Anthony's Computer Forensics

OK, we've got to figure out the time difference. I am looking at our "shared" file in the cloud for Preliminary - history1.xls, and it has 13:50 (1:50 pm) as the time. It is only in the file in your new "decoded" folder that has the time as 14:50 (2:50 pm). So something changed in the decoding process.

Hey, there is a reason I labelled it Preliminary ...

The reason I went looking for a second program is that the person who wrote the first one said it was quick and dirty and not to blame him if it did not work right. The comments in the second one went out of their way to point out nuances in Mork that made it a "stupid" way to store data. :banghead:

But that does not really prove anything, does it? :snooty:

Soooo...I first determined that all records produced by the second program are one hour later than those produced by the first program.

Then, I noticed there was activity on June 17. Casey's cell phone records say she would have been at the house no earlier than 2:18 PM (she is clearly driving at that time) and no later than 4:04 PM.

The newer program says there was Firefox activity from 3:14 PM to 3:27 PM on the 17th. If we were to use the earlier time stamps in the "preliminary" files, the activity would overlap with Casey driving, which is impossible. I've got a bunch of other examples where the newer version lines up perfectly with released evidence, such as phone records, and the old one does not, but the real kicker was the example I just gave - she can't be on the computer if she is not physically there.

So, the newer version is right, and I will scrap the preliminary version.

The fallout from this is that I noticed the Firefox Google searches produced by OCSO have the earlier time stamp. That means they are wrong. :eek:

The time stamps we have are the only correct ones out there. You saw them first here on Websleuths. :thumb:
 
Hey, there is a reason I labelled it Preliminary ...

The reason I went looking for a second program is that the person who wrote the first one said it was quick and dirty and not to blame him if it did not work right. The comments in the second one went out of their way to point out nuances in Mork that made it a "stupid" way to store data. :banghead:

But that does not really prove anything, does it? :snooty:

Soooo...I first determined that all records produced by the second program are one hour later than those produced by the first program.

Then, I noticed there was activity on June 17. Casey's cell phone records say she would have been at the house no earlier than 2:18 PM (she is clearly driving at that time) and no later than 4:04 PM.

The newer program says there was Firefox activity from 3:14 PM to 3:27 PM on the 17th. If we were to use the earlier time stamps in the "preliminary" files, the activity would overlap with Casey driving, which is impossible. I've got a bunch of other examples where the newer version lines up perfectly with released evidence, such as phone records, and the old one does not, but the real kicker was the example I just gave - she can't be on the computer if she is not physically there.

So, the newer version is right, and I will scrap the preliminary version.

The fallout from this is that I noticed the Firefox Google searches produced by OCSO have the earlier time stamp. That means they are wrong. :eek:

The time stamps we have are the only correct ones out there. You saw them first here on Websleuths. :thumb:

Now who's gonna tell JB that "his girl" was searching "fool-proof suffication" at 2:50 pm, after George had left for work? :what:

ETA: And who's gonna tell OSCO that their timeline for this search, which they probably didn't use at trial because they figured JB would just blame George, was messed up? :(
 
thanks JWG but I am now confused..
which time is the correct one 1:40 or 2:40..
and does this mean we have to refigure our time stamps lol..
hmm isnt the aol chat that am (the 16th time stamped from aol?
 
There is a lot of good stuff in the browser history files that AZlawyer kindly shared with me. :thumb: Some of it is illuminating, some of it is funny, and some of it is a bit disturbing in some ways.

Let's start with the allegation that George is the one who searched for the term "foolproof suffocation" on the afternoon of June 16, 2008, as Jose Biaz claims in his book. I have not read the book, but as I understand it he gives three reasons why it was George and not Casey who did this search:

  • George claimed Casey had already left for work when the search was done.
  • George is a poor speller, and Google corrected his spelling before doing the search.
  • George had an AIM account and Casey did not. The search was done within seconds of an AIM session being started.
Addressing these in order …


  • There is a thread on this site that has a lengthy debate on whether or not George was accurately recalling the events of June 16 or some earlier date (IIRC, the most likely candidate was June 9). I subscribe to the notion that there is no way that George would treat and commit to memory June 16 as it happened any differently than any other day. After 4 weeks, when pressed to recall details of events he had not spent effort to commit to memory, he misremembered. Casey never left that day before George went to work. He probably did not take much notice as he left for work. George's recollection is unreliable.
There is evidence to support this notion. Casey's cell phone pings place her at or near the home the entire time. More importantly, George places a very rare call to Casey at the home around 3:00 PM that day. He does this immediately after attempting a call to her cell (she was on her cell at the time). Why call her at home if he believed she were gone?
  • George is the poor speller and Casey is not? Actually, the apple does not fall far from the tree. Casey misspelled chloroform when she searched for it in March. She misspelled it twice (as chloraform). The misspelling on the 16th of June was "less severe" - "fool-proof" was changed to "foolproof". Basically, the misspelling proves nothing.

  • I have no idea if George had an AIM account, but I know for certain that Casey did. Casey logged in the morning of June 16 at 7:53 AM and started chatting with witeplayboi within minutes. The URL for her AIM Today connection contained the unique identifier "SN=CBOFHLHFFIGCOKCLHKEPCPNDBB&PC=HDLEDICEBJ" and had her login number registered as 215.
Then she logged in again at 10:08 AM with login number of 216, but did not chat with anyone. Another login without chat at 10:14 with login number of 217. Then 1:39 PM with login number of 218. And 2:50 PM with login number of 219. This final login was supposedly George, but it had Casey's unique identifier string and matched her login sequence. All of the logins also contained the unique identifier.
Casey got a call from Jesse Grund two minutes after her last login to AIM, or one minute after the "foolproof suffocation" search. George called the home phone from his cell around 3:03 and hung up when the answering machine picked up. He then immediately called Casey's cell from his cell at 3:04. One could speculate that George - diabolically clever guy that he is - was simply setting up an alibi. Or one could assume George was not at home, knew Casey was, and was trying to reach her while she was on the phone with an ex-boyfriend and online trying to chat with a new one. Which is the simpler explanation?

The evidence supports Casey searching for a method of "foolproof suffocation" just before 3 PM on June 16, not George. The evidence supports George being at work, or close to pulling in the parking lot. Not at the computer.

JWG in da house!!!

:cheer:
 
I have previewed this post and have no idea why it looks so ugly. Perhaps it is me?

Here are the searches for chloroform and other nefarious items, with ads removed:

http://en.wikipedia.org/w/index.php...search=head+injuries&fulltext=Advanced+search Search - Wikipedia, the free encyclopedia 3/17/08 15:00:14
Head Injuries - Wikipedia, the free encyclopedia Head Injuries - Wikipedia, the free encyclopedia 3/17/08 15:00:14
http://en.wikipedia.org/wiki/Special:Search?search=head+trama&go=Go Search - Wikipedia, the free encyclopedia 3/17/08 15:00:04
http://en.wikipedia.org/wiki/Hand_to_hand_combat Hand to hand combat - Wikipedia, the free encyclopedia 3/17/08 14:59:08
RBSD - Wikipedia, the free encyclopedia Reality-based self-defense - Wikipedia, the free encyclopedia 3/17/08 14:58:58
http://en.wikipedia.org/wiki/Special:Search?search=self+defense&go=Go
3/17/08 14:58:38
http://en.wikipedia.org/wiki/Self_defense Self-defense - Wikipedia, the free encyclopedia 3/17/08 14:58:38
Death - Wikipedia, the free encyclopedia Death - Wikipedia, the free encyclopedia 3/17/08 14:58:11
Inhalation - Wikipedia, the free encyclopedia Inhalation - Wikipedia, the free encyclopedia 3/17/08 14:57:44
http://en.wikipedia.org/wiki/Special:Search?search=hydrogen+peroxide&go=Go
3/17/08 14:56:33
Hydrogen peroxide - Wikipedia, the free encyclopedia Hydrogen peroxide - Wikipedia, the free encyclopedia 3/17/08 14:56:33
http://en.wikipedia.org/wiki/Special:Search?search=hydrogen+peroxode&go=Go Search - Wikipedia, the free encyclopedia 3/17/08 14:56:29
Peroxide - Wikipedia, the free encyclopedia Peroxide - Wikipedia, the free encyclopedia 3/17/08 14:55:34
Error 400 (Bad Request)!!1 chloraform - Google Search 3/17/08 14:43:41

Imagine that...all those searches after Cindy cut OCA off from stealing, I mean borrowing funds, from her BoA bank account
 
I'm beginning to think the entire story of Casey going anywhere was a total fabrication...regardless of what day it was supposed to have happened. They couldn't remember the date because every day was like any other. Did we ever see the computer activity for June 9th?

BBM
I agree.
IMO OCA never left the house that day.
IMO George said she did so he could help OCA and back up her story about her leaving for work and going to the Nanny's
Unfortunately for George his helping hand backfired on him, being accused of covering up the death and molestation accusations, all thanks to the person he was trying to help in the first place, OCA
 
Now who's gonna tell JB that "his girl" was searching "fool-proof suffication" at 2:50 pm, after George had left for work? :what:

ETA: And who's gonna tell OSCO that their timeline for this search, which they probably didn't use at trial because they figured JB would just blame George, was messed up? :(

Here is something interesting.

Casey got on the computer at 2:50:42 PM after being off for over an hour, and the first thing she does is search for "foolproof suffocation". But she gave up after just a couple minutes at 2:52:55. Why was that?

Well, because at 2:52:53 her phone started ringing with an incoming call from Jesse that lasted 11 minutes. He interrupted her!
 

Attachments

  • foolproof.jpg
    foolproof.jpg
    447.1 KB · Views: 85
thanks JWG but I am now confused..
which time is the correct one 1:40 or 2:40..
and does this mean we have to refigure our time stamps lol..
hmm isnt the aol chat that am (the 16th time stamped from aol?

Here's the new timeline:

12:54 am Casey finishes up an 80-minute phone call with Tony
1:05-1:54 am Casey texting back and forth with Tony
3:08-3:22 am Casey on the phone with Tony

7:54 am Someone calls Casey's phone from the house landline-goes to voicemail
7:56-8:06 am Casey IM'ing/flirting with Alex and checking Facebook/MySpace
8:06-8:44 am Casey continues checking Facebook, etc.
8:45 am Casey texts Tony

9:27 am Casey uploads Fusion photo

10:07-11:59 am Casey is surfing the web again--AIM, Facebook, Myspace, Victoria's Secret, Frederick's of Hollywood--which leads to a lengthy search re: shot girl outfits, etc.
11:47 am-12:06 pm Casey on the phone with Tony

12:55 pm Casey exchanges texts with Tony
1:00-1:14 pm Casey on the phone with Tony
1:26 pm Casey exchanges texts with Jesse
1:39-1:42 pm Casey signs in to AIM, checks Facebook and MySpace
1:44-2:20 pm Casey on the phone with Amy
2:50-2:52 pm Casey signs in to AIM, searches "fool-proof suffication", looks at the "Venturing Into the Pro-Suicide Pit" page everyone's been talking about for less than a minute, then at an article about how heated wires can melt disposable breathing circuits (??) for about 12 seconds lol, then checks out Facebook and MySpace, then reads "10 Ways to Kill a Rhododendron" for 11 seconds (this must be the "gardening searches" JB referred to). NOTICE THIS WHOLE THING TAKES 2-3 MINUTES.
2:52-3:04 pm Casey on the phone with Jesse

George was at work by 3:00 pm, and tried to call Casey from his cell phone at 3:04 pm.

No internet activity after this. :(
 
thanks JWG but I am now confused..
which time is the correct one 1:40 or 2:40..
and does this mean we have to refigure our time stamps lol..
hmm isnt the aol chat that am (the 16th time stamped from aol?

No LC, you won't have to figure out time stamps. AZ and I are in synch now and agree that the later times are the correct ones. The correct time is 2:40 (2:50 to be more precise).
 
Here's the new timeline:

12:54 am Casey finishes up an 80-minute phone call with Tony
1:05-1:54 am Casey texting back and forth with Tony
3:08-3:22 am Casey on the phone with Tony

7:54 am Someone calls Casey's phone from the house landline-goes to voicemail
7:56-8:06 am Casey IM'ing/flirting with Alex and checking Facebook/MySpace
8:06-8:44 am Casey continues checking Facebook, etc.
8:45 am Casey texts Tony

9:27 am Casey uploads Fusion photo

10:07-11:59 am Casey is surfing the web again--AIM, Facebook, Myspace, Victoria's Secret, Frederick's of Hollywood--which leads to a lengthy search re: shot girl outfits, etc.
11:47 am-12:06 pm Casey on the phone with Tony

12:55 pm Casey exchanges texts with Tony
1:00-1:14 pm Casey on the phone with Tony
1:26 pm Casey exchanges texts with Jesse
1:39-1:42 pm Casey signs in to AIM, checks Facebook and MySpace
1:44-2:20 pm Casey on the phone with Amy
2:50-2:52 pm Casey signs in to AIM, searches "fool-proof suffication", looks at the "Venturing Into the Pro-Suicide Pit" page everyone's been talking about for less than a minute, then at an article about how heated wires can melt disposable breathing circuits (??) for about 12 seconds lol, then checks out Facebook and MySpace, then reads "10 Ways to Kill a Rhododendron" for 11 seconds (this must be the "gardening searches" JB referred to). NOTICE THIS WHOLE THING TAKES 2-3 MINUTES.
2:52-3:04 pm Casey on the phone with Jesse

George was at work by 3:00 pm, and tried to call Casey from his cell phone at 3:04 pm.

No internet activity after this. :(

BBM

Her activity essentially ended when Tony's call came in. The only reason for the 11:59 is a single click on a Facebook profile at that time. Otherwise the cell records and computer activity seem to show Casey did not surf while talking on the phone.
 
Is there a way to look at a cached version of those other searches that Casey did? The ones that JWG said he didn't click on? :shush: I'm wondering if maybe Casey was searching for a certain photo or video. I admit it, I clicked on those links and they show the most searched videos are for each day, etc.
 
Is there a way to look at a cached version of those other searches that Casey did? The ones that JWG said he didn't click on? :shush: I'm wondering if maybe Casey was searching for a certain photo or video. I admit it, I clicked on those links and they show the most searched videos are for each day, etc.

Ummm...the video she watched is still there at the full address from the history file. :blushing: I wanted to see how long it was (the video, that is) to see if the duration fit with the pause in surfing. It did. The video was only about 5 minutes.

I have not been posting full URLs because many are really long, but if anyone wants a specific one, just ask.
 
There were a few videos linked. So did she watch all of them? Or can you tell?
 
Was the "mini-stroke" story setting the stage for George's untimely death later on?
This is scary...I have NEVER considered that Casey was out to kill her parents...but with all the months of convos with friends about the house, the mini-stroke, etc...and the searches that we know SHE did...wow! Maybe there is something to what you're saying. Very scary!

The "my dad ALMOST had a stroke" story was OCA's excuse to not go with Amy to Jacksonville to get her car.
Instead of saying to Amy she didn't want to go or, more likely, that she couldn't go because she had to take care of Caylee she comes up with some excuse
 
Sooo, JWG has some exciting new analysis. Stand by. :)

In the meantime, let me share with you my latest discovery. Remember the email (or MySpace message) Cindy sent to Casey on July 14, which was suspiciously deleted sometime before LE got hold of the computer? Here's the thread to remind you: http://websleuths.com/forums/showthread.php?t=83443. And here's the fragment recovered by LE:

can't sleep, stupid hot flashes wake me up then I start thinking about you and Caylee. Dad said he went to work at 9am and he got home at 630p, he said he did not come home in between. I don't know who or what to believe anymore. You've told me everyday that you were going to call me and you haven't but you choose to call when you know I won't be home. What the hell is going on? I've tried not to bug you to death but I still haven't gotten to see pictures of Caylee or gotten to speak to her. It's been over a month now. Am I ever going to see her again? Are you still with Jeff? Are you going back to work? I saw on the news that Anheiser Busch is being bought by a foreign company that does not want the theme parks only the beer part of the Co. What is that all about they're talking Disney or Universal may get to buy the theme parks. I thought Universal already merged with them? I'm not sure how much longer I can continue on this day to day course. I'm going freakin nuts not knowing whats going on with you. I had a breakdown at work, can't take much more stre

So, it appears that, after Cindy sent that message at 12:12 am on July 15, she then went on an all-out MySpace sleuthing binge that puts the lie to her "no red flags" argument. This included close review of the Lake Vaj "anything but clothes party" photos, emailing a couple of the photos to herself, and even commenting on a couple of the photos! (Why did we never see those comments? Anyone know how to get hold of that Lake Vaj guy who used to post here?) She also checked out, among other things, Brandon S's blog and Ricardo's profile.

Great work AZ and JWG!!!!!
 
OK, a morbid title, I agree.

I have attached an image of the surfing activity on the 17th at the Anthony home. I removed the entries for the ads that appeared.

The answer is:

  • Login to AIM, Facebook and Myspace.
  • Look at Amys Facebook page.
  • Check and reply to Myspace mail.
  • Check out an "Embroidered mesh babydoll with underwire cups, adjustable straps and back closure. Matching sexy G-string included".
  • Start using an event promotion app on Facebook to create and advertise an upcoming event.
  • Look at some pictures in your Myspace album.
  • Pack up and drive the kid back to Tony's. :(
 

Attachments

  • July17.jpg
    July17.jpg
    367.5 KB · Views: 110
Hey, there is a reason I labelled it Preliminary ...

The reason I went looking for a second program is that the person who wrote the first one said it was quick and dirty and not to blame him if it did not work right. The comments in the second one went out of their way to point out nuances in Mork that made it a "stupid" way to store data. :banghead:

But that does not really prove anything, does it? :snooty:

Soooo...I first determined that all records produced by the second program are one hour later than those produced by the first program.

Then, I noticed there was activity on June 17. Casey's cell phone records say she would have been at the house no earlier than 2:18 PM (she is clearly driving at that time) and no later than 4:04 PM.

The newer program says there was Firefox activity from 3:14 PM to 3:27 PM on the 17th. If we were to use the earlier time stamps in the "preliminary" files, the activity would overlap with Casey driving, which is impossible. I've got a bunch of other examples where the newer version lines up perfectly with released evidence, such as phone records, and the old one does not, but the real kicker was the example I just gave - she can't be on the computer if she is not physically there.

So, the newer version is right, and I will scrap the preliminary version.

The fallout from this is that I noticed the Firefox Google searches produced by OCSO have the earlier time stamp. That means they are wrong. :eek:

The time stamps we have are the only correct ones out there. You saw them first here on Websleuths. :thumb:

:what:

:cheers:





:yourock:
 
There were a few videos linked. So did she watch all of them? Or can you tell?

Her surfing only paused long enough to really view the one. With the others she might have watched a few seconds but it is impossible to tell. Starting / stopping streaming video does not leave a record in the browser history file.
 

Members online

Online statistics

Members online
208
Guests online
1,861
Total visitors
2,069

Forum statistics

Threads
589,949
Messages
17,928,072
Members
228,011
Latest member
legalpyro74
Back
Top