Anthony's Computer Forensics

New Posts

Are we allowed to bring up the calendar thread for June 16th??? (It was in the basement...) Can it be brought upstairs?
 
Pink Panther said:
Are we allowed to bring up the calendar thread for June 16th??? (It was in the basement...) Can it be brought upstairs?
Click to expand...

Let me look into it. Give me a few minutes
 
Are you talking about this one?

[ame="http://www.websleuths.com/forums/showthread.php?t=73218"]Ping Map and Timeline for June 16, 2008 - Discuss that day only. - Websleuths Crime Sleuthing Community[/ame]

This is in the Anthony resource forum toward the top of the main Anthony forum.
 
YES! Thanks Tricia! That's the one! I remember being absolutely flabbergasted that she was so busy, busy, busy...I couldn't believe she could be taking care of her child! When we reviewed all of the days and just how much time she was spending on the computer, the phone etc without ever pausing...the pauses, were so disconcerting! If you look at the information for that day, the Defence's claim that Caylee died while both GA and KC were home is impossible...Unless she kept phoning, texting and surfing while everything else was going on!
 
AZlawyer said:
There just has to be a connection, right?? And Cindy closed the bank account Casey had been stealing from on or shortly after March 14, which must have ticked Casey off quite a bit. Especially since Casey's birthday was coming up, and I'm sure she was planning to use that account to get herself something nice. ;)
Click to expand...

This is where IMO that ca gave serious thought to doing her parents in and again when she made arrangements about Amy moving in and again IMO when she was angry with cindy that night and took off she was able to make that jump to strike back at cindy and that brought about the babys' demise.
I think when these searches were brought to cindys' attention she wouldn't think any of that pertained to her and if this paticular search was brought to her attention IMO she was first to say cover that up it was to incriminating to ca.
At the beginning I didn't believe this was premeditated in any way but because of those searches whether it didn't pertain to the baby at first it was the strike out at cindy that and ca and ga were a premeditated and she chose not to stop what she had done that to me showed premeditated so I am not surprised about the sear ch and I am not surprised about supressed evidence I the jb found out early enough he was able to keep it hidden from co-council even. As usual I get into a rant regarding this circus I thank you all for letting me.
 
BondJamesBond said:
OK...first things first.

A few days ago I was attempting to triangulate the cell records, the Encase activity files for the desktop & laptop, and statements...trying to learn if there was something that would help us better support that Caylee was alive or not when Casey left G&C's ~4:11PM Monday, 6/16. In doing this I made a huge gaffe reading the Encase activity report. Posted the whole stinkin' mess w/o noticing the goof. Within a minute or two I got a short PM from JWG very kindly pointing it out. Sooo...I was able to yank the post and retool. In the end, it took me in another direction. So...big TY to JWG for (a) catching the initial mistake & pointing it out so quickly, and (b) bouncing around this latest, but, not fully resolved observation. :highfive:

Alright then, onto the thing.

Conclusion/Speculation: The Encase activity reports are shifted 1 hr earlier than actual. For example, activity level shown as 2-3PM on the report ACTUALLY describes the activity level that occurred 3-4PM. I have one or two ideas on how this might've happened, but, lets save that for later.

IF this conclusion is correct, it may support the following speculation:
  • 6/16 Heavy HP Desktop activity 3-4PM (shown as 2-3PM) can be attributed to Casey since George had left for work <3PM
  • During Casey's first opportunity for privacy after George left for work <3PM she spent a significant amount of the time before she left ~4:11PM - on the desktop computer :eek:nline:
  • Hence, Caylee was likely still alive when George left ~2:45PM 6/16

Some other potentially useful speculation w/o details that would make this even longer:
a) Caylee's naptime was typically 2-4PM based on JWG's Photobucket upload analysis, as well as Casey's recurring cell call duration pattern during this time of the day (ETA: updated time per JWG's owing to central vs. eastern time on Pb records)
b) George statement re: seeing Casey & Caylee leave @ 12:50 was a description of 6/9 vs. 6/16. George called the house 1 minute before he called Casey&#8217;s cell @ 3:04PM 6/16 indicating George knew Casey was @ the house when he left
c) The %&#8217;s shown in the Encase report may reflects the % of the hour listed during which the computer processor was active. IOW 100% = 60 minutes of activity​

OK...here's how we get there. Working backwards from Tuesday 6/17...

Observing Casey&#8217;s cell records for Tuesday, 6/17, it appears she arrived in the area of G&C&#8217;s ~2:30PM and waited to either observe George leave, or until a time when she could be confident he was gone. Between 2:30 and 2:49PM Casey placed/took calls to/from Ricardo, Tony and Clint. It appears George left ~2:49PM at which time Casey&#8217;s cell went inactive for 57 minutes.

At 3:47PM Casey resumed a light texting conversation with Tony that concluded @ 4:05PM when she called him and left sometime between 4:05-4:36PM.

In agreement with the cell activity that placed Casey @ G&C&#8217;s ~2:49PM-4:05PM we have the computer forensics report that tells us the nursing home pic of Caylee with Alex was copied onto the laptop 6/17 3:28PM. (Note: This is the pic that LE used to check the clock of the laptop vs. the camera vs. the memory card to confirm the pic was indeed taken on 6/15).

Also in agreement w/ the cell activity AND the computer forensics report, Casey sent a Facebook message to Amy, 3:15PM 6/17, "cheer up me lady! i love you and can't wait to finally get you moved in". (ETA: Updated Fb after JWG confirmed for me. :thumb:)

Note that the Encase report shows for the laptop on Tuesday, 6/17:
2-3PM: 80% activity (e.g. perhaps 48 minutes)
3-4PM: 0% activity

These timestamps are in direct conflict w/ the forensics report regarding the downloading of the nursing home pic AND the timeframe in which Casey was @ G&C&#8217;s per the cell pings AND the timing of Casey's Facebook message to Amy. However, they synchronize perfectly if the Encase activity report is shifted 1 hour.

*snipped for Encase data & some times w/ 0% activity added for continuity)*

Looking @ Monday, 6/16, to see if the same time shift may apply to the Desktop computer&#8230;

Casey was on the phone w/ Amy 1:44-2:20PM, and on the phone again w/ Jesse @ 2:52PM-3:03PM. Although Casey could have certainly multi-tasked, consider that this phone activity would have significantly impacted her ability to be active on the computer&#8230;leaving only 32 minutes (or ~53%) free & clear during the 2-3PM hour vs. 82% activity (49 minutes) shown on the Encase report .

In contrast, between 3-4PM Casey had almost no activity on her cell phone. She wrapped up her call w/ Jesse @ 3:04PM in order to take the incoming call from George, which lasted <1minute. She also placed one call to Tony that lasted <1minute. She did, however, receive 3 MySpace alerts to her cell phone during this period. If we continue w/ the time-based interpretation of the Encase report, the desktop was in use ~49 minutes. FWIW, if Casey&#8217;s cell MySpace alerts were directly or indirectly in response to her desktop activity, these timestamps being 3:23PM through 3:39PM, spanned 16 minutes&#8230;and left 49-16=33 minutes of activity to split before and/or after 3:23 & 3:39PM.

IMHO, the above strongly indicates the HP desktop Encase report time is also shifted by 1 hour (e.g. activity level shown as 2-3PM on the report ACTUALLY describes the activity level that occurred 3-4PM), similar to the laptop.

Now, IF one buys the conclusion, one can still interpret it to support a variety of theories. However, IMHO, the degree of usage on the desktop by Casey for what appears to have been 3-4PM, including what appears to have been MySpace activity can be factored in to support Caylee was likely still alive when George left ~2:45PM 6/16. Otherwise, Casey's first activities in private that afternoon would have more likely been consumed in dealing with something of higher priority than MySpace, etc.
Click to expand...
Slam bam thank you mam. Can't wait to see you bond and jwr. You're my heroes!

You're still my heroes but the wrong quote linked. ???
 
The report on WKMG last night said that the history went back as far as 2004. Is it wrong for me to be very curious about the internet history back then? :innocent: I think a lot of the lies this family told can be uncovered by looking at their computer history.
 
Congratulations to our two super-hero websleuthers! It doesn't surprise at all given all your hard work and knowledge!
 
BondJamesBond said:
OK...first things first.

A few days ago I was attempting to triangulate the cell records, the Encase activity files for the desktop & laptop, and statements...trying to learn if there was something that would help us better support that Caylee was alive or not when Casey left G&C's ~4:11PM Monday, 6/16. In doing this I made a huge gaffe reading the Encase activity report. Posted the whole stinkin' mess w/o noticing the goof. Within a minute or two I got a short PM from JWG very kindly pointing it out. Sooo...I was able to yank the post and retool. In the end, it took me in another direction. So...big TY to JWG for (a) catching the initial mistake & pointing it out so quickly, and (b) bouncing around this latest, but, not fully resolved observation. :highfive:

Alright then, onto the thing.

Conclusion/Speculation: The Encase activity reports are shifted 1 hr earlier than actual. For example, activity level shown as 2-3PM on the report ACTUALLY describes the activity level that occurred 3-4PM. I have one or two ideas on how this might've happened, but, lets save that for later.

IF this conclusion is correct, it may support the following speculation:
  • 6/16 Heavy HP Desktop activity 3-4PM (shown as 2-3PM) can be attributed to Casey since George had left for work <3PM
  • During Casey's first opportunity for privacy after George left for work <3PM she spent a significant amount of the time before she left ~4:11PM - on the desktop computer :eek:nline:
  • Hence, Caylee was likely still alive when George left ~2:45PM 6/16

Some other potentially useful speculation w/o details that would make this even longer:
a) Caylee's naptime was typically 2-4PM based on JWG's Photobucket upload analysis, as well as Casey's recurring cell call duration pattern during this time of the day (ETA: updated time per JWG's owing to central vs. eastern time on Pb records)
b) George statement re: seeing Casey & Caylee leave @ 12:50 was a description of 6/9 vs. 6/16. George called the house 1 minute before he called Casey’s cell @ 3:04PM 6/16 indicating George knew Casey was @ the house when he left
c) The %’s shown in the Encase report may reflects the % of the hour listed during which the computer processor was active. IOW 100% = 60 minutes of activity​

OK...here's how we get there. Working backwards from Tuesday 6/17...

Observing Casey’s cell records for Tuesday, 6/17, it appears she arrived in the area of G&C’s ~2:30PM and waited to either observe George leave, or until a time when she could be confident he was gone. Between 2:30 and 2:49PM Casey placed/took calls to/from Ricardo, Tony and Clint. It appears George left ~2:49PM at which time Casey’s cell went inactive for 57 minutes.

At 3:47PM Casey resumed a light texting conversation with Tony that concluded @ 4:05PM when she called him and left sometime between 4:05-4:36PM.

In agreement with the cell activity that placed Casey @ G&C’s ~2:49PM-4:05PM we have the computer forensics report that tells us the nursing home pic of Caylee with Alex was copied onto the laptop 6/17 3:28PM. (Note: This is the pic that LE used to check the clock of the laptop vs. the camera vs. the memory card to confirm the pic was indeed taken on 6/15).

Also in agreement w/ the cell activity AND the computer forensics report, Casey sent a Facebook message to Amy, 3:15PM 6/17, "cheer up me lady! i love you and can't wait to finally get you moved in". (ETA: Updated Fb after JWG confirmed for me. :thumb:)

Note that the Encase report shows for the laptop on Tuesday, 6/17:
2-3PM: 80% activity (e.g. perhaps 48 minutes)
3-4PM: 0% activity

These timestamps are in direct conflict w/ the forensics report regarding the downloading of the nursing home pic AND the timeframe in which Casey was @ G&C’s per the cell pings AND the timing of Casey's Facebook message to Amy. However, they synchronize perfectly if the Encase activity report is shifted 1 hour.

*snipped for Encase data & some times w/ 0% activity added for continuity)*

Looking @ Monday, 6/16, to see if the same time shift may apply to the Desktop computer…

Casey was on the phone w/ Amy 1:44-2:20PM, and on the phone again w/ Jesse @ 2:52PM-3:03PM. Although Casey could have certainly multi-tasked, consider that this phone activity would have significantly impacted her ability to be active on the computer…leaving only 32 minutes (or ~53%) free & clear during the 2-3PM hour vs. 82% activity (49 minutes) shown on the Encase report .

In contrast, between 3-4PM Casey had almost no activity on her cell phone. She wrapped up her call w/ Jesse @ 3:04PM in order to take the incoming call from George, which lasted <1minute. She also placed one call to Tony that lasted <1minute. She did, however, receive 3 MySpace alerts to her cell phone during this period. If we continue w/ the time-based interpretation of the Encase report, the desktop was in use ~49 minutes. FWIW, if Casey’s cell MySpace alerts were directly or indirectly in response to her desktop activity, these timestamps being 3:23PM through 3:39PM, spanned 16 minutes…and left 49-16=33 minutes of activity to split before and/or after 3:23 & 3:39PM.

IMHO, the above strongly indicates the HP desktop Encase report time is also shifted by 1 hour (e.g. activity level shown as 2-3PM on the report ACTUALLY describes the activity level that occurred 3-4PM), similar to the laptop.

Now, IF one buys the conclusion, one can still interpret it to support a variety of theories. However, IMHO, the degree of usage on the desktop by Casey for what appears to have been 3-4PM, including what appears to have been MySpace activity can be factored in to support Caylee was likely still alive when George left ~2:45PM 6/16. Otherwise, Casey's first activities in private that afternoon would have more likely been consumed in dealing with something of higher priority than MySpace, etc.
Click to expand...

Thanks to Pink Panther for reminding me that Bond had figured out the problem with the time stamps long ago! Now we have the computer forensic confirmation of that thanks to JWG.
 
So to catch me up 2 of our own WS'ers somehow got the computer history on the moxilla fire log that the D.A's office didn't get????

Wow. Do we know all her web searches for that time period? Will we the public be able to look at that list too?
 
Digitally speaking, Casey Anthony left little bread crumbs everywhere and for some reason Ashton didnt pick them up.
 
SindyBill said:
Digitally speaking, Casey Anthony left little bread crumbs everywhere and for some reason Ashton didnt pick them up.
Click to expand...

IMO, JA was not responsible for producing or finding this data, nor the lead Prosecutor on this case.
 
piratemom said:
So to catch me up 2 of our own WS'ers somehow got the computer history on the moxilla fire log that the D.A's office didn't get????

Wow. Do we know all her web searches for that time period? Will we the public be able to look at that list too?
Click to expand...

Any member of the public can make the same public records request I did and get the same information.

Personally, I'm not releasing it on the Internet as it contains massive amounts of private information about the Anthony family and their thoughts and activities that is none of our damn business. ;)
 
SindyBill said:
Digitally speaking, Casey Anthony left little bread crumbs everywhere and for some reason Ashton didnt pick them up.
Click to expand...

Why would Ashton pick up on them?
He was asked to be on this Team to handle the Scientific/medical evidence.

Linda Drane Burdick is an outstanding Prosecutor and I would guess she believed she had all the computer evidence handed over to her from not only June 16th but all the crucial dates.
 
Sorry if this has already been asked, but JWG...did you use a newer version of a computer program than what the prosecution had at their disposal?
Thanks!
 
Then this is truly a travesty whomever couldn't get this info earlier! What are we to do now?

Would it be possible to piece it all together and find out what really happened on that day?
 
Folks can download the spreadsheet containing the Firefox History information from the link here.

There are three tabs in the spreadsheet.

  • The tab "History from Unallocated Space" contains the Google searches for chloroform.
  • The tab "History from Casey Account" contains the activity from the account George and Cindy used that was not password protected.
  • The tab "History from Owner Account" contains the activity from the account Casey used that was password protected. This tab contains the search for "fool-proof suffocation".
None of the information in this file looked personal in nature with respect to George, Cindy, or Lee.
 
You must log in or register to reply here.

DNASolves

Who is Escambia County John Doe (1989)?

Members online

... and 202 more.
Total: 3,596 (members: 203, guests: 3,393)

Online statistics

Members online
203
Guests online
3,393
Total visitors
3,596
Totals may include hidden visitors.

Forum statistics

Threads
591,812
Messages
17,959,283
Members
228,612
Latest member
boymom0304
Back
Top