Ricardo's Computer Forensics

[AZlawyer]

Was RM on the list of calls from the 17th? Or maybe communicating thru IM? I can go look if no one knows off hand... Could KC have called RM and requested the photos? Otherwise, it sounds like we are left with another coincidence?

On 6/17 at 2:30 pm, KC called Ricardo from the area of the A. home, at a time when many of us believe she was downloading bucketloads of information from the home computer to the laptop. Ricardo called right back from his work phone, and they were on the phone for 8 minutes.

The emlx files were created 6/17/08 after 9:00 pm, however.

 

[scratchthatitch]

The times that the files were created were 9:22 and 9:41 pm . Just quickly looking at my earlier post from the calendar, muzikman shows KC downloading images and on a computer somewhere at 8:14pm. Maybe there is a longer window of computer activity for KC.. I'll check out the ping maps for that time of day as well..

 

[Jolynna]

The computer forensics report (http://media2.myfoxorlando.com/documents/032310-anthony1.pdf p. 103) says that the emix file part of the report "contains email files sent to and received from Sunsational-Stories@hotmail.com" (the Globe). I noticed most of the files were in Ricardo's "INBOX"--i.e., they were received from the Globe, not sent to the Globe. Only a few were in the "SENT" folder--the 2 with creation dates of 6/17/08 and one created 8/27/08.

So either Ricardo was sending messages to the Globe on 6/17/08 about something else, which I doubt, or he was sending messages to the Globe on 6/17/08 about this case, which I doubt, or the file creation date does not necessarily indicate the date the email was sent--e.g., if it was an email forwarding a prior email from him to Casey or vice versa.

BBM

I vote for this one.

There are JPG creation dates for all of the JPG files except IMG_0400.JPG. It sounds like Ricardo wanted to find all the pictures he could of Caylee with Casey to sell to the Globe, didn't still have IMG_0400.JPG in his picture files and so forwarded the Globe the prior email to Casey. That emix files are email attachment artifacts backs your theory up.

 

[scratchthatitch]

Last Cell activity was at 10:23 pm when KC retrieved a voice mail. 7:00 pm to midnight shows high activity on the computer. So basically, KC was doing something on the computer at the time the files were created by RM. Nothing noted in the phone calls, but do we have IM activity listed anywhere?

 

[AZlawyer]

Was RM on the list of calls from the 17th? Or maybe communicating thru IM? I can go look if no one knows off hand... Could KC have called RM and requested the photos? Otherwise, it sounds like we are left with another coincidence?

Last Cell activity was at 10:23 pm when KC retrieved a voice mail. 7:00 pm to midnight shows high activity on the computer. So basically, KC was doing something on the computer at the time the files were created by RM. Nothing noted in the phone calls, but do we have IM activity listed anywhere?

No IM activity at that time.

 

[Jolynna]

On 6/17 at 2:30 pm, KC called Ricardo from the area of the A. home, at a time when many of us believe she was downloading bucketloads of information from the home computer to the laptop. Ricardo called right back from his work phone, and they were on the phone for 8 minutes.

The emlx files were created 6/17/08 after 9:00 pm, however.

Maybe she called and asked for pictures of her and Caylee and Ricardo didn't look for the pictures or send them until later that evening? An email artifact from Ricardo's computer would show when Ricardo sent an email with that email attachment, not when Casey (or anyone else) picked it up.

 

[scratchthatitch]

OK...the files on page 122 of http://media2.myfoxorlando.com/documents/032.10-anthony1.pdf that were created on 6/17/08 aren't image files that can be uploaded off of a digital camera. They are emix files. IMG_0400.JPG was an image file that was uploaded into an emix-file-creating program and used to become the emix files 1337.emix and 1342.emix on 6/17/08.

The investigative report doesn't say what day the IMG_0400.JPG file was uploaded to Ricardo's computer. It does say that IMG_0401.JPG IMG_0404, IMG_408.JPG, IMG_0409.JPG were uploaded on 3/20/08. IMG_0285.JPG was uploaded on 2/18/08.

According to page 55 of the investigative report:

On November 2nd, 2009 I asked Detective Sandy Cawn of our computer crimes unit to review these photos from American Media and see if there was information embedded in the photos that would tell the date they ere taken. I also asked her to check the copy of Ricardo Morales' hard drive to see if the original photos were there. Detective Cawn found all but one of the American Media received photos on Ricardo Morales' hard drive. The photographs were taken on January 28th, 2008 and March 19th, 2008. Refer to her report for further details. http://media2.myfoxorlando.com/documents/032310-anthony1.pdf
​

From looking at Caylee and Casey in the pictures and the numbering of the JPG files, I'd say that IMG_0400.JPG was the first (of 5) to be uploaded to Ricardo's computer in March and that IMG_0385.JPG was uploaded to Ricardo's computer in February. For whatever reason, Ricardo did pull one of the images (IMG_0400.JPG) into a program using emix-file-creating software on 6/17/08.

I confess, I'm extremely computer illiterate, but wouldn't you have to turn a photo from iphoto into a another type of file in order to email it?

Oops, my bad. Sorry Jolynna, I didn't see your post about the EMIX files

 

[scratchthatitch]

No IM activity at that time.

Could you be so kind as to point me in the direction to find that info? I'm seeing that KC was on the computer during the time period the files were created, but if she wasn't IMing and no phone calls appear to RM, what other forms of communication are there via internet?

Argh! I must've missed a bunch of posts because I see now that AZLawyer posted a call to RM at 2:29 for 1 minute

 

[AZlawyer]

Could you be so kind as to point me in the direction to find that info? I'm seeing that KC was on the computer during the time period the files were created, but if she wasn't IMing and no phone calls appear to RM, what other forms of communication are there via internet?

Argh! I must've missed a bunch of posts because I see now that AZLawyer posted a call to RM at 2:29 for 1 minute

Snipped from the IM time log:

6/16/2008 7:56:34 AM WhitPlayboi
6/16/2008 7:56:39 AM WhitPlayboi
6/16/2008 7:57:30 AM WhitPlayboi
6/16/2008 7:57:33 AM WhitPlayboi
6/16/2008 7:59:07 AM WhitPlayboi
6/16/2008 7:59:11 AM WhitPlayboi
6/16/2008 8:00:19 AM WhitPlayboi
6/16/2008 8:00:38 AM WhitPlayboi
6/16/2008 8:01:08 AM WhitPlayboi
6/16/2008 8:02:02 AM WhitPlayboi
6/16/2008 8:02:03 AM WhitPlayboi
6/16/2008 8:02:32 AM WhitPlayboi
6/16/2008 8:02:37 AM WhitPlayboi
6/16/2008 8:02:58 AM WhitPlayboi
6/16/2008 8:03:53 AM WhitPlayboi
6/16/2008 8:04:23 AM WhitPlayboi
6/16/2008 8:04:29 AM WhitPlayboi
6/16/2008 8:04:34 AM WhitPlayboi
6/16/2008 8:05:09 AM WhitPlayboi
6/16/2008 8:05:25 AM WhitPlayboi
6/16/2008 8:05:32 AM WhitPlayboi
6/16/2008 8:05:40 AM WhitPlayboi
6/16/2008 8:05:59 AM WhitPlayboi
6/16/2008 8:06:00 AM WhitPlayboi
6/19/2008 1:42:55 PM Iassen
6/19/2008 1:43:13 PM Iassen
6/19/2008 1:43:32 PM Iassen
6/19/2008 1:43:37 PM Iassen
6/19/2008 1:43:41 PM Iassen
6/19/2008 1:44:27 PM Iassen
6/19/2008 1:44:41 PM Iassen
6/19/2008 1:44:42 PM Iassen
6/19/2008 1:44:50 PM Iassen
6/19/2008 1:44:52 PM Iassen
6/19/2008 1:45:02 PM Iassen
6/19/2008 1:45:12 PM Iassen
6/19/2008 1:45:18 PM Iassen
6/19/2008 1:45:35 PM Iassen
6/19/2008 1:46:33 PM Iassen
6/19/2008 1:46:37 PM Iassen

But certainly Ricardo's 9:-- pm emails could have been in response to Casey's 2:30 pm phone call to him. The fact that they (apparently) weren't communicating right at that time is not too important.

And, of course, there are other forms of communication--MySpace messages, Facebook messages/chat, etc.

 

[Jolynna]

The report shows email attachment artifacts (associated with the "significant" JPG files) on Ricardo's computer for certain days. The report doesn't show who the emails were for.

 

[scratchthatitch]

Sorry, last question and then I'll go away:blushing:

Is there a date for the seizure of RM's computer? I know there was something related to the chloroform "joke" but I'm not sure what time period.

 

[AZlawyer]

I thought I would post Woe.be.gone's question from RM's interview thread over onto this thread. Hoping someone can answer? Is there enough data in the document to come to any conclusion? TIA

If anyone's interested, over on the RM interview thread we are exploring the possibility that the 6/17/08 email files were emails sent by RM to someone (Casey?) on 6/17, then forwarded to the Globe later. I suppose any further opinions in that regard should really go on this thread, but you might want to check the RM thread first to see what's been discussed.

 

[nanny2five]

I thought I would post Woe.be.gone's question from RM's interview thread over onto this thread. Hoping someone can answer? Is there enough data in the document to come to any conclusion? TIA

i conclude that the first set of pics, the ones with the little pics at the bottom, were all but one, taken on 3/18/08 at 6:15 to 6:17 am. strange time to be playing guitar hero, but according to how i understood the info on the camera, the time was correct. the one of kc and Caylee sitting on the bed was taken on 1/28/08 at 23:03:03 or 11:03pm. the rest of the pics were taken from the flash drive and we dont have the camera info on those, at least i havent seen it yet. jmo

 

[AZlawyer]

i conclude that the first set of pics, the ones with the little pics at the bottom, were all but one, taken on 3/18/08 at 6:15 to 6:17 am. strange time to be playing guitar hero, but according to how i understood the info on the camera, the time was correct. the one of kc and Caylee sitting on the bed was taken on 1/28/08 at 23:03:03 or 11:03pm. the rest of the pics were taken from the flash drive and we dont have the camera info on those, at least i havent seen it yet. jmo

Not too strange if you've been up all night celebrating St. Patrick's Day. :shamrock:


ETA: I just realized the post I quoted above was in error--the photos were taken March 19 (Casey's birthday), not March 18.

 

[Jolynna]

AZlawyer - I am wondering the same thing. If these photos were not all taken on the same day but all taken at RM's apartment then why are Casey and Caylee both wearing what looks like the same clothes? But that just leads me to other questions that don't belong in this thread.

One of those photos was uploaded to RM's computer in February. Its file number IMG_0285.JPG is not of the same sequence as the other 5 pictures. Caylee's bangs are shorter and cut neatly in that picture.

JPG image files: IMG_0404, IMG_0408, IMG_0409, IMG_0401., and IMG_0400 are all in close file number sequence,show KC and Caylee in a different room and Caylee's bangs are down in her eyes. All but one of them was uploaded on March 20, 2008. IMG_0400, the one in the report without a date showing when it was uploaded, was probably taken before the others.

 

[nanny2five]

If anyone's interested, over on the RM interview thread we are exploring the possibility that the 6/17/08 email files were emails sent by RM to someone (Casey?) on 6/17, then forwarded to the Globe later. I suppose any further opinions in that regard should really go on this thread, but you might want to check the RM thread first to see what's been discussed.

i think its clear that these pics were involved in some sort of email on 6/17, but there isnt enough info to tell what that was. its true rm could have emailed them to somebody on that day, but its also possible, since there are only two, he may have emailed them to himself from his phone. im still looking at the files but i havent been able to tell if those pics came from camera or phone but if anybody knows how to tell, that would narrow it down. jmoaa

 

[scratchthatitch]

i think its clear that these pics were involved in some sort of email on 6/17, but there isnt enough info to tell what that was. its true rm could have emailed them to somebody on that day, but its also possible, since there are only two, he may have emailed them to himself from his phone. im still looking at the files but i havent been able to tell if those pics came from camera or phone but if anybody knows how to tell, that would narrow it down. jmoaa

It shows "iphoto" on some of the data underneath, so I'm thinking it was directly from the computer. Also, just to be clear, we are not discussing the time or date the photo was taken but rather the date of 2 files being created for those photos on June 17, 2008.

 

[AZlawyer]

I agree with the BBM statement and I am considering the circumstances as well.
Perhaps there could have been something nefarious in Casey requesting these photos at this time?

By this I mean, Was Casey already putting together a Nanny story? She needed to find a place where the Nanny lived and part of that story involved JP's/Ric's apartment.

Caylee at the drums photo taken at their apartment and Casey leading Cindy to believe it is the Nanny's apartment...she did tell Cindy that both apartments were laid out the same.

Casey giving Cindy JP's/Ric's number as being the Nanny's number.

:twocents::crazy:

Well, I don't think we know for sure that these are the only photos Ricardo sold to the Globe, or that Ricardo sent Casey any of these photos either. The comp. forensics report says that Yuri gave the examiner a USB drive on November 2, 2009 with JUST THOSE SIX PHOTOS on it and requested info about whether they were also stored on Ricardo's computer. Obviously by then Yuri was well aware that the "Big Trouble" shirt was important, so probably he only put the "Big Trouble" photos on the thumb drive.

None of the 6 photos was found in the email files on the computer. :waitasec:

 

[sleutherontheside]

Well, I don't think we know for sure that these are the only photos Ricardo sold to the Globe, or that Ricardo sent Casey any of these photos either. The comp. forensics report says that Yuri gave the examiner a USB drive on November 2, 2009 with JUST THOSE SIX PHOTOS on it and requested info about whether they were also stored on Ricardo's computer. Obviously by then Yuri was well aware that the "Big Trouble" shirt was important, so probably he only put the "Big Trouble" photos on the thumb drive.

None of the 6 photos was found in the email files on the computer. :waitasec:

BBM
I will go back and find reference to this in the interviews.......but while I do that......was there not discussion about RM having his personal email and his work email?? He was able to access both from work. Does that have any impact here?????

 

[Woe.be.gone]

BBM
I will go back and find reference to this in the interviews.......but while I do that......was there not discussion about RM having his personal email and his work email?? He was able to access both from work. Does that have any impact here?????

I recall this too. He was able to access his email but he wasn't sure if what he sent was saved on his home computer as well. I think that's what it was. I'll try to find this info too.

I never got around to this today. Iirc LE did pin him down and question him about the sale of pics to the Globe which RM did admit but only after he was cornered.