Terri's Computer forensics

Okay, Kaine stated that TH's favorite medium of communication was electronic. Certainly LE has her laptop, right, and her phone? Isn't it true that everything on a computer or SIM chip in a phone is never "completely" erased?

I remember with Scott Peterson, that was one of the circumstantial evidence that brought him down...his searches, etc.

Anyone care to shed some light on this for me? I don't really know too much about it. Looks like TH's achilles heel will be her love for all things electronic.

Definitely true for a hard drive, not sure about a SIM card, though. However, most of the phone companies retain SMS (text) messages as well as phone call history. So those records can be gotten that way. I wish we could see the contents of the hard drive and phone messages!

SurfieTX said:

Okay, Kaine stated that TH's favorite medium of communication was electronic. Certainly LE has her laptop, right, and her phone? Isn't it true that everything on a computer or SIM chip in a phone is never "completely" erased?

I remember with Scott Peterson, that was one of the circumstantial evidence that brought him down...his searches, etc.

Anyone care to shed some light on this for me? I don't really know too much about it. Looks like TH's achilles heel will be her love for all things electronic.

Click to expand...

LE should have it all. Regardless, they can request all records from all electronics be sent from x time period to x time period. Hopefully LE has gone through it all already, or is still perusing. Hmmm...

I have my Facebook set so I don't get emails when I comment on someone else's wall or pictures, or when people respond. And I've got certain conversations blocked so they won't fill up my email with notifications. I think that's what Kaine was talking about - there might be other things out there the police don't have yet.

I am no computer whiz, but I know that there's a file in your computer called "Index.Dat" that is never cleared even when you delete your history. Over time it gets larger and larger and contains everything you've ever written or looked at online or offline. Some people think Microsoft has it set up that way precisely to help Law Enforcement.

http://en.wikipedia.org/wiki/Index.dat

The index.dat file is a database file. It is a repository of information such as web URLs, search queries and recently opened files. Its purpose is to enable quick access to data used by Internet Explorer. For example, every web address visited is stored in the index.dat file, allowing Internet Explorer to quickly find Autocomplete matches as the user types a web address. The index.dat file is user-specfic and is open as long a user is logged on in Windows. Separate index.dat files exist for the Internet Explorer history, cache, and cookies.

The index.dat file is never resized or deleted. A large index.dat file can impair performance.[1]

Click to expand...

ThoughtFox said:

I have my Facebook set so I don't get emails when I comment on someone else's wall or pictures, or when people respond. And I've got certain conversations blocked so they won't fill up my email with notifications. I think that's what Kaine was talking about - there might be other things out there the police don't have yet.

I am no computer whiz, but I know that there's a file in your computer called "Index.Dat" that is never cleared even when you delete your history. Over time it gets larger and larger and contains everything you've ever written or looked at online or offline. Some people think Microsoft has it set up that way precisely to help Law Enforcement.

http://en.wikipedia.org/wiki/Index.dat

Click to expand...

Wow that was fascinating. I had no idea that existed.

If she was a big fan of CSI - and whatever happened was pre-planned - then she SHOULD have been smart enough to have a second, disposable cell phone that the husband didn't know about. And it wouldn't take too much to swap out a computer's hard drive - which I think would get rid of anything incriminating on the computer.

debirlfan said:

If she was a big fan of CSI - and whatever happened was pre-planned - then she SHOULD have been smart enough to have a second, disposable cell phone that the husband didn't know about. And it wouldn't take too much to swap out a computer's hard drive - which I think would get rid of anything incriminating on the computer.

Click to expand...

That would be very obvious to LE even on a cursory exam, though. Then she'd have to explain why there's a new hard drive in the puter, who installed it and when, and where the old one was disposed of.

Sherbie said:

That would be very obvious to LE even on a cursory exam, though. Then she'd have to explain why there's a new hard drive in the puter, who installed it and when, and where the old one was disposed of.

Click to expand...

Saying that it died, she replaced it and threw it in the trash might be suspicious, but I doubt if they could prove otherwise.

debirlfan said:

Saying that it died, she replaced it and threw it in the trash might be suspicious, but I doubt if they could prove otherwise.

Click to expand...

I agree with that. But they can build a pretty strong circumstantial case for it by subpoenaing records from social media sites, ISPs, etc., as well as reconstructing from emails and texts provided by others. What I meant was there was no way she'd be able to fool them that it was the original hard drive, sorry.

Sherbie said:

I agree with that. But they can build a pretty strong circumstantial case for it by subpoenaing records from social media sites, ISPs, etc., as well as reconstructing from emails and texts provided by others. What I meant was there was no way she'd be able to fool them that it was the original hard drive, sorry.

Click to expand...

I agree - that would really be incriminating if she destroyed possible evidence in her computer!

Just because she used technology doesn't mean she knew how to remove a hard drive.

If she kept all her text messages in her phone, I doubt she would be the kind to clean her cache on a regular basis.

ThoughtFox said:

I have my Facebook set so I don't get emails when I comment on someone else's wall or pictures, or when people respond. And I've got certain conversations blocked so they won't fill up my email with notifications. I think that's what Kaine was talking about - there might be other things out there the police don't have yet.

I am no computer whiz, but I know that there's a file in your computer called "Index.Dat" that is never cleared even when you delete your history. Over time it gets larger and larger and contains everything you've ever written or looked at online or offline. Some people think Microsoft has it set up that way precisely to help Law Enforcement.

http://en.wikipedia.org/wiki/Index.dat

Click to expand...

I know I am pedantic but that file is used for IE only (not firefox or opera, for example) and several ways to delete it even if you use IE as is written in the end of the wiki you linked.

2goldfish said:

I know I am pedantic but that file is used for IE only (not firefox or opera, for example) and several ways to delete it even if you use IE as is written in the end of the wiki you linked.

Click to expand...

Okay, thank you. I said I wasn't a computer whiz. And I realize there are ways to delete that file also, but I'm not going to post that here and give anyone ideas.

I posted that I believe that TH might have had online cybersex relationships. Possibly a pedophile saw her as a great " mark ", and once he found out she had kids at home he may have pursued her, making her believe it was a romantic,genuine interest. KH does say her favorite form of communication is email...

But, I would not assume that she used her own computer ; I'm sure she used a friend's computer, or possibly even a library computer.....


All JMO

SurfieTX said:

Okay, Kaine stated that TH's favorite medium of communication was electronic. Certainly LE has her laptop, right, and her phone? Isn't it true that everything on a computer or SIM chip in a phone is never "completely" erased?

I remember with Scott Peterson, that was one of the circumstantial evidence that brought him down...his searches, etc.

Anyone care to shed some light on this for me? I don't really know too much about it. Looks like TH's achilles heel will be her love for all things electronic.

Click to expand...

Yes, ITA that Terri's love for all things electronic could actually be the big key piece of hard, substantiated evidence that IMO will be key to convicting her for either MFH or Kyrons disappearance(which unfortunately I believe, just as with Haleigh's case that even if Kyron is not found will be eventually a homicide case) or both...

Yes, you are correct it is ALMOST impossible to erase data from a computer hard drive(no matter how many times you erase it) and also with whomever you have your internet provider as they also keep detailed, extremely comprehensive records (And that includes every single detail of data if even using "private browsing" caret, as with Casey Anthony tho she "googled" all info about killing a child with household items, chloroform, etc "in private browsing" [tho it is not saved or any record on the computers hard drive], however the internet service provider has detailed record of it ALL)..

This too is very similar with cell phones (think about most phones these days are basically mini, handheld computers.) Since getting my iphone I very rarely use my laptop, simply because everything I can do on my laptop can be done on my phone. As I had posted in another thread just recently a family member knew her hubby was cheating but needed to see proof with her own eyes. she was checking his cell phone for a few weeks but he kept EVERYTHING erased. She simply went to her cell phone service provider and requested the last 3 months of detailed, itemized statement of hubby's cell. 15mins later she left with a large legal size manilla envelope stacked full of every single last word from every single text sent or received, along with every single pic&video received to that cell(and they emailed the actual video to her) and of course all records of incoming and outgoing calls (& 1 other tidbit about incoming&outgoing calls tho the person may use *67 to block their # from showing up on the other person phone, little do ppl know that when you get the itemized call log the number is not blocked/hidden, it clearly shows from what # the call came)

And here is a post from NewsMuse that I found interesting to know that all archives of the above mentioned data are REQUIRED to be kept. Here's a snip from NewMuse post...

Originally Posted by NewsMuse
{Respectfully snipped}
And you know, SmoothOperator is right. This info has to be archived forever. Not just wireless providers, either. Any companies that use anything wireless: all emails (even intra-office); all phone records (wireless, landline, fax). The list goes on and on. A friend of mine works for Homeland Security and, well, it's just mind blowing.

Click to expand...

So basically my hope is that with all of this detailed info available that hopefully Terri was NOT aware of just how detailed records are kept of her electronic communications and was under the assumption(as many are) that especially where her cell was concerned that once she erased the data, pics, etc that it was FOREVER GONE. Something that makes me think this is possible is the "sexting" and "graphic sexual activity" that she depicted in communicating with MC. I tend to believe she had no idea that LE would be able to see and have full knowledge of such or maybe I'm wrong and if so its an even scary depiction of what type person Terri is, to take part in such FULL WELL KNOWING it was going to be seen by LE(and now the entire world knows all the lurid detail).

Am just hoping that something that was said by her communications IS THAT SOMETHING that will eventually lead to Kyron and then to swift and firm judgement on his behalf...

liz b. said:

But, I would not assume that she used her own computer ; I'm sure she used a friend's computer, or possibly even a library computer.....
All JMO

Click to expand...

It certainly wouldn't surprise me to find out that TH had an online "affair" but I think she would use her own computer. Unfortunately, Kaine was oblivious to a lot of things going in during their marriage and I truly don't think he would have suspected anything.

:twocents:

liz b. said:

I'm sure she used a friend's computer, or possibly even a library computer.....

Click to expand...

Hmmm...that's interesting. I wonder if that's why they were searching her friends' homes...to look at their computers? What is the protocol for using a library computer? Do you have a username or something static and identifiable for each user? (sorry, I've never used one).

Thanks, Smooth Operator! :dance: I've been saying for days that the emails and text messages are not just rumors but absolute hard evidence. Anything written that can be printed out, and which shows a direct connection between one electronic device and another, is hard evidence.

I remember with the Laci Peterson case, it took several weeks for LE to get all the emails from the cell phone companies. Those days are gone. Of course that was also before 911 and Homeland Security and technology has made leaps and bounds since then.

ThoughtFox said:

Thanks, Smooth Operator! :dance: I've been saying for days that the emails and text messages are not just rumors but absolute hard evidence. Anything written that can be printed out, and which shows a direct connection between one electronic device and another, is hard evidence.

I remember with the Laci Peterson case, it took several weeks for LE to get all the emails from the cell phone companies. Those days are gone. Of course that was also before 911 and Homeland Security and technology has made leaps and bounds since then.

Click to expand...

But then, that makes me wonder why Kaine was so adamant about anyone who knew Terri to report or show questionable emails/texts, etc. Hmmm (again), I wonder when her laptop was purchased? Could other computers been disposed of?

SurfieTX said:

Hmmm...that's interesting. I wonder if that's why they were searching her friends' homes...to look at their computers? What is the protocol for using a library computer? Do you have a username or something static and identifiable for each user? (sorry, I've never used one).

Click to expand...

At our library you have to use a library card number to log in before using the internet.

However, if a librarian caught someone looking at a suggestive picture they would throw them off, so Terri would have been taking a big risk. My gut feeling is that she wouldn't do that at a library.

Most adult content or websites are blocked on library computers. But emails would go through and she could read them on a library computer. I've had to do that when my computer was on the fritz.

Kaine may be like my husband who knows almost nothing about email or ways to send images. Not everyone is proficient with technology. So maybe Terri counted on the fact that he wasn't going to look back through the emails. She might have also had an email account he didn't know about, or had her own with a password, while he used another for family email.

In the days immediately after Kyron's disappearance one of the local media outlets - don't remember which one - was fairly certain the TH was posting comments on their website. This led me to wonder exactly when LE grabbed her computer. About five years back I spent an afternoon interviewing the principals of a small consulting company that did computer forensics. Most of their business was contract work for local LE. They were working on a child *advertiser censored* case at the time. With PCs you never really erase anything - you just write over information that is no longer needed. And even if information has been written over, computer forensics can sometimes still figure out what was underneath. Even when you "wipe" a hard drive by writing over data multiple times, information is sometime still left behind. The folks I talked to used an analogy to explain to me how they could sometimes extract information from a disk that had theoretically been wiped clean. Assume you have an old fashioned tape cassette, and you tape over what was originally on the cassette. If alignment of the tape and the recorder is not absolutely perfect, a tiny bit of what was originally recorded would remain along the edges of the tape. All information on a computer is stored digitally, so if computer forensic analysts can reconstruct a pattern of ones and zeros from “ghost” information left on the hard drive, they have a chance of figuring out what was on the computer. My best guess is that TH’s computer was turned over to the FBI. Moral of the story: If you have incriminating info on your computer, take a sledge hammer to it and then toss it in a very hot fire.