Page 5 of 5 FirstFirst ... 3 4 5
Results 61 to 71 of 71
  1. #61
    Join Date
    Jul 2008
    Posts
    362
    Quote Originally Posted by cody100 View Post
    I too wonder why the prosecution team did not offer reasonable explanation for the timestamps. Personally, I believe the prosecution "experts" truly were not experienced enough to render a detailed explanation so they said they did not think it was tampering. After all, the expert witness is allowed to render an opinion based on their knowledge and experience. It never says how much knowledge and experience are required. IMO, I believe also that the prosecution was afraid of something on the computer that might cause the timestamp to be questioned strongly. I have never seen a prosecution fight so hard to keep testimony out of a case.
    Here's a slide of the timestamp info for the cursor files.
    I think it is clear that the correct time for these files is 7/11/08 17:14 UTC.
    I don't think it needs further explanation.
    The time was corroborated by other personal computer activity before and after this time.
    The time was corroborated by witnesses placing him with the computer at that time.

    The defense did a yeoman's job finding questions that they could not answer in that data, and trying to lead the jury to the conclusion that this somehow creates doubt.

    But really? Can you look at that slide, understand the corroborating details, and genuinely believe that these files are anything other than a by-product of a search done at 7/11/08 17:14 UTC? Really?


  2. The Following 2 Users Say Thank You to macd For This Useful Post:


  3. #62
    Join Date
    Mar 2011
    Posts
    1,246
    Quote Originally Posted by macd View Post
    I followed the Duke case closely and I thought it was obvious that the DA and detectives engaged in misconduct, while other parties willfully turned a blind eye. I found it obvious that all of the lacrosse players were 100% innocent.
    I followed this case closely, and I thought it was obvious that, while somewhat bumbling, the DA and detectives were honest and the evidence genuine and damning.
    For both cases, everyone I know in meat-space was only vaguely aware the cases were going on. They only saw the one-minute sound-bites each day from the local news. Other than on the Internet, I have not met anyone who feels strongly one way or the other for either case. And I look for people to talk with me about this stuff. :-)
    I guess we run in different circles. The majority of the folks I know talked frequently about both cases-----now I do know other people in judicial.legal system. But even outside of that group, people I know would talk openly and frequently about it. I guess this indicates the need for forums like this. BTW, thanks for your input on timestamp issues.


  4. #63
    Join Date
    Jul 2008
    Posts
    362
    Quote Originally Posted by cody100 View Post
    I guess we run in different circles. The majority of the folks I know talked frequently about both cases-----now I do know other people in judicial.legal system. But even outside of that group, people I know would talk openly and frequently about it. I guess this indicates the need for forums like this. BTW, thanks for your input on timestamp issues.
    What are our thoughts on the Duke case?
    What is common sentiment you find?
    I hate when I run into a "something must have happened" person, even to this day. I don't think the degree of police and prosecutor misconduct ever came through to people who did not follow the case closely.


  5. #64
    Join Date
    Mar 2011
    Posts
    1,246
    MACD, i still can't see your slide very well. I have seen several slides but not sure where you found that one. Not disputing your opinion or your source, just wondering where this slide originated or if you had a clearer image of it. Honestly, MACD, I am not a computer expert and I was not in court for all of the evidence that was presented during the blackouts.


  6. #65
    Join Date
    Jul 2008
    Posts
    362
    Quote Originally Posted by cody100 View Post
    MACD, i still can't see your slide very well. I have seen several slides but not sure where you found that one. Not disputing your opinion or your source, just wondering where this slide originated or if you had a clearer image of it. Honestly, MACD, I am not a computer expert and I was not in court for all of the evidence that was presented during the blackouts.
    jrb posted it here. It was part of GM's proffer.

    It shows the eight timestamps for two files. Seven of the eight timestamps are valid and consistent with the files being part of a google search done Friday before lunch. One timestamp is described as "invalid", but no information was offered how or why that timestamp is invalid.

    If the evidence was planted the planters were clever enough to get 7 timestamps correct but missed one, I guess.
    Last edited by KateB; 05-15-2015 at 11:54 PM. Reason: repair url tag.


  7. #66
    Join Date
    Mar 2011
    Posts
    1,338
    I don't think enough information was really provided by either side to say the files were or were not tampered with in any way . In everything I have seen the discussions have all been around comparing the timestamps to each other and all timestamps being compared seem to be SIA timestamps. It would be better to compare the SIA timestamps to the FNA timestamps which would make it much more clear that things had or had not been changed.

    I agree there was no explanation at all as to what they were referring to when they said "invalid timestamps" there are also too many things that can cause a timestamp to be invalid and with no definition of what they meant by "invalid" it was pretty useless information.

    I do think it was suspicious that the main thing Boz wanted to keep out of JW's testimony was any reference at all to the registry. There could be some key information in there and I don't think GM had gotten that far into his exam to offer any insight on the registry itself.

    Vista throws a lot of monkey wrenches into the picture as well just y virtue of the number of changes done o things like timestamp modification, security permissions, etc. that need to be addressed in reference to the conclusions being made which weren't mentioned at all really.

    All in all I don't really have confidence in anything that was presented from either side as far as evidence coming from the laptop. The lack of follow-up with Google to get verification, with Cisco to get verification, etc. make it pretty much a complete failure.
    Hoisted with his own Petard


  8. #67
    Join Date
    Jul 2008
    Posts
    3,436
    Quote Originally Posted by SleuthinNC View Post
    I don't think enough information was really provided by either side to say the files were or were not tampered with in any way . In everything I have seen the discussions have all been around comparing the timestamps to each other and all timestamps being compared seem to be SIA timestamps. It would be better to compare the SIA timestamps to the FNA timestamps which would make it much more clear that things had or had not been changed.

    I agree there was no explanation at all as to what they were referring to when they said "invalid timestamps" there are also too many things that can cause a timestamp to be invalid and with no definition of what they meant by "invalid" it was pretty useless information.

    I do think it was suspicious that the main thing Boz wanted to keep out of JW's testimony was any reference at all to the registry. There could be some key information in there and I don't think GM had gotten that far into his exam to offer any insight on the registry itself.

    Vista throws a lot of monkey wrenches into the picture as well just y virtue of the number of changes done o things like timestamp modification, security permissions, etc. that need to be addressed in reference to the conclusions being made which weren't mentioned at all really.

    All in all I don't really have confidence in anything that was presented from either side as far as evidence coming from the laptop. The lack of follow-up with Google to get verification, with Cisco to get verification, etc. make it pretty much a complete failure.


    That's the frustrating part. Google could have made all of this tampering stuff irrelevant. Simply show a google search for that area code at that time (to match the evidence) and the defense claims wouldn't have mattered.


  9. The Following User Says Thank You to ncsu95 For This Useful Post:


  10. #68
    Join Date
    Jul 2008
    Posts
    362
    I'm a little bit dumbfounded of the expectation for police to prove that they didn't fabricate this evidence.

    The search files on the computer tell the story of zooming in on the cul-de-sac.
    The MFT table gives timestamps of when the search was done.
    The browser history gives information of what the search was.
    The event log gives information that BC logged into the computer shortly before the search.
    Other files show BC logging personal credentials into other sites around the same time as the search.
    Eyewitnesses have him in his office with his computer at the time of the search.

    Sure... it would be nice if there was a sixth form of corroboration, but at some point isn't it just piling on?

    If you're not convinced at this point, I don't think a log from Cisco or Google would convince you.


  11. The Following 2 Users Say Thank You to macd For This Useful Post:


  12. #69
    Join Date
    Mar 2011
    Posts
    1,338
    The fact that it is extremely easy to change the date and time, do a search and change the time back combined with the fact that the files and timestamps on the computer do not look like "normal" operations along with a computer that was not properly handled makes the evidence less than crystal clear. To have this fuzzy evidence be the "smoking gun" to convict somebody to life in prison is enough to make me want some sort of clarifying evidence.

    I don't understand why having real data and fabricated data occur on the same day seems to be an impossibility to some people. Data manipulation exactly like this happens ALL the time. It is an extremely common security exploit.

    If CPD didn't do such a crappy job extra validation might not be as important, but they did do a crappy job, the extra information was ridiculously easy to get and wasn't, if you have a chance for a slam dunk, why not do it?

    And who were these phantom eyewitnesses that have him in his office with his computer at the time of the search? The evidence is sketchy enough without added embellishment.
    Last edited by SleuthinNC; 06-07-2011 at 03:19 PM. Reason: eyewitnesses
    Hoisted with his own Petard


  13. The Following User Says Thank You to SleuthinNC For This Useful Post:


  14. #70
    Join Date
    Jul 2008
    Posts
    362
    Quote Originally Posted by SleuthinNC View Post
    And who were these phantom eyewitnesses that have him in his office with his computer at the time of the search? The evidence is sketchy enough without added embellishment.
    The co-workers he had lunch with. They said they left the office together and all left their laptops in the office. The search was done very soon before they left for lunch.


  15. #71
    Join Date
    Jan 2004
    Posts
    24,092
    Quote Originally Posted by macd View Post
    The co-workers he had lunch with. They said they left the office together and all left their laptops in the office. The search was done very soon before they left for lunch.
    I first learned that there were records of his personal login searches before and after map search during closing arguments, and it was but a brief one-liner. Was there blacked-out testimony about Cooper searching bank records before and after the map search?


Page 5 of 5 FirstFirst ... 3 4 5

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •