LDB: "Can you tell either in the temporary Internet files, or in the cookies or in the Internet history uh, which user, meaning you said there were two users on the computer, which user is making the search?"
SO: "Yes, the Internet history database is re.... (Baez objects: "It seems facts are not in evidence, I believe the witness testified to two user profiles, not two users. Overruled, witness continues) ...the temporary files database will record which user account was logged in and active at the time the search was conducted so that's what it's recording as opposed to an individual user sitting at the keyboard which obviously it wouldn't know, it can only know which user is active at the time the search is conducted."
LDB: "Alright, but the temporary internet files will record which user account is being accessed at the time?"
SO: "That's correct."
LDB: "Is that also true with the internet history?"
SO: "Yes."
LDB: "How about any of the cookies that appear?"
SO: "That's correct."
LDB: "What about once a file, or files are deleted? Will the record associated with the deleted files tell you which user account generated that original search?"
SO: "No. That information is no longer available."
LDB: "Were you asked by Detective Yuri Melich to perform a keyword search for the word "chloroform" *witness grins* or any alternate spellings of that word?"
SO: "Yes I was."
LDB: "When did that happen?"
SO: "Sometime around August 2008, I think late August 2008."
LDB: "and how was that keyword search performed?"
SO: "In the same manner that the Zenaida Fernandez-Gonzales keyword search was performed. I input that word into NCASE, spelled correctly and spelled incorrectly and came up with keyword search hits for both."
LDB: "Was there a particular location on the computer where you were able to determine where the keyword search hits were performed?"
SO: "Yes."
LDB: "Where was that?"
SO "The keywords appeared in unallocated or deleted space on the hard drive."
LDB: "Are you able to then view the information associated with those hits?"
SO: "I'm sorry? Am I able to what?"
LDB: "View any of the information that is in deleted space or unallocated space?"
SO: "Yes."
LDB: "What can you see?"
SP: "Well, because it's in deleted space, it's hit or miss as to whether you get an entire Internet record or not. In this case, with the "chloroform" keyword search hit we were able to recover a complete internet history from Mozilla FireFox. The complete history meaning right from the beginning of the code that begins the programming to create the page right to the very end of the page. So we basically, got a complete internet history record from unallocated space that had been deleted."
LDB: "You said that that is sometimes difficult depending on user activity, what did you mean?"
SO: "Right, when we were talking earlier about overwriting space with deleted files, there's always an opportunity when you delete a file especially a very, very large file that new data being saved to the computer will overwrite some of the data, some of the old data that was deleted. That did not happen in this case. We were able to recover an entire internet history record."
LDB: "And how is it, you know it is an entire record? What is it about the information that makes you able to tell us that?"
SO: *grin* "Because I turned it over to my sergeant who is an expert in that area. Um, I am not. (Baez objects to strike I did not hear why, HJBP: "sustained.")"
LDB: "Alright, so the information, that information, you alerted another individual you located, you had hits in unallocated space?"
SO: "When NCASE (?) reported back to me the fact that it found the word chloroform spelled correctly or not, I was able to look at the language surrounding that word and I realized, I recognized it as a file as an Internet database file. I looked around a little bit to see if I could figure out if it was Internet Explorer, or if it was some other type of browser but since I am not that familiar, I was not able to determine that. i went back to the beginning of the record because I don't know where within a web page the word chloroform would have appeared so, it was just very difficult for me at that time to figure that out so I found the search hit and turned it over to my Sergeant from there."
(commercial break)