TonE's. ?????:eek:

I'll admit, the text messages intrigue me. I'd imagine there was a flurry of those, too, between the 16-18th. Not to mention how revealing previous/post disappearance they'd be.

NighTillDawn
08-19-2008, 11:48 PM
Ok, I found the transcript of the jail phone call with LEE about the cell phones and SIM Cards and all I can say is Casey seems to have an answer for everything and anything and yet at the end of the day - it seems to me she really doesn't provide any information that is particularly helpful. Is it just me, or does anyone else see it that way?

http://www.myfoxorlando.com/myfox/pages/Home/Detail;jsessionid=87C1248F64CB0E81751E49212C3D8134 ?contentId=7082866&version=1&locale=EN-US&layoutCode=TSTY&pageId=1.1.1&sflg=1

Cindy called police after that phone call? How come there are no records of that? Oh yea, I keep forgetting, the phone company makes mistakes and deleted that phone number, stupid me once again. :banghead:

ThoughtElf
08-19-2008, 11:51 PM
It is very confusing, ITA!

It would help if we knew the DATE of that apparently bogus email as well as how much investigating LE is doing into the cell phone - e.g. are they trying to recover any deleted text messages, phone numbers, etc.

If you notice in the convo with LEE, she suggests maybe the missing cellphone is in her stuff at home or possibly TonE's. ?????:eek:

Here is the audio of that call, if you wish to listen:

http://www.orlandosentinel.com/news/local/orange/orl-caylee-anthony-casey-lee-mp3,0,7946378.mp3file

ThoughtElf
08-19-2008, 11:53 PM
Cindy called police after that phone call? How come there are no records of that? Oh yea, I keep forgetting, the phone company makes mistakes and deleted that phone number, stupid me once again. :banghead:

No, this was a call taped while Casey was in jail.

NighTillDawn
08-19-2008, 11:54 PM
No, this was a call taped while Casey was in jail.


Cindy taped the call? Is there proof of that call anywhere?

ThoughtElf
08-19-2008, 11:59 PM
I found that, um really hard, um to read. It um gave me um a headache.

Um is in that transcript 45 times. I um counted.

I can tell we'd have fun together working tech support.

technicalconfusion
08-20-2008, 12:01 AM
I can tell we'd have fun together working tech support.

Oh yea. One must have fun doing tech support. It's required. Must work well under pressure:eek:

ThoughtElf
08-20-2008, 12:01 AM
Cindy taped the call? Is there proof of that call anywhere?

Sorry, I think I confused you. I was discussing the SIM card in another message and mentioned a specific taped Lee/Casey call while Casey was in jail.

So, Cindy had already called the cops on Casey. this occurred afterwards.

ThoughtElf
08-20-2008, 12:05 AM
Oh yea. One must have fun doing tech support. It's required. Must work well under pressure:eek:

Years ago when we still owned an ISP, I had tee's made for my TS crew, "It works for me!"

Back on topic: I keep hearing My Space over and over. Has anyone found her on Facebook? (I haven't checked)

technicalconfusion
08-20-2008, 12:10 AM
Years ago when we still owned an ISP, I had tee's made for my TS crew, "It works for me!"



:thumb: That is too funny! :biglaugh: The phrase that is said most often.

SouthernMom
08-20-2008, 12:20 AM
Years ago when we still owned an ISP, I had tee's made for my TS crew, "It works for me!"

Back on topic: I keep hearing My Space over and over. Has anyone found her on Facebook? (I haven't checked)


There's a whole thread dedicated to her Myspace and Facebook presence.

ThoughtElf
08-20-2008, 12:24 AM
There's a whole thread dedicated to her Myspace and Facebook presence.

Thanks, I missed that - back to search.

peace9274
08-20-2008, 01:23 AM
It is extremely easy to spoof an email. Extremely easy. Right from your own mail program.

And don't users with an AOL.com email addy all have the same ISP, saying it's from VA?

technicalconfusion
08-20-2008, 01:36 AM
And don't users with an AOL.com email addy all have the same ISP, saying it's from VA?

Aol users have an ip address that starts with 172. An ip address lookup will show the company address of aol out of Va.

peace9274
08-20-2008, 01:38 AM
K - Thanx

DAWN TREADER
08-20-2008, 02:01 AM
It doesn't matter if it's an AOL user - they can still get the users ID through a subpoena.

LaLaw2000
08-20-2008, 06:30 AM
I'll bet there were things found on Casey's computer that would curl the average person's hair!!

technicalconfusion
08-20-2008, 07:30 AM
I'll bet there were things found on Casey's computer that would curl the average person's hair!!

I would love to get my hands on it <rubs hands together gleefully>.

RoseRed
08-20-2008, 08:34 AM
It is extremely easy to spoof an email. Extremely easy. Right from your own mail program.

Not that easy to do. How do you suppose a virus creator is traced back to the originator by FBI if it so easy? The virus creator tries to spoof his address but they are traced back and found.

technicalconfusion
08-20-2008, 08:45 AM
Not that easy to do. How do you suppose a virus creator is traced back to the originator by FBI if it so easy? The virus creator tries to spoof his address but they are traced back and found.

I'm not in the business of writing viruses, but for someone who wants to pretend that they're emailing from address A, it is easily done. A virus writer makes it difficult, but he will use the addresses in your address book and use them as the from: if he doesn't use yours. He might use your machine as well.
He may use a zombie machine. His virus may be written in a very complicated manner, it may not be. I've looked at hacks installed on websites that were so easy, that I probably could have written them, and I'm not a programmer.

All a spammer does is use proxies, usually located overseas. The from address is any old address, whether they've harvested the email from websites, bought a list, or whatever. So if you look at the headers of a spam email you've received, you can trace the ip addresses and find out it's not from who it says it is.

It is very easy.

I do it at christmas time to make my son think he got a letter from santa:)

Blink34
08-20-2008, 08:46 AM
Not that easy to do. How do you suppose a virus creator is traced back to the originator by FBI if it so easy? The virus creator tries to spoof his address but they are traced back and found.

I agree that it is NEXT to impossible today to do almost anything anonymously on any computer. However, I recently read of a case where the FBI COULD NOT break the encryption on a highly dangerous man's computer who had no formal education..scary..

websurfer
08-20-2008, 10:35 AM
Phones
computers
cars
etc....

Chezhire
08-20-2008, 11:34 AM
I'm not in the business of writing viruses, but for someone who wants to pretend that they're emailing from address A, it is easily done. A virus writer makes it difficult, but he will use the addresses in your address book and use them as the from: if he doesn't use yours. He might use your machine as well.
He may use a zombie machine. His virus may be written in a very complicated manner, it may not be. I've looked at hacks installed on websites that were so easy, that I probably could have written them, and I'm not a programmer.

All a spammer does is use proxies, usually located overseas. The from address is any old address, whether they've harvested the email from websites, bought a list, or whatever. So if you look at the headers of a spam email you've received, you can trace the ip addresses and find out it's not from who it says it is.

It is very easy.

I do it at christmas time to make my son think he got a letter from santa:)


Hey TC - had to comment that I love the Letter From Santa idea!
:crazy:

LI_Mom
08-20-2008, 11:52 AM
Aol users have an ip address that starts with 172. An ip address lookup will show the company address of aol out of Va.

Just to clarify...

172. is only ONE of the aol ip's.... they have quite a few & there is only more than one central location, not just the one based in VA.

That said.... even though on the user's end you can't tell one aol ip from another, AOL can check their own records to see who was assigned the actual & complete ip assigned to each specific user.

The fact is.... the average user is NOT anonymous on the internet... is easily traceable if LE gets involved.

Thinking_Out_Loud
08-20-2008, 12:08 PM
Not that easy to do. How do you suppose a virus creator is traced back to the originator by FBI if it so easy? The virus creator tries to spoof his address but they are traced back and found.

Sorry, but I have to throw my two cents in here. This forum caught my eye since I am studying digital forensics. Basically, I wanted to say that sometimes it is easy to trace a virus back to the origin but most the time it is not. You typically have a scale of mal-ware creators out there. This scale ranges from newbies to experts. Now, if it is a newbie, then it will be a piece of cake because they will probably forget to hide headers. Usually, these are kids and they might create something that infects a computer, but doesn't do much else. On the other hand, you can have a pro that will basically bring down the house, and they may not ever get caught. The FBI catches people who are careless. A hacker will think that what they have done is so funny that they need to boast about their work. That is when they get caught. People turn them into the authorities. Granted, there are ways to trace it back to origin (if there wasn't, I would be out of a job), but it is not always so easy.

As far as Casey's computer networking skills, there should be some incriminating finds if she did anything. This girl was posting on Myspace and Facebook like nothing happened. If she knew anything about computer forensics, then she would have stayed away from the computer or destroyed the harddrive; that is, if she searched for anything that is telling about the case. However, if she has other parties involved (ie JP), then there might not be much info there. I did some research on JP (Ricardo M's roommate). Apparently, he is a computer science major at UCF. I believe it said that he was in his last year. Just so you know, I also attend this school, and used to major in CS and am full aware that you have to know your stuff to get through that program. UCF offers a very intensive Computer Science program, and most students will fail out or drop out before their junior year. Not to say that kid is actually involved with Caylee's disappearance, but if he is, then he probably guided her in what to do on a computer while her child is missing. All in all, I am more curious as to what is on TonE's computer (my guess is that it is probably a Mac since he goes to Full Sail). She was spending her days there while Caylee was missing, and he was allowing her to use his computer...

ThoughtElf
08-20-2008, 12:27 PM
All in all, I am more curious as to what is on TonE's computer (my guess is that it is probably a Mac since he goes to Full Sail). She was spending her days there while Caylee was missing, and he was allowing her to use his computer...

Good point. I wonder if LE subpoenaed his computer. Anyone know?

As for JP, it might seem to be a leap in logic to think she'd ask for help destroying her own back-trail, or that he would provide it without asking a lot of questions. I don't know of many computer professionals who would not question WHY they'd been asked for assistance like that by an average 22 y/o end user who seems to use the net for social aspects more than anything else.

technicalconfusion
08-20-2008, 01:15 PM
Hey TC - had to comment that I love the Letter From Santa idea!
:crazy:

Oh it's effective! Especially when they're young and don't know any better and you need to get them into bed so you can wrap presents. A well timed email from Santa saying I see you, better go to bed can work wonders!

DAWN TREADER
08-20-2008, 11:50 PM
Regarding Facebook - apparently Casey Anthony posted this message to a Facebook member named Troy. Not sure but it seems to me this date and time is close to the date and time Casey went to her parents and the gas cans were discovered by George Anthony in the back of the car trunk. Anybody know exactly when George said Casey came over and he found the gas cans in the car's trunk? IIRC, it was about 2:25 pm on June 24th, the same day he reported them stolen. I'd be curious to know what computer Casey used to post this message which is something LE and her attorney would be able to determine by subpoena to Facebook. Did she post from the home computer or somewhere else?

To Troy on Facebook
Casey Anthony (Orlando, FL) wrote
at 2:40 pm on June 24th, 2008
she still has yet to move into the house. hell, in the past 9 days, i haven't even been living at the house. DRAMMMMMA. i'll fill ya in later on. miss ya, yo.

MommaD
08-21-2008, 07:39 AM
Sorry, but I have to throw my two cents in here. This forum caught my eye since I am studying digital forensics. Basically, I wanted to say that sometimes it is easy to trace a virus back to the origin but most the time it is not. You typically have a scale of mal-ware creators out there. This scale ranges from newbies to experts. Now, if it is a newbie, then it will be a piece of cake because they will probably forget to hide headers. Usually, these are kids and they might create something that infects a computer, but doesn't do much else. On the other hand, you can have a pro that will basically bring down the house, and they may not ever get caught. The FBI catches people who are careless. A hacker will think that what they have done is so funny that they need to boast about their work. That is when they get caught. People turn them into the authorities. Granted, there are ways to trace it back to origin (if there wasn't, I would be out of a job), but it is not always so easy.

As far as Casey's computer networking skills, there should be some incriminating finds if she did anything. This girl was posting on Myspace and Facebook like nothing happened. If she knew anything about computer forensics, then she would have stayed away from the computer or destroyed the harddrive; that is, if she searched for anything that is telling about the case. However, if she has other parties involved (ie JP), then there might not be much info there. I did some research on JP (Ricardo M's roommate). Apparently, he is a computer science major at UCF. I believe it said that he was in his last year. Just so you know, I also attend this school, and used to major in CS and am full aware that you have to know your stuff to get through that program. UCF offers a very intensive Computer Science program, and most students will fail out or drop out before their junior year. Not to say that kid is actually involved with Caylee's disappearance, but if he is, then he probably guided her in what to do on a computer while her child is missing. All in all, I am more curious as to what is on TonE's computer (my guess is that it is probably a Mac since he goes to Full Sail). She was spending her days there while Caylee was missing, and he was allowing her to use his computer...


WOW ... Now this was about the most interesting post on this site, that I have read so far.. Thank you for all the information. Great Job..

DAWN TREADER
08-23-2008, 12:14 PM
In Summary - (not verbatim)

On July 16, 2008 George Anthony gave LE a laptop used by Casey. LE then obtained a search warrant on the laptop to see if anything could be found on it to help them find Caylee Anthony. A picture was found of Caylee with an elderly gentleman dated June 15, 2008. On July 21, LE showed this picture to George and Cindy Anthony who at first weren't sure of the accuracy of the date but being that it was Father's Day it could be.

On July 29, 2008 Lee Anthony provided LE with a copy of a forwarded email to Casey from a "Thomas Franck" about an upcoming Universal event and what time to appear at said event. Upon further investigation and contact with Universal, it was determined no one by the name of Thomas Franck apparently worked for Universal and in fact, their Server Technology Dept. had never heard of @events.universal.com as one of their email addresses.

See Search Warrant 08 07 08
http://www.ocso.com/Default.aspx?tabid=547

DT

Edited to add: Still no mention of the DATE on the invalid email but I suspect it won't be long before we learn more about this particular email including whether LE was able to determine who might have actually created and sent it.

nobody2
08-27-2008, 12:16 AM
Please post things here regarding the computer forensics.
Were there any revelations regarding these in the documents released?
We know the young cop lost his job because they found his communication with Casey on there. What else might be on there? You KNOW when someone lives their life online like Casey does, they wouldn't be able to help 'googling' whatever is on their mind. I wonder what else was up on that computer? Was she searching anything regarding getting out of the country? Or about drugs being found in systems, or about "accidental" deaths or about hiding evidence?
I didn't really see anything in the docs that related to the forensic computer stuff, just the downloaded pictures from the camera and the fake email stuff.

Interesting.

JBean
08-27-2008, 02:17 AM
HI nobody. I am going to ask the mods to merge with the existing thread on this topic. Thanks for reposting the idea :)

http://www.websleuths.com/forums/showthread.php?t=69288&highlight=computer

nobody2
08-27-2008, 08:55 AM
HI nobody. I am going to ask the mods to merge with the existing thread on this topic. Thanks for reposting the idea :)

http://www.websleuths.com/forums/showthread.php?t=69288&highlight=computer

Thanks, didn't realize we had a thread for this already.

SO, for the optimists in the group, the computer forensics SHOULD probably solve once and for all the issues of whether the child was kidnapped. If she was, or if Casey gave her to someone, I imagine she would be doing research online about it. As "sloppy" as she appeared to be with much of her coverup, I seriously doubt that she would understand that "deleted" computer info can generally be retrieved.

DAWN TREADER
08-27-2008, 02:54 PM
In the docs, it's revealed Cindy Anthony gave LE her Compaq laptop and that this laptop was being analyzed.

DT

BondJamesBond
10-12-2008, 10:33 PM
Thought the post fit here as well as anywhere.

There are some key items from the computer forensic report that was released w/ the 600pgs that still don't appear on the WS calendar (e.g. IIRC, 6/17 download of pics from 6/15, 7/2 draft of "Diary of Days", etc.).

I just thought I'd throw it out there if anyone want to plow some time into it.

TURBOTHINK
10-12-2008, 11:20 PM
There are many email anonymizers out there on the net - anyone can send someone an email anonymously by funneling it though the anonymizer ... the send can make it look like the email came from any given name/company, etc. that they choose...

I believe Casey sent those to herself thorough an anonymizer and put in the name she wanted so she could "show" her mother something from work which said she needed to be out that night and CA would keep Caylee for her.

Psmith
10-13-2008, 12:28 AM
Hi, all!

I skimed the first page and the last. It does seem that much of this info/questioning has been covered before. Ie, the faked message from Universal, etc. I think it is covered in the discussion of the first doct drop (400 pp).

While related, I do not think it is appropriate to discuss sim cards here. That goes into another thread, with the ping people, perhaps.

Let's discuss what we have about searches on the computer HD: ZFG, chloroform, missing children, "escort" sites, facebook/photobucket.

Thanks....waiting to hear from you all... : )

Psmith
10-13-2008, 12:32 AM
I believe Casey sent those to herself thorough an anonymizer and put in the name she wanted so she could "show" her mother something from work which said she needed to be out that night and CA would keep Caylee for her.

Correct, it was false. Set up to make it look like she was working for a reputable employer. (As was her phone with all numbers of the people she had set up as ZFG knowers and friends who "knew" about missing Caylee.)


So we know much is faked on her computer. Let's talk about what is there!

Psmith
10-13-2008, 12:34 AM
Thought the post fit here as well as anywhere.

There are some key items from the computer forensic report that was released w/ the 600pgs that still don't appear on the WS calendar (e.g. IIRC, 6/17 download of pics from 6/15, 7/2 draft of "Diary of Days", etc.).


I just thought I'd throw it out there if anyone want to plow some time into it.

That's the ticket! But do we have enough info now to infer what was deleted or tanked (by KC or LA) yet?

LinasK
10-13-2008, 12:37 AM
Okay, I was asked by another poster on another thread for the links to the dates Casey searched online for ZF-G prior to Caylee's disappearance. Another forum stated June 12th. Can anyone verify this for me please? I'm not looking for the July 16th date, I want prior to June 15th or earlier. Thanks...

Psmith
10-13-2008, 12:51 AM
Thanks, didn't realize we had a thread for this already.

SO, for the optimists in the group, the computer forensics SHOULD probably solve once and for all the issues of whether the child was kidnapped. If she was, or if Casey gave her to someone, I imagine she would be doing research online about it. As "sloppy" as she appeared to be with much of her coverup, I seriously doubt that she would understand that "deleted" computer info can generally be retrieved.


I really think that KC believed LE would buy her story and hie off like foxhounds looking for the notorious ZFG child kidnapping ring. That the focus would not be on her per se. All her stage design was just that--hollow, paper / electronic images of a faux reality. And you are right: it is very stupid of KC to think that erasing really meant all info was gone. Should have spent less time at Fusian, more time on WS threads? ; )

a ) Alrighty, first dibs on this topic on this thread: Many have already suggested on a prior thread that KC was looking at missing children sites well before Caylee also went "missing" in order to construct a good tale.

However, I also believe she was looking at how aggrieved mothers act and what they say. Got the words just about right, but missed the crocodile tears.

True, this is also o/t since it belongs in psych thread.

b) Chloroform searches really bother me. If, as some have suggested, it was to process meth or for certain sexual practices (ignoring pool idea, too silly), why that sudden clutch of searches, then no more? This follows from the screening of a CSI episode featuring that old fave chloroform as a knock-out agent to subdue a person.

True, this is also o/t since it belongs in theory thread.


HOW do we get out of this cycle?

Anyone have more info?

Psmith
10-13-2008, 12:54 AM
Okay, I was asked by another poster on another thread for the links to the dates Casey searched online for ZF-G prior to Caylee's disappearance. Another forum stated June 12th. Can anyone verify this for me please? I'm not looking for the July 16th date, I want prior to June 15th or earlier. Thanks...

Cannot verify with thread tags but there were 3: an early one in Oct 07, a late one July 15-17 2008, and one in June 2008 that is really signficant per timing. Sorry not to be of more help.

LinasK
10-13-2008, 01:05 AM
Cannot verify with thread tags but there were 3: an early one in Oct 07, a late one July 15-17 2008, and one in June 2008 that is really signficant per timing. Sorry not to be of more help.

Thank-you! The Oct. '07 and the June ones are the ones I knew I'd seen. This other poster would not believe without a link. Insisted that July 16th was the only one.

Psmith
10-13-2008, 01:05 AM
Okay, I was asked by another poster on another thread for the links to the dates Casey searched online for ZF-G prior to Caylee's disappearance. Another forum stated June 12th. Can anyone verify this for me please? I'm not looking for the July 16th date, I want prior to June 15th or earlier. Thanks...



Ideas: ask Turbothink (seems to have a good handle on info), check the calendar sticky the upper right of the forum, ask the media pundit (Patty G?). BondJamesBond also seems to have facts at fingertips.

I am here mostly to learn about comp forensics. So interesting!

Psmith
10-13-2008, 01:09 AM
Thank-you! The Oct. '07 and the June ones are the ones I knew I'd seen. This other poster would not believe without a link. Insisted that July 16th was the only one.

Ha ha ha. :crazy:

I'm not a fact link, but I do remember. Hate the darned dyscalcula. Can't remember numbers unless linked to verbals. : )

But yes, three times. That really got me.

Also another place to look (of course) using advanced search in a ZFG thread.

Tell it!

truthsleuth
10-13-2008, 02:09 AM
I believe Casey sent those to herself thorough an anonymizer and put in the name she wanted so she could "show" her mother something from work which said she needed to be out that night and CA would keep Caylee for her.

Amazing. She sure worked hard at not working.

Psmith
10-13-2008, 02:20 AM
Amazing. She sure worked hard at not working.


And the funny thing is, she is really bad about the subject and field. Even I, 52 yo know that data is not erased when you hit delete or even crash a computer. Ie, KC is truly ignorant. But for LE and most of us, that is a plus sign.

Type away, murderous vixen that destroys it's young.

Ok back to computers.

BondJamesBond
10-13-2008, 10:16 AM
Cannot verify with thread tags but there were 3: an early one in Oct 07, a late one July 15-17 2008, and one in June 2008 that is really signficant per timing. Sorry not to be of more help.

Excerpt from the forensics report...

ORANGE COUNTY SHERIFF'S OFFICE
08-069208 COMPUTER FORENSICS REPORT
Zenaida Fernandez Gonzalez
A keyword search for "Zenaida" was conducted on the HP desktop computer. The
following files are records of web pages indicating that someone was searching
for that name on the Internet.

Name: casey@www.reunion[2].txt
Description: File, Archive
File Created: 07/16/08 06:21:17AM
Last Accessed: 07/16/08 06:21:27AM
Last Written: 07/16/08 06:21:27AM
Full Path: 08-069208\S013J10X237614\D\Documents and Settings\casey\Cookies\casey@www.reunion[2].txt
zenaida

Name: history.dat
Description: File, Archive
File Created: 10/22/07 01:13:21PM
Last Accessed: 07/16/08 12:03:24PM
Last Written: 07/16/08 12:03:24PM
Full Path: 08-069208\S013J10X237614\D\Documents and Settings\casey\Application
Data\Mozilla\Firefox\Profiles\mfhaxjkl.default\his tory.dat
http://friends.myspace.com/index.cfm?fuseaction=user.viewfriends\ =203461948897ec12-9984-4944-b65e-
6dcef3d5a590=zenaida

Name: index.dat
Description: File, Archive
File Created: 06/12/08 11:15:29PM
Last Accessed: 06/12/08 11:15:29PM
Last Written: 07/16/08 04:20:12PM
Full Path: 08-069208\S013J10X237614\D\Documents and Settings\casey\Local Settings\Temporary Internet
Files\Content.IE5\index.dat
http://clk.atdmt.com/RUC/go/whtpgreu0210000164ruc/direct;at.rucreu00001670;ct.1/01?dispatch=show
SearchRegistration&action=peopleSearch_wp_resultcount&city=&mname=&peopleSearchFrom=wp&affiliate
id=131&searchFirstName=zenaida&searchLastName=Gonzalez&searchAge=25

Name: index.dat
Description: File, Archive
File Created: 06/12/08 11:15:29PM
Last Accessed: 06/12/08 11:15:29PM
Last Written: 07/16/08 04:20:12PM
Full Path: 08-069208\S013J10X237614\D\Documents and Settings\casey\Local Settings\Temporary Internet
Files\Content.IE5\index.dat
http://preview.ussearch.com/preview/ala/newsearch?&searchLName=Fernandez&searchState=FL&searchCi
ty=jacksonville&searchFName=Zenaida&adID=303014F936&adsource=8&TID=0&cid=people&searchtab=people
·ð-·newsearch[2]

Hope this helps. I am not computer forensic savy, but, you need to make sure you pull the string on exactly what this info means before drawing conclusions. I'm sure some WS's will assist w/ any specific questions.

Broderick
10-13-2008, 10:22 AM
The written record is the key here. The file creation date means nothing and the access date depends on the file and when reviewed. File creation is the history files pertinent creation date. You can create a history in IE for instance once you start collection of history. Each time you hit a website it is added as a record to the file as a written record. When you access history to see what history you have in the file, that is accessing the file.

That is the way I understand it as a former IT director. I am not a forensics expert, nor was I in anyway certified in networks or software. Just headed up the departments some years ago.

princess
10-13-2008, 10:26 AM
The ZFG searches were talked about in this thread as well...http://www.websleuths.com/forums/showthread.php?t=70663&highlight=zfg+cookies&page=7

Start at post # 161

Lots of explanations and thoughts about the prior July searches...

I am of the opinion that it is not possible to really know from what LE has released if there were prior searched before the July search, the July search is the only one that is validated.
IMOO though I believe there were but can not of course back it up.

Broderick
10-13-2008, 10:26 AM
Excerpt from the forensics report...

ORANGE COUNTY SHERIFF'S OFFICE
08-069208 COMPUTER FORENSICS REPORT
Zenaida Fernandez Gonzalez
A keyword search for "Zenaida" was conducted on the HP desktop computer. The
following files are records of web pages indicating that someone was searching
for that name on the Internet.

Name: casey@www.reunion[2].txt
Description: File, Archive
File Created: 07/16/08 06:21:17AM
Last Accessed: 07/16/08 06:21:27AM
Last Written: 07/16/08 06:21:27AM
Full Path: 08-069208\S013J10X237614\D\Documents and Settings\casey\Cookies\casey@www.reunion[2].txt
zenaida

Name: history.dat
Description: File, Archive
File Created: 10/22/07 01:13:21PM
Last Accessed: 07/16/08 12:03:24PM
Last Written: 07/16/08 12:03:24PM
Full Path: 08-069208\S013J10X237614\D\Documents and Settings\casey\Application
Data\Mozilla\Firefox\Profiles\mfhaxjkl.default\his tory.dat
http://friends.myspace.com/index.cfm?fuseaction=user.viewfriends\ =203461948897ec12-9984-4944-b65e-
6dcef3d5a590=zenaida

Name: index.dat
Description: File, Archive
File Created: 06/12/08 11:15:29PM
Last Accessed: 06/12/08 11:15:29PM
Last Written: 07/16/08 04:20:12PM
Full Path: 08-069208\S013J10X237614\D\Documents and Settings\casey\Local Settings\Temporary Internet
Files\Content.IE5\index.dat
http://clk.atdmt.com/RUC/go/whtpgreu0210000164ruc/direct;at.rucreu00001670;ct.1/01?dispatch=show
SearchRegistration&action=peopleSearch_wp_resultcount&city=&mname=&peopleSearchFrom=wp&affiliate
id=131&searchFirstName=zenaida&searchLastName=Gonzalez&searchAge=25

Name: index.dat
Description: File, Archive
File Created: 06/12/08 11:15:29PM
Last Accessed: 06/12/08 11:15:29PM
Last Written: 07/16/08 04:20:12PM
Full Path: 08-069208\S013J10X237614\D\Documents and Settings\casey\Local Settings\Temporary Internet
Files\Content.IE5\index.dat
http://preview.ussearch.com/preview/ala/newsearch?&searchLName=Fernandez&searchState=FL&searchCi
ty=jacksonville&searchFName=Zenaida&adID=303014F936&adsource=8&TID=0&cid=people&searchtab=people
·ð-·newsearch[2]

Hope this helps. I am not computer forensic savy, but, you need to make sure you pull the string on exactly what this info means before drawing conclusions. I'm sure some WS's will assist w/ any specific questions.



As my post above explains, the written record to what keywords or history is the only important date. The records on retrieved search results indicates when exactly the actual history "record" was written to the history "files". Creation date is meaningless and only indicates when the file was created and started having records written to it. Access dates are when someone perused history records written in the file.

BondJamesBond
10-13-2008, 10:48 AM
As my post above explains, the written record to what keywords or history is the only important date. The records on retrieved search results indicates when exactly the actual history "record" was written to the history "files". Creation date is meaningless and only indicates when the file was created and started having records written to it. Access dates are when someone perused history records written in the file.

OK...I dunno what I'm talking 'bout here :) ...just trying to restate to test my understanding of Broderick's post w/ hope that it'll be confirmed or corrected and help someone else. My selfish/personal interest is in seeing another WS w/ curiosity, tech knowledge & available time, willing to go through the full forensic report and update the Calendar w/ relevant info (e.g. Father's Day pic downloads 6/17, Diary of Days creation, etc.)

Sooo...Broderick...

IOW...for example, the "index.dat" file was created on 6/12. And, IIRC, this particular file will be likely be written to anytime a user browses w/ that software (e.g. IE5 or Mozilla). If this is correct, then 6/12 may represent a date when the browser software was re-loaded, or something to that effect? That would suggest the 6/12 date corresponding to the index.dat file containing ZFG search text tells nothing more than ZFG was searched for as late as 7/16. Correct? Same w/ the history.dat file and Mozilla too, right?

The "last written" dates will IMHO correspond to Lee et.al. doing searches after Casey gave them info.

Again...my goal just to toss this out there if anyone else is interested/available to tackle. IMHO, it would be helpful. TIA!

BondJamesBond
10-13-2008, 10:52 AM
forensic report here: http://www.cfnews13.com/uploadedFile...s%20Report.pdf

Nana46
10-13-2008, 10:58 AM
forensic report here: http://www.cfnews13.com/uploadedFile...s%20Report.pdf

TY for posting this but I cannot get the link to work...is it not there anymore?

Broderick
10-13-2008, 11:29 AM
OK...I dunno what I'm talking 'bout here :) ...just trying to restate to test my understanding of Broderick's post w/ hope that it'll be confirmed or corrected and help someone else. My selfish/personal interest is in seeing another WS w/ curiosity, tech knowledge & available time, willing to go through the full forensic report and update the Calendar w/ relevant info (e.g. Father's Day pic downloads 6/17, Diary of Days creation, etc.)

Sooo...Broderick...

IOW...for example, the "index.dat" file was created on 6/12. And, IIRC, this particular file will be likely be written to anytime a user browses w/ that software (e.g. IE5 or Mozilla). If this is correct, then 6/12 may represent a date when the browser software was re-loaded, or something to that effect? That would suggest the 6/12 date corresponding to the index.dat file containing ZFG search text tells nothing more than ZFG was searched for as late as 7/16. Correct? Same w/ the history.dat file and Mozilla too, right?

The "last written" dates will IMHO correspond to Lee et.al. doing searches after Casey gave them info.

Again...my goal just to toss this out there if anyone else is interested/available to tackle. IMHO, it would be helpful. TIA!

Yes you are correct as I see it. The index.dat file was created on 6-12 or more importantly the last time the history file was created (it can be created upon first use, reload, load, or deletion of a history file). This setup of the file can also be done in the registry or in the browser setup depending on how much filespace you allocate and how many days you wish to record. The only record found related to searching ZFG was done as a record written to the index file on 7-16 - the same with all the history files. Had there been more searches, it would have reflected that. The forensic team was very specific in saying that no searches or history was created on ZFG prior to 7-16 and the detail proves that. Some folks see the history files, or index files' creation dates whereby records are written to as someone doing something prior to 7-16 which is not the case whatsoever.

BondJamesBond
10-13-2008, 11:59 AM
Yes you are correct as I see it. The index.dat file was created on 6-12 or more importantly the last time the history file was created (it can be created upon first use, reload, load, or deletion of a history file). This setup of the file can also be done in the registry or in the browser setup depending on how much filespace you allocate and how many days you wish to record. The only record found related to searching ZFG was done as a record written to the index file on 7-16 - the same with all the history files. Had there been more searches, it would have reflected that. The forensic team was very specific in saying that no searches or history was created on ZFG prior to 7-16 and the detail proves that. Some folks see the history files, or index files' creation dates whereby records are written to as someone doing something prior to 7-16 which is not the case whatsoever.

Thanks, Broderick. That makes sense to me. Still - I understand why it may be confusing.

Still no takers on updating the calender :(

BondJamesBond
10-13-2008, 11:59 AM
TY for posting this but I cannot get the link to work...is it not there anymore?

"No good deed goes unpunished", eh? I shoulda tested the link. I grabbed it from the Jury Room. Sorry.

SCSam
10-13-2008, 12:06 PM
[quote=BondJamesBond;2809061]Excerpt from the forensics report...
Name: index.dat
Description: File, Archive
File Created: 06/12/08 11:15:29PM
Last Accessed: 06/12/08 11:15:29PM
Last Written: 07/16/08 04:20:12PM
Full Path: 08-069208\S013J10X237614\D\Documents and Settings\casey\Local Settings\Temporary Internet
Files\Content.IE5\index.dat
http://clk.atdmt.com/RUC/go/whtpgreu0210000164ruc/direct;at.rucreu00001670;ct.1/01?dispatch=show
SearchRegistration&action=peopleSearch_wp_resultcount&city=&mname=&peopleSearchFrom=wp&affiliate
id=131&searchFirstName=zenaida&searchLastName=Gonzalez&searchAge=25

Name: index.dat
Description: File, Archive
File Created: 06/12/08 11:15:29PM
Last Accessed: 06/12/08 11:15:29PM
Last Written: 07/16/08 04:20:12PM
Full Path: 08-069208\S013J10X237614\D\Documents and Settings\casey\Local Settings\Temporary Internet
Files\Content.IE5\index.dat
http://preview.ussearch.com/preview/ala/newsearch?&searchLName=Fernandez&searchState=FL&searchCi
ty=jacksonville&searchFName=Zenaida&adID=303014F936&adsource=8&TID=0&cid=people&searchtab=people
·ð-·newsearch[2]Snipped...

Oooo - this does indeed say PREMEDIATED - no??

Nana46
10-13-2008, 12:08 PM
:)"No good deed goes unpunished", eh? I shoulda tested the link. I grabbed it from the Jury Room. Sorry.

Not a problem:)Keep up the good work:clap:

BondJamesBond
10-13-2008, 01:59 PM
[quote=BondJamesBond;2809061]Excerpt from the forensics report...
Name: index.dat
Description: File, Archive
File Created: 06/12/08 11:15:29PM
Last Accessed: 06/12/08 11:15:29PM
Last Written: 07/16/08 04:20:12PM
Full Path: 08-069208\S013J10X237614\D\Documents and Settings\casey\Local Settings\Temporary Internet
Files\Content.IE5\index.dat
http://clk.atdmt.com/RUC/go/whtpgreu0210000164ruc/direct;at.rucreu00001670;ct.1/01?dispatch=show
SearchRegistration&action=peopleSearch_wp_resultcount&city=&mname=&peopleSearchFrom=wp&affiliate
id=131&searchFirstName=zenaida&searchLastName=Gonzalez&searchAge=25

Name: index.dat
Description: File, Archive
File Created: 06/12/08 11:15:29PM
Last Accessed: 06/12/08 11:15:29PM
Last Written: 07/16/08 04:20:12PM
Full Path: 08-069208\S013J10X237614\D\Documents and Settings\casey\Local Settings\Temporary Internet
Files\Content.IE5\index.dat
http://preview.ussearch.com/preview/ala/newsearch?&searchLName=Fernandez&searchState=FL&searchCi
ty=jacksonville&searchFName=Zenaida&adID=303014F936&adsource=8&TID=0&cid=people&searchtab=people
·ð-·newsearch[2]Snipped...

Oooo - this does indeed say PREMEDIATED - no??

...actually, no, I don't think it does (say pre-meditated). Take a look at the dialogue w/ Broderick a page or so back...IMHO, the bolded "File Created" dates are likely just coincidental and not related to the actual time any ZFG info was researched. What we can say is that the computer was used to search for ZFG info on 7/16 using both Internet Explorer & Mozilla...which correlates to Lee, et.al. doing follow-up on the info Casey was giving the family after her arrest. Hope that helps.

LinasK
10-13-2008, 03:13 PM
...actually, no, I don't think it does (say pre-meditated). Take a look at the dialogue w/ Broderick a page or so back...IMHO, the bolded "File Created" dates are likely just coincidental and not related to the actual time any ZFG info was researched. What we can say is that the computer was used to search for ZFG info on 7/16 using both Internet Explorer & Mozilla...which correlates to Lee, et.al. doing follow-up on the info Casey was giving the family after her arrest. Hope that helps.

It does to me!! It screams pre-meditation. She created a Zenaida file as far back as Oct. '07, she accessed it on June 12th. Those dates don't lie. It was also accessed on July 16th, but I'm sure that was Cindy...

BondJamesBond
10-13-2008, 04:31 PM
It does to me!! It screams pre-meditation. She created a Zenaida file as far back as Oct. '07, she accessed it on June 12th. Those dates don't lie. It was also accessed on July 16th, but I'm sure that was Cindy...

Hey, LinasK.

What I'm attempting to say is...based on what I'm gathering from computer techs alot smarter than me (not sayin' alot :) )that the dates associated w/ the creation of those files isn't tied specifically to searches for ZFG. Those files (e.g. index.dat & history.dat) are generic files that are used for a bunch-o-stuff. IOW...it's just a coincidence those file creation dates are anywhere in the range of dates we're interested in...those files are a dumping ground.

Not trying to be argumentative...just tryin' to understand it myself. And, I'm learning...so, I'm open to be corrected @ anytime, by anyone.

LinasK
10-13-2008, 04:37 PM
Hey, LinasK.

What I'm attempting to say is...based on what I'm gathering from computer techs alot smarter than me (not sayin' alot :) )that the dates associated w/ the creation of those files isn't tied specifically to searches for ZFG. Those files (e.g. index.dat & history.dat) are generic files that are used for a bunch-o-stuff. IOW...it's just a coincidence those file creation dates are anywhere in the range of dates we're interested in...those files are a dumping ground.

Not trying to be argumentative...just tryin' to understand it myself. And, I'm learning...so, I'm open to be corrected @ anytime, by anyone.

Just because she didn't search for Z until June, she was already thinking about it as far back as Oct. Why else create a Zenaida file back then??? She was already trying to frame her, just hadn't made it a point or found the time to do it until days before she killed Caylee. She also searched missing children's websites back in March. All of this and the chloroform searches scream pre-meditation.

Broderick
10-13-2008, 04:45 PM
Just because she didn't search for Z until June, she was already thinking about it as far back as Oct. Why else create a Zenaida file back then??? She was already trying to frame her, just hadn't made it a point or found the time to do it until days before she killed Caylee. She also searched missing children's websites back in March. All of this and the chloroform searches scream pre-meditation.

LOL, they are NOT ZFG files. They are generic index files created either when the computer was first fired up or when the history files were created (which will have ALL search information). It collects search information as records from that point on. There is absolutely no indication that the computers ever saw any search or information of ZFG prior to July 16th. Sorry, this forensic release does not help premediation. It only tells us that whoever was at the computer on JULY 16 of 2008, did searches for ZFG.

BonKai
10-13-2008, 04:46 PM
Shouldn't be too hard to find the ISP of the email sender. Just hope we hear more about this because I do feel it's an important issue.

I'll bet the GJ hears about it tomorrow. (Wish I could be a fly on that wall!)

BonKai
10-13-2008, 04:49 PM
There are many email anonymizers out there on the net - anyone can send someone an email anonymously by funneling it though the anonymizer ... the send can make it look like the email came from any given name/company, etc. that they choose...

I do not know anything about anonymizers. Wouldn't it still show that is was sent via a certain computer?

HRCODEPINK
10-13-2008, 05:04 PM
Sorry if this has been covered, but is this a new spoof email from work, or is it the ones that they already gave us in the first 400 pages....pages 411 - 415?

If it is those, they are all from Yahoo addresses which tells me that she spent a day making up yahoo addresses and faking emails to herself. Might have even been smart enough to at least go to a library, but I doubt it. Guaranteed none of them came from Universal.

truthsleuth
10-13-2008, 05:12 PM
Snip:

... KC is truly ignorant. But for LE and most of us, that is a plus sign.

Type away, murderous vixen that destroys it's young.

Ok back to computers.

Every day I have resisted calling her a moron just to be polite. But after your fabulous "murderous vixen that destroys its young" remark, I thought, what the heck? Why not? ...

So here you go, Mrs. Peel, in your honor:
Casey Anthony is a moron.

I'm so proud of myself. :)

JWG
12-09-2008, 08:57 AM
Time to bump this thread up some and updating what we know from the computer searches. In particular, some of the information we have from various computer searches can help fill gaps in our understanding of where Casey was.

For example, if she was on the HP desktop, she had to be at mom and dad's.

If she was on her laptop, she probably had to be at Tony's or Amy's where she could get an internet connection. Yes, she could have been at Starbuck's. But doubtful she was at Jay Blanchard Park.

Of course, this does mean a more meaty post is forthcoming :).

BondJamesBond
12-09-2008, 09:29 AM
Time to bump this thread up some and updating what we know from the computer searches. In particular, some of the information we have from various computer searches can help fill gaps in our understanding of where Casey was.

For example, if she was on the HP desktop, she had to be at mom and dad's.

If she was on her laptop, she probably had to be at Tony's or Amy's where she could get an internet connection. Yes, she could have been at Starbuck's. But doubtful she was at Jay Blanchard Park.

Of course, this does mean a more meaty post is forthcoming :).

Drop the hammer...:highfive:

JWG
12-09-2008, 09:56 AM
On pages 2844 and 2845 are two screen shots of a computer forensic application called Encase Law Enforcement. It appears that this program is reporting the number of files that were created / written / accessed / modified / deleted. The data is summarized to show hourly activity on the HP desktop and Compaq laptop by hour for the days of June 16 and June 17. Although we do not know exactly what each "dot" means in the plot, we can use the information to see a relative usage pattern.

I am going to make the following assumptions:
1) The HP desktop always stays in the Anthony home
2) The Compaq laptop traveled around with Casey
3) Cindy's working hours ~ 8-5 PM so not at home during that time
4) George's working hours ~ 2-10 PM so not at home during that time
5) Cindy clearly used computer for email and managing social networking page
6) Not sure what George's usage of computer was, but reasonable to assume he surfed as well.

Looking back at the screen shot, although we do not know exactly what each "dot" means in the plot, we can use the information to see a relative usage pattern. What I have done below is show the relative usage of the two computers, as reported by EnCase. The 100% from 9-10 PM on the 17th for the Compaq computer means that was the most active computer usage for either computer during the two days. A 49% from 12-1 AM on the 16th for the desktop means the computer was roughly half as active as the previous example.


HP Desktop Compaq Laptop
16-Jun
12AM 1AM 49% *****
7AM 8AM 74% *******
8AM 9AM 15% **
10AM 11AM 80% ********
11AM 12PM 49% ***** 0%
1PM 2PM 1%
2PM 3PM 82% ******** 1%
4PM 5PM 1%
11PM 12AM 23% **
17-Jun
12AM 1AM 3%
1AM 2AM 6% *
3AM 4AM 36% ****
4AM 5AM 5% *
8AM 9AM 5% *
12PM 1PM 26% ***
1PM 2PM 3%
2PM 3PM 80% ********
4PM 5PM 13% *
7PM 8PM 54% *****
8PM 9PM 44% ****
9PM 10PM 100% **********
10PM 11PM 65% *****
11PM 12AM 6% *

My interpretation is as follows:

The HP computer had relatively light usage on the 17th. I believe this was likely indicative of the parent's computer usage. The 11PM to 1AM usage into the 17th is probably Cindy, and after that is probably George - based on when each has to get up for work in the AM. Yes, seems odd for George, but maybe he was surfing Websleuths. :waitasec:

KC was a very active user, based on what we see with the Compaq on the 17th. Thus, based on the level of activity and the assumptions I listed above, I humbly conclude the following:

KC spent the night of the 15th / morning of the 16 at her parents. She is very active on the HP in the morning, probably before Caylee gets up. Caylee gets up between 8 and 9, usage drops. Caylee then plays or watches TV from 9-10 while Casey gets back on the computer until noon.

From noon to 2 PM there is no HP activity, supporting George's statements he saw the two and they left around 1 PM. However, from 2 to 3 - after George has left for work - the usage goes way up. This is the second most active period of either computer during this time.

Usage abruptly ends at 3 PM. I suspect Casey was preoccupied from 2 to 3 and not paying attention to Caylee. Around 3 PM, I submit, is when Casey discovers something awful happened to Caylee. :eek:

The minimal activity seen on the Compaq (and I do mean minimal) can easily be explained by the laptop being powered on and open and connected to the internet. This alone will cause some small number of files to be accessed and modified. Casey did not really need to be doing anything on the computer.

BondJamesBond
12-09-2008, 10:14 AM
FWIW...some other information about what was going on in the same timeframe...

Monday, 6/16 Noon-2PM Casey 5 out of 6 pings are on the cell tower closest to Lee's (a.k.a.Twr 22).
Monday, 6/16 3:04:06 PM INCOMING CALL George A. (Cell) Casey A. 0.4 mins


Tuesday, 6/17, 3:15PM Casey texts Amy, "can't wait to finally get you moved in""
Tuesday, 6/17, 3:31PM the nursing home pics of Caylee are downloaded onto the laptop.

Georgia101957
12-09-2008, 10:17 AM
Snipped
Around 3 PM, I submit, is when Casey discovers something awful happened to Caylee.


and would that tie in with the flurry of phone calls? Great sleuthing!

Devon
12-09-2008, 10:21 AM
On pages 2844 and 2845 are two screen shots of a computer forensic application called Encase Law Enforcement. It appears that this program is reporting the number of files that were created / written / accessed / modified / deleted. The data is summarized to show hourly activity on the HP desktop and Compaq laptop by hour for the days of June 16 and June 17. Although we do not know exactly what each "dot" means in the plot, we can use the information to see a relative usage pattern.

I am going to make the following assumptions:
1) The HP desktop always stays in the Anthony home
2) The Compaq laptop traveled around with Casey
3) Cindy's working hours ~ 8-5 PM so not at home during that time
4) George's working hours ~ 2-10 PM so not at home during that time
5) Cindy clearly used computer for email and managing social networking page
6) Not sure what George's usage of computer was, but reasonable to assume he surfed as well.

Looking back at the screen shot, although we do not know exactly what each "dot" means in the plot, we can use the information to see a relative usage pattern. What I have done below is show the relative usage of the two computers, as reported by EnCase. The 100% from 9-10 PM on the 17th for the Compaq computer means that was the most active computer usage for either computer during the two days. A 49% from 12-1 AM on the 16th for the desktop means the computer was roughly half as active as the previous example.


HP Desktop Compaq Laptop
16-Jun
12AM 1AM 49% *****
7AM 8AM 74% *******
8AM 9AM 15% **
10AM 11AM 80% ********
11AM 12PM 49% ***** 0%
1PM 2PM 1%
2PM 3PM 82% ******** 1%
4PM 5PM 1%
11PM 12AM 23% **
17-Jun
12AM 1AM 3%
1AM 2AM 6% *
3AM 4AM 36% ****
4AM 5AM 5% *
8AM 9AM 5% *
12PM 1PM 26% ***
1PM 2PM 3%
2PM 3PM 80% ********
4PM 5PM 13% *
7PM 8PM 54% *****
8PM 9PM 44% ****
9PM 10PM 100% **********
10PM 11PM 65% *****
11PM 12AM 6% *

My interpretation is as follows:

The HP computer had relatively light usage on the 17th. I believe this was likely indicative of the parent's computer usage. The 11PM to 1AM usage into the 17th is probably Cindy, and after that is probably George - based on when each has to get up for work in the AM. Yes, seems odd for George, but maybe he was surfing Websleuths. :waitasec:

KC was a very active user, based on what we see with the Compaq on the 17th. Thus, based on the level of activity and the assumptions I listed above, I humbly conclude the following:

KC spent the night of the 15th / morning of the 16 at her parents. She is very active on the HP in the morning, probably before Caylee gets up. Caylee gets up between 8 and 9, usage drops. Caylee then plays or watches TV from 9-10 while Casey gets back on the computer until noon.

From noon to 2 PM there is no HP activity, supporting George's statements he saw the two and they left around 1 PM. However, from 2 to 3 - after George has left for work - the usage goes way up. This is the second most active period of either computer during this time.

Usage abruptly ends at 3 PM. I suspect Casey was preoccupied from 2 to 3 and not paying attention to Caylee. Around 3 PM, I submit, is when Casey discovers something awful happened to Caylee. :eek:

The minimal activity seen on the Compaq (and I do mean minimal) can easily be explained by the laptop being powered on and open and connected to the internet. This alone will cause some small number of files to be accessed and modified. Casey did not really need to be doing anything on the computer.

This fits in very well with the theory that I have been nursing along for some time now, although I suspected that it was either during her long phone call that afternoon (with Amy?) or whilst she was on the PC. I also think the 'ladder still by the pool and gate left open' incident mentioned by GA/CA may have been on the same day.

JWG
12-09-2008, 10:28 AM
This fits in very well with the theory that I have been nursing along for some time now, although I suspected that it was either during her long phone call that afternoon (with Amy?) or whilst she was on the PC. I also think the 'ladder still by the pool and gate left open' incident mentioned by GA/CA may have been on the same day.

Yes, Casey was very distracted from 1:45 until just after 3, with the Amy call, computer work, and Jesse G. call. She was not paying close attention to Caylee, IMO.

BondJamesBond
12-09-2008, 10:30 AM
This fits in very well with the theory that I have been nursing along for some time now, although I suspected that it was either during her long phone call that afternoon (with Amy?) or whilst she was on the PC. I also think the 'ladder still by the pool and gate left open' incident mentioned by GA/CA may have been on the same day.

...doesn't necessarily change your generally theory, but, FWIW, after the long call w/ Amy is the 11min call w/ Jesse when he stated he heard Caylee...just FYI. The "flurry" started @ 4:10PM. George called right on the heal of the end of Jesse's call for <1min @ 3:04PM. Between 3:04PM and the start of the flurry of calls @ 4:10PM there is less than 1minute cumulative phone time (texts & calls), and no computer activity. Of course, this means you have to buy Jesse's statement...or....something happened immediately after he heard Caylee and Casey was distracted otherwise...

Apologies in advance...since the call info OT to computer forensics, but, IMHO, relevant to using in combo w/ computer forensics to establish what was actually going on.

21merc7
12-09-2008, 10:49 AM
Thinking of Jesse's statement, when were the photos and videos of Caylee being downloaded? Could the perp have been listening to those when talking with Jesse, or they were just playing in the background on the computer, you see where I am going with that...

JWG
12-09-2008, 10:52 AM
Thinking of Jesse's statement, when were the photos and videos of Caylee being downloaded? Could the perp have been listening to those when talking with Jesse, or they were just playing in the background on the computer, you see where I am going with that...

The videos and pictures, I thought, were downloaded the following day - the 17th. However, that does not mean KC was not viewing them during the call with Jesse.

Also, I thought that Jesse mentioned hearing Caylee on the 24th, and then later retracted that.

Do we have a statement from Jesse pinpointing the 16th as a date when he heard Caylee?

Devon
12-09-2008, 10:59 AM
Similarly with apologies for being O/T, but if my hunches are correct, I can't help thinking that if just one of those 'flurry' calls had been answered, KC might now be facing trial for alleged murder.

21merc7
12-09-2008, 11:00 AM
The videos and pictures, I thought, were downloaded the following day - the 17th. However, that does not mean KC was not viewing them during the call with Jesse.

Also, I thought that Jesse mentioned hearing Caylee on the 24th, and then later retracted that.

Do we have a statement from Jesse pinpointing the 16th as a date when he heard Caylee?

http://www.websleuths.com/forums/showthread.php?t=72088

oops, this pdf http://flawebhosting.net/docs092308/jg092308.pdf

page 14

Still looking around, may add.

Adding page 14 through 16.

Devon
12-09-2008, 11:04 AM
...doesn't necessarily change your generally theory, but, FWIW, after the long call w/ Amy is the 11min call w/ Jesse when he stated he heard Caylee...just FYI. The "flurry" started @ 4:10PM. George called right on the heal of the end of Jesse's call for <1min @ 3:04PM. Between 3:04PM and the start of the flurry of calls @ 4:10PM there is less than 1minute cumulative phone time (texts & calls), and no computer activity. Of course, this means you have to buy Jesse's statement...or....something happened immediately after he heard Caylee and Casey was distracted otherwise...

Apologies in advance...since the call info OT to computer forensics, but, IMHO, relevant to using in combo w/ computer forensics to establish what was actually going on.

Since it appears that KC spent half of the previous night (early hours 16/6) texting and talking to AL, it is possible that she may even have been dozing during the period you highlighted above. Just a thought.

JWG
12-09-2008, 11:07 AM
http://www.websleuths.com/forums/showthread.php?t=72088

oops, this pdf http://flawebhosting.net/docs092308/jg092308.pdf

page 14

Still looking around, may add.

Adding page 14 through 16.

OK, I see it (evidence page 1517 for those that keep track of the dumps in this way).

It seems from his statement that he is pretty sure he heard Caylee, but perhaps not 100%. Not unusual to hear her in the background, he noted.

21merc7
12-09-2008, 11:09 AM
Yeah, guess I got carried away. We still do not know how many older videos could have been on the computer either. But, it would be interesting if the computer would show activity during the calls with Jesse.

BondJamesBond
12-09-2008, 01:22 PM
FWIW...some other information about what was going on in the same timeframe...

Monday, 6/16 Noon-2PM Casey 5 out of 6 pings are on the cell tower closest to Lee's (a.k.a.Twr 22).
Monday, 6/16 3:04:06 PM INCOMING CALL George A. (Cell) Casey A. 0.4 mins


Tuesday, 6/17, 3:15PM Casey texts Amy, "can't wait to finally get you moved in""
Tuesday, 6/17, 3:31PM the nursing home pics of Caylee are downloaded onto the laptop.

Yes...(see above) pics were downloaded on 6/17. Maybe confusing, but, thought these items would help establish Casey as the user for the times were discussing...6/16 and 6/17...perhaps not necessary, but, since we can...wth.

Chezhire
12-09-2008, 01:25 PM
SNIPPED: "... Usage abruptly ends at 3 PM. I suspect Casey was preoccupied from 2 to 3 and not paying attention to Caylee. Around 3 PM, I submit, is when Casey discovers something awful happened to Caylee. :eek: . . ."

You're assuming she found her after something awful happened and that Casey did not cause something awful to happen to Caylee. :(

Chezhire
12-09-2008, 01:28 PM
SNIPPED: "... Also, I thought that Jesse mentioned hearing Caylee on the 24th, and then later retracted that.

Do we have a statement from Jesse pinpointing the 16th as a date when he heard Caylee?


No, you're correct, he originally believed he'd heard Caylee on June 24, and later recanted being certain he'd heard Caylee that date. No other dates have been in the information we have to date.

JWG
12-09-2008, 01:29 PM
You're assuming she found her after something awful happened and that Casey did not cause something awful to happen to Caylee. :(

That is correct. All along I have believed this all started with a tragic and avoidable accident. A circuit-breaker tripped in Casey's brain that made a very bad situation a whole lot worse. :(

Probably a topic for the Theories thread.

BondJamesBond
12-09-2008, 01:39 PM
On pages 2844 and 2845 are two screen shots of a computer forensic application called Encase Law Enforcement. It appears that this program is reporting the number of files that were created / written / accessed / modified / deleted. The data is summarized to show hourly activity on the HP desktop and Compaq laptop by hour for the days of June 16 and June 17. Although we do not know exactly what each "dot" means in the plot, we can use the information to see a relative usage pattern.

I am going to make the following assumptions:
1) The HP desktop always stays in the Anthony home
2) The Compaq laptop traveled around with Casey
3) Cindy's working hours ~ 8-5 PM so not at home during that time
4) George's working hours ~ 2-10 PM so not at home during that time
5) Cindy clearly used computer for email and managing social networking page
6) Not sure what George's usage of computer was, but reasonable to assume he surfed as well.

Looking back at the screen shot, although we do not know exactly what each "dot" means in the plot, we can use the information to see a relative usage pattern. What I have done below is show the relative usage of the two computers, as reported by EnCase. The 100% from 9-10 PM on the 17th for the Compaq computer means that was the most active computer usage for either computer during the two days. A 49% from 12-1 AM on the 16th for the desktop means the computer was roughly half as active as the previous example.


HP Desktop Compaq Laptop
16-Jun
12AM 1AM 49% *****
7AM 8AM 74% *******
8AM 9AM 15% **
10AM 11AM 80% ********
11AM 12PM 49% ***** 0%
1PM 2PM 1%
2PM 3PM 82% ******** 1%
4PM 5PM 1%
11PM 12AM 23% **
17-Jun
12AM 1AM 3%
1AM 2AM 6% *
3AM 4AM 36% ****
4AM 5AM 5% *
8AM 9AM 5% *
12PM 1PM 26% ***
1PM 2PM 3%
2PM 3PM 80% ********
4PM 5PM 13% *
7PM 8PM 54% *****
8PM 9PM 44% ****
9PM 10PM 100% **********
10PM 11PM 65% *****
11PM 12AM 6% *

My interpretation is as follows:

The HP computer had relatively light usage on the 17th. I believe this was likely indicative of the parent's computer usage. The 11PM to 1AM usage into the 17th is probably Cindy, and after that is probably George - based on when each has to get up for work in the AM. Yes, seems odd for George, but maybe he was surfing Websleuths. :waitasec:

KC was a very active user, based on what we see with the Compaq on the 17th. Thus, based on the level of activity and the assumptions I listed above, I humbly conclude the following:

KC spent the night of the 15th / morning of the 16 at her parents. She is very active on the HP in the morning, probably before Caylee gets up. Caylee gets up between 8 and 9, usage drops. Caylee then plays or watches TV from 9-10 while Casey gets back on the computer until noon.

From noon to 2 PM there is no HP activity, supporting George's statements he saw the two and they left around 1 PM. However, from 2 to 3 - after George has left for work - the usage goes way up. This is the second most active period of either computer during this time.

Usage abruptly ends at 3 PM. I suspect Casey was preoccupied from 2 to 3 and not paying attention to Caylee. Around 3 PM, I submit, is when Casey discovers something awful happened to Caylee. :eek:

The minimal activity seen on the Compaq (and I do mean minimal) can easily be explained by the laptop being powered on and open and connected to the internet. This alone will cause some small number of files to be accessed and modified. Casey did not really need to be doing anything on the computer.

First - huge TY to JWG for taking the time to lay all this out!

Not debating this theory...there's room for plenty-o-theories...just thought I'd toss 'nother one out there...jus' for grins. :)

IIRC, Tony stayed home from class 6/17 to be w/ Casey, yet, he wasn't certain Casey actually stayed WITH HIM that night (someone ck me please). He could be saying 6/16PM-6/17AM vs. 6/17PM-6/18AM.

Let's say...for speculating purposes based on the computer forensics...

1) The HP usage 6/17 1AM-5AM was Casey...seems like Casey-time, IMHO.
2) This would mean, IF proven with the use details, Casey went back to G&C's 6/16 after 11:17PM (her last ping @ Tony's apt.) without Caylee. IF she encountered anyone @ G&C's it woulda been George (Cindy sleeping for work). Casey coulda told George she left Caylee with the Nanny since she allegedly already told George they might stay out that night anyway when they allegedly left ~12:50PM Monday, 6/16.
3) Casey coulda used the HP to look-up some stuff until 5'ish, then, drove back to Tony's...her first ping-o-the-day being @ 10:52AM @ Tony's 6/17.

This scenario would have George & Cindy covering a...Casey-came-home-without-Caylee 6/16PM...which would blow even bigger holes in the defense than already exist today.

cuppy199
12-09-2008, 01:48 PM
You're assuming she found her after something awful happened and that Casey did not cause something awful to happen to Caylee. :(

I think its easy for some to come to that conclusion because 1 She is a pretty young women and 2 Her friends say she was a good mother. But lets not forget these are the same friends that have been lied to and fooled for years.And as far as looks go well looks can be deceiving and in this case IMO are. Sorry I just dont buy its a accident gone wrong. She a good actress I give her that. But even actress have a soul and IMO thats something KC lacks:)

JWG
12-09-2008, 01:53 PM
First - huge TY to JWG for taking the time to lay all this out!

Not debating this theory...there's room for plenty-o-theories...just thought I'd toss 'nother one out there...jus' for grins. :)

IIRC, Tony stayed home from class 6/17 to be w/ Casey, yet, he wasn't certain Casey actually stayed WITH HIM that night (someone ck me please). He could be saying 6/16PM-6/17AM vs. 6/17PM-6/18AM.

Let's say...for speculating purposes based on the computer forensics...

1) The HP usage 6/17 1AM-5AM was Casey...seems like Casey-time, IMHO.
2) This would mean, IF proven with the use details, Casey went back to G&C's after 11:17PM (her last ping @ Tony's apt.) without Caylee. IF she encountered anyone @ G&C's it woulda been George (Cindy sleeping for work). Casey coulda told George she left Caylee with the Nanny since she allegedly already told George they might stay out that night anyway when they allegedly left ~12:50PM Monday, 6/16.
3) Casey coulda used the HP to look-up some stuff until 5'ish, then, drove back to Tony's...her first ping-o-the-day being @ 10:52AM @ Tony's 6/17.

This scenario would have George & Cindy covering a...Casey-came-home-without-Caylee 6/16PM...which would blow even bigger holes in the defense than already exist today.

I will have to chew on that, but possible. Evidence page 2499 says AL skipped school on the 17th to sleep in with Casey. He does not mention her leaving after they watch movies and then coming back.

Chezhire
12-09-2008, 01:55 PM
That is correct. All along I have believed this all started with a tragic and avoidable accident. A circuit-breaker tripped in Casey's brain that made a very bad situation a whole lot worse. :(

Probably a topic for the Theories thread.

O/T, but thanks for your posts today on this thread - they are very helpful to me in terms of firming up my thoughts on what time Caylee died. :)

faefrost
12-09-2008, 02:15 PM
Sorry, I don't buy the tragic accident. She was given plenty of oportunities to BS her way out that way and didn't take them. Because all would have required her to reveal where caylee is. There is something about the body that would directly implicate her in a deliberate act.

One thing I would be interested to see is what network the laptop was connected to during each period of activity?

natsound
12-09-2008, 02:20 PM
That is correct. All along I have believed this all started with a tragic and avoidable accident. A circuit-breaker tripped in Casey's brain that made a very bad situation a whole lot worse. :(

Probably a topic for the Theories thread.

JWG, I'm really on the fence on whether Caylee was murdered or if it was an accident. I love your theory. BUT, where does chloroform fit in, and how about KC's partying, nonchalant attitude, who gives a ***** attitude after the fact? And what do you make of the death & neck breaking searches back in March?

BondJamesBond
12-09-2008, 02:34 PM
...doesn't necessarily change your generally theory, but, FWIW, after the long call w/ Amy is the 11min call w/ Jesse when he stated he heard Caylee...just FYI. The "flurry" started @ 4:10PM. George called right on the heal of the end of Jesse's call for <1min @ 3:04PM. Between 3:04PM and the start of the flurry of calls @ 4:10PM there is less than 1minute cumulative phone time (texts & calls), and no computer activity. Of course, this means you have to buy Jesse's statement...or....something happened immediately after he heard Caylee and Casey was distracted otherwise...

Apologies in advance...since the call info OT to computer forensics, but, IMHO, relevant to using in combo w/ computer forensics to establish what was actually going on.

...with some attempt to keep one foot on the "computer forensics" path and keeping with theory development from it...

I'm seeing that Casey had almost an hour of uninterrupted time between 3:04PM and 4:10PM when she wasn't on the computer (tie to forensics :)) and she wasn't on the phone (except a ~30sec call to Tony @ 3:35PM) IMMEDIATELY before the "flurry" begins @ 4:10PM.

Soo...this doesn't prove whether or not she was distracted OR engaged in nefarious activity...either way....jus' pick the one you wanna work with for now.

JWG
12-09-2008, 06:43 PM
Soo...this doesn't prove whether or not she was distracted OR engaged in nefarious activity...either way....jus' pick the one you wanna work with for now.

My working hypothesis is a little different. I am guessing she was distracted up until 3:00, to the point where her call with JG ended. Then she realized Caylee was not around. From 3:00 to 4:00 she was engaged in a search, attempted resuscitation, and panic. Her reaction was classic me-first Casey: what's CA going to think? I'm in trouble. I gotta make up a story. Her reaction was not about Caylee.

Part of 3:00 to 4:00 is making up the story about whatever happened. Once she had her story straight, she started the flurry of phone calls, but cannot reach anyone. She could not execute this brand new plan. So now she thinks I gotta get outta here. And I can't come back to stay without Caylee. She decides to subtley move in with Tony at that point.

Of course, nothing but a working hypothesis. :waitasec:

Chilly Willy
12-09-2008, 06:48 PM
My working hypothesis is a little different. I am guessing she was distracted up until 3:00, to the point where her call with JG ended. Then she realized Caylee was not around. From 3:00 to 4:00 she was engaged in a search, attempted resuscitation, and panic. Her reaction was classic me-first Casey: what's CA going to think? I'm in trouble. I gotta make up a story. Her reaction was not about Caylee.

Part of 3:00 to 4:00 is making up the story about whatever happened. Once she had her story straight, she started the flurry of phone calls, but cannot reach anyone. She could not execute this brand new plan. So now she thinks I gotta get outta here. And I can't come back to stay without Caylee. She decides to subtley move in with Tony at that point.

Of course, nothing but a working hypothesis. :waitasec:

This is very close to what I believe happened.

BondJamesBond
12-10-2008, 05:45 AM
My working hypothesis is a little different. I am guessing she was distracted up until 3:00, to the point where her call with JG ended. Then she realized Caylee was not around. From 3:00 to 4:00 she was engaged in a search, attempted resuscitation, and panic. Her reaction was classic me-first Casey: what's CA going to think? I'm in trouble. I gotta make up a story. Her reaction was not about Caylee.

Part of 3:00 to 4:00 is making up the story about whatever happened. Once she had her story straight, she started the flurry of phone calls, but cannot reach anyone. She could not execute this brand new plan. So now she thinks I gotta get outta here. And I can't come back to stay without Caylee. She decides to subtley move in with Tony at that point.

Of course, nothing but a working hypothesis. :waitasec:

ok...I think I gotcha now. Following this, the Jesse-hearing-Caylee-(or not) would just serve to narrow down to a finer point the time went something went wrong.

TripleA
12-10-2008, 10:11 AM
The early morning activity could be an automatic update/back-up/virus scan. Mine runs from 3-4 am.

JWG
12-10-2008, 10:16 AM
The early morning activity could be an automatic update/back-up/virus scan. Mine runs from 3-4 am.

Good point. I normally do not leave my desktop computer on overnight. To me it is like leaving a light on in a room (actually, four lights). But, I recently learned my parents and one brother do, so it may not be all that uncommon.

passionflower
12-10-2008, 10:26 AM
Sorry, I don't buy the tragic accident. She was given plenty of oportunities to BS her way out that way and didn't take them. Because all would have required her to reveal where caylee is. There is something about the body that would directly implicate her in a deliberate act.

One thing I would be interested to see is what network the laptop was connected to during each period of activity?

Not an accident......KC would call 911, or CA/GA would if KC called anyone!
KC would have tremdous sympathy from all. IMO, she investigated ways to murder some one on computer........shovel, household weapons and choroform,
not buying accident..........killing in a rage maybe, but I feel premeditated,
get rid of the snothead theory. Bless little Caylee :furious:

theskredes
12-10-2008, 10:43 AM
Snipped

From noon to 2 PM there is no HP activity, supporting George's statements he saw the two and they left around 1 PM. However, from 2 to 3 - after George has left for work - the usage goes way up. This is the second most active period of either computer during this time.

Usage abruptly ends at 3 PM. I suspect Casey was preoccupied from 2 to 3 and not paying attention to Caylee. Around 3 PM, I submit, is when Casey discovers something awful happened to Caylee. :eek:



I just wanted to comment that I have a daughter just about the same age as Caylee. So I am pretty experienced in toddler behavior. I know that if you get them out of their 'routine' that they are pretty unruley. This is what I see: Noon to 2 no activity- This could be lunch and getting ready for naps. If GA says he saw them leave, that may be true, but KC might have brought her back for a nap a little later. This would explain the 2-3 very active computer time. This could be when Caylee is napping. I just don't see KC leaving at that time for all afternoon. Toddlers need their naps and this gives her plenty of alone time to do her computer stuff.

JWG
12-10-2008, 10:49 AM
I just wanted to comment that I have a daughter just about the same age as Caylee. So I am pretty experienced in toddler behavior. I know that if you get them out of their 'routine' that they are pretty unruley. This is what I see: Noon to 2 no activity- This could be lunch and getting ready for naps. If GA says he saw them leave, that may be true, but KC might have brought her back for a nap a little later. This would explain the 2-3 very active computer time. This could be when Caylee is napping. I just don't see KC leaving at that time for all afternoon. Toddlers need their naps and this gives her plenty of alone time to do her computer stuff.

I agree they need their naps, but my experience with my now 4 1/2 year old girl was, she stopped napping just after she turned 1. Not my choice - hers. She would play quietly during "nap time" until about 2 years of age, and then after that she played wherever.

She needed the nap as 5 PM meltdowns proved, but there was nothing I could do short of sedation to get her to sleep.

Did I just say sedation? :waitasec:

Theonly1
12-10-2008, 11:10 AM
First - huge TY to JWG for taking the time to lay all this out!

Not debating this theory...there's room for plenty-o-theories...just thought I'd toss 'nother one out there...jus' for grins. :)

IIRC, Tony stayed home from class 6/17 to be w/ Casey, yet, he wasn't certain Casey actually stayed WITH HIM that night (someone ck me please). He could be saying 6/16PM-6/17AM vs. 6/17PM-6/18AM.

Let's say...for speculating purposes based on the computer forensics...

1) The HP usage 6/17 1AM-5AM was Casey...seems like Casey-time, IMHO.
2) This would mean, IF proven with the use details, Casey went back to G&C's 6/16 after 11:17PM (her last ping @ Tony's apt.) without Caylee. IF she encountered anyone @ G&C's it woulda been George (Cindy sleeping for work). Casey coulda told George she left Caylee with the Nanny since she allegedly already told George they might stay out that night anyway when they allegedly left ~12:50PM Monday, 6/16.
3) Casey coulda used the HP to look-up some stuff until 5'ish, then, drove back to Tony's...her first ping-o-the-day being @ 10:52AM @ Tony's 6/17.

This scenario would have George & Cindy covering a...Casey-came-home-without-Caylee 6/16PM...which would blow even bigger holes in the defense than already exist today.

While the HP usage on June 17 does seem like "Casey-time" don't you find returning to the A family home in the wee hours of the morning without Caylee just a bit too risky for Casey?

Perhaps GA or CA simply woke up and decided to get on the computer. If we knew what websites were being accessed at that time I'm sure we'd know exactly who was on the HP computer.

If Casey did come home in the dark of night, without Caylee, and got on the home computer then I would assume what she needed to do must have been VERY IMPORTANT (like deleting stuff?).

T

chris1990
12-10-2008, 11:13 AM
this thought just came to me. 6/16 she calls AL (i think 3:35) wants to watch movies and spend the night, he agrees to not go in to class on the 17th so they can spend time together. Maybe the flurry of calls was so mom & dad would babysit. But, no answer, she thinks they are avoiding her because of the fight this makes her angry and she kills Caylee. Now she can stay with AL. just a theory.

debs
12-10-2008, 11:38 AM
With regard to the late night computer activity, I wonder, with Cindy's penchant for having to know all details of absolutely everything in her family, that there were nights when she decided to get up and check to see what George had been doing online. From what we have learned of their marriage, she would be pretty mistrustful of him, and from what she's shared of her personality, I would have to keep this as a possibility.

JWG
12-10-2008, 12:02 PM
While the HP usage on June 17 does seem like "Casey-time" don't you find returning to the A family home in the wee hours of the morning without Caylee just a bit too risky for Casey?

Perhaps GA or CA simply woke up and decided to get on the computer. If we knew what websites were being accessed at that time I'm sure we'd know exactly who was on the HP computer.

If Casey did come home in the dark of night, without Caylee, and got on the home computer then I would assume what she needed to do must have been VERY IMPORTANT (like deleting stuff?).

T

I don't believe the early morning usage on the 17th was Casey. She would have to have a darn good reason to want to sneak out of bed from AL, sneak into mom and dad's, use the computer, sneak back out of mom and dad's and sneak back into bed at AL's. Any one step might be possible but successfully executing all five seems highly unlikely.

And again, what would the reason be? We already know she returned there on the afternoon of the 17th, 18th, and 20th during the afternoon when mom and dad were not there.

Mendara
12-10-2008, 12:18 PM
this thought just came to me. 6/16 she calls AL (i think 3:35) wants to watch movies and spend the night, he agrees to not go in to class on the 17th so they can spend time together. Maybe the flurry of calls was so mom & dad would babysit. But, no answer, she thinks they are avoiding her because of the fight this makes her angry and she kills Caylee. Now she can stay with AL. just a theory.

The simplest theory is at times the answer. But the cloroform searches early one with the other searches throws this off. Unless she planned to kill her at a later time and the day came earlier. Or her plan was always to keep her drugged in the car while she hung out and then one day it became too much and she ended it.

Mendara
12-10-2008, 12:19 PM
With regard to the late night computer activity, I wonder, with Cindy's penchant for having to know all details of absolutely everything in her family, that there were nights when she decided to get up and check to see what George had been doing online. From what we have learned of their marriage, she would be pretty mistrustful of him, and from what she's shared of her personality, I would have to keep this as a possibility.

Well he did lose the family's savings on an internet scam which he blamed on internet gambling.

JWG
12-10-2008, 12:52 PM
The simplest theory is at times the answer. But the cloroform searches early one with the other searches throws this off. Unless she planned to kill her at a later time and the day came earlier. Or her plan was always to keep her drugged in the car while she hung out and then one day it became too much and she ended it.

I agree, simpler is better.

The searches in question were done 3 months prior. Maybe they are related to Caylee's death, maybe not. Remember she was still dating Ric at the time and he had that chloroform picture on his myspace, probably to be funny (hey, I have an odd sense of humor too that may not be shared by all others).

So, perhaps Casey just thought she'd poke around on the web to learn more. And in the process of clicking around she ran across more things that caused her to throw some odd stuff into Google. What we see right now in the evidence dump is search history on a few interesting words, but what we don't see is the total context - especially all the web pages she subsequently visited.

I am willing to bet that if I randomly selected anyone on Websleuths for a computer forensic examination that I could cherry pick their Google search history and imply a very chilling and sinister plot was brewing in their mind.
:devil:

Consider this: the prosecutors office is cherry-picking what they release to the public - release large amounts of information that may have once been interesting to them but has since been deemed irrelevent. Add to the mix relevent information, and you end up with a volitale information cocktail. This would send the public and media on wild goose-chases and let speculation run rampant, all the time painting Casey as a bigger and bigger monster. This serves to really turn up the heat on the defense, hoping to force them to the table - or keep them guessing. :waitasec:

Skully
12-10-2008, 01:22 PM
I agree, simpler is better.

The searches in question were done 3 months prior. Maybe they are related to Caylee's death, maybe not. Remember she was still dating Ric at the time and he had that chloroform picture on his myspace, probably to be funny (hey, I have an odd sense of humor too that may not be shared by all others).

So, perhaps Casey just thought she'd poke around on the web to learn more. And in the process of clicking around she ran across more things that caused her to throw some odd stuff into Google. What we see right now in the evidence dump is search history on a few interesting words, but what we don't see is the total context - especially all the web pages she subsequently visited.

I am willing to bet that if I randomly selected anyone on Websleuths for a computer forensic examination that I could cherry pick their Google search history and imply a very chilling and sinister plot was brewing in their mind.
:devil:

Consider this: the prosecutors office is cherry-picking what they release to the public - release large amounts of information that may have once been interesting to them but has since been deemed irrelevent. Add to the mix relevent information, and you end up with a volitale information cocktail. This would send the public and media on wild goose-chases and let speculation run rampant, all the time painting Casey as a bigger and bigger monster. This serves to really turn up the heat on the defense, hoping to force them to the table - or keep them guessing. :waitasec:

I whole heartedly agree. Why search "shovel" I mean really, it had to be in with something else that would narrow down a search. I would get LWOP if they built a case on my searches. LOL

JWG
12-18-2008, 10:51 PM
Many have ascribed a great deal of significance to KC's mid-March computer searches that seemed to scream premeditation. I think there is a more practical explanation.

First, let me start by saying I think LE and the prosecution got lucky when they found a search for chloroform on the computer and they found elevated levels of chloroform in the trunk. I think they used this coincidence to apply pressure to the defense and, more importantly, the parents. It may not have worked, but it was a good strategy.

It is important to look closely at what the prosecution did and did not release in the document dump in late November. What they did release were the clicks on websites with "google" in the name during mid-March. This gave us search terms and syndicated click-throughs. What it did not give us were the non-syndicated clicks that KC visited after searching. Those are the websites that are not paying $$$ for a high Google search result. That information, however, is in the data the prosecution retrieved from the hard drive and, I believe, the defense retrieved as well. The clicks KC made after searching should be quite informative.

Before I get into the details then, it is my opinion that the searches are not useful in making the prosecution's case, which may explain why of all the "Dream Team" members, the computer forensics expert is essentially a "newbie." They did not need to spend a lot of money debunking the computer searches because they are easy to debunk.

Here is the gist of my speculation:

Ricardo and KC started dating in early February 2008 and ended in mid-April 2008 (evidence page 2417).

Sometime in early to mid-March Ricardo puts the "Win her over with chloroform" image (chloroform.jpg) on his myspace. This image was created by someone around 2004 but appeared on a number of myspace pages in March 2008. I cannot confirm this is when it appeared on Ricardo's page, so anyone with a screen shot of that page may be able to help solve a mystery.

KC sees the image and wonders what the deal is with chloroform. Old people like me know what it is, but ask a senior in high school (such as my honors-student daughter) what it is, and most will have heard of it but not know what it is. I am betting KC fell into that category.

Here are the clicks from March 17:

17-Mar 9:36:12 Clicked a Google-hosted ad from a myspace page
13:43:41 Search chloraform
13:43:41 Search chloroform
13:54:26 Search alcohol
13:54:42 Search acetone
13:55:34 Search peroxide
13:53:25 to 13:58:38 Wikipedia searches for inhalation, chloroform, alcohol, acetone, peroxide, hydrogen peroxide, death

One should note that KC uses the default 10 results per page, and only once does she look at results 11 - 20. Using such generic terms and spending so little time between term, I believe she is doing nothing more than very high-level information gathering. This is what I got when putting the above into Google searches (adding -anthony).

Now let's look at the clicks on March 21:

21-Mar 14:16:30 Search how to make chloraform
14:16:30 Search how to make chloroform Google automatically suggested correct spelling
14:19:16 Clicked a Google syndicated ad
14:20:32 Search self defense
14:21:14 Clicked a Google syndicated ad
14:21:58 Search household weapons
14:22:01 Clicked a Google syndicated ad
14:23:08 Clicked a blog poll hosted by Google http://www.google.com/reviews/polls/display/3467892467758549303/blogger_template/run_app?txtclr=%23666666&lnkclr=%235588aa
14:25:12 Clicked a Google syndicated ad
14:25:33 Search household weapons
14:25:54 Clicks http://books.google.com/books?id=_QMJNJIOKPEC&pg=PA79
14:26:18 Clicks http://books.google.com/books?id=_QMJNJIOKPEC&pg=PA79
14:26:24 Search neck breaking
14:28:18 Search shovel

Notice that one of the links is a women's self-defense book (visited twice) and the other is a zombie poll. All of this "research" was done in the span of 12 short minutes and we do not know what other non-Google websites were visited.

Rumor has it that Ricardo may have had a bit of a temper. So...KC finds the image on his myspace....researches chloroform...decides he might be capable of using it on her...researches self-defense...runs across suggestions of how some useful household items might be used in self-defense...such as a shovel...eventually "breaks up" with him in mid-April.

IMHO, the searches are unrelated to Caylee, but coincidentally helped the prosecution when no body was available.

Thank God little Caylee showed up when she did.

nancy botwin
12-19-2008, 12:29 AM
Many have ascribed a great deal of significance to KC's mid-March computer searches that seemed to scream premeditation. I think there is a more practical explanation.

First, let me start by saying I think LE and the prosecution got lucky when they found a search for chloroform on the computer and they found elevated levels of chloroform in the trunk. I think they used this coincidence to apply pressure to the defense and, more importantly, the parents. It may not have worked, but it was a good strategy.

It is important to look closely at what the prosecution did and did not release in the document dump in late November. What they did release were the clicks on websites with "google" in the name during mid-March. This gave us search terms and syndicated click-throughs. What it did not give us were the non-syndicated clicks that KC visited after searching. Those are the websites that are not paying $$$ for a high Google search result. That information, however, is in the data the prosecution retrieved from the hard drive and, I believe, the defense retrieved as well. The clicks KC made after searching should be quite informative.

Before I get into the details then, it is my opinion that the searches are not useful in making the prosecution's case, which may explain why of all the "Dream Team" members, the computer forensics expert is essentially a "newbie." They did not need to spend a lot of money debunking the computer searches because they are easy to debunk.

Here is the gist of my speculation:

Ricardo and KC started dating in early February 2008 and ended in mid-April 2008 (evidence page 2417).

Sometime in early to mid-March Ricardo puts the "Win her over with chloroform" image (chloroform.jpg) on his myspace. This image was created by someone around 2004 but appeared on a number of myspace pages in March 2008. I cannot confirm this is when it appeared on Ricardo's page, so anyone with a screen shot of that page may be able to help solve a mystery.

KC sees the image and wonders what the deal is with chloroform. Old people like me know what it is, but ask a senior in high school (such as my honors-student daughter) what it is, and most will have heard of it but not know what it is. I am betting KC fell into that category.

Here are the clicks from March 17:

17-Mar 9:36:12 Clicked a Google-hosted ad from a myspace page
13:43:41 Search chloraform
13:43:41 Search chloroform
13:54:26 Search alcohol
13:54:42 Search acetone
13:55:34 Search peroxide
13:53:25 to 13:58:38 Wikipedia searches for inhalation, chloroform, alcohol, acetone, peroxide, hydrogen peroxide, death

One should note that KC uses the default 10 results per page, and only once does she look at results 11 - 20. Using such generic terms and spending so little time between term, I believe she is doing nothing more than very high-level information gathering. This is what I got when putting the above into Google searches (adding -anthony).

Now let's look at the clicks on March 21:

21-Mar 14:16:30 Search how to make chloraform
14:16:30 Search how to make chloroform Google automatically suggested correct spelling
14:19:16 Clicked a Google syndicated ad
14:20:32 Search self defense
14:21:14 Clicked a Google syndicated ad
14:21:58 Search household weapons
14:22:01 Clicked a Google syndicated ad
14:23:08 Clicked a blog poll hosted by Google http://www.google.com/reviews/polls/display/3467892467758549303/blogger_template/run_app?txtclr=%23666666&lnkclr=%235588aa
14:25:12 Clicked a Google syndicated ad
14:25:33 Search household weapons
14:25:54 Clicks http://books.google.com/books?id=_QMJNJIOKPEC&pg=PA79
14:26:18 Clicks http://books.google.com/books?id=_QMJNJIOKPEC&pg=PA79
14:26:24 Search neck breaking
14:28:18 Search shovel

Notice that one of the links is a women's self-defense book (visited twice) and the other is a zombie poll. All of this "research" was done in the span of 12 short minutes and we do not know what other non-Google websites were visited.

Rumor has it that Ricardo may have had a bit of a temper. So...KC finds the image on his myspace....researches chloroform...decides he might be capable of using it on her...researches self-defense...runs across suggestions of how some useful household items might be used in self-defense...such as a shovel...eventually "breaks up" with him in mid-April.

IMHO, the searches are unrelated to Caylee, but coincidentally helped the prosecution when no body was available.

Thank God little Caylee showed up when she did.

NICE-- thank you so much for outlining the google searches like this-- I was wondering what google book results she got specifically. And also having trouble actually reading all the hits, so thank you! Also, Ricardo uploaded the "Win her over with chloroform" image to his Facebook account on March 18. I have the screencap of his page here (http://i388.photobucket.com/albums/oo326/misconline/orv7mq.jpg).

ibyoungr
12-19-2008, 12:57 AM
Many have ascribed a great deal of significance to KC's mid-March computer searches that seemed to scream premeditation. I think there is a more practical explanation.

First, let me start by saying I think LE and the prosecution got lucky when they found a search for chloroform on the computer and they found elevated levels of chloroform in the trunk. I think they used this coincidence to apply pressure to the defense and, more importantly, the parents. It may not have worked, but it was a good strategy.

It is important to look closely at what the prosecution did and did not release in the document dump in late November. What they did release were the clicks on websites with "google" in the name during mid-March. This gave us search terms and syndicated click-throughs. What it did not give us were the non-syndicated clicks that KC visited after searching. Those are the websites that are not paying $$$ for a high Google search result. That information, however, is in the data the prosecution retrieved from the hard drive and, I believe, the defense retrieved as well. The clicks KC made after searching should be quite informative.

Before I get into the details then, it is my opinion that the searches are not useful in making the prosecution's case, which may explain why of all the "Dream Team" members, the computer forensics expert is essentially a "newbie." They did not need to spend a lot of money debunking the computer searches because they are easy to debunk.

Here is the gist of my speculation:

Ricardo and KC started dating in early February 2008 and ended in mid-April 2008 (evidence page 2417).

Sometime in early to mid-March Ricardo puts the "Win her over with chloroform" image (chloroform.jpg) on his myspace. This image was created by someone around 2004 but appeared on a number of myspace pages in March 2008. I cannot confirm this is when it appeared on Ricardo's page, so anyone with a screen shot of that page may be able to help solve a mystery.

KC sees the image and wonders what the deal is with chloroform. Old people like me know what it is, but ask a senior in high school (such as my honors-student daughter) what it is, and most will have heard of it but not know what it is. I am betting KC fell into that category.

Here are the clicks from March 17:

17-Mar 9:36:12 Clicked a Google-hosted ad from a myspace page
13:43:41 Search chloraform
13:43:41 Search chloroform
13:54:26 Search alcohol
13:54:42 Search acetone
13:55:34 Search peroxide
13:53:25 to 13:58:38 Wikipedia searches for inhalation, chloroform, alcohol, acetone, peroxide, hydrogen peroxide, death

One should note that KC uses the default 10 results per page, and only once does she look at results 11 - 20. Using such generic terms and spending so little time between term, I believe she is doing nothing more than very high-level information gathering. This is what I got when putting the above into Google searches (adding -anthony).

Now let's look at the clicks on March 21:

21-Mar 14:16:30 Search how to make chloraform
14:16:30 Search how to make chloroform Google automatically suggested correct spelling
14:19:16 Clicked a Google syndicated ad
14:20:32 Search self defense
14:21:14 Clicked a Google syndicated ad
14:21:58 Search household weapons
14:22:01 Clicked a Google syndicated ad
14:23:08 Clicked a blog poll hosted by Google http://www.google.com/reviews/polls/display/3467892467758549303/blogger_template/run_app?txtclr=%23666666&lnkclr=%235588aa
14:25:12 Clicked a Google syndicated ad
14:25:33 Search household weapons
14:25:54 Clicks http://books.google.com/books?id=_QMJNJIOKPEC&pg=PA79
14:26:18 Clicks http://books.google.com/books?id=_QMJNJIOKPEC&pg=PA79
14:26:24 Search neck breaking
14:28:18 Search shovel

Notice that one of the links is a women's self-defense book (visited twice) and the other is a zombie poll. All of this "research" was done in the span of 12 short minutes and we do not know what other non-Google websites were visited.

Rumor has it that Ricardo may have had a bit of a temper. So...KC finds the image on his myspace....researches chloroform...decides he might be capable of using it on her...researches self-defense...runs across suggestions of how some useful household items might be used in self-defense...such as a shovel...eventually "breaks up" with him in mid-April.

IMHO, the searches are unrelated to Caylee, but coincidentally helped the prosecution when no body was available.

Thank God little Caylee showed up when she did.

THANK YOU THANK YOU THANK YOU.. As an IT person.. I was wanting to get more information.. (not enough time)

It's elementary, my dear Watson!

Now, I noticed there was a some research done on computer usage on June 16th. Which indicated Casey got busy on the computer and possibly Caylee got away from her and got in the pool and drowned. ( My daughter is 1 week older than Caylee this is something she would have tried this summer)
If the pool was heavily clorinated.. would that cause the chorolform in the trunk? This being interesting in light that they may have found a swimsuit at the remains site?

JWG
12-19-2008, 09:01 AM
NICE-- thank you so much for outlining the google searches like this-- I was wondering what google book results she got specifically. And also having trouble actually reading all the hits, so thank you! Also, Ricardo uploaded the "Win her over with chloroform" image to his Facebook account on March 18. I have the screencap of his page here (http://i388.photobucket.com/albums/oo326/misconline/orv7mq.jpg).

Interesting...the screencap shows an upload on the 18th, and home computer searches on the topic on the 17th, the day before.

So here is some additional speculation. KC is with Ricardo on Sunday the 16th and they are surfing around together and find the image on one of the myspace pages I found it on. Ric has a good chuckle about it and downloads it. The next day, KC looks it up to learn more, and the following day Ric get's back on his computer and uploads it to his myspace, possibly after KC mentioned looking it up earlier in the day.

I don't think it is coincidence the search and upload occurred within a day of each other.

JWG
01-04-2009, 09:14 PM
Muzikman uploaded KC's photobucket images to icons157.zip (http://www.filefactory.com/file/a00eh09/n/icons157_zip). I downloaded these last night and looked through the files today. There are several thousand images here, most of them "icons" with a few hundred pictures of Casey, Caylee, and friends scattered throughout. Most of the pictures have been posted on the web, and a few of the icons.

Executive Summary: Since many won't read my long-winded analysis, I will cut to the chase. Having analyzed KC's Photobucket uploads and the patterns of the uploads, I am convinced now more than ever that the searches for chloroform, household weapons, etc. in mid-March 2008 were meaningless and unconnected to the death of Caylee.

I looked at several things when examining this CD: Date / time files were uploaded, the content of the image or picture that was uploaded, the "theme" of the images, and whether or not "clustering" of images occurred (uploads of several pictures having the same theme at the same time).

Here is a summary of what I found along with some conclusions I drew:1. Prior to June 16, KC almost always uploaded files before 8:30 AM, from 1:00 PM to 3:00 PM, and after 8:30 PM. While there are a very small handful of exceptions, the overall pattern is very clear.
I would conclude from the above that KC was on the computer when Caylee was asleep (evening) or napping. Nap time seems to be roughly 1 to 3 PM, based on computer activity.

2. Uploads after 6/16 clearly break the pattern established pre-6/16.

I would conclude that KC is no longer worrying about Caylee's sleep habits.

3. KC uploads in "themes". Multiple themes are often uploaded in a single day, within a very short (minutes) period of time. A theme might be tattoos, love, boyfriends, gangstas, or oral sex.

I would conclude that KC has "internet ADD". She spends a very short period of time on one topic and then bounces into another. I think her twelve minutes of chloroform and household weapons searches fall into this category. It is almost like Homer Simpson talking philosophy and then stopping to pick up a penny he found on a sidewalk.

4. KC likes images of skulls, tatoos, suggestions of being a slut or whore, and partying.

5. Many of the sayings or quotes collected by KC refer to relationships in either a serious or dark-humor manner.

6. By far the largest and most graphic collection of icons and quotes of a sexual nature were posted mid-2007. By comparison the images uploaded after January 2008 are pretty lame.

While these are not images of KC, I believe that these are the images the FBI was referring to when interviewing George.

7. The largest collection of skulls and other "dark images" also occurred in 2007.

8. The largest collection of party images occurred in 2007 and early January 2008.

9. KC clearly spent a substantial amount of time searching for and collecting the images.
Standing back and putting the chloroform searches into a better context than reasoned above in my earlier posts, I think KC was originally searching for an image similar to the "Win her over ... with chloroform" image, and this search took her to women's self-defense site, then to weapon's sites, then to a zombie poll...then after 12 minutes she got bored and "found a penny", moving on to something else.

Living her life 10 minutes at a time.

BondJamesBond
01-04-2009, 11:28 PM
O/T to computer forensics, but, tie to the timing established by them...

Notice we haven't heard ANYTHING from ANYONE 'bout that 26 second call Casey took from George @ 3:04PM on 6/16.

IF Jesse did hear Caylee on the prior call, perhaps the timing of George's call had something more direct to do with Caylee's demise....recall that Casey's story to George was that she was dropping Caylee off w/ nanny so she could goto work. If Caylee woke up early from her nap (Jesse hearing her) and Casey took George's call (switched over) it wouldn't do for George to hear Caylee in the background...

I don't know WTH Casey took George's call if the circumstances weren't right...unless it was a mistake...jus' thinkin' out loud (again).

There just wouldn't have been enough time for Casey to react to the situation in switching over to take George's call and doing something like duct-taping Caylee quiet...leading to suffocation...ugh...but somehow w/ the computer usage stopping abruptly...at almost exactly the time of George's (extremely rare) incoming call...there's an answer...

spartanmom
01-05-2009, 07:23 AM
Muzikman uploaded KC's photobucket images to icons157.zip (http://www.filefactory.com/file/a00eh09/n/icons157_zip). I downloaded these last night and looked through the files today. There are several thousand images here, most of them "icons" with a few hundred pictures of Casey, Caylee, and friends scattered throughout. Most of the pictures have been posted on the web, and a few of the icons.

Executive Summary: Since many won't read my long-winded analysis, I will cut to the chase. Having analyzed KC's Photobucket uploads and the patterns of the uploads, I am convinced now more than ever that the searches for chloroform, household weapons, etc. in mid-March 2008 were meaningless and unconnected to the death of Caylee.

I looked at several things when examining this CD: Date / time files were uploaded, the content of the image or picture that was uploaded, the "theme" of the images, and whether or not "clustering" of images occurred (uploads of several pictures having the same theme at the same time).

Here is a summary of what I found along with some conclusions I drew:1. Prior to June 16, KC almost always uploaded files before 8:30 AM, from 1:00 PM to 3:00 PM, and after 8:30 PM. While there are a very small handful of exceptions, the overall pattern is very clear.
I would conclude from the above that KC was on the computer when Caylee was asleep (evening) or napping. Nap time seems to be roughly 1 to 3 PM, based on computer activity.

2. Uploads after 6/16 clearly break the pattern established pre-6/16.

I would conclude that KC is no longer worrying about Caylee's sleep habits.

3. KC uploads in "themes". Multiple themes are often uploaded in a single day, within a very short (minutes) period of time. A theme might be tattoos, love, boyfriends, gangstas, or oral sex.

I would conclude that KC has "internet ADD". She spends a very short period of time on one topic and then bounces into another. I think her twelve minutes of chloroform and household weapons searches fall into this category. It is almost like Homer Simpson talking philosophy and then stopping to pick up a penny he found on a sidewalk.

4. KC likes images of skulls, tatoos, suggestions of being a slut or whore, and partying.

5. Many of the sayings or quotes collected by KC refer to relationships in either a serious or dark-humor manner.

6. By far the largest and most graphic collection of icons and quotes of a sexual nature were posted mid-2007. By comparison the images uploaded after January 2008 are pretty lame.

While these are not images of KC, I believe that these are the images the FBI was referring to when interviewing George.

7. The largest collection of skulls and other "dark images" also occurred in 2007.

8. The largest collection of party images occurred in 2007 and early January 2008.

9. KC clearly spent a substantial amount of time searching for and collecting the images.
Standing back and putting the chloroform searches into a better context than reasoned above in my earlier posts, I think KC was originally searching for an image similar to the "Win her over ... with chloroform" image, and this search took her to women's self-defense site, then to weapon's sites, then to a zombie poll...then after 12 minutes she got bored and "found a penny", moving on to something else.

Living her life 10 minutes at a time.

THanks for all the work. I like your line of thinking. I have to get ready for work, can't wait to get home tonight and really read all of this and think about it.

JWG
01-05-2009, 08:22 AM
O/T to computer forensics, but, tie to the timing established by them...

Notice we haven't heard ANYTHING from ANYONE 'bout that 26 second call Casey took from George @ 3:04PM on 6/16.

IF Jesse did hear Caylee on the prior call, perhaps the timing of George's call had something more direct to do with Caylee's demise....recall that Casey's story to George was that she was dropping Caylee off w/ nanny so she could goto work. If Caylee woke up early from her nap (Jesse hearing her) and Casey took George's call (switched over) it wouldn't do for George to hear Caylee in the background...

I don't know WTH Casey took George's call if the circumstances weren't right...unless it was a mistake...jus' thinkin' out loud (again).

There just wouldn't have been enough time for Casey to react to the situation in switching over to take George's call and doing something like duct-taping Caylee quiet...leading to suffocation...ugh...but somehow w/ the computer usage stopping abruptly...at almost exactly the time of George's (extremely rare) incoming call...there's an answer...

I'm not sure how reliable Jesse's recollection of hearing Caylee in the background on this specific date / call is, given that he back-pedaled on claiming to hear her KC tell Caylee to "get off the table" on the 24th.

It may be neither here nor there. I think you are right in noting that the call from GA at 3:04 precipitated something. That rare call interrupted her call with Jesse and interrupted her time on the computer.

If LE ever asked GA about the call, would love to hear him say what it was about.

JWG
01-06-2009, 09:10 PM
I had some time this evening to examine KC's uploads to Photobucket - more the when rather than the what.

Some general comments:


The highest daily upload activity occurred in the first three months after opening the Photobucket account on April 2, 2007.
January 4, 2008 and April 25, 2008 stand out as high upload dates after the initial three months.
The raciest and most suggestive images and icons were uploaded in the first three months of activity.
Many, many of the images uploaded are quite "dark" in theme. Skulls seem to be a particular favorite. However, I cannot discern whether or not she grew more dark over time or if it was constant. If I have time, I might try to see if her upload themes trended in any particular direction (time consuming with 20,000 images).

Following is a summary of what I found by examining KC's computer upload pattern. While not a full-blown EnCase examination of the hard drive, the patterns are pretty suggestive.

April 2, 2007 to January 4, 2008: 278 days total, 102 days uploads, 16716 uploads, 60 uploads per day.

http://www.websleuths.com/forums/picture.php?albumid=672&pictureid=5304

January 5, 2008 to June 16, 2008: 164 days total, 34 days uploads, 1799 uploads, 11 uploads per day.

http://www.websleuths.com/forums/picture.php?albumid=672&pictureid=5305

June 17, 2008 to July 16, 2008: 31 days total, 16 days uploads, 549 uploads, 18 uploads per day.

http://www.websleuths.com/forums/picture.php?albumid=672&pictureid=5306

IMHO, it looks like some sort of restriction was placed on KC's computer activity after she uploaded pictures on January 4, 2008, presumably taken at some sort of holiday party. This restriction was "lifted" after June 16, 2008.

I sure wish I had access to that hard drive :rolleyes:.

debs
01-06-2009, 09:38 PM
JWG, this is impressive!!!!!!

OneLostGrl
01-06-2009, 11:24 PM
I had some time this evening to examine KC's uploads to Photobucket - more the when rather than the what.

Some general comments:


The highest daily upload activity occurred in the first three months after opening the Photobucket account on April 2, 2007.
January 4, 2008 and April 25, 2008 stand out as high upload dates after the initial three months.
The raciest and most suggestive images and icons were uploaded in the first three months of activity.
Many, many of the images uploaded are quite "dark" in theme. Skulls seem to be a particular favorite. However, I cannot discern whether or not she grew more dark over time or if it was constant. If I have time, I might try to see if her upload themes trended in any particular direction (time consuming with 20,000 images).

Following is a summary of what I found by examining KC's computer upload pattern. While not a full-blown EnCase examination of the hard drive, the patterns are pretty suggestive.

April 2, 2007 to January 4, 2008: 278 days total, 102 days uploads, 16716 uploads, 60 uploads per day.

http://www.websleuths.com/forums/picture.php?albumid=672&pictureid=5304

January 5, 2008 to June 16, 2008: 164 days total, 34 days uploads, 1799 uploads, 11 uploads per day.

http://www.websleuths.com/forums/picture.php?albumid=672&pictureid=5305

June 17, 2008 to July 16, 2008: 31 days total, 16 days uploads, 549 uploads, 18 uploads per day.

http://www.websleuths.com/forums/picture.php?albumid=672&pictureid=5306

IMHO, it looks like some sort of restriction was placed on KC's computer activity after she uploaded pictures on January 4, 2008, presumably taken at some sort of holiday party. This restriction was "lifted" after June 16, 2008.

I sure wish I had access to that hard drive :rolleyes:.

Wow!! How interesting, thanks for sharing! Do you know what pictures were uploaded that day?

JWG
01-06-2009, 11:35 PM
Wow!! How interesting, thanks for sharing! Do you know what pictures were uploaded that day?

Unfortunately, OneGrl (you're not lost), there is not just one day represented in the graphs. We are talking roughly 20,000 pictures uploaded in about 150 separate days - many hours were invested. :rolleyes:

This is just one piece of the puzzle, but at least a piece that we have. She was also surfing the internet and IMing friends, but I believe the trends were similar there as well:



Lot's of freedom before January 4.
A tight leash from January 5 to June 16.
Anything goes after June 16.

OneLostGrl
01-07-2009, 12:18 AM
Unfortunately, OneGrl (you're not lost), there is not just one day represented in the graphs. We are talking roughly 20,000 pictures uploaded in about 150 separate days - many hours were invested. :rolleyes:

This is just one piece of the puzzle, but at least a piece that we have. She was also surfing the internet and IMing friends, but I believe the trends were similar there as well:



Lot's of freedom before January 4.
A tight leash from January 5 to June 16.
Anything goes after June 16.


LOL yep, you caught me- I'm not, not anymore- thank G0d! :)

I am quite impressed with the work you have done with all the computer forensics that have been made available to us! I tend to agree with you about Casey's computer searches. The chloroform, as the murder weapon, I seriously doubt it!

You should put your amazing thought process together with Nancy botwin's! The two of you would make a great team, IMO. She's got great info and insight into Casey photobucket account. I so love the way both of ya'll's minds work!

ETA- the day I was asking about what she uploaded was Jan. 4, the last day of her "freedom" on the computer.

LisaNY
01-07-2009, 12:49 AM
Muzikman uploaded KC's photobucket images to icons157.zip (http://www.filefactory.com/file/a00eh09/n/icons157_zip). I downloaded these last night and looked through the files today. There are several thousand images here, most of them "icons" with a few hundred pictures of Casey, Caylee, and friends scattered throughout. Most of the pictures have been posted on the web, and a few of the icons.

Executive Summary: Since many won't read my long-winded analysis, I will cut to the chase. Having analyzed KC's Photobucket uploads and the patterns of the uploads, I am convinced now more than ever that the searches for chloroform, household weapons, etc. in mid-March 2008 were meaningless and unconnected to the death of Caylee.

I looked at several things when examining this CD: Date / time files were uploaded, the content of the image or picture that was uploaded, the "theme" of the images, and whether or not "clustering" of images occurred (uploads of several pictures having the same theme at the same time).

Here is a summary of what I found along with some conclusions I drew:1. Prior to June 16, KC almost always uploaded files before 8:30 AM, from 1:00 PM to 3:00 PM, and after 8:30 PM. While there are a very small handful of exceptions, the overall pattern is very clear.
I would conclude from the above that KC was on the computer when Caylee was asleep (evening) or napping. Nap time seems to be roughly 1 to 3 PM, based on computer activity.

2. Uploads after 6/16 clearly break the pattern established pre-6/16.

I would conclude that KC is no longer worrying about Caylee's sleep habits.

3. KC uploads in "themes". Multiple themes are often uploaded in a single day, within a very short (minutes) period of time. A theme might be tattoos, love, boyfriends, gangstas, or oral sex.

I would conclude that KC has "internet ADD". She spends a very short period of time on one topic and then bounces into another. I think her twelve minutes of chloroform and household weapons searches fall into this category. It is almost like Homer Simpson talking philosophy and then stopping to pick up a penny he found on a sidewalk.

4. KC likes images of skulls, tatoos, suggestions of being a slut or whore, and partying.

5. Many of the sayings or quotes collected by KC refer to relationships in either a serious or dark-humor manner.

6. By far the largest and most graphic collection of icons and quotes of a sexual nature were posted mid-2007. By comparison the images uploaded after January 2008 are pretty lame.

While these are not images of KC, I believe that these are the images the FBI was referring to when interviewing George.

7. The largest collection of skulls and other "dark images" also occurred in 2007.

8. The largest collection of party images occurred in 2007 and early January 2008.

9. KC clearly spent a substantial amount of time searching for and collecting the images.
Standing back and putting the chloroform searches into a better context than reasoned above in my earlier posts, I think KC was originally searching for an image similar to the "Win her over ... with chloroform" image, and this search took her to women's self-defense site, then to weapon's sites, then to a zombie poll...then after 12 minutes she got bored and "found a penny", moving on to something else.

Living her life 10 minutes at a time.

GREAT post! When I got to the end, what crossed my mind was perhaps she was searching for a photo to post on her my space that depicted a woman fighting off a man trying to chloroform her, or something along those lines (self defense), to post along with a snazzy remark, sort of in reply to ric's pic. Just a thought ...

Pink Panther
01-07-2009, 01:29 AM
I totally love this thread! So much here to read, ponder, think about and research! Thanks so much to all who contribute and of course, to JWG! I am shocked by this data when I think of the fact that SHE was Caylee's Nanny! I was shocked when I saw the ping info for very much the same reason! How on earth was this woman spending so much time on the phone talking, on the phone texting and on the computer downloading/uploading while she was supposedly taking care (singlehandedly) of her toddler!???

Also - JWG - I've had similar suspicions about the RM "chloroform" posting and the appearance of the same substance in the trunk of KC's car...I do think that she originally went onto the internet as a curiousity - trying to figure out RM's icon - But...I haven't yet discounted the possibility that her searches could have given her "ideas" to fulfill a plot that she had already thought out. (Just something to think about...)

MOO

EchointheDark
01-07-2009, 06:13 AM
[LIST]
The highest daily upload activity occurred in the first three months after opening the Photobucket account on April 2, 2007.
January 4, 2008 and April 25, 2008 stand out as high upload dates after the initial three months.
January 5, 2008 to June 16, 2008: 164 days total, 34 days uploads, 1799 uploads, 11 uploads per day.

June 17, 2008 to July 16, 2008: 31 days total, 16 days uploads, 549 uploads, 18 uploads per day.




Jeeze; when did that girl work? Oh, that's right-- she DIDN'T!!!!!!!!!!!!!!

2goldfish
01-07-2009, 06:59 AM
I whole heartedly agree. Why search "shovel" I mean really, it had to be in with something else that would narrow down a search. I would get LWOP if they built a case on my searches. LOL

me too!

lisalei321
01-07-2009, 07:30 AM
JWG - I sure wish you had access to that hard drive as well !!!!!!!!

It's Not the Nanny
01-07-2009, 09:00 AM
Amazing work, JWG!!!!!


So, what is your theory as to why her computer usage/uploading went majorly down after January 5th during Caylee's waking hours?

Was all of the uploading on the desktop in the A house or all on the laptop or a little of both?

Wasn't she supposedly "working" and leaving the house every morning with Caylee at that point (Jan-Jun)?

Was she sneaking back home every day during that timeframe to use the computer/put Caylee down for a nap??

I'm curious where she was playing on the computer and why she seemed to have newfound restrictions during Jan-Jun '08.

Good information, JWG! Looking at your graphs goes a long way into showing me that she was doing the right thing (watching Caylee) but maybe suffocating under her load of responsibilities and lack of a free life at the same time.

I'm not believing the chloroform to make Caylee pass out all day. It's obvious from your usage analysis that Caylee was napping at the time most children her age napped. Why would Caylee take a regular 2 hour nap if she was Chloroformed all day?

debs
01-07-2009, 09:04 AM
Could it be as simple as she started using Cindy's laptop more exclusively?

It's Not the Nanny
01-07-2009, 09:05 AM
debs - Maybe....but where was she taking Caylee to use it?

BonKai
01-07-2009, 09:22 AM
Unfortunately, OneGrl (you're not lost), there is not just one day represented in the graphs. We are talking roughly 20,000 pictures uploaded in about 150 separate days - many hours were invested. :rolleyes:

This is just one piece of the puzzle, but at least a piece that we have. She was also surfing the internet and IMing friends, but I believe the trends were similar there as well:



Lot's of freedom before January 4.
A tight leash from January 5 to June 16.
Anything goes after June 16.


NICE work! :clap: TY so much.

Very interesting. It makes me wonder when Cindy started seeing the counselor.

eddeva
01-07-2009, 09:29 AM
this is just amazing!
thank you JWG.

debs
01-07-2009, 09:37 AM
debs - Maybe....but where was she taking Caylee to use it?

Quite a number of the pictures of Caylee we've seen (but not paid to view!!!) were taken in other peoples' homes. She could have brought the computer there. A lot of fast food places with play yards have wi-fi. A lot of areas are close enough to be wired, especially in a metro area. She could have gone virtually (no pun intended) anywhere and had access to the internet. But to simply use the computer for whatever else, obviously she only needed to be where she could plug the comp in, and if she had an adapter in her car, then she really didn't need to be anywhere special at all but the front seat.

indicat
01-07-2009, 12:41 PM
I had some time this evening to examine KC's uploads to Photobucket - more the when rather than the what.

Some general comments:


The highest daily upload activity occurred in the first three months after opening the Photobucket account on April 2, 2007.
January 4, 2008 and April 25, 2008 stand out as high upload dates after the initial three months.
The raciest and most suggestive images and icons were uploaded in the first three months of activity.
Many, many of the images uploaded are quite "dark" in theme. Skulls seem to be a particular favorite. However, I cannot discern whether or not she grew more dark over time or if it was constant. If I have time, I might try to see if her upload themes trended in any particular direction (time consuming with 20,000 images).

Following is a summary of what I found by examining KC's computer upload pattern. While not a full-blown EnCase examination of the hard drive, the patterns are pretty suggestive.

April 2, 2007 to January 4, 2008: 278 days total, 102 days uploads, 16716 uploads, 60 uploads per day.

http://www.websleuths.com/forums/picture.php?albumid=672&pictureid=5304

January 5, 2008 to June 16, 2008: 164 days total, 34 days uploads, 1799 uploads, 11 uploads per day.

http://www.websleuths.com/forums/picture.php?albumid=672&pictureid=5305

June 17, 2008 to July 16, 2008: 31 days total, 16 days uploads, 549 uploads, 18 uploads per day.

http://www.websleuths.com/forums/picture.php?albumid=672&pictureid=5306

IMHO, it looks like some sort of restriction was placed on KC's computer activity after she uploaded pictures on January 4, 2008, presumably taken at some sort of holiday party. This restriction was "lifted" after June 16, 2008.

I sure wish I had access to that hard drive :rolleyes:.

I wish you did to JWG! You have done an excellent job:)

Who_What_When
01-11-2009, 07:44 PM
Unfortunately, OneGrl (you're not lost), there is not just one day represented in the graphs. We are talking roughly 20,000 pictures uploaded in about 150 separate days - many hours were invested. :rolleyes:

This is just one piece of the puzzle, but at least a piece that we have. She was also surfing the internet and IMing friends, but I believe the trends were similar there as well:



Lot's of freedom before January 4.
A tight leash from January 5 to June 16.
Anything goes after June 16.


I just wanted to say that I think your analysis is amazing. Very interesting stuff!!! TY! :clap::clap::clap:

alwaysonmymind
01-22-2009, 09:28 AM
Bumpity bump--

A forensic search of the Anthonys home computer had revealed searches for "how to make chloroform", "self defense", "household weapons", "neck breaking", and "shovel". These searches took place on March 17th and March 21st.

Cindy was at work on both days.

The latest documents reveal George was not working on the 17th but was working on the 21st.

Any thoughts on who might have been available to perform the searches on *both* days?? :waitasec:

http://www.wesh.com/download/2009/0121/18530509.pdf See page 11 of 12.

joyce D
01-28-2009, 12:44 PM
Hey everyone had to re sign up due to forgot my login stuff.I dont know where on here to ask a question about computers.Its not related to this case so if you can send me a message with a link for help with my pc.Or if you have any knowledge i have a question.Thanks and you guys rock

ziggy
01-28-2009, 01:11 PM
On the other hand...if Casey's chloraform search is on the 17th, perhaps she is asking RM about it and they have a discussion which triggers RM to find the dark humor chloraform pic. and post it on the 18th. That piques KC's interest even more and she continues the searchs on the 21st. (hope I have these dates right, 4 hours of sleep).

BondJamesBond
03-02-2009, 10:40 PM
Bringing over from the Q&A thread:

Verrrrry Interesting ...

The screenshot clearly indicates WFTV had access to a file we have not seen.

If it was released to the media, the public ought to be able to get it.

Wonder if this is a job for Muzikman?? I hate to always lean on him. Do you know of anyone else in the area that has had the gumption to visit the office down there?




...adding after a little Google work...

Here's the link to the WFTV report that makes these specific claims:

http://www.wftv.com/news/17567178/detail.html

If you watch the video (link in the story) they show a screenshot of the specific site they allege Casey visited.

Now...(a) I defer to JWG on the released docs being silent on these searches, and (b) the media made errors in their reporting such as claiming the computer forensics showed Casey searched re: ZFG in June.

There were also references to the Duckett case early on...and another website claims that Lee was in contact with Josh...

So...FWIW...hope that helps.

The website WFTV showed in the video and indicated Casey visited, "over a year ago" is:
http://www.get-involved.com/

The story aired in September 26, 2008.

The link to missing children at the above site is a tool that was created Memorial Day Weekend 2006. The tool allows (1) a view of missing children by geographic location, and (2) adding a missing child to your MySpace friend's list to increase visibility to their cause. So, the timeframe we're talking about here for Casey to have visited the site is June 2006-September 2007.

Consider that Trenton Ducket went missing August 27, 2006 and the case obviously had a tremendous amount of local media attention.

Given Casey's proclivity for all things MySpace. Perhaps she ventured here to add Trenton's missing person file to her own MySpace friends list. Perhaps that has already been established, or if not, would be simple enough to confirm or debunk. Just a thought...

JWG
03-03-2009, 07:53 AM
Bringing over from the Q&A thread:

The website WFTV showed in the video and indicated Casey visited, "over a year ago" is:
http://www.get-involved.com/

The story aired in September 26, 2008.

The link to missing children at the above site is a tool that was created Memorial Day Weekend 2006. The tool allows (1) a view of missing children by geographic location, and (2) adding a missing child to your MySpace friend's list to increase visibility to their cause. So, the timeframe we're talking about here for Casey to have visited the site is June 2006-September 2007.

Consider that Trenton Ducket went missing August 27, 2006 and the case obviously had a tremendous amount of local media attention.

Given Casey's proclivity for all things MySpace. Perhaps she ventured here to add Trenton's missing person file to her own MySpace friends list. Perhaps that has already been established, or if not, would be simple enough to confirm or debunk. Just a thought...

Or perhaps the visit germinated the seed for an extreme version of Münchausen syndrome by proxy. :waitasec:

Lovejac
03-03-2009, 08:19 AM
Or perhaps the visit germinated the seed for an extreme version of Münchausen syndrome by proxy. :waitasec:

That's what I'm thinking, personally, JWG.

The bad seed.:mad:

awakewriter
03-03-2009, 08:35 AM
Or perhaps the visit germinated the seed for an extreme version of Münchausen syndrome by proxy. :waitasec:

Interesting thought. I don't think she was trying to keep Caylee sick to get attention, though.

In fact, her text messages indicate she was annoyed when Caylee was sick because she had to stay home with her.

I haven't seen any evidence to indicate Caylee had recently been extremely ill or that Casey was trying to get Caylee treatment for any illnesses.

JWG
03-03-2009, 09:02 AM
Interesting thought. I don't think she was trying to keep Caylee sick to get attention, though.

In fact, her text messages indicate she was annoyed when Caylee was sick because she had to stay home with her.

I haven't seen any evidence to indicate Caylee had recently been extremely ill or that Casey was trying to get Caylee treatment for any illnesses.

Illness is not what I was thinking. I was thinking more along the lines of "gee, Trenton's parents became celebrities when he went missing...wonder if the same would work for me?"

debs
03-03-2009, 09:20 AM
Illness is not what I was thinking. I was thinking more along the lines of "gee, Trenton's parents became celebrities when he went missing...wonder if the same would work for me?"

There seems to be a lot of that going around.

eddeva
03-03-2009, 09:25 AM
Hey everyone had to re sign up due to forgot my login stuff.I dont know where on here to ask a question about computers.Its not related to this case so if you can send me a message with a link for help with my pc.Or if you have any knowledge i have a question.Thanks and you guys rock


hi joyce - you only have 6 posts so i'm afraid it's impossible, as yet, to send you a message http://i430.photobucket.com/albums/qq29/eddeva/smilies/ohwell.gif

BondJamesBond
03-03-2009, 10:14 AM
Illness is not what I was thinking. I was thinking more along the lines of "gee, Trenton's parents became celebrities when he went missing...wonder if the same would work for me?"

...although "over a year ago" would be in the neighborhood of 525,590 minutes beyond Casey's attention span :rolleyes:

FWIW...Melinda's 'fame' was short-lived...having committed suicide (with a shotgun :eek:) less than two weeks after he was 'abducted'.

I checked the "cayleeismissing" myspace last night and "missing" friends are listed there for both Trenton and Josh (Trenton's living father). I haven't followed the MySpace transformation in detail, but, if (1) the cayleeismissing site is the reincarnation of Casey's former personal site, and (2) MySpace provides a means to view when a "friend" was added, a little sleuthin' might confirm/debunk if adding Trenton occurred pre-September '07 resulting in this report we're given by WFTV.

My suspicion is - not unlike JWG's earlier speculation about stream-of-consciousness surfing through sites re: chloroform, etc, being unrelated to Caylee's death - that this visit to a missing children site was just Casey's foray into something vogue for MySpace @ the time.

JWG - did you look specifically for the following sites?
http://www.get-involved.com/
http://www.peace-train.org/
...as their description alone might not have been explicit enough scanning through casually to denote them as being related to 'missing children'.

JWG
03-03-2009, 10:22 AM
...although "over a year ago" would be in the neighborhood of 525,590 minutes beyond her attention span :rolleyes:

I checked the "cayleeismissing" myspace last night and "missing" friends are listed there for both Trenton and Josh (Trenton's living father). I haven't followed the MySpace transformation in detail, but, if (1) the cayleeismissing site is the reincarnation of Casey's former personal site, and (2) MySpace provides a means to view when a "friend" was added, a little sleuthin' might confirm/debunk if adding Trenton occurred pre-September '07 resulting in this report we're given by WFTV.

My suspicion is - not unlike JWG's earlier speculation about stream-of-consciousness surfing through sites re: chloroform, etc, being unrelated to Caylee's death - that this visit to a missing children site was just Casey's foray into something vogue for MySpace @ the time.

JWG - did you look specifically for the following sites?
http://www.get-involved.com/
http://www.peace-train.org/
...as their description alone might not have been explicit enough scanning through casually to denote them as being related to 'missing children'.

Good point. It took a moment for me to see that there is a connection between those sites and missing person's sites. Question is, what did those sites look like when KC surfed across them? How prominent were the missing children links back then.

stream-of-consciousness surfing is probably behind these searches as well...

BondJamesBond
03-03-2009, 10:43 AM
Good point. It took a moment for me to see that there is a connection between those sites and missing person's sites. Question is, what did those sites look like when KC surfed across them? How prominent were the missing children links back then.

stream-of-consciousness surfing is probably behind these searches as well...

Upon reading further...

It appears the Memorial Day 2006 date is associated with a petition that was drafted and subsequently circulated to get MySpace to participate.

Then, January 23, 2007, MySpace joined in partnership with the Nat'l Center for Missing & Exploited Children.

So....Casey either:
(a) signed the petition through this website late-May 2006-September 2007, or
(b) she added Trenton as a 'missing' Friend to her MySpace late-Aug 2006 to early-Sep 2007, or
(c) she visited the Yahoo Map=NMEC map "mash up" tool (dunno the origin date), or
(d) something else???

I can't view the petition link from here...perhaps someone that can will be able to see other signatures and check for Casey's???

JWG
03-03-2009, 07:33 PM
First, a BIG thanks to Muzikman :rocker: for uploading the Sept. 26 computer search data. Some questions answered, some left unanswered. This was a big help though. :bow:

As much as I love the guy - and I do want to give him a hug some day - I am convinced now that the visits to escort sites found on the Anthony home computer were visits done by George and not by KC.

First, there are no similar visits on the laptop computer that was in KC's possession after June 16. Admittedly, that is not saying much as the internet history on that computer only went back to July 3.

More importantly though, there are four time periods in which the visits occur on the home computer that KC could not possibly have been responsible:



Saturday, July 12 6:49 to 7:09 AM (no pings at that time, but near that time KC pings from Tony's)
Tuesday, July 8 3:08 to 3:18 PM (KC pings from Tony's)
Sunday, June 22 11:25 to 11:28 PM (no pings at that time, but near that time KC pings from Tony's)
Thursday, June 19 9:49 PM (no pings at that time, but near that time KC pings from Tony's)


No other visits occur between June 16 and July 16.

Many other visits occur prior to June 16, but they are often preceded by visits to sports news websites and career / job-hunting websites. Unlikely visits by KC, IMHO.

I will post more on those earlier visits later.

karen in New York
03-03-2009, 08:28 PM
You know its possible that George was checking to see if his daughter, Casey was on any of those adult sites. They probably suspected something bad and G tried to check it out.
I was wondering if she did phone sex for a living ...

JWG
03-03-2009, 10:43 PM
Here are the other dates and approximate times escort sites were visited on the Anthony home computer. Note that no visits were recorded on the laptop in KC's possession.

Anyone thinking that March 2008 might be an important month in the Anthony family dynamic?

May 30 5:23 PM
May 7 11:28 PM
May 5 11:01 - 11:10 PM
April 10 11:06 PM
April 7 2:04 PM, 4:07 PM
April 6 11:05 - 11:37 PM
April 5 9:56 AM, 4:35 PM
April 3 11:20 PM - 11:59 PM
April 3 11:22 AM - 12:22 PM
April 2 11:47 PM - 12:42 AM
April 2 8:20 AM - 1:34 PM (sparse - not very many clicks)
April 1 8:09 AM
March 31 11:53 PM
March 30 11:50 PM
March 28 12:47 AM, 1:48 PM
March 27 12:09 AM, 7:21 PM
March 26 12:25 AM, 11:21 PM
March 25 11:52 PM
March 24 12:26 PM, 11:02 PM
March 23 10:18 PM - 11:35 PM
March 21 7:15 AM, 6:16 PM
March 20 6:15 AM, 6:46 PM
March 21 6:45 AM
March 18 6:44 PM
March 17 6:56 AM, 11:09 AM - 12:54 PM
March 16 11:38 PM
March 15 7:05 AM, 11:56 AM - 12:30 PM
March 14 6:04 AM - 8:34 AM
March 15 7:04 AM - 7:42 AM, 10:47 AM - 11:33 AM, 1:44 PM - 2:58 PM, 4:23 PM - 4:39 PM
March 14 9:16 AM - 9:26 AM
February 22 4:27 PM
February 20 8:29 AM - 8:41 AM
February 10 12:35 PM, 7:38 PM
February 8 4:44 PM - 4:56 PM
February 7 4:55 PM
January 31 1:53 PM, 6:31 PM
January 29 6:25 AM
January 28 6:09 AM
January 27 11:11 AM
January 25 4:55 PM
January 24 2:45 PM
January 23 11:40 AM, 10:39 PM
January 22 2:22 PM
January 13 4:06 AM
January 6 7:04 AM
December 20 9:45 - 9:58 PM
December 8 7:02 AM

wonderer
03-03-2009, 11:11 PM
I don't know if this is the case, but there's actually a "company" that pays people to get others to sign up to their escorts' website. They post an ad on Craigslist, talk to people on IM and get them to sign up (and get paid via Paypal or check for each sign up).

It's a slight possibility that this is why there's so many escort page vists. It's probably more likely that someone was looking up escorts for themselves or looking to be one, though.

Annie Maude
03-04-2009, 05:16 AM
Illness is not what I was thinking. I was thinking more along the lines of "gee, Trenton's parents became celebrities when he went missing...wonder if the same would work for me?"

I wouldn't be surprised if that is a big part of motive. It's almost understandable, in a very sick sort of way.

Where's Andre
03-04-2009, 07:40 PM
I don't know if this is the case, but there's actually a "company" that pays people to get others to sign up to their escorts' website. They post an ad on Craigslist, talk to people on IM and get them to sign up (and get paid via Paypal or check for each sign up).

It's a slight possibility that this is why there's so many escort page vists. It's probably more likely that someone was looking up escorts for themselves or looking to be one, though.

This could also be evidence of malware activity. Malware can generate what some people call "pornado" activity meant to inflate click count advertising revenue of pr0n sites or similar baditude, by forcing clicks without user input.

JWG
03-04-2009, 09:53 PM
I've been looking through the mountain of computer forensic data released last September and uploaded yesterday to a file sharing site by dedicated websleuther Muzikman. :rocker:

I posted yesterday (http://websleuths.com/forums/showpost.php?p=3404221&postcount=173) on the escort service surfing activity, and I will have more to say about that in a future post. Suffice it to say, I am 99% certain George is solely responsible for the visits to escort sites, :blushing: and KC is uninvolved in that surfing activity.

This evening I took a close look at the visits to missing person's websites widely reported last September in the media. My conclusion is that KC did not visit missing persons websites prior to Caylee's disappearance. In fact, I do not believe she is responsible for those visits at all. :eek:

Following is the raw data for the visits in question:

07/16/2008 14:51:37 06/24/2008 16:01:46 http://www.missingkids.com/photographs/NCMC1097725c1t.jpg
07/16/2008 14:51:31 07/03/2008 01:28:12 http://www.missingkids.com/photographs/NCMC1099693c1t.jpg
07/16/2008 14:51:25 07/10/2008 11:37:33 http://www.missingkids.com/photographs/NCMC1096469c1t.jpg
07/16/2008 14:51:24 05/27/2008 12:58:47 http://www.missingkids.com/photographs/NCMC1096536c1t.jpg
07/16/2008 14:51:24 04/24/2008 16:06:48 http://www.missingkids.com/photographs/NCMC1094062c2t.jpg
07/16/2008 14:51:24 04/24/2008 16:06:48 http://www.missingkids.com/photographs/NCMC1094062c1t.jpg
07/16/2008 14:51:24 05/03/2008 17:07:29 http://www.missingkids.com/photographs/NCMC1094659c1t.jpg
07/16/2008 14:51:24 06/23/2008 15:30:12 http://www.missingkids.com/photographs/NCMC1098504c1t.jpg
07/16/2008 14:51:24 04/24/2008 16:06:48 http://www.missingkids.com/photographs/NCMC1094062c3t.jpg
07/16/2008 14:51:24 06/24/2008 14:14:01 http://www.missingkids.com/photographs/NCMC1098088c1t.jpg
07/16/2008 14:51:24 07/02/2008 19:50:00 http://www.missingkids.com/photographs/NCMC1099149c1t.jpg
07/16/2008 14:51:24 07/01/2008 00:06:13 http://www.missingkids.com/photographs/NCMC1099410c1t.jpg
07/16/2008 14:51:24 03/17/2008 15:47:48 http://www.missingkids.com/photographs/NCMC1091268c1t.jpg

07/16/2008 14:51:24 04/10/2007 12:29:03 http://www.get-involved.com/mashup/marker.swf
07/16/2008 14:51:22 http://www.get-involved.com/mashup/RSS_Read.php?state=XX
07/16/2008 14:51:22 http://www.get-involved.com/mashup/RSS_Read.php?state=XX
07/16/2008 14:51:21 06/19/2007 06:32:24 http://www.get-involved.com/mashup/map_small.swf
07/16/2008 14:51:20 04/26/2007 08:04:49 http://www.get-involved.com/mashup/images/kids_widget_04.gif
07/16/2008 14:51:20 04/26/2007 08:04:48 http://www.get-involved.com/mashup/images/kids_widget_01.gif
07/16/2008 14:51:20 04/26/2007 08:04:49 http://www.get-involved.com/mashup/images/kids_widget_05.gif
07/16/2008 14:51:20 04/26/2007 08:04:49 http://www.get-involved.com/mashup/images/kids_widget_02.gif
07/16/2008 14:43:09 http://www.get-involved.com/mashup/RSS_Read.php?state=XX

There are a few things to note about each item listed. First, the items are objects on the website, such as an image (.gif or .jpg) or shockwave video (.swf). The web browser will store the objects on the computer so that the next time the website is visited, it will appear to load faster than the first time. This is called caching.

The date / time shown in red indicates when the object was accessed by the web browser. This is indicative of when the website was surfed.

The other date / time (if there is one) indicates when the object was last modified by whoever created it or otherwise owned the object. Using an image, for example, this date / time could indicate when the picture was taken, resized, photoshopped...you name it. It is often indicative of when the web page was created or modified. It is not indicative of when the web page was surfed.

Unfortunately, the media saw the old dates and assumed that they were surf dates. LE did not make that assumption. There is nothing in the complete forensic report that indicates they ever thought this was something to look into.

I should further point out that the sites were visited from the desktop computer.

So what really happened?

Sometime during the afternoon of the 16th the "cayleeismissing" myspace page goes live. This page becomes a missing person's website - Caylee's. Work on this page occurred between 2:37 PM and 2:52 PM on July 16th - completely encompassing the time the missing person's sites were accessed. It may have started earlier, but it definitely occurred during this time period.

Given KC was pre-occupied during this time, the best candidate for this activity is ... Lee. He was just trying to get Caylee's name out there as a missing person.

kashell
03-04-2009, 10:05 PM
JWG-
You are brilliant!

MD MOMMY
03-04-2009, 10:16 PM
Interesting! He may have also been looking up missing person's websites to see how they were formated/set up to use as a guide. Good work!

reeseeva
03-04-2009, 10:21 PM
Thanks JWG, As always you have followed thru to the letter.

I had a feeling that this was a misnomer, as the Media & Nancy G. would still be screaming this over the airwaves.

I hope ButWhatIf also sees this.

:blowkiss:

butwhatif?
03-04-2009, 10:32 PM
Thanks JWG, As always you have followed thru to the letter.

I had a feeling that this was a misnomer, as the Media & Nancy G. would still be screaming this over the airwaves.

I hope ButWhatIf also sees this.

:blowkiss:

Yep...here I am. Thanks JWG for putting it all together and explaining it.
Can you tell me the doc page where you got all this info please? Great work as usual btw.:clap:

AlwaysShocked
03-04-2009, 10:34 PM
"I posted yesterday on the escort service surfing activity, and I will have more to say about that in a future post. Suffice it to say, I am 99% certain George is solely responsible for the visits to escort sites, and KC is uninvolved in that surfing activity."

Hoo-boy! Cindy isn't going to like this at all!

By the way, JWG, nice signature line.......... and nice photos in your profile!

Searchfortruth
03-04-2009, 10:45 PM
Wow JWG, this is IMPRESSIVE ! Thank you so very much for putting it together for all of us..!!!!!!!!!

BondJamesBond
03-04-2009, 10:48 PM
Thanks, JWG (and Muzikman). Excellent work, indeed! You obviously plowed some time into the research, and organized it so that it was easy to follow. :clap:

This case has certainly given me a heavily jaundiced eye when any 'analysis' comes from the mainstream media. :shakehead:

Now...methinks you're gonna tell us the tale of the BSOD :offtheair: very soon. Looking forward to the next chapter... :book:

JWG
03-04-2009, 10:51 PM
Yep...here I am. Thanks JWG for putting it all together and explaining it.
Can you tell me the doc page where you got all this info please? Great work as usual btw.:clap:

Hi butwhatif...

There is not a document page to reference. I downloaded computer files released by LE in September and looked through those. Surf to my profile page and look for a recent post by Muzikman - there is a link there for a 95MB zip file containing the documents I've been looking at.

That file also contained a couple of Caylee pics (very good resolution) from the visit to Mt. Dora that I had personally not seen before. Worth the download just for those, IMO.

elfie
03-04-2009, 10:59 PM
I've been looking through the mountain of computer forensic data released last September and uploaded yesterday to a file sharing site by dedicated websleuther Muzikman. :rocker:

I posted yesterday (http://websleuths.com/forums/showpost.php?p=3404221&postcount=173) on the escort service surfing activity, and I will have more to say about that in a future post. Suffice it to say, I am 99% certain George is solely responsible for the visits to escort sites, :blushing: and KC is uninvolved in that surfing activity.

This evening I took a close look at the visits to missing person's websites widely reported last September in the media. My conclusion is that KC did not visit missing persons websites prior to Caylee's disappearance. In fact, I do not believe she is responsible for those visits at all. :eek:

Following is the raw data for the visits in question:

07/16/2008 14:51:37 06/24/2008 16:01:46 http://www.missingkids.com/photographs/NCMC1097725c1t.jpg
07/16/2008 14:51:31 07/03/2008 01:28:12 http://www.missingkids.com/photographs/NCMC1099693c1t.jpg
07/16/2008 14:51:25 07/10/2008 11:37:33 http://www.missingkids.com/photographs/NCMC1096469c1t.jpg
07/16/2008 14:51:24 05/27/2008 12:58:47 http://www.missingkids.com/photographs/NCMC1096536c1t.jpg
07/16/2008 14:51:24 04/24/2008 16:06:48 http://www.missingkids.com/photographs/NCMC1094062c2t.jpg
07/16/2008 14:51:24 04/24/2008 16:06:48 http://www.missingkids.com/photographs/NCMC1094062c1t.jpg
07/16/2008 14:51:24 05/03/2008 17:07:29 http://www.missingkids.com/photographs/NCMC1094659c1t.jpg
07/16/2008 14:51:24 06/23/2008 15:30:12 http://www.missingkids.com/photographs/NCMC1098504c1t.jpg
07/16/2008 14:51:24 04/24/2008 16:06:48 http://www.missingkids.com/photographs/NCMC1094062c3t.jpg
07/16/2008 14:51:24 06/24/2008 14:14:01 http://www.missingkids.com/photographs/NCMC1098088c1t.jpg
07/16/2008 14:51:24 07/02/2008 19:50:00 http://www.missingkids.com/photographs/NCMC1099149c1t.jpg
07/16/2008 14:51:24 07/01/2008 00:06:13 http://www.missingkids.com/photographs/NCMC1099410c1t.jpg
07/16/2008 14:51:24 03/17/2008 15:47:48 http://www.missingkids.com/photographs/NCMC1091268c1t.jpg

07/16/2008 14:51:24 04/10/2007 12:29:03 http://www.get-involved.com/mashup/marker.swf
07/16/2008 14:51:22 http://www.get-involved.com/mashup/RSS_Read.php?state=XX
07/16/2008 14:51:22 http://www.get-involved.com/mashup/RSS_Read.php?state=XX
07/16/2008 14:51:21 06/19/2007 06:32:24 http://www.get-involved.com/mashup/map_small.swf
07/16/2008 14:51:20 04/26/2007 08:04:49 http://www.get-involved.com/mashup/images/kids_widget_04.gif
07/16/2008 14:51:20 04/26/2007 08:04:48 http://www.get-involved.com/mashup/images/kids_widget_01.gif
07/16/2008 14:51:20 04/26/2007 08:04:49 http://www.get-involved.com/mashup/images/kids_widget_05.gif
07/16/2008 14:51:20 04/26/2007 08:04:49 http://www.get-involved.com/mashup/images/kids_widget_02.gif
07/16/2008 14:43:09 http://www.get-involved.com/mashup/RSS_Read.php?state=XX

There are a few things to note about each item listed. First, the items are objects on the website, such as an image (.gif or .jpg) or shockwave video (.swf). The web browser will store the objects on the computer so that the next time the website is visited, it will appear to load faster than the first time. This is called caching.

The date / time shown in red indicates when the object was accessed by the web browser. This is indicative of when the website was surfed.

The other date / time (if there is one) indicates when the object was last modified by whoever created it or otherwise owned the object. Using an image, for example, this date / time could indicate when the picture was taken, resized, photoshopped...you name it. It is often indicative of when the web page was created or modified. It is not indicative of when the web page was surfed.

Unfortunately, the media saw the old dates and assumed that they were surf dates. LE did not make that assumption. There is nothing in the complete forensic report that indicates they ever thought this was something to look into.

I should further point out that the sites were visited from the laptop computer and not the home computer.

So what really happened? :waitasec:

Recall that Lee picked up KC's computer on the evening of the 15th from Tony's. (I will need to post later on the activity beginning late that night, but in an attempt to keep this post to under five pages, I will stay on topic. :rolleyes:)

Sometime during the afternoon of the 16th the "cayleeismissing" myspace page goes live. This page becomes a missing person's website - Caylee's. Work on this page occurred between 2:37 PM and 2:52 PM on July 16th - completely encompassing the time the missing person's sites were accessed.

Given KC was pre-occupied during this time, the best candidate for this activity is ... Lee. He was just trying to get Caylee's name out there as a missing person. :angel:

Thanks for the info & explanations JWG. Very sleuthy!

Muzikman
03-04-2009, 11:28 PM
Hi butwhatif...

There is not a document page to reference. I downloaded computer files released by LE in September and looked through those. Surf to my profile page and look for a recent post by Muzikman - there is a link there for a 95MB zip file containing the documents I've been looking at.

That file also contained a couple of Caylee pics (very good resolution) from the visit to Mt. Dora that I had personally not seen before. Worth the download just for those, IMO.

Great work JWG. Wish I would have put this up back in Sept! Thought it was out there for everyone...

I also put a couple links in the Jury Room, 10/8 Doc Dump thread, for those that want to download for themselves.

Where's Andre
03-04-2009, 11:37 PM
I posted yesterday (http://websleuths.com/forums/showpost.php?p=3404221&postcount=173) on the escort service surfing activity, and I will have more to say about that in a future post. Suffice it to say, I am 99% certain George is solely responsible for the visits to escort sites, :blushing: and KC is uninvolved in that surfing activity.


Interesting... I look forward to your future post. This was my "gut" as well when you brought this up. I imagine such sites are usually set up for the benefit of customers, not "employees". It stands to reason a typical back-end for a site like that would be pages, or texts, or emails, so that employees get data on-the-road in a more practical universally accessible manner than a web browser.

They don't call them "call girls" for nothing.

JWG
03-05-2009, 12:16 AM
As I was researching the missing persons website visits on KC's laptop computer, I began to piece together what happened to KC's laptop during the final 24 hours before it was turned over to LE.

Lee arrives at Tony's around midnight, leaving around 2:00AM and arriving back at his parents around 2:25AM (evidence pages 1442 - 1445). While there he sees KC's laptop plugged in and set up on the kitchen counter top. He starts it up but gets the "blue screen of death" indicating the computer was improperly shutdown and data has been lost (page 1478). Lee also states later that, as he is investigating the situation with Caylee after bringing KC's computer back to life, he notices that in KC's Yahoo email account all emails prior to June 15 were deleted (page 1479).

I personally noticed that the internet history before June 27 was deleted, as was July 2 - 9.

Now let's look at the activity...

No activity on July 15 until 8:47 PM, when about 40 seconds worth of AIM activity occurs. My belief is this is when the computer is powered on by Tony, and AIM automatically launches. Nothing happens for 1 1/2 hours.

KC's phone - which is in the possession of Tony, receives texts from Andy F. and Will W., around 9:25. At around 10:05 Tony calls Amy and learns about KC cleaning out her bank account. Tony is probably not emotionally stable at this point.

At 10:15 PM activity resumes. For the next five minutes it looks like there are repeated attempts to log into KC's ATT wireless account, culminating in a visit to the "lost password" page to presumably have a new password sent to her email account. A successful login to Yahoo may have occurred at this time.

Activity resumes again at 10:30 with an attempt to either register with or log into an existing "Lava Life" account. This lasts for about a minute (methinks Tony is looking at the internet history). Attempts are then made to log into Facebook (unsuccessfully).

10:43 PM - a successful attempt to log into myspace is made, although the account is not clear (if I knew the numeric ID for KC I could probably tell). For the next 10 minutes comments and inbox messages are viewed.

10:57 PM - a successful attempt to log into Facebook is made, although the account is not clear. Numerous photos are viewed for the next 3 minutes. Activity stops.

11:15 PM - a return to Facebook with what appears to be a single upload.

11:19 PM - a second attempt to login to the ATT wireless account.

11:23 PM to 11:35 PM - a rapid-fire mixture of myspace and photobucket views. On Photobucket it is images. On myspace it is images and messages.

11:35 PM to 11:50 PM - many, many views of Facebook photos after what appears to be a successful login.

Computer handed over to Lee.

1:40 AM - computer appears to reboot.

2:32 AM - successful login to Yahoo mail. Activity stops at 2:34 (possibly after seeing no email exists).

At 5:09 AM the computer is powered up, but no real activity until 5:18 when the MSN website is brought up. One of the very first things done here is to go to the white pages search off this site and enter "aida" as a first name and "fernandez-gonzalez" as the last name. Lee searches referral sites ussearch.com and reunion.com for ZFG. Activity is very sparse from about 5:25 AM to 1:40 PM.

From 1:40 PM to 2:00 PM or so there are multiple searches on multiple site for combinations of "cheryl davis" "east coast universal" and "battle of the bands" - all of which were figments of KC's imagination. One wonders how he continues believing sis to this day. :waitasec:

After a brief pause of 20 minutes or so, work began on the cayleeismissing, myspace page...Lee's part to understand just what KC was up to.

Muzikman
03-05-2009, 12:52 AM
10:43 PM - a successful attempt to log into myspace is made, although the account is not clear (if I knew the numeric ID for KC I could probably tell). For the next 10 minutes comments and inbox messages are viewed.



Not 100% positive (99%), but I believe this is KC's original MS Page ID #:
10472558

RR0004
03-05-2009, 01:28 AM
As I was researching the missing persons website visits on KC's laptop computer, I began to piece together what happened to KC's laptop during the final 24 hours before it was turned over to LE.

Lee arrives at Tony's around midnight, leaving around 2:00AM and arriving back at his parents around 2:25AM (evidence pages 1442 - 1445). While there he sees KC's laptop plugged in and set up on the kitchen counter top. He starts it up but gets the "blue screen of death" indicating the computer was improperly shutdown and data has been lost (page 1478). Lee also states later that, as he is investigating the situation with Caylee after bringing KC's computer back to life, he notices that in KC's Yahoo email account all emails prior to June 15 were deleted (page 1479).

I personally noticed that the internet history before June 27 was deleted, as was July 2 - 9.

Now let's look at the activity...

No activity on July 15 until 8:47 PM, when about 40 seconds worth of AIM activity occurs. My belief is this is when the computer is powered on by Tony, and AIM automatically launches. Nothing happens for 1 1/2 hours.

KC's phone - which is in the possession of Tony, receives texts from Andy F. and Will W., around 9:25. At around 10:05 Tony calls Amy and learns about KC cleaning out her bank account. Tony is probably not emotionally stable at this point.

At 10:15 PM activity resumes. For the next five minutes it looks like there are repeated attempts to log into KC's ATT wireless account, culminating in a visit to the "lost password" page to presumably have a new password sent to her email account. A successful login to Yahoo may have occurred at this time.

Activity resumes again at 10:30 with an attempt to either register with or log into an existing "Lava Life" account. This lasts for about a minute (methinks Tony is looking at the internet history). Attempts are then made to log into Facebook (unsuccessfully).

10:43 PM - a successful attempt to log into myspace is made, although the account is not clear (if I knew the numeric ID for KC I could probably tell). For the next 10 minutes comments and inbox messages are viewed.

10:57 PM - a successful attempt to log into Facebook is made, although the account is not clear. Numerous photos are viewed for the next 3 minutes. Activity stops.

11:15 PM - a return to Facebook with what appears to be a single upload.

11:19 PM - a second attempt to login to the ATT wireless account.

11:23 PM to 11:35 PM - a rapid-fire mixture of myspace and photobucket views. On Photobucket it is images. On myspace it is images and messages.

11:35 PM to 11:50 PM - many, many views of Facebook photos after what appears to be a successful login.

Computer handed over to Lee.

1:40 AM - computer appears to reboot.

2:32 AM - successful login to Yahoo mail. Activity stops at 2:34 (possibly after seeing no email exists).

At 5:09 AM the computer is powered up, but no real activity until 5:18 when the MSN website is brought up. One of the very first things done here is to go to the white pages search off this site and enter "aida" as a first name and "fernandez-gonzalez" as the last name. Lee searches referral sites ussearch.com and reunion.com for ZFG. Activity is very sparse from about 5:25 AM to 1:40 PM.

From 1:40 PM to 2:00 PM or so there are multiple searches on multiple site for combinations of "cheryl davis" "east coast universal" and "battle of the bands" - all of which were figments of KC's imagination. One wonders how he continues believing sis to this day. :waitasec:

After a brief pause of 20 minutes or so, work began on the cayleeismissing, myspace page...Lee's part to understand just what KC was up to.
Ok...a couple of questions...how does Tony get on to the laptop...when did the "blue screen" appear supposedly? I thought it was there when Lee came to pick it up. I also remember a lot of discussion about what went on the morning of the 16th. I believe it was CA talking about how that morning, when Casey was back home, they were all busy setting up the website. Remember how she said they had very little time to talk- Casey took a shower, they were busy setting up the website ('cause Cindy had no idea how) yada yada. If what you're saying is true (and I do believe it is) then all that talk from CA was a bunch of baloney. The website was set up in the afternoon...and Casey was NOT there. Is that correct?
Thanks, JWG!

magic-cat
03-05-2009, 03:53 AM
I wonder if there was a phone call or more than one phone call from the house or from Lee's cell TO Tony that evening. He is bound to have called to say he was coming for Casey's things? Maybe he said some more things-like look in that computer and see if you can find anything because Caylee is missing? OR they could actually have conspired together AFTER Lee got there and agreed the blue screen of death was a way to protect Casey? The meeting that presumably happened between Tony and Lee that was videoed- I wonder if it is in regard to something they concocted about that computer or something else that they both knew and one decided to tell...It will be interesting to see that and have one teeny tiny question answered...instead of even more questions arising!

By the way-to all of you SUPER SLEUTHS who have done so much dedicated work on this case for the benefit of us all-I thank you...

shgrbkr
03-05-2009, 04:01 AM
So was TL just snooping on KC after she left with Cindy? Think the texts from Andy and Will prompted Tony to find out if KC was cheating around on him? I'm sorry this sounds like I'm in the 7th grade, but I'm just curious. Didn't TL have his own computer?

JWG
03-05-2009, 07:56 AM
I will try to answer RR0004. magic-cat, and shgrbkr in this post.

First, I will point out again that the computer was left at Tony's when Cindy came over to get KC, as were KC's clothes and other belongings.

Based on the fact that the computer was booted around 10:15 and activity ceased just before midnight, it is clear that Tony was the one on the computer and not Lee. Lee was still at his parents. Lee arrived at Tony's around midnight and left around 2:00 AM.

Lee did say in his interview that he called Tony in advance to tell him he was coming over to get KC's stuff. Given that Lee had to this point never met nor spoken to Tony before, I think it is highly unlikely that the two of them immediately launched into a conspiracy to protect KC.

Trying to connect the dots and put myself into the player's minds that evening of July 15, what I think happened is...

Tony calls KC's phone at 8:22 PM in an attempt to try to find out from KC what was going on between she and her mother. However, KC had left her phone at Tony's, and he locates it in the process of calling her.

At 9:12 a text comes in from Will W. At 9:27 Tony attempts to call Amy on KC's phone but does not reach her. At 9:35 another text comes in from will and at 9:37 one comes in from Andy F. It is possible that Tony sees these and decides to take a peek at KC's other texts, and discovers quite a few messages that cause him to question KC's fidelity. :waitasec:

Another attempt to call Amy is made at 10:07, immediately followed by a call from Mark H. that goes to VM. Tony calls Amy again and they connect. This is when Tony learns KC cleaned out Amy's bank account. :eek:

Ya think maybe Tony's a little bit suspicious of this girl KC now? :sick:

He flips open her laptop and tries to get into her ATT account to see who she might have been calling. Based on the links to "forgotten" or "lost" password on that site, he is not successful.

Next he looks at her browser history to get a sense of where she's been. He notices that the "lava life" dating site had been visited so he goes there to see if he can figure out how to view her profile. It looks like he registered in order to do this.

Tony tries to get into her Facebook, but cannot.:banghead:

Next he tries myspace and is successful logging into her account (thanks Muzikman for digging up her numeric ID - it matched!!!). :dance: Tony spends 10 minutes looking through LOTS of profile comments and mailbox messages, and I am guessing what he sees only makes him that much more upset with her. :mad:

Sometime during his viewing of KC's myspace he figures out how to get into her Photobucket and Facebook. For the next hour he is viewing photos on both sites and messages / photos on myspace. I am guessing that what he sees infuriates him, and out of anger starts deleting stuff that upsets him. :furious:

Remember - he does not know at this point that Caylee is missing. He only knows his girlfriend is a thief and a cheat.

Somewhere along the way, in the process of deleting material, Tony accidentally corrupts a system file. This is what causes the blue screen of death. About the time this happens he gets a call from Lee who is headed over.

So Tony gathers up KC's belongings, folds them and stacks them neatly, and waits for Lee to arrive to get that woman's stuff out of his house.

It's Not the Nanny
03-05-2009, 08:55 AM
I have to wonder if George's Nigerian internet scam was really money going to escort services?? hmmmmm.....


JWG - You always continue to amaze me!! Thank you for clearly showing what happened with her computer.

I would like to see what time Lee's calls to TonE came in.....and for how long they talked.

The only statement you made that I'm not 100% certain of is that TonE ACCIDENTALLY caused the blue screen.

LA could have called TonE and told him KC was in a lot of trouble and to please start deleting.....and he would be over soon to pick up her stuff.

TonE definitely gathered KC's things and probably folded them and packed her bags -- good riddance after what he saw on her computer.

I'm hoping the taped meeting between LA and TonE will give us a better understanding of what exactly happened that night.

debs
03-05-2009, 09:06 AM
I have to wonder if George's Nigerian internet scam was really money going to escort services?? hmmmmm.....


JWG - You always continue to amaze me!! Thank you for clearly showing what happened with her computer.

I would like to see what time Lee's calls to TonE came in.....and for how long they talked.

The only statement you made that I'm not 100% certain of is that TonE ACCIDENTALLY caused the blue screen.

LA could have called TonE and told him KC was in a lot of trouble and to please start deleting.....and he would be over soon to pick up her stuff.

TonE definitely gathered KC's things and probably folded them and packed her bags -- good riddance after what he saw on her computer.

I'm hoping the taped meeting between LA and TonE will give us a better understanding of what exactly happened that night.

Doesn't seem like whoever looked at the pages spent a whole lot of time there.

lastchance
03-05-2009, 09:23 AM
Wow, oh, Wow! Great sleuthing, JWG and Muzikman. It really clears up so much for me. This computer thing has always bothered me, but it makes sense that TL would be curious about what the heck was going on. This also could explain how completely he dropped KC after this and why she was so anxious to talk to him while she was in jail. She wanted to get to him before anyone else and give her "side of the story". Does anyone know if they had any contact after that first arrest?

Shannon33
03-05-2009, 09:31 AM
Casey Myspace friend ID is 10472558...
If that is not the numberical ID in your findings, post it and we can tell you who's page they were logged into. I would find it interesting to learn that Tony had logged into CASEY's Myspace and was deleting messages and comments...

JWG
03-05-2009, 09:40 AM
Casey Myspace friend ID is 10472558...
If that is not the numberical ID in your findings, post it and we can tell you who's page they were logged into. I would find it interesting to learn that Tony had logged into CASEY's Myspace and was deleting messages and comments...

Thanks Shannon. Muzikman supplied this to me and it is a match. Tony was somehow able to get into her myspace.

NYJeremy
03-05-2009, 09:52 AM
"I posted yesterday on the escort service surfing activity, and I will have more to say about that in a future post. Suffice it to say, I am 99% certain George is solely responsible for the visits to escort sites, and KC is uninvolved in that surfing activity."

Hoo-boy! Cindy isn't going to like this at all!

By the way, JWG, nice signature line.......... and nice photos in your profile!

Agree 100%, this is where George spent the money not the Nigerian Email Scam.

DiDi
03-05-2009, 09:52 AM
First and foremost, thank you for this great sleuthing - I was beginning to lose faith in why I'm still here, but posts like this remind me of exactly why!

I absolutely don't think Tony started any type of cover up for Casey - I do think as suggested that his head was swirling with all the deceit he just found out about. Now question, or thought. If he just pushed the power button on the laptop ( he's upset with what he's finding out, fed up, just turns it off) would that cause the blue screen of death?

per_curiam
03-05-2009, 09:54 AM
So, you think it is George going to the escort site? Do you think he is looking for services, or he's just there to, er...choke the, er...chicken? :hen:Either way, I'm already laughing at Cindy's future response to this one. :thewhip:

ElizaAvalon
03-05-2009, 10:56 AM
JWG - do we have collaberation between Lee and Tony that, in fact, Lee arrived at Tony's at midnight?

The Internet history smells more like Lee's work to me than Tony's. I see Lee having more of a motive to want to access KC's cellphone records based on the information he got at home re: the "missing" blackjack.

ElizaAvalon
03-05-2009, 11:00 AM
Thanks Shannon. Muzikman supplied this to me and it is a match. Tony was somehow able to get into her myspace.

She probably was always logged in.

Shannon33
03-05-2009, 11:16 AM
Does anyone know what Sales.Liveperson.Com is? It looks to be a website that you can speak with professionals of all different topics on?

Also has anyone else noticed on 7/16 there was a search for AIDA FERNANDEZ... that is strange to me - I have never seen reference to that name.

CapsDeej
03-05-2009, 11:17 AM
She probably was always logged in.

MySpace will remember your ID but not your password - you have to type that in every time. (at least I do)

ElizaAvalon
03-05-2009, 11:46 AM
MySpace will remember your ID but not your password - you have to type that in every time. (at least I do)

The browser could have still been open. Then she could still have been logged in.

I can't download Muzikman's doc so that I can check it out myself. :(

Hot Dogs
03-05-2009, 11:54 AM
The browser could have still been open. Then she could still have been logged in.

It seems the computer was powered off when Tony got to it...

the computer is powered on by Tony

JWG
03-05-2009, 12:45 PM
The browser could have still been open. Then she could still have been logged in.

I can't download Muzikman's doc so that I can check it out myself. :(

Not sure exactly how the laptop internet history got trashed in the process of Tony "cleansing" KC's accounts of images / messages that upset him, but it appears it did because there is very little activity shown pre-7/14, yet we know she was uploading to Photobucket quite frequently (as well as posting on FB and MS).

With that preamble, I am not seeing a previous instance of a myspace visit in the notebook history.

Also, the sequence of visits begins with three visits to
http://www.myspace.com/
followed 11 minutes later (after attempts to get into FB and then a pause by a visit to:
http://home.myspace.com/index.cfm?fuseaction=user

This kind of implies to me that there were a couple of failed password attempts before success. That said, if KC never closed her browser and never shut down her laptop (put it to sleep only), Tony could have clicked into her myspace home page directly from the myspace main page. I just cannot tell which is which, and I'm not seeing an older access to myspace.

What is clear is he does eventually get into her Facebook and Photobucket after many failed attempts, so somehow he figured out her password or found it on the system.

JWG
03-05-2009, 01:00 PM
It seems the computer was powered off when Tony got to it...

It seems that way, because AIM is the first thing that launches (accesses the internet) on the 15th - it looks like an application launch on boot, or an application access to the internet after waking up from sleep mode. Then nothing happens for a while, further solidifying this opinion.

DazzlinDebSD
03-05-2009, 02:01 PM
Last week I turned my laptop on, and oops......I got a blue screen. I called Sony Vaio and spent over an hour on the phone with a guy from over seas. Long story short after paying $39.95 for tech support, and $19.95 for the recovery CD's I took the 18 month old laptop into a shop with a good reputation close by where I work. Diognosis....fried hard drive, recovery not even possible.

I went home and started a fire in the firepit in my yard and torched the old hard drive, lol. It felt good knowing that every skull, chloroform search, and every thing I've ever stumbled upon in that 18 months is gone for good. Since this case I've deleted my facebook, and myspace. When I go on Craigslist to the rants and raves section I never open a link because it may have a nasty picture in it. Everything I do on my PC, I think twice about it!!!! Thanks you Casey Anthony!!!

awakewriter
03-05-2009, 02:26 PM
SNIPPED:
Following is the raw data for the visits in question:

07/16/2008 14:51:37 06/24/2008 16:01:46 http://www.missingkids.com/photographs/NCMC1097725c1t.jpg
07/16/2008 14:51:31 07/03/2008 01:28:12 http://www.missingkids.com/photographs/NCMC1099693c1t.jpg
07/16/2008 14:51:25 07/10/2008 11:37:33 http://www.missingkids.com/photographs/NCMC1096469c1t.jpg
07/16/2008 14:51:24 05/27/2008 12:58:47 http://www.missingkids.com/photographs/NCMC1096536c1t.jpg
07/16/2008 14:51:24 04/24/2008 16:06:48 http://www.missingkids.com/photographs/NCMC1094062c2t.jpg
07/16/2008 14:51:24 04/24/2008 16:06:48 http://www.missingkids.com/photographs/NCMC1094062c1t.jpg
07/16/2008 14:51:24 05/03/2008 17:07:29 http://www.missingkids.com/photographs/NCMC1094659c1t.jpg
07/16/2008 14:51:24 06/23/2008 15:30:12 http://www.missingkids.com/photographs/NCMC1098504c1t.jpg
07/16/2008 14:51:24 04/24/2008 16:06:48 http://www.missingkids.com/photographs/NCMC1094062c3t.jpg
07/16/2008 14:51:24 06/24/2008 14:14:01 http://www.missingkids.com/photographs/NCMC1098088c1t.jpg
07/16/2008 14:51:24 07/02/2008 19:50:00 http://www.missingkids.com/photographs/NCMC1099149c1t.jpg
07/16/2008 14:51:24 07/01/2008 00:06:13 http://www.missingkids.com/photographs/NCMC1099410c1t.jpg
07/16/2008 14:51:24 03/17/2008 15:47:48 http://www.missingkids.com/photographs/NCMC1091268c1t.jpg

07/16/2008 14:51:24 04/10/2007 12:29:03 http://www.get-involved.com/mashup/marker.swf
07/16/2008 14:51:22 http://www.get-involved.com/mashup/RSS_Read.php?state=XX
07/16/2008 14:51:22 http://www.get-involved.com/mashup/RSS_Read.php?state=XX
07/16/2008 14:51:21 06/19/2007 06:32:24 http://www.get-involved.com/mashup/map_small.swf
07/16/2008 14:51:20 04/26/2007 08:04:49 http://www.get-involved.com/mashup/images/kids_widget_04.gif
07/16/2008 14:51:20 04/26/2007 08:04:48 http://www.get-involved.com/mashup/images/kids_widget_01.gif
07/16/2008 14:51:20 04/26/2007 08:04:49 http://www.get-involved.com/mashup/images/kids_widget_05.gif
07/16/2008 14:51:20 04/26/2007 08:04:49 http://www.get-involved.com/mashup/images/kids_widget_02.gif
07/16/2008 14:43:09 http://www.get-involved.com/mashup/RSS_Read.php?state=XX

There are a few things to note about each item listed. First, the items are objects on the website, such as an image (.gif or .jpg) or shockwave video (.swf). The web browser will store the objects on the computer so that the next time the website is visited, it will appear to load faster than the first time. This is called caching.

The date / time shown in red indicates when the object was accessed by the web browser. This is indicative of when the website was surfed.

The other date / time (if there is one) indicates when the object was last modified by whoever created it or otherwise owned the object. Using an image, for example, this date / time could indicate when the picture was taken, resized, photoshopped...you name it. It is often indicative of when the web page was created or modified. It is not indicative of when the web page was surfed.

Unfortunately, the media saw the old dates and assumed that they were surf dates. LE did not make that assumption. There is nothing in the complete forensic report that indicates they ever thought this was something to look into.

I should further point out that the sites were visited from the laptop computer and not the home computer.

So what really happened? :waitasec:

Recall that Lee picked up KC's computer on the evening of the 15th from Tony's. (I will need to post later on the activity beginning late that night, but in an attempt to keep this post to under five pages, I will stay on topic. :rolleyes:)

Sometime during the afternoon of the 16th the "cayleeismissing" myspace page goes live. This page becomes a missing person's website - Caylee's. Work on this page occurred between 2:37 PM and 2:52 PM on July 16th - completely encompassing the time the missing person's sites were accessed.

Given KC was pre-occupied during this time, the best candidate for this activity is ... Lee. He was just trying to get Caylee's name out there as a missing person. :angel:

What about searches for chloroform!?! Did they really happen before Caylee's death?!!???

This is fantastic work!

marbrit
03-05-2009, 02:55 PM
Thank you so much for all your hard work JWG and Muzikman! I appreciate the very hard digging and exposing of stories.

lawlady84
03-05-2009, 03:49 PM
I have to wonder if George's Nigerian internet scam was really money going to escort services?? hmmmmm.....


JWG - You always continue to amaze me!! Thank you for clearly showing what happened with her computer.

I would like to see what time Lee's calls to TonE came in.....and for how long they talked.

The only statement you made that I'm not 100% certain of is that TonE ACCIDENTALLY caused the blue screen.

LA could have called TonE and told him KC was in a lot of trouble and to please start deleting.....and he would be over soon to pick up her stuff.

TonE definitely gathered KC's things and probably folded them and packed her bags -- good riddance after what he saw on her computer.

I'm hoping the taped meeting between LA and TonE will give us a better understanding of what exactly happened that night.


First, GREAT work everyone! JWG & Muzik you both are fantastic- I hope LE is this savy with this data as you two are.

I agree JWG, I think Tony probably saw "flirty" messages from WW, and then heard KC wiped out Amy's bank account - and was floored. IMO he was probably furious and automatically wanted to check KC's accounts to see if there were any "Tony's a joke, I'm stealing from him ahah" type of posts.

I don't think the deleting was anything but either out of anger, or "I want nothing to do with this $*&#&% I wish I never met her" - virtually erasing her from his life. Also I really highly doubt that there was a Lee/Tony conspiracy to delete, because at that point for all Lee knew KC could have just been being a brat - and Caylee could have been actually safe with someone. At this point KC just said "I haven't seen her" - knowing KC, Lee could have thought she was causing the scene just to spite Cindy but that everything was actually okay.

So soon after the fact I'd think that Lee would want to see all of the information from KC's computer he could - to try to figure out what happened. If this was a week later, I'd buy more of the cover-up angle. But I don't think Lee would just trust Tony "hey man delete everything but tell me what it said."

rice09
03-05-2009, 03:55 PM
[QUOTE=CapsDeej;3413831]MySpace will remember your ID but not your password - you have to type that in every time. (at least I do)[/

Unless you LOG off, myspace will stayed logged in if you have a window open. I can check myspace all day long when i have a window open. Once all your windows are closed it will automatically log you off.

RR0004
03-06-2009, 01:23 AM
I will try to answer RR0004. magic-cat, and shgrbkr in this post.

First, I will point out again that the computer was left at Tony's when Cindy came over to get KC, as were KC's clothes and other belongings.

Based on the fact that the computer was booted around 10:15 and activity ceased just before midnight, it is clear that Tony was the one on the computer and not Lee. Lee was still at his parents. Lee arrived at Tony's around midnight and left around 2:00 AM.

Lee did say in his interview that he called Tony in advance to tell him he was coming over to get KC's stuff. Given that Lee had to this point never met nor spoken to Tony before, I think it is highly unlikely that the two of them immediately launched into a conspiracy to protect KC.

Trying to connect the dots and put myself into the player's minds that evening of July 15, what I think happened is...

Tony calls KC's phone at 8:22 PM in an attempt to try to find out from KC what was going on between she and her mother. However, KC had left her phone at Tony's, and he locates it in the process of calling her.

At 9:12 a text comes in from Will W. At 9:27 Tony attempts to call Amy on KC's phone but does not reach her. At 9:35 another text comes in from will and at 9:37 one comes in from Andy F. It is possible that Tony sees these and decides to take a peek at KC's other texts, and discovers quite a few messages that cause him to question KC's fidelity. :waitasec:

Another attempt to call Amy is made at 10:07, immediately followed by a call from Mark H. that goes to VM. Tony calls Amy again and they connect. This is when Tony learns KC cleaned out Amy's bank account. :eek:

Ya think maybe Tony's a little bit suspicious of this girl KC now? :sick:

He flips open her laptop and tries to get into her ATT account to see who she might have been calling. Based on the links to "forgotten" or "lost" password on that site, he is not successful.

Next he looks at her browser history to get a sense of where she's been. He notices that the "lava life" dating site had been visited so he goes there to see if he can figure out how to view her profile. It looks like he registered in order to do this.

Tony tries to get into her Facebook, but cannot.:banghead:

Next he tries myspace and is successful logging into her account (thanks Muzikman for digging up her numeric ID - it matched!!!). :dance: Tony spends 10 minutes looking through LOTS of profile comments and mailbox messages, and I am guessing what he sees only makes him that much more upset with her. :mad:

Sometime during his viewing of KC's myspace he figures out how to get into her Photobucket and Facebook. For the next hour he is viewing photos on both sites and messages / photos on myspace. I am guessing that what he sees infuriates him, and out of anger starts deleting stuff that upsets him. :furious:

Remember - he does not know at this point that Caylee is missing. He only knows his girlfriend is a thief and a cheat.

Somewhere along the way, in the process of deleting material, Tony accidentally corrupts a system file. This is what causes the blue screen of death. About the time this happens he gets a call from Lee who is headed over.

So Tony gathers up KC's belongings, folds them and stacks them neatly, and waits for Lee to arrive to get that woman's stuff out of his house.

Thanks JWG for all the info!!

Dr. Know?
03-06-2009, 02:26 AM
Snipped from JWG. Thanks as you and Bond and many others are amazing.

"Not sure exactly how the laptop internet history got trashed in the process of Tony "cleansing" KC's accounts of images / messages that upset him, but it appears it did because there is very little activity shown pre-7/14, yet we know she was uploading to Photobucket quite frequently (as well as posting on FB and MS)."

Reply:

I have and older HP and they have a restore point which is to safely restore your computer to a saved restore point in case you have a problem or virus etc... I remember in the beginning that LA said something like everything from the 15th of June to the time he turned it over to police was gone (July 15th or 16th). Yahoo accounts etc. Was that disproven? Sorry, I kind of worked with computers in my day and try not to read this thread. Too much like my old work!

Also, I would think, and again I am sorry for not reading this thread close enough, but doesn't anyone else remember DOS codes? I remember the f/xxxx to wipe out everything. Easy blue screen of death possibly. I have not tried it on my newer computers but 5 years ago, yes and it still worked if needed.

Anyone else that old? J/K

Dr. Know?
03-06-2009, 02:31 AM
Oh and if it was an older computer, even upgraded, you could go to the command and do an f/xxxx. Gone, baby, gone. Almost...Please accept my apologies as I know so many of you are smarter than I am. I am old school.

nancy botwin
03-06-2009, 03:07 AM
I've been looking through the mountain of computer forensic data released last September and uploaded yesterday to a file sharing site by dedicated websleuther Muzikman. :rocker:

I posted yesterday (http://websleuths.com/forums/showpost.php?p=3404221&postcount=173) on the escort service surfing activity, and I will have more to say about that in a future post. Suffice it to say, I am 99% certain George is solely responsible for the visits to escort sites, :blushing: and KC is uninvolved in that surfing activity.

This evening I took a close look at the visits to missing person's websites widely reported last September in the media. My conclusion is that KC did not visit missing persons websites prior to Caylee's disappearance. In fact, I do not believe she is responsible for those visits at all. :eek:

Following is the raw data for the visits in question:

07/16/2008 14:51:37 06/24/2008 16:01:46 http://www.missingkids.com/photographs/NCMC1097725c1t.jpg
07/16/2008 14:51:31 07/03/2008 01:28:12 http://www.missingkids.com/photographs/NCMC1099693c1t.jpg
07/16/2008 14:51:25 07/10/2008 11:37:33 http://www.missingkids.com/photographs/NCMC1096469c1t.jpg
07/16/2008 14:51:24 05/27/2008 12:58:47 http://www.missingkids.com/photographs/NCMC1096536c1t.jpg
07/16/2008 14:51:24 04/24/2008 16:06:48 http://www.missingkids.com/photographs/NCMC1094062c2t.jpg
07/16/2008 14:51:24 04/24/2008 16:06:48 http://www.missingkids.com/photographs/NCMC1094062c1t.jpg
07/16/2008 14:51:24 05/03/2008 17:07:29 http://www.missingkids.com/photographs/NCMC1094659c1t.jpg
07/16/2008 14:51:24 06/23/2008 15:30:12 http://www.missingkids.com/photographs/NCMC1098504c1t.jpg
07/16/2008 14:51:24 04/24/2008 16:06:48 http://www.missingkids.com/photographs/NCMC1094062c3t.jpg
07/16/2008 14:51:24 06/24/2008 14:14:01 http://www.missingkids.com/photographs/NCMC1098088c1t.jpg
07/16/2008 14:51:24 07/02/2008 19:50:00 http://www.missingkids.com/photographs/NCMC1099149c1t.jpg
07/16/2008 14:51:24 07/01/2008 00:06:13 http://www.missingkids.com/photographs/NCMC1099410c1t.jpg
07/16/2008 14:51:24 03/17/2008 15:47:48 http://www.missingkids.com/photographs/NCMC1091268c1t.jpg

07/16/2008 14:51:24 04/10/2007 12:29:03 http://www.get-involved.com/mashup/marker.swf
07/16/2008 14:51:22 http://www.get-involved.com/mashup/RSS_Read.php?state=XX
07/16/2008 14:51:22 http://www.get-involved.com/mashup/RSS_Read.php?state=XX
07/16/2008 14:51:21 06/19/2007 06:32:24 http://www.get-involved.com/mashup/map_small.swf
07/16/2008 14:51:20 04/26/2007 08:04:49 http://www.get-involved.com/mashup/images/kids_widget_04.gif
07/16/2008 14:51:20 04/26/2007 08:04:48 http://www.get-involved.com/mashup/images/kids_widget_01.gif
07/16/2008 14:51:20 04/26/2007 08:04:49 http://www.get-involved.com/mashup/images/kids_widget_05.gif
07/16/2008 14:51:20 04/26/2007 08:04:49 http://www.get-involved.com/mashup/images/kids_widget_02.gif
07/16/2008 14:43:09 http://www.get-involved.com/mashup/RSS_Read.php?state=XX

There are a few things to note about each item listed. First, the items are objects on the website, such as an image (.gif or .jpg) or shockwave video (.swf). The web browser will store the objects on the computer so that the next time the website is visited, it will appear to load faster than the first time. This is called caching.

The date / time shown in red indicates when the object was accessed by the web browser. This is indicative of when the website was surfed.

The other date / time (if there is one) indicates when the object was last modified by whoever created it or otherwise owned the object. Using an image, for example, this date / time could indicate when the picture was taken, resized, photoshopped...you name it. It is often indicative of when the web page was created or modified. It is not indicative of when the web page was surfed.

Unfortunately, the media saw the old dates and assumed that they were surf dates. LE did not make that assumption. There is nothing in the complete forensic report that indicates they ever thought this was something to look into.

I should further point out that the sites were visited from the laptop computer and not the home computer.

So what really happened? :waitasec:

Recall that Lee picked up KC's computer on the evening of the 15th from Tony's. (I will need to post later on the activity beginning late that night, but in an attempt to keep this post to under five pages, I will stay on topic. :rolleyes:)

Sometime during the afternoon of the 16th the "cayleeismissing" myspace page goes live. This page becomes a missing person's website - Caylee's. Work on this page occurred between 2:37 PM and 2:52 PM on July 16th - completely encompassing the time the missing person's sites were accessed.

Given KC was pre-occupied during this time, the best candidate for this activity is ... Lee. He was just trying to get Caylee's name out there as a missing person. :angel:

wow! This is very interesting! Excellent work--
JB would do well to set http://www.websleuths.com/forums/search.php?searchid=1889621 as his homepage :wink:

Dr. Know?
03-06-2009, 03:22 AM
JWG, I couldn't open many of the links you posted. I did open some to a small picture. Thanks for the post.

CapsDeej
03-06-2009, 08:08 AM
[QUOTE=CapsDeej;3413831]MySpace will remember your ID but not your password - you have to type that in every time. (at least I do)[/

Unless you LOG off, myspace will stayed logged in if you have a window open. I can check myspace all day long when i have a window open. Once all your windows are closed it will automatically log you off.

True - but JWGs analysis clearly shows that Tony powered on the laptop indicating that the laptop was off - so no windows cold have been open.

JWG
03-06-2009, 08:18 AM
Everyone makes mistakes, especially me. Because I had trouble unzipping the entire archive, I just accessed the files from within the archive. I did not closely check the file structure when doing so. :bang:

Turns out I was not looking at the history for the laptop when I did this analysis.

I was looking at the temporary history for the desktop.:loser:

The analysis I did for the missing person's website was correct - it was taken from the internet explorer history file.

So, knowing it was the desktop and not the laptop, it could not have been Tony on the 'puter. It had to be someone at the Anthony's. Given activity stops from just before midnight to just after 2:30 AM - the window of time Lee went up to Tony's, it had to be Lee on the desktop deleting away. :rolleyes:

Thanks to ElizaAvalon for showing me the error of my ways. Eliza...if you would like to expand, please have at it. I should probably go into a sleuthing time out for this faux pas.

I will try to answer RR0004. magic-cat, and shgrbkr in this post.

First, I will point out again that the computer was left at Tony's when Cindy came over to get KC, as were KC's clothes and other belongings.

Based on the fact that the computer was booted around 10:15 and activity ceased just before midnight, it is clear that Tony was the one on the computer and not Lee. Lee was still at his parents. Lee arrived at Tony's around midnight and left around 2:00 AM.

Lee did say in his interview that he called Tony in advance to tell him he was coming over to get KC's stuff. Given that Lee had to this point never met nor spoken to Tony before, I think it is highly unlikely that the two of them immediately launched into a conspiracy to protect KC.

Trying to connect the dots and put myself into the player's minds that evening of July 15, what I think happened is...

Tony calls KC's phone at 8:22 PM in an attempt to try to find out from KC what was going on between she and her mother. However, KC had left her phone at Tony's, and he locates it in the process of calling her.

At 9:12 a text comes in from Will W. At 9:27 Tony attempts to call Amy on KC's phone but does not reach her. At 9:35 another text comes in from will and at 9:37 one comes in from Andy F. It is possible that Tony sees these and decides to take a peek at KC's other texts, and discovers quite a few messages that cause him to question KC's fidelity. :waitasec:

Another attempt to call Amy is made at 10:07, immediately followed by a call from Mark H. that goes to VM. Tony calls Amy again and they connect. This is when Tony learns KC cleaned out Amy's bank account. :eek:

Ya think maybe Tony's a little bit suspicious of this girl KC now? :sick:

He flips open her laptop and tries to get into her ATT account to see who she might have been calling. Based on the links to "forgotten" or "lost" password on that site, he is not successful.

Next he looks at her browser history to get a sense of where she's been. He notices that the "lava life" dating site had been visited so he goes there to see if he can figure out how to view her profile. It looks like he registered in order to do this.

Tony tries to get into her Facebook, but cannot.:banghead:

Next he tries myspace and is successful logging into her account (thanks Muzikman for digging up her numeric ID - it matched!!!). :dance: Tony spends 10 minutes looking through LOTS of profile comments and mailbox messages, and I am guessing what he sees only makes him that much more upset with her. :mad:

Sometime during his viewing of KC's myspace he figures out how to get into her Photobucket and Facebook. For the next hour he is viewing photos on both sites and messages / photos on myspace. I am guessing that what he sees infuriates him, and out of anger starts deleting stuff that upsets him. :furious:

Remember - he does not know at this point that Caylee is missing. He only knows his girlfriend is a thief and a cheat.

Somewhere along the way, in the process of deleting material, Tony accidentally corrupts a system file. This is what causes the blue screen of death. About the time this happens he gets a call from Lee who is headed over.

So Tony gathers up KC's belongings, folds them and stacks them neatly, and waits for Lee to arrive to get that woman's stuff out of his house.

Where's Andre
03-06-2009, 08:24 AM
True - but JWGs analysis clearly shows that Tony powered on the laptop indicating that the laptop was off - so no windows cold have been open.

This is a laptop. There's a possibility it could have been a power up into a resume. I rarely truly cold-boot laptops.

ElizaAvalon
03-06-2009, 08:25 AM
JWG - first of all, you've done GREAT sleuthing work on this case and we need ya!

The profile user name on the laptop is Bobby.

The profile user name on the desktop is Casey.

Very easy to see how the desktop and the laptop could be confused.

kew17
03-06-2009, 09:11 AM
I'm seeing the comment that "he knows what he's done" could refer to Lee's attempt at clearing potentially damning info off the computer as part of the obstruction of justice? My question is I've always heard nothing except a complete reformat of the hard drive will erase it. Even though items were deleted, are they still there - deeply embedded there somewhere?

Jess1985
03-06-2009, 09:12 AM
Does anyone think that perhaps, after Tony found out all this information, which was probably overwhelming....and logged in to her myspace and read some messages from probably other guys, that he could have thrown or punched the laptop, causing it to die out(blue screen)??
OR....could it have been Lee, which then after talking with Tony, and reading some messages and realizing that she was lying to him, got upset and proceeded to take it out on the computer??:confused:

Jersey*Girl
03-06-2009, 09:20 AM
Not just back in the day....I have been using Xanax for a few months now for PMDD which is basically PMS to the extreme.
(But it has been prescribed as a last resort, since we have tried everything else available over the last 8 yrs.)
I noticed in KC's photobucket acc that she had several PMS related icons, and wondered if she had significant mood shifts when she was premenstrual?

I also have some questions about the pc....If it was already wiped when LA got to TL's or it wouldnt start up, then how did they access the pictures to make the missing posters?
Or was that from another PC and results of both searches have been included? Sorry if its a repeat question- wish I had time to read all the posts but I dont.
ETA- Could this be why the file is called bobby?

The original Bobby was a free online tool provided by the Centre for Applied Special Technology (CAST) used to validate websites for WAI and Section 508 compliance. Launched in 1995 [1], it became well known for the usage of the Bobby Approved icon that website authors could use to indicate they have successfully passed the Bobby online test.

The CAST tool was officially closed on May 1, 2005. However, the Bobby name lives on in Watchfire Corporation's Watchfire Bobby program. Watchfire provided the same free service that CAST did with Bobby in their Watchfire WebXACT tool. Watchfire's current offering, now part of an IBM suite described below, tests pages of web content for quality, accessibility and privacy issues.

The free tool was officially closed by the owners, IBM, on February 1, 2008 [2]. The software is now available as part of IBM's Rational Policy Tester Accessibility Edition. [3]

Currently, the Web Accessibility Evaluation Tool (WAVE) provides this free service at http://wave.webaim.org "[2]".

[edit] References
^ Centre for Applied Special Technology (CAST), Bobby, cited 4 May 2008.
^ Watchfire, Bobby and WebXact, cited 4 May 2008.
^ Rational Policy Tester Accessibility Edition, "[1]".

JWG - first of all, you've done GREAT sleuthing work on this case and we need ya!

The profile user name on the laptop is Bobby.

The profile user name on the desktop is Casey.

Very easy to see how the desktop and the laptop could be confused.

Eliza, I remembered this from a prior thread earlier on, so thought I'd just bring it over to this thread. Not sure if this is what the reference to Bobby really is, but it seemingly could be. It explains the term Bobby rather clearly...although, not exactly sure if it really pertains to the A's comp.

JWG - Do you have any knowledge with this? I've gone through our computers and I've found no reference to Bobby. This could be b/c our computers are newer and we've never used that free utility (or program so to speak). I've searched our harddrives and throughly went through safe mode...still found nothing with reference to Bobby. So, either the A's used the Bobby free utility, it was a file or something set up by one of them, or it was from a previous owner...right? Do you maybe have any insight to this? Thanks bunches! Jersey

ibyoungr
03-06-2009, 10:19 AM
Does anyone think that perhaps, after Tony found out all this information, which was probably overwhelming....and logged in to her myspace and read some messages from probably other guys, that he could have thrown or punched the laptop, causing it to die out(blue screen)??
OR....could it have been Lee, which then after talking with Tony, and reading some messages and realizing that she was lying to him, got upset and proceeded to take it out on the computer??:confused:

JWG has recanted and stated that the information was from the DESKTOP not the LAPTOP

However, that does not change the forensics.. it just changes that it was
LEE on the family desktop and NOT TONY on the Laptop.
LETS NOT LET THIS BECOME A MISUNDERSTANDING!

JWG does great work and it one of the best sleuthers - often his work is very factual and not emotional. We all could take a page from his book and remember not to put too much emotion into the sleuthing.


JWG--- I have not had time to go through the forensics... are there any records of the EVENT VIEWER - system or application properties?? This would give us exact times of reboots, application hangs.

ibyoungr
03-06-2009, 10:45 AM
For those that are not computer savvy...

Profiles are created for each log in. On Windows XP computers, the profile is created when you set up the computer login(user account) for the first time. The profile is located in C:\Documents and Settings\nameofuseraccount

The profile contains all the settings and information for that user account. This is helpful if more than one person uses a computer and each user wants a seperate "Desktop", "Document" or Favorites.
A profile contains the following folders
Desktop folder contains the "icons" that are on the desktop
My Documents folder contains the documents the user saves to the computer this folder usually contains "My Pictures" and "My Music".
Favorites contains the favorite links that one chooses to save to use within Internet Explorer.
Application Data folder contains information about various applications ex: Outlook express settings and the outlook/outlook express mail. Application data holds information like the dictionary (during spell check when you want to save a specific word to the dictionary.. this is where the info goes)

The "bobby" profilecould have been from a previous user, a generic name or some inexperienced IT guy used his own first name when setting up the PC.

In Windows Xp, you will see other profiles such as Administrator, Default User, or All Users. When there are Desktop icons in All Users that means the icons are available to ALL USERS that log in no matter which profile they use.

Forensic evidence that would be very interesting for me to see would be the event logs in the Control Panel-Admin Tools- Event Viewer as well as what was in the My Documents folder.

I would love to get a hold of the hard drive and run a data recovery application that I use on a regular basis that has retrieved data from over 20 "crashed" hard drives. Gilware, Inc will also retrieve photos, documents, etc for a fee. They own a clean lab which will retrieve data from water, fire and platter damaged PC's.

ibyoungr
03-06-2009, 10:52 AM
Another lesson for those less than computer savvy...


There are many Free applications that clear your internet tracks...
One that I suggest is CCLEANER. This will also remove registry entries that tend to clog up the the registry. This comes from removing and installing applications. This only helps with your tracks on your computer.
This will not help with posting or updating items on Myspace or Facepage.
Casey would not have been able to cover those tracks at all.

However, keep in mind.. with a nice data recovery program alot of these deleted files can be retrieved. The best way to cover your tracks is to completely destroy the hard drive or do a Department of Defense standard format. This would require a full install of the operating system and applications and restoration of data files from a backup. ( I would not suggest anyone to do this if you are NOT experienced.)

ElizaAvalon
03-06-2009, 10:58 AM
JWG--- I have not had time to go through the forensics... are there any records of the EVENT VIEWER - system or application properties?? This would give us exact times of reboots, application hangs.

Unfortunately, the Event Viewer system or application log is not in the docs for either the laptop or the desktop.

No time today to review them, but it does look to me like on the laptop Safari was used for the Internet and IE was used to view photos on the computer itself - most likely IE was the default viewer for photos.

The IE history only shows hits to local files and very rare hits to Internet addresses (2 hits - yahoo insider or at&t).

Either the 'unfiltered' IE history is actually filtered or I suspect a virus on the laptop, hence the Blue Screen of Death, which may or may not have been real (sometimes a virus will put up a fake BSD).

ElizaAvalon
03-06-2009, 11:00 AM
Another lesson for those less than computer savvy...


There are many Free applications that clear your internet tracks...
One that I suggest is CCLEANER. This will also remove registry entries that tend to clog up the the registry. This comes from removing and installing applications. This only helps with your tracks on your computer.
This will not help with posting or updating items on Myspace or Facepage.
Casey would not have been able to cover those tracks at all.

However, keep in mind.. with a nice data recovery program alot of these deleted files can be retrieved. The best way to cover your tracks is to completely destroy the hard drive or do a Department of Defense standard format. This would require a full install of the operating system and applications and restoration of data files from a backup. ( I would not suggest anyone to do this if you are NOT experienced.)

I second that.

Make sure you use ccleaner on all user profiles on the computer.

Cleanup! is another good one...

faefrost
03-06-2009, 11:03 AM
I'm seeing the comment that "he knows what he's done" could refer to Lee's attempt at clearing potentially damning info off the computer as part of the obstruction of justice? My question is I've always heard nothing except a complete reformat of the hard drive will erase it. Even though items were deleted, are they still there - deeply embedded there somewhere?

They are still there. Even a standard format will not prevent a forensics program from locating it on the disk surface.

The only "user capable" things that will prevent data recovery on a drive are a "low level format", which directly rewrites every sector on the driive platters, and requires a special software tool from he drives manufacturer. A government quality data erasure tool, which are very expensive and not very effective once the FBI is involved. Or actual physical damage to the hard Drive. Subjecting it to a very strong magnetic field, such as proximity to an MRI scanner, or driving several 1/4" holes through it with a power drill.

And even if one of the above is used, while it may prevent a local or state lab from recovering much, the FBI is the best in the world. They have recovered portions of useable data from unbelievably damaged drives.

ibyoungr
03-06-2009, 11:06 AM
Unfortunately, the Event Viewer system or application log is not in the docs for either the laptop or the desktop.

No time today to review them, but it does look to me like on the laptop Safari was used for the Internet and IE was used to view photos on the computer itself - most likely IE was the default viewer for photos.

The IE history only shows hits to local files and very rare hits to Internet addresses (2 hits - yahoo insider or at&t).

Either the 'unfiltered' IE history is actually filtered or I suspect a virus on the laptop, hence the Blue Screen of Death, which may or may not have been real (sometimes a virus will put up a fake BSD).

Bolded by me.. there was a virus last summer that seemed to exhibit that behavior I ended up having to reinstall the OS on several machines. Good call.
Also I believe Safari has a feature to allow private browsing as does Internet explorer 8.

I just think that either LE is holding back info on the PC's or they did not do a very throughly look of the state of the PC. I just think she would have alot of items in the "My Documents or My Pictures" folder.

ElizaAvalon
03-06-2009, 11:06 AM
Eliza, I remembered this from a prior thread earlier on, so thought I'd just bring it over to this thread. Not sure if this is what the reference to Bobby really is, but it seemingly could be. It explains the term Bobby rather clearly...although, not exactly sure if it really pertains to the A's comp.

JWG - Do you have any knowledge with this? I've gone through our computers and I've found no reference to Bobby. This could be b/c our computers are newer and we've never used that free utility (or program so to speak). I've searched our harddrives and throughly went through safe mode...still found nothing with reference to Bobby. So, either the A's used the Bobby free utility, it was a file or something set up by one of them, or it was from a previous owner...right? Do you maybe have any insight to this? Thanks bunches! Jersey

Jersey - bobby was just the username that was used on the laptop. She could have bought the laptop used or from a friend or whatever and just didn't create a new profile.

It may also have been the ONLY profile. And then she wouldn't have even had to log into the laptop. The name bobby would have been transparent. She may not have even known.

Also - I do believe the computer was cleaned up at some point. I'll have to go way back into my notes but I think there was something that made me think they brought it in for service. Maybe the creation dates of the history.dat files? I forget so don't quote me. My point is, it could have been the name of the person who did the work.

Lanie
03-06-2009, 11:09 AM
Snipped from JWG. Thanks as you and Bond and many others are amazing.

"Not sure exactly how the laptop internet history got trashed in the process of Tony "cleansing" KC's accounts of images / messages that upset him, but it appears it did because there is very little activity shown pre-7/14, yet we know she was uploading to Photobucket quite frequently (as well as posting on FB and MS)."

Reply:

I have and older HP and they have a restore point which is to safely restore your computer to a saved restore point in case you have a problem or virus etc... I remember in the beginning that LA said something like everything from the 15th of June to the time he turned it over to police was gone (July 15th or 16th). Yahoo accounts etc. Was that disproven? Sorry, I kind of worked with computers in my day and try not to read this thread. Too much like my old work!

Also, I would think, and again I am sorry for not reading this thread close enough, but doesn't anyone else remember DOS codes? I remember the f/xxxx to wipe out everything. Easy blue screen of death possibly. I have not tried it on my newer computers but 5 years ago, yes and it still worked if needed.

Anyone else that old? J/K

LOL, amatuer computer tech here from way back before windows. These days I learn what I need to to fix whatever is wrong with one of our computers or my friends', but haven't stayed on top of everything that has come out. So I understand some of this computer forensic stuff, and the rest is Greek to me.
Lanie

ibyoungr
03-06-2009, 11:10 AM
They are still there. Even a standard format will not prevent a forensics program from locating it on the disk surface.

The only "user capable" things that will prevent data recovery on a drive are a "low level format", which directly rewrites every sector on the driive platters, and requires a special software tool from he drives manufacturer. A government quality data erasure tool, which are very expensive and not very effective once the FBI is involved. Or actual physical damage to the hard Drive. Subjecting it to a very strong magnetic field, such as proximity to an MRI scanner, or driving several 1/4" holes through it with a power drill.

And even if one of the above is used, while it may prevent a local or state lab from recovering much, the FBI is the best in the world. They have recovered portions of useable data from unbelievably damaged drives.


ITA! Most users are not that savvy and if they were a government quality data erasure would take some time to run on a good sized hard drive.. hour not minutes and definitely not seconds.

Remember BTK was caught because of data left on a floppy drive.

Lesson to be learned from this case...
If you are going to commit a crime, do not use a cell phone, computer or any digital equipment. You will and can be traced.

ElizaAvalon
03-06-2009, 11:13 AM
Bolded by me.. there was a virus last summer that seemed to exhibit that behavior I ended up having to reinstall the OS on several machines. Good call.
Also I believe Safari has a feature to allow private browsing as does Internet explorer 8.

I just think that either LE is holding back info on the PC's or they did not do a very throughly look of the state of the PC. I just think she would have alot of items in the "My Documents or My Pictures" folder.

The virus that causes the fake BSD is killer, for sure. Doesn't allow running or installing of any of the anti-malware programs. Requires manual deletion of dlls. :bang:

I think KC had IE5 on the laptop.

There are a lot of hits to My Documents in IE on the laptop. But not the documents/pictures themselves. Probably because it would add to the confusion of a juror.

ibyoungr
03-06-2009, 11:19 AM
Snipped from JWG. Thanks as you and Bond and many others are amazing.

"Not sure exactly how the laptop internet history got trashed in the process of Tony "cleansing" KC's accounts of images / messages that upset him, but it appears it did because there is very little activity shown pre-7/14, yet we know she was uploading to Photobucket quite frequently (as well as posting on FB and MS)."

Reply:

I have and older HP and they have a restore point which is to safely restore your computer to a saved restore point in case you have a problem or virus etc... I remember in the beginning that LA said something like everything from the 15th of June to the time he turned it over to police was gone (July 15th or 16th). Yahoo accounts etc. Was that disproven? Sorry, I kind of worked with computers in my day and try not to read this thread. Too much like my old work!

Also, I would think, and again I am sorry for not reading this thread close enough, but doesn't anyone else remember DOS codes? I remember the f/xxxx to wipe out everything. Easy blue screen of death possibly. I have not tried it on my newer computers but 5 years ago, yes and it still worked if needed.

Anyone else that old? J/K

I don't know if I am that old but one code I remember is:
DOS code to undelete a file would be UNDELETE [d:][path][filename] [/DT|/DS|/DOS]

But that would not do much good if they have used the computer since deleting a file because the data would rewrite over those sectors. There are many good data recovery tools. FBI would not need to mess with old DOS commands. Since the hard drive was not crashed and the OS was accessible they could run any number of data recovery tools to find deleted data and fragments of data.

ibyoungr
03-06-2009, 11:27 AM
The virus that causes the fake BSD is killer, for sure. Doesn't allow running or installing of any of the anti-malware programs. Requires manual deletion of dlls. :bang:

I think KC had IE5 on the laptop.

There are a lot of hits to My Documents in IE on the laptop. But not the documents/pictures themselves. Probably because it would add to the confusion of a juror.

O/T There was the one last summer with the manual deletion of the dll's but the other bad one was the one that created the many dll's in %systemroot%/Windows/system32 Everytime you deleted the .dll's another one was created on boot up. Some registry entries also had to be removed as well. I believe it is the Virtumonde???

IE5??? Holy cow, that could explain a virus or two. I really need to spend more time analyzing the forensic docs but since I do IT for a living.. I have other things IT related I like to do in my spare time. :)

BondJamesBond
03-06-2009, 11:58 AM
So, knowing it was the desktop and not the laptop, it could not have been Tony on the 'puter. It had to be someone at the Anthony's. Given activity stops from just before midnight to just after 2:30 AM - the window of time Lee went up to Tony's, it had to be Lee on the desktop deleting away. :rolleyes:

*snipped*

Hey, JWG...it's all good. :thumb: Quite frankly, the activity on the desktop is every bit as interesting/important as the laptop, IMHO.

And we know the media has been releasing information attributing things to Casey when, without backing it up with detail, it could come from either computer. So, learning details on either computer gives us the granularity that IS the higher standard of a good WS, eh? :highfive:

IIRC, on the 7/15 & 7/16 ping threads a detailed (eg. by the hour) timeline of Casey's location & activities was in the process of being constructed. I thought I recalled Cindy making some statements about Lee and Casey going in to work on the computer and creating the cayleeismissing page together - a collaboration. IMHO, it would makes sense Casey had to be present at least part of the time to provide Lee with the passwords as he rifled through applications.

Put yourself in that room that night, LE swarming the place, body dumped a quarter-mile down the road...Lee and Casey frantically going through AT&T, Yahoo, MySpace, etc....then getting on with the work of the cayleeismissing space. Per your earlier post, IIRC, that they tried logging into AT&T first (right?) is very telling.

:clap: Thanks again for all the hard work! :clap:

ElizaAvalon
03-06-2009, 12:14 PM
O/T There was the one last summer with the manual deletion of the dll's but the other bad one was the one that created the many dll's in %systemroot%/Windows/system32 Everytime you deleted the .dll's another one was created on boot up. Some registry entries also had to be removed as well. I believe it is the Virtumonde???

IE5??? Holy cow, that could explain a virus or two. I really need to spend more time analyzing the forensic docs but since I do IT for a living.. I have other things IT related I like to do in my spare time. :)

Virtumonde is still out there but easy to clean with anti-malware programs. If I remember correctly, the one I'm talking about is TDSSserv. I was wrong, it was deleting a driver entry...

Anyway, yes IE5. And the use of Safari also makes me suspect a virus. People are usually happy with IE until they start getting pop-ups...

BondJamesBond
03-06-2009, 01:18 PM
Not directed @ anyone in particular, and I understand the interest in discussing it, but, please consider going to this thread in the Parking Lot to discuss generic computer virus stuff.

http://websleuths.com/forums/showthread.php?p=3419499#post3419499

I included a link back here in that thread for convenience. :)

Shaymus at The Rock
03-06-2009, 01:25 PM
"I posted yesterday on the escort service surfing activity, and I will have more to say about that in a future post. Suffice it to say, I am 99% certain George is solely responsible for the visits to escort sites, and KC is uninvolved in that surfing activity."

Hoo-boy! Cindy isn't going to like this at all!

By the way, JWG, nice signature line.......... and nice photos in your profile!

Agree 100%, this is where George spent the money not the Nigerian Email Scam.

So many implications could be drawn from this. I wonder how important it was in driving the As behavior:

+ GA not really challenging KC about the "job", the thefts, etc

+ KC and LA's apparent disdain for their father which included NO celebration for Father's Day

+ CA's overly flirtatious and touchy approach to multiple men

I'm sure there are others.

Hot Dogs
03-06-2009, 01:37 PM
So many implications could be drawn from this.


Certain specific things have not been established as facts. It is a fact that GA said he was taken by a Nigerian Scam. It is not established as fact that it was GA surfing escort sites, nor that he ever spent a dime on any escort.

ibyoungr
03-06-2009, 06:05 PM
Virtumonde is still out there but easy to clean with anti-malware programs. If I remember correctly, the one I'm talking about is TDSSserv. I was wrong, it was deleting a driver entry...

Anyway, yes IE5. And the use of Safari also makes me suspect a virus. People are usually happy with IE until they start getting pop-ups...

I ran into Virtumonde before the anti-malware had a fix. YES! The TDSSserv is the one I ran into when working on my daycare provider PC. That pc had that one as many other viruses and trojans.(it was BAD) She was so infected that I just wiped the drive and reloaded everything and then told her to buy a router to put between her DSL connection and PC. I do not do much desktop work anymore, I work as a Server admin. Sorry this is so off topic.. I have been off work for a surgery the past 2 weeks and I am itching to talk shop! :)

However, I am always willing to impart knowledge to the less savvy. The more savvy users the better!

ibyoungr
03-06-2009, 06:08 PM
Not directed @ anyone in particular, and I understand the interest in discussing it, but, please consider going to this thread in the Parking Lot to discuss generic computer virus stuff.

http://websleuths.com/forums/showthread.php?p=3419499#post3419499

I included a link back here in that thread for convenience. :)

Thanks BJB.. didn't mean to get so off topic... :crazy:

ibyoungr
03-06-2009, 06:12 PM
Do we have any spreadsheets that combine the cell phone records, pings, computer forensics and interviews to get a play by play of the time period between July 15th from the time Cindy picked up Casey to the July 16th when Casey was arrested?