Cross went on for a good while, because Chappell was stonewalling big time. I have pages of notes, but I'll try to hit some high points. (Perhaps some of you with more tech experience will show me that this all meant nothing, but it seemed compelling to me.)
K-When did you export the file table from FTK? (forensic tool kit)
C-About 3 weeks ago when I did the report.
K-When you did the extraction you became aware of invalid time stamps. You didn't note those on the report, did you?
C-Correct.
K-Is that something you omitted intentionally?
C-I omitted lots of things I didn't find relevant.
K-Did you note that all 500(?) files in this 41 seconds had invalid time stamps?
C-I was satisfied that the other 7 time stamps were correct.
K-Why didn't you put your name and the date on your report?
C-It was really just notes, not a report.
Kurtz then asks Chappell to take us step-by-step --show us what the State alleges BC did. This is not to demonstrate how long it takes. Just show us the exact steps.
K-You don't know how/when google updates.
C-No, but I'm satisfied that my results were the same. For the record, I want to say that 3 years later, it may be different.
Boz-objection-overruled--let Jury decide weight to give the testimony.
C-Level of zoom was 11/default. Went to almost maximum
K-Not my question. How many actual levels of zoom...
C-(Shut Kurtz down at this point.)
K-Went to 41 second question. asked if he thought BC found/decided where to dump his wife's body in 41 sec.
C-41 seconds is a long time.
K-presents Def. exhibit 84--Ward's report on tampering, appendix states "In fact, these files contain both the active and the deleted files..."
C-There is one missing --related to google ads
C-One google cookie can do different things.
K-Google cookies 1,2,3,5,6,7,8 are all there. Missing cookie 4.
K-Can you show us that cookie?
K-Would that cookie show intermediate access? Not just first and last activity?
K-Was any google cookie activity modified on July 11? Is it your testimony?
(shut down by C)
K-Not a single cookie that corresponds with this visit on the machine.
C-Not that we can see from this side.
K-In your "non report" you said there WAS a cookie.
C-That's what I believed at the time.
K-So it isn't true?
C-It was inaccurate.
K-If you'd had a cookie, it would have been a significant piece of evidence.
C-We found lots of cookies.
K-If you had found that PARTICULAR cookie.
C-It would have been nice.
Kurtz got C to say they did not get court order for google. C-"We sent a preservation letter." K-produced letter--You didn't ask to preserve cookies? C-(Read letter) K-Did you zero in on 1:14 in letter? C-No. That would have been a way to make sure it was preserved.
K-Is it your opinion that Mr. Cooper deleted the single cookie and shredded it? C-It is possible. K-You know BC has a degree in comp sci? You think he would go to time/trouble to clear that ONE cookie but fail to get rid of temporary internet files?
K-Did you evaluate routers? C-No. K-Any other hardware? An external hard drive, thumb drive...
Boz--OBJECTION! DUMB QUESTION...
More later....re:time stamps and CSA logs....