Anthony's Computer Forensics

[JWG]

Casey Myspace friend ID is 10472558...
If that is not the numberical ID in your findings, post it and we can tell you who's page they were logged into. I would find it interesting to learn that Tony had logged into CASEY's Myspace and was deleting messages and comments...

Thanks Shannon. Muzikman supplied this to me and it is a match. Tony was somehow able to get into her myspace.

 

[NYJeremy]

"I posted yesterday on the escort service surfing activity, and I will have more to say about that in a future post. Suffice it to say, I am 99% certain George is solely responsible for the visits to escort sites, and KC is uninvolved in that surfing activity."

Hoo-boy! Cindy isn't going to like this at all!

By the way, JWG, nice signature line.......... and nice photos in your profile!

Agree 100%, this is where George spent the money not the Nigerian Email Scam.

 

[DiDi]

First and foremost, thank you for this great sleuthing - I was beginning to lose faith in why I'm still here, but posts like this remind me of exactly why!

I absolutely don't think Tony started any type of cover up for Casey - I do think as suggested that his head was swirling with all the deceit he just found out about. Now question, or thought. If he just pushed the power button on the laptop ( he's upset with what he's finding out, fed up, just turns it off) would that cause the blue screen of death?

 

[per_curiam]

So, you think it is George going to the escort site? Do you think he is looking for services, or he's just there to, er...choke the, er...chicken? :hen:Either way, I'm already laughing at Cindy's future response to this one. :thewhip:

 

[ElizaAvalon]

JWG - do we have collaberation between Lee and Tony that, in fact, Lee arrived at Tony's at midnight?

The Internet history smells more like Lee's work to me than Tony's. I see Lee having more of a motive to want to access KC's cellphone records based on the information he got at home re: the "missing" blackjack.

 

[ElizaAvalon]

Thanks Shannon. Muzikman supplied this to me and it is a match. Tony was somehow able to get into her myspace.

She probably was always logged in.

 

[Shannon33]

Does anyone know what Sales.Liveperson.Com is? It looks to be a website that you can speak with professionals of all different topics on?

Also has anyone else noticed on 7/16 there was a search for AIDA FERNANDEZ... that is strange to me - I have never seen reference to that name.

 

[CapsDeej]

She probably was always logged in.

MySpace will remember your ID but not your password - you have to type that in every time. (at least I do)

 

[ElizaAvalon]

MySpace will remember your ID but not your password - you have to type that in every time. (at least I do)

The browser could have still been open. Then she could still have been logged in.

I can't download Muzikman's doc so that I can check it out myself.

 

[Hot Dogs]

The browser could have still been open. Then she could still have been logged in.

It seems the computer was powered off when Tony got to it...

the computer is powered on by Tony

 

[JWG]

The browser could have still been open. Then she could still have been logged in.

I can't download Muzikman's doc so that I can check it out myself.

Not sure exactly how the laptop internet history got trashed in the process of Tony "cleansing" KC's accounts of images / messages that upset him, but it appears it did because there is very little activity shown pre-7/14, yet we know she was uploading to Photobucket quite frequently (as well as posting on FB and MS).

With that preamble, I am not seeing a previous instance of a myspace visit in the notebook history.

Also, the sequence of visits begins with three visits to
http://www.myspace.com/
followed 11 minutes later (after attempts to get into FB and then a pause by a visit to:
http://home.myspace.com/index.cfm?fuseaction=user

This kind of implies to me that there were a couple of failed password attempts before success. That said, if KC never closed her browser and never shut down her laptop (put it to sleep only), Tony could have clicked into her myspace home page directly from the myspace main page. I just cannot tell which is which, and I'm not seeing an older access to myspace.

What is clear is he does eventually get into her Facebook and Photobucket after many failed attempts, so somehow he figured out her password or found it on the system.

 

[JWG]

It seems the computer was powered off when Tony got to it...

It seems that way, because AIM is the first thing that launches (accesses the internet) on the 15th - it looks like an application launch on boot, or an application access to the internet after waking up from sleep mode. Then nothing happens for a while, further solidifying this opinion.

 

[DazzlinDebSD]

Last week I turned my laptop on, and oops......I got a blue screen. I called Sony Vaio and spent over an hour on the phone with a guy from over seas. Long story short after paying $39.95 for tech support, and $19.95 for the recovery CD's I took the 18 month old laptop into a shop with a good reputation close by where I work. Diognosis....fried hard drive, recovery not even possible.

I went home and started a fire in the firepit in my yard and torched the old hard drive, lol. It felt good knowing that every skull, chloroform search, and every thing I've ever stumbled upon in that 18 months is gone for good. Since this case I've deleted my facebook, and myspace. When I go on Craigslist to the rants and raves section I never open a link because it may have a nasty picture in it. Everything I do on my PC, I think twice about it!!!! Thanks you Casey Anthony!!!

 

[awakewriter]

SNIPPED:

Following is the raw data for the visits in question:

07/16/2008 14:51:37 06/24/2008 16:01:46 http://www.missingkids.com/photographs/NCMC1097725c1t.jpg
07/16/2008 14:51:31 07/03/2008 01:28:12 http://www.missingkids.com/photographs/NCMC1099693c1t.jpg
07/16/2008 14:51:25 07/10/2008 11:37:33 http://www.missingkids.com/photographs/NCMC1096469c1t.jpg
07/16/2008 14:51:24 05/27/2008 12:58:47 http://www.missingkids.com/photographs/NCMC1096536c1t.jpg
07/16/2008 14:51:24 04/24/2008 16:06:48 http://www.missingkids.com/photographs/NCMC1094062c2t.jpg
07/16/2008 14:51:24 04/24/2008 16:06:48 http://www.missingkids.com/photographs/NCMC1094062c1t.jpg
07/16/2008 14:51:24 05/03/2008 17:07:29 http://www.missingkids.com/photographs/NCMC1094659c1t.jpg
07/16/2008 14:51:24 06/23/2008 15:30:12 http://www.missingkids.com/photographs/NCMC1098504c1t.jpg
07/16/2008 14:51:24 04/24/2008 16:06:48 http://www.missingkids.com/photographs/NCMC1094062c3t.jpg
07/16/2008 14:51:24 06/24/2008 14:14:01 http://www.missingkids.com/photographs/NCMC1098088c1t.jpg
07/16/2008 14:51:24 07/02/2008 19:50:00 http://www.missingkids.com/photographs/NCMC1099149c1t.jpg
07/16/2008 14:51:24 07/01/2008 00:06:13 http://www.missingkids.com/photographs/NCMC1099410c1t.jpg
07/16/2008 14:51:24 03/17/2008 15:47:48 http://www.missingkids.com/photographs/NCMC1091268c1t.jpg

07/16/2008 14:51:24 04/10/2007 12:29:03 http://www.get-involved.com/mashup/marker.swf
07/16/2008 14:51:22 http://www.get-involved.com/mashup/RSS_Read.php?state=XX
07/16/2008 14:51:22 http://www.get-involved.com/mashup/RSS_Read.php?state=XX
07/16/2008 14:51:21 06/19/2007 06:32:24 http://www.get-involved.com/mashup/map_small.swf
07/16/2008 14:51:20 04/26/2007 08:04:49 http://www.get-involved.com/mashup/images/kids_widget_04.gif
07/16/2008 14:51:20 04/26/2007 08:04:48 http://www.get-involved.com/mashup/images/kids_widget_01.gif
07/16/2008 14:51:20 04/26/2007 08:04:49 http://www.get-involved.com/mashup/images/kids_widget_05.gif
07/16/2008 14:51:20 04/26/2007 08:04:49 http://www.get-involved.com/mashup/images/kids_widget_02.gif
07/16/2008 14:43:09 http://www.get-involved.com/mashup/RSS_Read.php?state=XX

There are a few things to note about each item listed. First, the items are objects on the website, such as an image (.gif or .jpg) or shockwave video (.swf). The web browser will store the objects on the computer so that the next time the website is visited, it will appear to load faster than the first time. This is called caching.

The date / time shown in red indicates when the object was accessed by the web browser. This is indicative of when the website was surfed.

The other date / time (if there is one) indicates when the object was last modified by whoever created it or otherwise owned the object. Using an image, for example, this date / time could indicate when the picture was taken, resized, photoshopped...you name it. It is often indicative of when the web page was created or modified. It is not indicative of when the web page was surfed.

Unfortunately, the media saw the old dates and assumed that they were surf dates. LE did not make that assumption. There is nothing in the complete forensic report that indicates they ever thought this was something to look into.

I should further point out that the sites were visited from the laptop computer and not the home computer.

So what really happened? :waitasec:

Recall that Lee picked up KC's computer on the evening of the 15th from Tony's. (I will need to post later on the activity beginning late that night, but in an attempt to keep this post to under five pages, I will stay on topic. )

Sometime during the afternoon of the 16th the "cayleeismissing" myspace page goes live. This page becomes a missing person's website - Caylee's. Work on this page occurred between 2:37 PM and 2:52 PM on July 16th - completely encompassing the time the missing person's sites were accessed.

Given KC was pre-occupied during this time, the best candidate for this activity is ... Lee. He was just trying to get Caylee's name out there as a missing person. :angel:

What about searches for chloroform!?! Did they really happen before Caylee's death?!!???

This is fantastic work!

 

[marbrit]

Thank you so much for all your hard work JWG and Muzikman! I appreciate the very hard digging and exposing of stories.

 

[lawlady84]

I have to wonder if George's Nigerian internet scam was really money going to escort services?? hmmmmm.....


JWG - You always continue to amaze me!! Thank you for clearly showing what happened with her computer.

I would like to see what time Lee's calls to TonE came in.....and for how long they talked.

The only statement you made that I'm not 100% certain of is that TonE ACCIDENTALLY caused the blue screen.

LA could have called TonE and told him KC was in a lot of trouble and to please start deleting.....and he would be over soon to pick up her stuff.

TonE definitely gathered KC's things and probably folded them and packed her bags -- good riddance after what he saw on her computer.

I'm hoping the taped meeting between LA and TonE will give us a better understanding of what exactly happened that night.

First, GREAT work everyone! JWG & Muzik you both are fantastic- I hope LE is this savy with this data as you two are.

I agree JWG, I think Tony probably saw "flirty" messages from WW, and then heard KC wiped out Amy's bank account - and was floored. IMO he was probably furious and automatically wanted to check KC's accounts to see if there were any "Tony's a joke, I'm stealing from him ahah" type of posts.

I don't think the deleting was anything but either out of anger, or "I want nothing to do with this $*&#&% I wish I never met her" - virtually erasing her from his life. Also I really highly doubt that there was a Lee/Tony conspiracy to delete, because at that point for all Lee knew KC could have just been being a brat - and Caylee could have been actually safe with someone. At this point KC just said "I haven't seen her" - knowing KC, Lee could have thought she was causing the scene just to spite Cindy but that everything was actually okay.

So soon after the fact I'd think that Lee would want to see all of the information from KC's computer he could - to try to figure out what happened. If this was a week later, I'd buy more of the cover-up angle. But I don't think Lee would just trust Tony "hey man delete everything but tell me what it said."

 

[rice09]

MySpace will remember your ID but not your password - you have to type that in every time. (at least I do)[/

Unless you LOG off, myspace will stayed logged in if you have a window open. I can check myspace all day long when i have a window open. Once all your windows are closed it will automatically log you off.

 

[RR0004]

I will try to answer RR0004. magic-cat, and shgrbkr in this post.

First, I will point out again that the computer was left at Tony's when Cindy came over to get KC, as were KC's clothes and other belongings.

Based on the fact that the computer was booted around 10:15 and activity ceased just before midnight, it is clear that Tony was the one on the computer and not Lee. Lee was still at his parents. Lee arrived at Tony's around midnight and left around 2:00 AM.

Lee did say in his interview that he called Tony in advance to tell him he was coming over to get KC's stuff. Given that Lee had to this point never met nor spoken to Tony before, I think it is highly unlikely that the two of them immediately launched into a conspiracy to protect KC.

Trying to connect the dots and put myself into the player's minds that evening of July 15, what I think happened is...

Tony calls KC's phone at 8:22 PM in an attempt to try to find out from KC what was going on between she and her mother. However, KC had left her phone at Tony's, and he locates it in the process of calling her.

At 9:12 a text comes in from Will W. At 9:27 Tony attempts to call Amy on KC's phone but does not reach her. At 9:35 another text comes in from will and at 9:37 one comes in from Andy F. It is possible that Tony sees these and decides to take a peek at KC's other texts, and discovers quite a few messages that cause him to question KC's fidelity. :waitasec:

Another attempt to call Amy is made at 10:07, immediately followed by a call from Mark H. that goes to VM. Tony calls Amy again and they connect. This is when Tony learns KC cleaned out Amy's bank account.

Ya think maybe Tony's a little bit suspicious of this girl KC now? :sick:

He flips open her laptop and tries to get into her ATT account to see who she might have been calling. Based on the links to "forgotten" or "lost" password on that site, he is not successful.

Next he looks at her browser history to get a sense of where she's been. He notices that the "lava life" dating site had been visited so he goes there to see if he can figure out how to view her profile. It looks like he registered in order to do this.

Tony tries to get into her Facebook, but cannot.:banghead:

Next he tries myspace and is successful logging into her account (thanks Muzikman for digging up her numeric ID - it matched!!!). :dance: Tony spends 10 minutes looking through LOTS of profile comments and mailbox messages, and I am guessing what he sees only makes him that much more upset with her.

Sometime during his viewing of KC's myspace he figures out how to get into her Photobucket and Facebook. For the next hour he is viewing photos on both sites and messages / photos on myspace. I am guessing that what he sees infuriates him, and out of anger starts deleting stuff that upsets him. :furious:

Remember - he does not know at this point that Caylee is missing. He only knows his girlfriend is a thief and a cheat.

Somewhere along the way, in the process of deleting material, Tony accidentally corrupts a system file. This is what causes the blue screen of death. About the time this happens he gets a call from Lee who is headed over.

So Tony gathers up KC's belongings, folds them and stacks them neatly, and waits for Lee to arrive to get that woman's stuff out of his house.

Thanks JWG for all the info!!

 

[Dr. Know?]

Snipped from JWG. Thanks as you and Bond and many others are amazing.

"Not sure exactly how the laptop internet history got trashed in the process of Tony "cleansing" KC's accounts of images / messages that upset him, but it appears it did because there is very little activity shown pre-7/14, yet we know she was uploading to Photobucket quite frequently (as well as posting on FB and MS)."

Reply:

I have and older HP and they have a restore point which is to safely restore your computer to a saved restore point in case you have a problem or virus etc... I remember in the beginning that LA said something like everything from the 15th of June to the time he turned it over to police was gone (July 15th or 16th). Yahoo accounts etc. Was that disproven? Sorry, I kind of worked with computers in my day and try not to read this thread. Too much like my old work!

Also, I would think, and again I am sorry for not reading this thread close enough, but doesn't anyone else remember DOS codes? I remember the f/xxxx to wipe out everything. Easy blue screen of death possibly. I have not tried it on my newer computers but 5 years ago, yes and it still worked if needed.

Anyone else that old? J/K

 

[Dr. Know?]

Oh and if it was an older computer, even upgraded, you could go to the command and do an f/xxxx. Gone, baby, gone. Almost...Please accept my apologies as I know so many of you are smarter than I am. I am old school.