Zani Timeline- Other ZannyThoughts- Zanny Searches on Caseys computer

New Posts

Status
Not open for further replies.
one_hooah_wife said:
Ok ... the Files (Index.dat and History.dat) are like "Cookie Jars" and the searches are the cookies. Just because the "cookie jar" (file) was created on a certain date it doesn't mean that all the cookies (searches) were placed in it on that same date. We do know that for example "cookie jar", index.dat was created on 6/12/08 and we know that the last cookie was placed in it on 7/16/08 ... but we don't know when each specific cookie was placed in the "cookie jar" (because that info is missing from the full path, it was replaced with Casey's case number by the forensics guy)

Anything?
Click to expand...

Perfect, thank you!
 
one_hooah_wife said:
Ok ... the Files (Index.dat and History.dat) are like "Cookie Jars" and the searches are the cookies. Just because the "cookie jar" (file) was created on a certain date it doesn't mean that all the cookies (searches) were placed in it on that same date. We do know that for example "cookie jar", index.dat was created on 6/12/08 and we know that the last cookie was placed in it on 7/16/08 ... but we don't know when each specific cookie was placed in the "cookie jar" (because that info is missing from the full path, it was replaced with Casey's case number by the forensics guy)

Anything?
Click to expand...

um, not viewed this file myself yet but don't cookies create thier own files too? so we should have cookies?

Well she probably cleared her cache for cookies but didnt clear the history.

I need to catch up on the docs!
 
one_hooah_wife said:
I'm not sure that we can say for sure that the search date of 6/12/08 is accurate since all we know about that search is that the file containing the data was created on 6/12/08 and Last written to on 7/16/08. Unless you have seen something different than I have ... I am happy to have a second pair of eyes ... and help in trying to aid everyone in understanding what they are reading!
Click to expand...
That's a very good point that I missed on the scan of that file, one_hooah_wife. And yes, I agree. That search could have also been performed on July 16, 2008. Which would rule it out as being anything of real significance, since that is when KC told CA about Zenaida.
 
Friptzap said:
um, not viewed this file myself yet but don't cookies create thier own files too? so we should have cookies?

Well she probably cleared her cache for cookies but didnt clear the history.

I need to catch up on the docs!
Click to expand...
Imho, one_hooah_wife, was using the "cookie jar" to simply explain how history files work. And clearing the cache, cookies, etcetera, is... well... meaningless anyway. Simply bc locards exchange principle works esp well for disk drives (i.e., the file headers, not the data, is deleted).
 
shadowraiths said:
That's a very good point that I missed on the scan of that file, one_hooah_wife. And yes, I agree. That search could have also been performed on July 16, 2008. Which would rule it out as being anything of real significance, since that is when KC told CA about Zenaida.
Click to expand...

Thank you so much for responding ... I was afraid I was missing something in trying to make sense of all of this and the more I try to explain the more I confuse myself! :crazy:
 
one_hooah_wife said:
Ok ... the Files (Index.dat and History.dat) are like "Cookie Jars" and the searches are the cookies. Just because the "cookie jar" (file) was created on a certain date it doesn't mean that all the cookies (searches) were placed in it on that same date. We do know that for example "cookie jar", index.dat was created on 6/12/08 and we know that the last cookie was placed in it on 7/16/08 ... but we don't know when each specific cookie was placed in the "cookie jar" (because that info is missing from the full path, it was replaced with Casey's case number by the forensics guy)

Anything?
Click to expand...
Just wanted to say that I'm blown away with how much you know about this stuff! Thank god you joined. the thing is I think you have seen now that you need to totally "dumb it down" to explain it to us, like you did above. Then you won't have to go through all those pages of us scratching our heads saying huh? and asking more questions. thanks so much for your expertise!
 
one_hooah_wife said:
Thank you so much for responding ... I was afraid I was missing something in trying to make sense of all of this and the more I try to explain the more I confuse myself! :crazy:
Click to expand...
From where I sit, you're doing a rather superb job of explaining things, one_hooah_wife! :)
 
Friptzap said:
um, not viewed this file myself yet but don't cookies create thier own files too? so we should have cookies?

Well she probably cleared her cache for cookies but didnt clear the history.

I need to catch up on the docs!
Click to expand...

You're right and I explained that earlier about cookies being a file and each having it's own creation date as opposed to strings of data within an index or archive file ... should have used some other container than "cookie jar" like I said ... I am feeling the stress :crazy:

The index.dat and history.dat files contain information that may have been cleared when cookies, temporary internet files and other caches have been emptied.
 
1st time blogger said:
Just wanted to say that I'm blown away with how much you know about this stuff! Thank god you joined. the thing is I think you have seen now that you need to totally "dumb it down" to explain it to us, like you did above. Then you won't have to go through all those pages of us scratching our heads saying huh? and asking more questions. thanks so much for your expertise!
Click to expand...

Well ... TY ... I will try to explain better!
 
shadowraiths said:
Imho, one_hooah_wife, was using the "cookie jar" to simply explain how history files work. And clearing the cache, cookies, etcetera, is... well... meaningless anyway. Simply bc locards exchange principle works esp well for disk drives (i.e., the file headers, not the data, is deleted).
Click to expand...

assuming she is not smart enough to defrag her hard drive and or clean this information through other "tools"

It can be cleaned well if you know how to do it ;-) now that said I don't think she is that smart!
 
one_hooah_wife ...one question I have for you since you seem to be a computer expert. Don't you think there are Kzillions more things on that computer than that one little print out? ALL the myspace, facebook, emails, searches etc. where are they? remember lee saying all the yahoo emails had been erased when he got the computer? wouldn't they have been able to access that stuff too?
 
1st time blogger said:
one_hooah_wife ...one question I have for you since you seem to be a computer expert. Don't you think there are Kzillions more things on that computer than that one little print out? ALL the myspace, facebook, emails, searches etc. where are they? remember lee saying all the yahoo emails had been erased when he got the computer? wouldn't they have been able to access that stuff too?
Click to expand...

Oh I am nearly positive there is tons more.
 
Friptzap said:
assuming she is not smart enough to defrag her hard drive and or clean this information through other "tools"

It can be cleaned well if you know how to do it ;-) now that said I don't think she is that smart!
Click to expand...
Even if she (or anyone else, for that matter) were "that smart," it is impossible to remove "all of the data." That is, unless one runs a hard core magnet over the thing and then breaks it into teeny tiny pieces with a hammer.
 
1st time blogger said:
one_hooah_wife ...one question I have for you since you seem to be a computer expert. Don't you think there are Kzillions more things on that computer than that one little print out? ALL the myspace, facebook, emails, searches etc. where are they? remember lee saying all the yahoo emails had been erased when he got the computer? wouldn't they have been able to access that stuff too?
Click to expand...

Oh, I am sure of it ... and as far as computer forensics go ... the analysis that we have seen in these documents is very basic ... pretty much anyone with software that parses binary files could have discovered this. I can't wait to see the stuff that she really made an effort to erase or hide!
 
shadowraiths said:
Even if she (or anyone else, for that matter) were "that smart," it is impossible to remove "all of the data." That is, unless one runs a hard core magnet over the thing and then breaks it into teeny tiny pieces with a hammer.
Click to expand...

Yep!

My husband, being the DOD computer genius that he is (yes, he is reading over my shoulder) says that the magnetic field on the disc stores an imprint of the last dozen or so writes, thus even the strategy of overwriting all with 101010... really only masks the contents of the disc, but it does not remove them. A highly skilled computer forensics expert would have the ability and tools needed to interpret and recreate files based on that imprint.
 
McNugget said:
it is possible to do a complete hard drive wipe with the right tools. Some people use special programs to do this when they want to sell their old computers to avoid identity theft.
Click to expand...
Not to belabor this subject... but... it is physically impossible to do a "complete hard drive wipe." This is due to the laws of "electromagnetic fields theory" as it applies to disk drive technology. Of course, companies that sell "disk wiping" software are going to make such outlandish claims... bc... well, it gets them sales. :rolleyes:
 
one_hooah_wife said:
Yep!

My husband, being the DOD computer genius that he is (yes, he is reading over my shoulder) says that the magnetic field on the disc stores an imprint of the last dozen or so writes, thus even the strategy of overwriting all with 101010... really only masks the contents of the disc, but it does not remove them. A highly skilled computer forensics expert would have the ability and tools needed to interpret and recreate files based on that imprint.
Click to expand...
LOL. Well, I was a disk drive engineer before I went soft and became a technodweeb... erm... software engineer. ;)
 
Status
Not open for further replies.

DNASolves

Who is Escambia County John Doe (1989)?

Members online

... and 146 more.
Total: 4,313 (members: 147, guests: 4,166)

Online statistics

Members online
147
Guests online
4,166
Total visitors
4,313
Totals may include hidden visitors.

Forum statistics

Threads
592,488
Messages
17,969,596
Members
228,786
Latest member
not_just_a_phase
Back
Top