661 users online (84 members and 577 guests)  


Websleuths News


Page 1 of 4 1 2 3 ... LastLast
Results 1 to 15 of 58
  1. #1
    Join Date
    Dec 2008
    Location
    onthecouch
    Posts
    12,985

    Ricardo's Computer Forensics

    Yesterdays Doc. Dump has a section (1st part of dump, written page 12501) about the photos that RM sold to the Globe. The section of docs can be found on Pdf. pages 101-22, link below.

    Two of the photos have the following markings:

    Name: 1337.emix
    File created: 6/17/08 9:22:10PM

    Name: 1342.emix
    File created: 6/17/08 9:41:45PM

    Last Accessed: 9/12/08, 11:25:58PM (date sent to Globe?)

    I'm not sure how to read these "codes" and compare them to the images that were found on RM's computer. What I mean is "file created" is not necessarily the day the picture was taken, correct? How is that determined? If the picture was take on June 17, 2008, and is of Caylee, there is a problem with RM's testimony that he last saw Caylee on June 10, 2008.

    I will bring the link here so it's easy for somebody who knows how to read this report to comment. Thank you.

    http://media2.myfoxorlando.com/docum...0-anthony1.pdf (pdf. pgs. 101-22, esp. pg. 122)
    Last edited by Woe.be.gone; 03-24-2010 at 02:13 PM. Reason: bring link

  2. #2
    Woe,

    I believe that if that is the computer's detail it is when the file was created on the hard drive. If it's the picture's EXIF data, that is the day the picture was taken according to the date on the camera.

    just chillin' with my own kind!

  3. #3
    Woe - for instance see page 104. The "file created" date a few lines down from the top is when they received the pic on their hard drive.

    Further down is the picture info, and "DateTimeOriginal" is when the picture was taken.

    just chillin' with my own kind!

  4. #4
    Join Date
    Oct 2008
    Posts
    9,462
    Quote Originally Posted by Woe.be.gone View Post
    Yesterdays Doc. Dump has a section (1st part of dump, written page 12501) about the photos that RM sold to the Globe. The section of docs can be found on Pdf. pages 101-22, link below.

    Two of the photos have the following markings:

    Name: 1337.emix
    File created: 6/17/08 9:22:10PM

    Name: 1342.emix
    File created: 6/17/08 9:41:45PM

    Last Accessed: 9/12/08, 11:25:58PM (date sent to Globe?)

    I'm not sure how to read these "codes" and compare them to the images that were found on RM's computer. What I mean is "file created" is not necessarily the day the picture was taken, correct? How is that determined? If the picture was take on June 17, 2008, and is of Caylee, there is a problem with RM's testimony that he last saw Caylee on June 10, 2008.

    I will bring the link here so it's easy for somebody who knows how to read this report to comment. Thank you.

    http://media2.myfoxorlando.com/docum...0-anthony1.pdf (pdf. pgs. 101-22, esp. pg. 122)

    Page 55/12433

    The photos were taken January 28, 2008 and March 19, 2008.

  5. #5
    Join Date
    Dec 2008
    Location
    onthecouch
    Posts
    12,985
    Quote Originally Posted by Harmony2 View Post
    Page 55/12433

    The photos were taken January 28, 2008 and March 19, 2008.
    How can you tell? I can see that the March 29 pictures are the ones where KC is playing the guitar with Caylee by her side. It was speculated earlier that those pictures were taken right before Caylee died - now we know they were taken March 19. check.

    But where there are no visual pictures attached to the data (where one can see what the actual picture is) how do we know what the picture is of and the correlation between what was found on RM's computer and what he sold to the Globe?

    There is a subtle note by LE that says something like 'other pictures were found on the harddrive too'.

    The date of June 17, 2008, jumped out at me. Now I'm hearing that KC hired JB on that day (per JB at indigency trial). Why would RM be messing around with pictures of interest to LE on June 17, 2008, especially if they were taken in January of 2008? More intriging though, is why would LE note that these pictures were sold to the Globe? RM wouldn't know to sell pictures until after July 15, 2008 - no? (I know he didn't sell pictures in June but I'm curious as to the images contained on those two pictures.)

    Is it possible to match the upper list (pics taken from RM's computer) to those pictures that were sold to the Globe?
    Last edited by Woe.be.gone; 03-24-2010 at 07:02 PM.

  6. #6
    Join Date
    Dec 2008
    Location
    onthecouch
    Posts
    12,985
    Quote Originally Posted by yeknomaras View Post
    Woe - for instance see page 104. The "file created" date a few lines down from the top is when they received the pic on their hard drive.

    Further down is the picture info, and "DateTimeOriginal" is when the picture was taken.
    The second list, the images that were sold to the Globe, doesn't contain thorough information about the image. Is there a way to link the emix No. back to the original list of pictures that were found on RM's harddrive?

    In other words, I'm wondering the significance of the two pictures that were sold to the Globe that have the date June 17, 2008 connected to them.

  7. #7
    Quote Originally Posted by Woe.be.gone View Post
    How can you tell? I can see that the March 29 pictures are the ones where KC is playing the guitar with Caylee by her side. It was speculated earlier that those pictures were taken right before Caylee died - now we know they were taken March 19. check.

    But where there are no visual pictures attached to the data (where one can see what the actual picture is) how do we know what the picture is of and the correlation between what was found on RM's computer and what he sold to the Globe?

    There is a subtle note by LE that says something like 'other pictures were found on the harddrive too'.

    The date of June 17, 2008, jumped out at me. Now I'm hearing that KC hired JB on that day (per JB at indigency trial). Why would RM be messing around with pictures of interest to LE on June 17, 2008, especially if they were taken in January of 2008? More intriging though, is why would LE note that these pictures were sold to the Globe? RM wouldn't know to sell pictures until after July 15, 2008 - no? (I know he didn't sell pictures in June but I'm curious as to the images contained on those two pictures.)

    Is it possible to match the upper list (pics taken from RM's computer) to those pictures that were sold to the Globe?
    I'm right there with you WBG. Hopefully JWG will pop his head in and take us to class again on computer forensics.

    Whether it was the photo date, file creation date or just another one of those darn coincidences that keep popping up in this case, I have a major red flag going up about anything dated June 17th 2008.

    Just Speculating....

    Maybe, possibly, could KC have sent those photos to RM on 6/17 and the file was created when he opened them up? If the file creation date is 6/17/08 and assuming a few things about young bachelors not going out of their way to flip thru old photos of someone else's toddler, then my thoughts go down the path that the photos were put in front of him for a reason. The only person I can think of that would be in a position to send photos of Caylee to RM would be KC.

    Sooo, going with my train of thought, we have KC (possibly) sending 5-6 month old photos of her daughter, to her ex-boyfriend, the day after Caylee goes missing and wearing the exact same shirt she would later be found in?

    JUST SPECULATING.... ALL MOO

  8. #8
    Does anyone remember what type of camera the A's have?

  9. #9
    According to the recent document dump those pictures were taken in January and March. I'll be back with the dates and a link.

  10. #10
    Join Date
    Dec 2008
    Location
    onthecouch
    Posts
    12,985
    Quote Originally Posted by Woe.be.gone View Post
    Yesterdays Doc. Dump has a section (1st part of dump, written page 12501) about the photos that RM sold to the Globe. The section of docs can be found on Pdf. pages 101-22, link below.

    Two of the photos have the following markings:

    Name: 1337.emix
    File created: 6/17/08 9:22:10PM

    Name: 1342.emix
    File created: 6/17/08 9:41:45PM

    Last Accessed: 9/12/08, 11:25:58PM (date sent to Globe?)

    I'm not sure how to read these "codes" and compare them to the images that were found on RM's computer. What I mean is "file created" is not necessarily the day the picture was taken, correct? How is that determined? If the picture was take on June 17, 2008, and is of Caylee, there is a problem with RM's testimony that he last saw Caylee on June 10, 2008.

    I will bring the link here so it's easy for somebody who knows how to read this report to comment. Thank you.

    http://media2.myfoxorlando.com/docum...0-anthony1.pdf (pdf. pgs. 101-22, esp. pg. 122)
    Bringing the link forward.


  11. #11
    Join Date
    Dec 2008
    Location
    onthecouch
    Posts
    12,985
    Quote Originally Posted by Jolynna View Post
    According to the recent document dump those pictures were taken in January and March. I'll be back with the dates and a link.
    Jolyanna, I provided a link. I would appreciate an explanation, if anyone knows one, of why the June 17, 2008 date shows up on two of the pics in question that were sold to the Globe. Which pictures on RM's harddrive do these two pictures link back to (because those listings provide more information regarding when the picture was taken, etc.)
    Last edited by Woe.be.gone; 03-25-2010 at 01:05 AM.

  12. #12
    Quote Originally Posted by Woe.be.gone View Post
    Jolyanna, I provided a link. I would appreciate an explanation, if anyone knows one, of why the June 17, 2008 date shows up on two of the pics in question that were sold to the Globe. Which pictures on RM's harddrive do these two pictures link back to (because those listings provide more information regarding when the picture was taken, etc.)
    I see exactly what you're seeing but I've looked at the pdf back and forth and can't even determine which pics the dates relate to, let alone decipher the more technical info. But, the date June 17,2008 IS there in 2 separate file creation dates associated with the GLobe pictures.

    Please don't let this be another odd coincidence in this case! I agree about the unlikeliness of RM not coming forward if KC had emailed him pics on that day but what other explanation? Here's what I got:

    1. RM held out on the photos (obviously not knowing about the shirt) hoping to later have something to sell that wasn't being held as evidence. Maybe thinking the pictures had no evidentiary value, he witholds them from LE?

    2. KC used RM's computer that day and RM was not aware the pics were on his computer until looking around one day and, boom- he comes across photos he can make a quick buck off of..

    3. This entry from Muzikman? quote:
    "Calendar: Caylee Anthony Case
    Muzikman
    06-17-2008 08:14 PM to 08:14 PM
    Casey adds pic to her Photobucket account - pic of her and TonE, photo by Teddy Pieper, looks like it's at Fusian.
    She's on a computer somewhere":end quote

    4. RM has a supplemental interview that has not been released?

    5. A typo?

    6. Another coincidence(really??) where unallocated space and some unrelated file blah blah blah...

    That's all I got so far..... still waiting for one of our tech guru's to guide us! But at the very least, I do see what you are talking about. Not the date of the photo, but the date the file was created, June 17. 2008. And for the record, yes, I think it was very scummy for RM to sell photos exploiting Caylee

  13. #13
    Join Date
    Aug 2008
    Location
    Heartland USA
    Posts
    592
    Amy had a camera, and lived at Ricardo's. At some point it needed repair, and was to be sent to the A's address but didn't arrive. IIRC, Amy forgot she'd had it sent back to Ricardo's.

    It's possible Amy took the photos, perhaps Ricardo just found them on his computer. Kind of crummy, but remember no one knew the significance of those particular photos at the time (meaning the shirt).

  14. #14

    Ricardo's Computer Forensics

    Quote Originally Posted by Woe.be.gone View Post
    Yesterdays Doc. Dump has a section (1st part of dump, written page 12501) about the photos that RM sold to the Globe. The section of docs can be found on Pdf. pages 101-22, link below.

    Two of the photos have the following markings:

    Name: 1337.emix
    File created: 6/17/08 9:22:10PM

    Name: 1342.emix
    File created: 6/17/08 9:41:45PM

    Last Accessed: 9/12/08, 11:25:58PM (date sent to Globe?)

    I'm not sure how to read these "codes" and compare them to the images that were found on RM's computer. What I mean is "file created" is not necessarily the day the picture was taken, correct? How is that determined? If the picture was take on June 17, 2008, and is of Caylee, there is a problem with RM's testimony that he last saw Caylee on June 10, 2008.

    I will bring the link here so it's easy for somebody who knows how to read this report to comment. Thank you.

    http://media2.myfoxorlando.com/docum...0-anthony1.pdf (pdf. pgs. 101-22, esp. pg. 122)
    I thought I would post Woe.be.gone's question from RM's interview thread over onto this thread. Hoping someone can answer? Is there enough data in the document to come to any conclusion? TIA

  15. #15
    OK...the files on page 122 of http://media2.myfoxorlando.com/docum...0-anthony1.pdf that were created on 6/17/08 aren't image files that can be uploaded off of a digital camera. They are emix files. IMG_0400.JPG was an image file that was uploaded into an emix-file-creating program and used to become the emix files 1337.emix and 1342.emix on 6/17/08.

    The investigative report doesn't say what day the IMG_0400.JPG file was uploaded to Ricardo's computer. It does say that IMG_0401.JPG IMG_0404, IMG_408.JPG, IMG_0409.JPG were uploaded on 3/20/08. IMG_0285.JPG was uploaded on 2/18/08.

    According to page 55 of the investigative report:
    On November 2nd, 2009 I asked Detective Sandy Cawn of our computer crimes unit to review these photos from American Media and see if there was information embedded in the photos that would tell the date they ere taken. I also asked her to check the copy of Ricardo Morales' hard drive to see if the original photos were there. Detective Cawn found all but one of the American Media received photos on Ricardo Morales' hard drive. The photographs were taken on January 28th, 2008 and March 19th, 2008. Refer to her report for further details. http://media2.myfoxorlando.com/docum...0-anthony1.pdf
    From looking at Caylee and Casey in the pictures and the numbering of the JPG files, I'd say that IMG_0400.JPG was the first (of 5) to be uploaded to Ricardo's computer in March and that IMG_0385.JPG was uploaded to Ricardo's computer in February. For whatever reason, Ricardo did pull one of the images (IMG_0400.JPG) into a program using emix-file-creating software on 6/17/08.
    Last edited by Jolynna; 03-25-2010 at 12:47 PM.

Page 1 of 4 1 2 3 ... LastLast


Similar Threads

  1. Anthony's Computer Forensics
    By DAWN TREADER in forum Caylee Anthony 2 years old
    Replies: 1452
    Last Post: 08-25-2016, 01:07 PM
  2. Sandra [Cawn] Osborne testimony (computer forensics)
    By Chiquita71 in forum Witness Testimonies and Closing Arguments
    Replies: 21
    Last Post: 07-01-2011, 04:35 PM
  3. Kevin Stenger testimony (Superviser, OCSO computer forensics)
    By wenwe4 in forum Witness Testimonies and Closing Arguments
    Replies: 10
    Last Post: 07-01-2011, 04:12 PM
  4. Computer Forensics Discussion
    By Kimster in forum General Information & Discussion
    Replies: 0
    Last Post: 01-24-2011, 02:06 AM
  5. Terri's Computer forensics
    By SurfieTX in forum Kyron Horman
    Replies: 81
    Last Post: 08-01-2010, 02:54 AM