Ricardo's Computer Forensics

Status
Not open for further replies.

Woe.be.gone

Well-Known Member
Joined
Dec 30, 2008
Messages
13,022
Reaction score
225
Yesterdays Doc. Dump has a section (1st part of dump, written page 12501) about the photos that RM sold to the Globe. The section of docs can be found on Pdf. pages 101-22, link below.

Two of the photos have the following markings:

Name: 1337.emix
File created: 6/17/08 9:22:10PM

Name: 1342.emix
File created: 6/17/08 9:41:45PM

Last Accessed: 9/12/08, 11:25:58PM (date sent to Globe?)

I'm not sure how to read these "codes" and compare them to the images that were found on RM's computer. What I mean is "file created" is not necessarily the day the picture was taken, correct? How is that determined? If the picture was take on June 17, 2008, and is of Caylee, there is a problem with RM's testimony that he last saw Caylee on June 10, 2008.

I will bring the link here so it's easy for somebody who knows how to read this report to comment. Thank you.

http://media2.myfoxorlando.com/documents/032310-anthony1.pdf (pdf. pgs. 101-22, esp. pg. 122)
 
Woe,

I believe that if that is the computer's detail it is when the file was created on the hard drive. If it's the picture's EXIF data, that is the day the picture was taken according to the date on the camera.
 
Woe - for instance see page 104. The "file created" date a few lines down from the top is when they received the pic on their hard drive.

Further down is the picture info, and "DateTimeOriginal" is when the picture was taken.
 
Yesterdays Doc. Dump has a section (1st part of dump, written page 12501) about the photos that RM sold to the Globe. The section of docs can be found on Pdf. pages 101-22, link below.

Two of the photos have the following markings:

Name: 1337.emix
File created: 6/17/08 9:22:10PM

Name: 1342.emix
File created: 6/17/08 9:41:45PM

Last Accessed: 9/12/08, 11:25:58PM (date sent to Globe?)

I'm not sure how to read these "codes" and compare them to the images that were found on RM's computer. What I mean is "file created" is not necessarily the day the picture was taken, correct? How is that determined? If the picture was take on June 17, 2008, and is of Caylee, there is a problem with RM's testimony that he last saw Caylee on June 10, 2008.

I will bring the link here so it's easy for somebody who knows how to read this report to comment. Thank you.

http://media2.myfoxorlando.com/documents/032310-anthony1.pdf (pdf. pgs. 101-22, esp. pg. 122)


Page 55/12433

The photos were taken January 28, 2008 and March 19, 2008.
 
Page 55/12433

The photos were taken January 28, 2008 and March 19, 2008.

How can you tell? I can see that the March 29 pictures are the ones where KC is playing the guitar with Caylee by her side. It was speculated earlier that those pictures were taken right before Caylee died - now we know they were taken March 19. check.

But where there are no visual pictures attached to the data (where one can see what the actual picture is) how do we know what the picture is of and the correlation between what was found on RM's computer and what he sold to the Globe?

There is a subtle note by LE that says something like 'other pictures were found on the harddrive too'.

The date of June 17, 2008, jumped out at me. Now I'm hearing that KC hired JB on that day (per JB at indigency trial). Why would RM be messing around with pictures of interest to LE on June 17, 2008, especially if they were taken in January of 2008? More intriging though, is why would LE note that these pictures were sold to the Globe? RM wouldn't know to sell pictures until after July 15, 2008 - no? (I know he didn't sell pictures in June but I'm curious as to the images contained on those two pictures.)

Is it possible to match the upper list (pics taken from RM's computer) to those pictures that were sold to the Globe?
 
Woe - for instance see page 104. The "file created" date a few lines down from the top is when they received the pic on their hard drive.

Further down is the picture info, and "DateTimeOriginal" is when the picture was taken.

The second list, the images that were sold to the Globe, doesn't contain thorough information about the image. Is there a way to link the emix No. back to the original list of pictures that were found on RM's harddrive?

In other words, I'm wondering the significance of the two pictures that were sold to the Globe that have the date June 17, 2008 connected to them.
 
How can you tell? I can see that the March 29 pictures are the ones where KC is playing the guitar with Caylee by her side. It was speculated earlier that those pictures were taken right before Caylee died - now we know they were taken March 19. check.

But where there are no visual pictures attached to the data (where one can see what the actual picture is) how do we know what the picture is of and the correlation between what was found on RM's computer and what he sold to the Globe?

There is a subtle note by LE that says something like 'other pictures were found on the harddrive too'.

The date of June 17, 2008, jumped out at me. Now I'm hearing that KC hired JB on that day (per JB at indigency trial). Why would RM be messing around with pictures of interest to LE on June 17, 2008, especially if they were taken in January of 2008? More intriging though, is why would LE note that these pictures were sold to the Globe? RM wouldn't know to sell pictures until after July 15, 2008 - no? (I know he didn't sell pictures in June but I'm curious as to the images contained on those two pictures.)

Is it possible to match the upper list (pics taken from RM's computer) to those pictures that were sold to the Globe?

I'm right there with you WBG. Hopefully JWG will pop his head in and take us to class again on computer forensics.

Whether it was the photo date, file creation date or just another one of those darn coincidences that keep popping up in this case, I have a major red flag going up about anything dated June 17th 2008.

Just Speculating....

Maybe, possibly, could KC have sent those photos to RM on 6/17 and the file was created when he opened them up? If the file creation date is 6/17/08 and assuming a few things about young bachelors not going out of their way to flip thru old photos of someone else's toddler, then my thoughts go down the path that the photos were put in front of him for a reason. The only person I can think of that would be in a position to send photos of Caylee to RM would be KC.

Sooo, going with my train of thought, we have KC (possibly) sending 5-6 month old photos of her daughter, to her ex-boyfriend, the day after Caylee goes missing and wearing the exact same shirt she would later be found in?

JUST SPECULATING.... ALL MOO
 
According to the recent document dump those pictures were taken in January and March. I'll be back with the dates and a link.
 
Yesterdays Doc. Dump has a section (1st part of dump, written page 12501) about the photos that RM sold to the Globe. The section of docs can be found on Pdf. pages 101-22, link below.

Two of the photos have the following markings:

Name: 1337.emix
File created: 6/17/08 9:22:10PM

Name: 1342.emix
File created: 6/17/08 9:41:45PM

Last Accessed: 9/12/08, 11:25:58PM (date sent to Globe?)

I'm not sure how to read these "codes" and compare them to the images that were found on RM's computer. What I mean is "file created" is not necessarily the day the picture was taken, correct? How is that determined? If the picture was take on June 17, 2008, and is of Caylee, there is a problem with RM's testimony that he last saw Caylee on June 10, 2008.

I will bring the link here so it's easy for somebody who knows how to read this report to comment. Thank you.

http://media2.myfoxorlando.com/documents/032310-anthony1.pdf (pdf. pgs. 101-22, esp. pg. 122)

Bringing the link forward.
 
According to the recent document dump those pictures were taken in January and March. I'll be back with the dates and a link.

Jolyanna, I provided a link. I would appreciate an explanation, if anyone knows one, of why the June 17, 2008 date shows up on two of the pics in question that were sold to the Globe. Which pictures on RM's harddrive do these two pictures link back to (because those listings provide more information regarding when the picture was taken, etc.)
 
Jolyanna, I provided a link. I would appreciate an explanation, if anyone knows one, of why the June 17, 2008 date shows up on two of the pics in question that were sold to the Globe. Which pictures on RM's harddrive do these two pictures link back to (because those listings provide more information regarding when the picture was taken, etc.)

I see exactly what you're seeing but I've looked at the pdf back and forth and can't even determine which pics the dates relate to, let alone decipher the more technical info. But, the date June 17,2008 IS there in 2 separate file creation dates associated with the GLobe pictures.

Please don't let this be another odd coincidence in this case! I agree about the unlikeliness of RM not coming forward if KC had emailed him pics on that day but what other explanation? Here's what I got:

1. RM held out on the photos (obviously not knowing about the shirt) hoping to later have something to sell that wasn't being held as evidence. Maybe thinking the pictures had no evidentiary value, he witholds them from LE?

2. KC used RM's computer that day and RM was not aware the pics were on his computer until looking around one day and, boom- he comes across photos he can make a quick buck off of..

3. This entry from Muzikman? quote:
"Calendar: Caylee Anthony Case
Muzikman
06-17-2008 08:14 PM to 08:14 PM
Casey adds pic to her Photobucket account - pic of her and TonE, photo by Teddy Pieper, looks like it's at Fusian.
She's on a computer somewhere":end quote

4. RM has a supplemental interview that has not been released?

5. A typo?

6. Another coincidence(really??) where unallocated space and some unrelated file blah blah blah...

That's all I got so far..... still waiting for one of our tech guru's to guide us! But at the very least, I do see what you are talking about. Not the date of the photo, but the date the file was created, June 17. 2008. And for the record, yes, I think it was very scummy for RM to sell photos exploiting Caylee :furious:
 
Amy had a camera, and lived at Ricardo's. At some point it needed repair, and was to be sent to the A's address but didn't arrive. IIRC, Amy forgot she'd had it sent back to Ricardo's.

It's possible Amy took the photos, perhaps Ricardo just found them on his computer. Kind of crummy, but remember no one knew the significance of those particular photos at the time (meaning the shirt).
 
Yesterdays Doc. Dump has a section (1st part of dump, written page 12501) about the photos that RM sold to the Globe. The section of docs can be found on Pdf. pages 101-22, link below.

Two of the photos have the following markings:

Name: 1337.emix
File created: 6/17/08 9:22:10PM

Name: 1342.emix
File created: 6/17/08 9:41:45PM

Last Accessed: 9/12/08, 11:25:58PM (date sent to Globe?)

I'm not sure how to read these "codes" and compare them to the images that were found on RM's computer. What I mean is "file created" is not necessarily the day the picture was taken, correct? How is that determined? If the picture was take on June 17, 2008, and is of Caylee, there is a problem with RM's testimony that he last saw Caylee on June 10, 2008.

I will bring the link here so it's easy for somebody who knows how to read this report to comment. Thank you.

http://media2.myfoxorlando.com/documents/032310-anthony1.pdf (pdf. pgs. 101-22, esp. pg. 122)

I thought I would post Woe.be.gone's question from RM's interview thread over onto this thread. Hoping someone can answer? Is there enough data in the document to come to any conclusion? TIA
 
OK...the files on page 122 of http://media2.myfoxorlando.com/documents/032.10-anthony1.pdf that were created on 6/17/08 aren't image files that can be uploaded off of a digital camera. They are emix files. IMG_0400.JPG was an image file that was uploaded into an emix-file-creating program and used to become the emix files 1337.emix and 1342.emix on 6/17/08.

The investigative report doesn't say what day the IMG_0400.JPG file was uploaded to Ricardo's computer. It does say that IMG_0401.JPG IMG_0404, IMG_408.JPG, IMG_0409.JPG were uploaded on 3/20/08. IMG_0285.JPG was uploaded on 2/18/08.

According to page 55 of the investigative report:
On November 2nd, 2009 I asked Detective Sandy Cawn of our computer crimes unit to review these photos from American Media and see if there was information embedded in the photos that would tell the date they ere taken. I also asked her to check the copy of Ricardo Morales' hard drive to see if the original photos were there. Detective Cawn found all but one of the American Media received photos on Ricardo Morales' hard drive. The photographs were taken on January 28th, 2008 and March 19th, 2008. Refer to her report for further details. http://media2.myfoxorlando.com/documents/032310-anthony1.pdf
From looking at Caylee and Casey in the pictures and the numbering of the JPG files, I'd say that IMG_0400.JPG was the first (of 5) to be uploaded to Ricardo's computer in March and that IMG_0385.JPG was uploaded to Ricardo's computer in February. For whatever reason, Ricardo did pull one of the images (IMG_0400.JPG) into a program using emix-file-creating software on 6/17/08.
 
Someone suggested to me yesterday that perhaps the 6/17/08 emix files were created by Ricardo emailing photos of Caylee to Casey on that date--then those same emails were later forwarded to the Globe.
 
Someone suggested to me yesterday that perhaps the 6/17/08 emix files were created by Ricardo emailing photos of Caylee to Casey on that date--then those same emails were later forwarded to the Globe.

Was RM on the list of calls from the 17th? Or maybe communicating thru IM? I can go look if no one knows off hand... Could KC have called RM and requested the photos? Otherwise, it sounds like we are left with another coincidence?
 
Someone suggested to me yesterday that perhaps the 6/17/08 emix files were created by Ricardo emailing photos of Caylee to Casey on that date--then those same emails were later forwarded to the Globe.

A quick google search shows that emix files might be artifact email files. So I think you might be right. :)
 
The computer forensics report (http://media2.myfoxorlando.com/documents/032310-anthony1.pdf p. 103) says that the emix file part of the report "contains email files sent to and received from Sunsational-Stories@hotmail.com" (the Globe). I noticed most of the files were in Ricardo's "INBOX"--i.e., they were received from the Globe, not sent to the Globe. Only a few were in the "SENT" folder--the 2 with creation dates of 6/17/08 and one created 8/27/08.

So either Ricardo was sending messages to the Globe on 6/17/08 about something else, which I doubt, or he was sending messages to the Globe on 6/17/08 about this case, which I doubt, or the file creation date does not necessarily indicate the date the email was sent--e.g., if it was an email forwarding a prior email from him to Casey or vice versa.
 
Status
Not open for further replies.

Members online

Online statistics

Members online
89
Guests online
1,597
Total visitors
1,686

Forum statistics

Threads
589,175
Messages
17,915,128
Members
227,745
Latest member
branditau.wareham72@gmail
Back
Top