SIDEBAR
3:41
Jury coming back 3:42
DIRECT EXAMINATION OF KEVIN STENGER BY LDB
Computer forensic examiner for OCSO.
He previously testified to Internet history in deleted files of HP from A's home for the dates of 3/17 and 3/21/08.
The deleted Firefox history is for 3/4/08 to 3/21/08.
He identified a disk that he created with the reports from Net Analysis and Cache Back. The report deals with the entire deleted history.
JB - no objection to conditionally admitting the disk into evidence. He wants a chance to review it. Wants a stipulation.
HHJBP: Are you offering it without conditions?
LDB: My offering is without condition.
HHJBP: What is the defect in the predict.
JB: I think it needs some explanation.
OBJECTION OVERRULED the disk will be accepted into evidence
SIDEBAR - 3:46
He was asked to perform key word searches for chlorophyl, neck, hand sanitizer and Gentiva.
The Net Analysis is a spreadsheet in Excel. You just search the spreadsheet. The Cache Back is an HTML report and Internet Explorer allows you to search for the words.
The disk was marked as State's Exhibit 346 and published.
The Net Analysis report is opened up in Microsoft Excel. Control F will bring up the search function. Then you enter the desired key word and you can search the entire spread sheet or one at a time.
Chlorophyl can be spelled many different ways. You can search using only the first four or five letters and that will search for any version of the spellings. They then search "chlor". It then produced a URL. It was a URL that had a reference to a chloroform habit web page - not chlorophyl.
OBJECTION BY JB
SIDEBAR 3:55
Using the "chlor" it pulls up chloroform, were a version of chlorophyl to appear?
He did not find any references to chlorophyl.
The same is true in the Cache Back report.
He also looked for hand sanitizer. The word sanitizer did not appear in any of the documents.
You searched for Neck?
OBJECTION - OVERRULED
It was in connection with neck break. There was another search in association with neck in conjunction with other terms.
Can you tell if this was a pop up that occurred?
OBJECTION - not rebuttal -
LDB: CA testified to a pop up
OVERRULED
This is a Google search that is specific to neck breaking
Anything typed into the search box will appear after the Q - in this instance a human typed in "neck breaking" and then pushed search.
When you searched for chlorophyl, you said there were no hits? Correct. Would that mean there were no searches for chlorophyl with any of the chloroform entries? Correct.
He did not find any instances of bamboo appearing in the deleted Firefox file.
How did you determine if there was any access to a Gentiva website? He searched for Gentiva.com and there was no reference to that in the history.
Did you use any other forensic tools to confirm? Yes. He utilized a tool which breaks down the raw interest history file into records and it creates a text file and then searched that. Then the Mork database is essentially a text file, so he imported it into Word and used Word's search feature. He then imported it into FTK and InCase and he repeated the searches there and couldn't find anything. He then used a Hex editor and searched that way and could find no references to them.
Any reference to anything to do with dogs? How to get rid of fleas? Yes.
CROSS EXAMINATION BY JB
What is Yahoo.com? It is a domain. If I go there, what comes up? The webpage for Yahoo? Yes. A number of different things - the news, a map to the drug store, stock market..... It doesn't tell me much about what is going on that page? No, sir.
The file he has is of web addresses? Yes.
All you were searching for was web names? With the exception of the Google search pages.
Unless the website had bamboo or chlorophyl in the domain name, you wouldn't have gotten a hit? Yes.
Neck breaking - you are aware no one has had their neck broken in this case? Correct.
OBJECTION - SUSTAINED
After the Google search of neck breaking, the next web site is Fightingarts.com? Yes. The URL would indicate it has something to do with martial arts. That would have come up on the search page and the user would have clicked a link on that page to go to that site. Whoever did that search ended up looking up a self defense web site? If we assume that is a martial arts web site.
He can't say what's on that page unless he goes there.
He wasn't asked to do this in July of 2009. He was just contacted recently to impeach CA.
He did not do specific searches for alcohol and peroxide. He knows they exist and he has seen them.
Witness excused.