999 users online (161 members and 838 guests)  


Websleuths News


Page 3 of 73 FirstFirst 1 2 3 4 5 13 53 ... LastLast
Results 31 to 45 of 1091
  1. #31
    Join Date
    Apr 2011
    Posts
    299
    No metadata for files involving Google Maps search.

    Another interesting piece of the testimony by GM is that the disk, before it was imaged and after the system was shut down, was accessed in read/write mode by another system. Did not use a write block.

  2. #32
    Join Date
    Aug 2003
    Location
    San Diego
    Posts
    32,579
    I think what it comes down to is the def had 2 1/2 years to review this evidence. We know they had two experts who didn't testify. That speaks volumes to me.

    This guy was only looking at the dates from the day before NC went missing to the time it was confiscated by LE. It had already been testified to that LE made a HUGE error in not turning off the computer. So you have some guy watching the trial and he knows about computer forensics and thinks he can find more evidence than what has already been provided in testimony.

    It's called dueling experts and happens all the time.

    I didn't see anything in that testimony that was exculpatory to the defendent. This expert was only looking for specific data, period. He found a way to IMPLY it was LE that altered the computer. Yet, the defendent was in possession of the computer for three days after the disappearance of his wife. He last had access at 3:10p.m. on 7/15, just two hours before it was confiscated. Then it was left on, which also gave him 'oppotunity' to access his account from his friend's home. There's also the issue of the router that may have been used. Yes, and then the trojan, etc, etc,.........already testified to.

    Nope, there's enough already in testimony to dispute this guy's findings, as far as I'm concerned. If he were allowed, it would put the case on hold. Then the pros would have to have an opportunity to cross and have THEIR newly found expert to dispute this guy's findings. IF there was REALLY evidence of LE tampering, the defense had plenty of time to prove it BEFORE trial and they didn't.

    While many who are into computers found the technical evidence fascinating, all of this computer detail forensic speak is subterfuge to the jury. They had to listen carefully to grasp what was relevant to the case and not try to become a computer expert. They used common sense in their guilty verdict.

    I just don't see this flying on appeal basing this (not formally presented) evidence.

    JMHO, of course!
    fran

  3. #33
    Join Date
    Jul 2008
    Posts
    3,436
    Quote Originally Posted by fran View Post
    I think what it comes down to is the def had 2 1/2 years to review this evidence. We know they had two experts who didn't testify. That speaks volumes to me.

    This guy was only looking at the dates from the day before NC went missing to the time it was confiscated by LE. It had already been testified to that LE made a HUGE error in not turning off the computer. So you have some guy watching the trial and he knows about computer forensics and thinks he can find more evidence than what has already been provided in testimony.

    It's called dueling experts and happens all the time.

    I didn't see anything in that testimony that was exculpatory to the defendent. This expert was only looking for specific data, period. He found a way to IMPLY it was LE that altered the computer. Yet, the defendent was in possession of the computer for three days after the disappearance of his wife. He last had access at 3:10p.m. on 7/15, just two hours before it was confiscated. Then it was left on, which also gave him 'oppotunity' to access his account from his friend's home. There's also the issue of the router that may have been used. Yes, and then the trojan, etc, etc,.........already testified to.

    Nope, there's enough already in testimony to dispute this guy's findings, as far as I'm concerned. If he were allowed, it would put the case on hold. Then the pros would have to have an opportunity to cross and have THEIR newly found expert to dispute this guy's findings. IF there was REALLY evidence of LE tampering, the defense had plenty of time to prove it BEFORE trial and they didn't.

    While many who are into computers found the technical evidence fascinating, all of this computer detail forensic speak is subterfuge to the jury. They had to listen carefully to grasp what was relevant to the case and not try to become a computer expert. They used common sense in their guilty verdict.

    I just don't see this flying on appeal basing this (not formally presented) evidence.

    JMHO, of course!
    fran

    Okay, 2 points. First, we know the defense didn't have the money to pay the other 2 expert witnesses. And second, the prosecution had the same evidence for an even longer period of time, yet found "new evidence" after they rested.

  4. #34
    Join Date
    Aug 2003
    Location
    San Diego
    Posts
    32,579
    The pros is given the last word. They countered with discovery that showed up in response to witnesses who had already appeared. They also did NOT introduce a NEW witness. These were people that were already listed BEFORE the trial started. IIRCC, the one guy from Cisco, who ended up not testifying before the jury, had already been on the witness list but hadn't been called up to that point.

    Apples and oranges.

    JMHO
    fran

  5. #35
    Join Date
    Jul 2008
    Posts
    362
    June 23 seems to be a magic date on that laptop.
    I wonder the significance.
    Is it system caused: Was an OS update done on that date? Was the browser software updated on that date? Was this the day the BC started using this laptop? (Older files copied from older PC)
    Is it person caused: Could BC have started using the laptop in a different way on that date? Is that the day the planning started? What day did NC leave on vacation?

    HK: and is there any limitation as to what time it could have actually occured, given the way computers work?
    GM: It could happen at an earlier time, things change I can use a program to make it say whatever I want ot to say...especially with Vista, Vista - when it came out, I still have my old Vista machine from 08, I purchased mine in April as well and numerous problems.
    Is GM implying that the laptop was a new purchase in April and that it is running Vista?
    BZ: And um, did you ever have occasion - what did you look at to determine spoilation in the files and that sort of stuff, what...
    GM: I looked at last-accessed
    Does this imply that the invalid timestamps were limited to the last-access timestamps?

    Too many open questions to have a reasonable discussion about the technical merits of this testimony.

    BZ had a lot of questions about router logs. If BC gets a second trial, I think he'll have more digital evidence to deal with, that we never heard about in the first trial.

  6. #36
    Madeleine74's Avatar
    Madeleine74 is online now Of course it's my opinion; who else's would it be?
    Join Date
    Apr 2011
    Location
    USA
    Posts
    10,232
    NCSU, read the sentence right before the one you highlighted. I clearly said "as a forensic expert."

    Cisco is the entity that found info they hadn't talked about before--specifically those log files showing BC was using that 3825 on Fri 7/11 at 10:30pm. Chris Frye. He wasn't called and that was a decision the state made (whether to call him or not). The IM chat log from an existing and already-testified witness (Greg M) didn't put the state in the same spot, so he was called, and it was enough proof to show BC had a 3825 router.

    The defense made decisions that didn't work out for their client. Spaghetti defenses are messy and imprecise and, often, simply not very effective.

  7. #37
    Join Date
    Jul 2008
    Posts
    3,436
    Quote Originally Posted by Madeleine74 View Post
    NCSU, read the sentence right before the one you highlighted. I clearly said "as a forensic expert."

    Cisco is the entity that found info they hadn't talked about before--specifically those log files showing BC was using that 3825 on Fri 7/11 at 10:30pm. Chris Frye. He wasn't called and that was a decision the state made (whether to call him or not). The IM chat log from an existing and already-testified witness (Greg M) didn't put the state in the same spot, so he was called, and it was enough proof to show BC had a 3825 router.

    The defense made decisions that didn't work out for their client. Spaghetti defenses are messy and imprecise and, often, simply not very effective.
    My mistake. I clearly have an issue with reading comprehension today.

  8. #38
    Join Date
    Jul 2008
    Location
    See above ^
    Posts
    596
    I've asked this before - is there a professional certification for any expert?

    Or is ti just if both parties agree they are an expert? These areas of forensics and network security and tampering and file alteration / spoilation, etc or so intertwined - I am wondering if the judge was not splitting hairs that should not have been split?

    Are we talking about a Dr. using Dr. Nelson, or Greg Nelson, MD? Or a vet using DVM, or VMD designations?

    I can easily see how forensics and network security would have huge overlap....

  9. #39
    Join Date
    Apr 2011
    Posts
    170
    Quote Originally Posted by RaleighNC View Post
    I've asked this before - is there a professional certification for any expert?

    Or is ti just if both parties agree they are an expert? These areas of forensics and network security and tampering and file alteration / spoilation, etc or so intertwined - I am wondering if the judge was not splitting hairs that should not have been split?

    Are we talking about a Dr. using Dr. Nelson, or Greg Nelson, MD? Or a vet using DVM, or VMD designations?

    I can easily see how forensics and network security would have huge overlap....
    here's the relevant statutes in the evidence code....

    http://www.ncga.state.nc.us/EnactedL...Article_7.html

  10. #40
    Join Date
    Jul 2008
    Posts
    362
    In June 2008, Microsoft Internet Explorer Version 8 was in Beta test. IE8, not released until March 2009, introduced "inPrivate Browsing" and "ClearTracks". These features automatically clears the digital bread crumbs left on a system when a user uses the browser.

    I wonder if BC had an Beta copy installed. If so, it must have been buggy to leave the evidence of the map search. If he did not have this software, BC had to manually clean up after himself each time he did research on the web.

    It would be interesting to know what OS and software was installed on the laptop, and see the windows system event log from June 23 to see what changes were made on the system.


  11. #41
    Join Date
    Apr 2011
    Posts
    1,234
    update on the appeal:

    "The public defender’s office is working on Cooper’s appeal. Kurtz said he is not involved in work on Cooper’s appeal at this time." [ARTICLE LINK]

    Some other interesting excerpts from the article which mainly discusses the computer evidence:

    "The nature of the timestamps suggests that someone after that period had tried to backdate the timestamps, says Kurtz."

    This is an element of the theory that BC had had indeed google-mapped the dump site, but only after receiving the news of NC body recovery and location.

    “There’s no way possible to have the same first-time-created and last-accessed timestamp down to the microsecond. That’s the difference between artifact and artwork. That’s artwork.” (Kurtz quote)

  12. #42
    Join Date
    Jul 2008
    Posts
    362
    Quote Originally Posted by jrb0124 View Post
    “There’s no way possible to have the same first-time-created and last-accessed timestamp down to the microsecond. That’s the difference between artifact and artwork. That’s artwork.” (Kurtz quote)
    If this is his best theory, Kurtz's experts let him down.
    In Microsoft Vista the last-access-time is never updated. Time-created and last-access are always exactly the same.

  13. #43
    Madeleine74's Avatar
    Madeleine74 is online now Of course it's my opinion; who else's would it be?
    Join Date
    Apr 2011
    Location
    USA
    Posts
    10,232
    Kurtz is trying to sell a conspiracy, and it isn't going to fly in front of the appellate court. He can stomp his feet all he wants but timestamp differences aren't going to make the case for appeal. He needs to explain how all those valid files BC worked on also got changed. This includes Cisco work files, his secure web logins to Citibank, HHonors, and other sites. None of those are alleged to be planted or tampered with, yet they too have these invalid timestamps.

    I think he's doing this for publicity for his firm. He's got his 15 min & he's hanging on for dear life.

  14. #44
    Join Date
    Aug 2003
    Location
    San Diego
    Posts
    32,579
    There very well may be evidence that some type of change was attempted or accomplished on the computer files. The problem is, Brad had possession of the computer until 5:20 on 7/15. His last login was 3:10 on 7/15.

    Not really a stretch of the imagination that BC deleted and altered dates and files himself. Actually, I WONDER what the deleted files are?!

    I think he messed up somehow and tried to delete the 'google search' and just deleted the 'cookie,' but there was probably some other step he should have taken. I don't know because I'm not a techy, so this is JMHO.

    After all, he did make an error a few times in attempting logins on some of his work lines or whatever they call them. He was nervous! Maybe even confused. His adrenalin was running 90 miles an hour.

    JMHO
    fran

  15. #45
    Join Date
    Mar 2011
    Location
    N.C.
    Posts
    4,097
    Quote Originally Posted by Madeleine74 View Post
    Kurtz is trying to sell a conspiracy, and it isn't going to fly in front of the appellate court. He can stomp his feet all he wants but timestamp differences aren't going to make the case for appeal. He needs to explain how all those valid files BC worked on also got changed. This includes Cisco work files, his secure web logins to Citibank, HHonors, and other sites. None of those are alleged to be planted or tampered with, yet they too have these invalid timestamps.

    I think he's doing this for publicity for his firm. He's got his 15 min & he's hanging on for dear life.
    I agree, and I also think this idea that the defense 'didn't have the money for experts' is such a line of bull. Far more likely than not, the case was the experts they attempted to get, didn't tell them what they wanted to *hear*. I heard of absolutely NO applications for funds *denied* prior to the trial. I feel confident, were that the case, we'd have definitely HEARD ABOUT IT. MOO

Page 3 of 73 FirstFirst 1 2 3 4 5 13 53 ... LastLast


Similar Threads

  1. Replies: 765
    Last Post: 10-29-2014, 05:28 PM
  2. Brad Cooper
    By SeriouslySearching in forum Nancy Cooper
    Replies: 211
    Last Post: 04-13-2014, 11:09 PM
  3. State v Brad Cooper 4-8-2011
    By cityslick in forum Nancy Cooper
    Replies: 592
    Last Post: 04-09-2011, 08:30 PM
  4. Brad Cooper Indicted #2
    By CW in forum Nancy Cooper
    Replies: 20
    Last Post: 12-10-2009, 04:08 PM
  5. Brad Cooper Indicted
    By courtney in forum Nancy Cooper
    Replies: 738
    Last Post: 10-31-2008, 08:42 PM

Tags for this Thread