Anthony's Computer Forensics

Nice work Bond! :thumb:

I wanted to note a couple of things. First off you are correct that KC posted the following message on Amy's wall on 6/17 at 3:15 PM: cheer up me lady! i love you and can't wait to finally get you moved in

Second...the percentages used are from me, and not from the actual encase report. I was trying to show relative usage between different time periods for the two computers on the two days given. The highest usage was between 9 and 10 PM on June 17 on the laptop. There were 300 file touches during that time window, or an average of one touch every 12 seconds. A number of 65% represents 195 file touches.

Lastly, as an FYI only, the Photobucket uploads, I learned in a recent document dump, are time-stamped Central Time. Thus, the assumption that Caylee napped 1 - 3 PM based on the upload patterns might be more correct as 2 - 4 PM. Just a thought.
 
Nice work Bond! :thumb:

I wanted to note a couple of things. First off you are correct that KC posted the following message on Amy's wall on 6/17 at 3:15 PM: cheer up me lady! i love you and can't wait to finally get you moved in

Second...the percentages used are from me, and not from the actual encase report. I was trying to show relative usage between different time periods for the two computers on the two days given. The highest usage was between 9 and 10 PM on June 17 on the laptop. There were 300 file touches during that time window, or an average of one touch every 12 seconds. A number of 65% represents 195 file touches.

Lastly, as an FYI only, the Photobucket uploads, I learned in a recent document dump, are time-stamped Central Time. Thus, the assumption that Caylee napped 1 - 3 PM based on the upload patterns might be more correct as 2 - 4 PM. Just a thought.

:fish:"...Running over the same old ground.
What have we fo-u-nd?
" :fish:​

Thanks, JWG. Updated above to reflect all but the % thing. I understand what you mean...I'm just kinda pressed for time @ the moment. I'll try to clean that up later on.
 
I have not placed too much in the chloroform searches, as I still seriously doubt KC would go to the trouble of acquiring chloroform. However, I am intrigued by the little ad that popped up first as possibly planting a seed in KC's little mind ...

How would that tie into it being on RM's computer? You mean, as a suggestion, that KC first saw it on RM's page and then was researching and while researching that ad popped up and one thing lead to another?

Sorry - just read backward on the thread. RM put the chloroform joke (ha ha) on his page after someone had been searching for info on it on the A's desktop on Mar 17. RM posted it to his computer on Mar 18. Ummmm. More research about chloroform was conducted from the A's computer on Mar 21. KC was talking to RM on the phone in tandem to researching chloroform. Interesting that RM can't offer up more insight as to what all this was about. He got the idea from KC? Could he have been with KC at her desktop?
 
If I am not mistaken, one could buy the ingredients needed to make chloroform over the Internet using a credit or bank debit card ... could they not?
 
Maybe RM came over for a little afternoon delight on his lunch hour and KC could not get Caylee to go down for her nap, so RM began to look for a solution to the problem for the next time he wanted have a quicky with KC.

Actually, as farfetched as that sounds, it kindof fits with the nature of what we know about KC's relationships. Win her over with chloroform by using it to eliminate the unwanted audience for a short period of time. :eek:
 
If I am not mistaken, one could buy the ingredients needed to make chloroform over the Internet using a credit or bank debit card ... could they not?
Yes.

The adept chemist could buy them in the grocery store for the price of a six-pack or two.
 
Considering Casey was stealing from her family, friends and according to George, even looting little Caylee's piggy bank, I wouldn't be surprised if Casey wasn't using her mother's credit cards to make purchases online in addition to any purchases she might have made locally. Just wondering if the computer forensics team would have uncovered these transactions or whether it would be investigated through another law enforcement agency such as the FBI.
 
If she ordered online chemicals would have needed to be delivered.
LE should check with mail service for large parcels? Especially labelled "Hazardous Chemicals"
 
Good thinking Hercule Poirot! Wonder if the Anthony's mail delivery person has been interviewed.
 
On Dec. 18 I posted an opinion [ame="http://websleuths.com/forums/showpost.php?p=3077024&postcount=134"]that the March chloroform searches were coincidences and unrelated to Caylee[/ame]. The main reason I thought this was that the searches occurred in a very short time window and included a visit to an unrelated site. Sort of "stream of consciousness" surfing, IYKWIM.

At the time I had thought that KC's searches were prompted by seeing the "Win her over with chloroform" image on Ricardo's myspace. That made sense...until that pixie Nancy Botwin :elfroll: gave me a link to a screenshot of his Facebook page showing an upload date of March 18 - the day after the first searches. :eek: Still, I figured that the two of them could have surfed the web together just a couple days earlier and found the image. They had a good laugh, and while Ricardo loaded it to Facebook...KC went off to figure out what chloroform was. :help:

Then I read and listened to Ricardo's latest interview, and he said something that caught my attention: He never discussed chloroform or the image with KC. There goes my theory... :bang:

Or does it?

In that interview Ricardo also mentioned that he uploaded the image to his myspace in early 2008 because he thought it was funny. Could he have meant earlier than March 18? It was then that I realized Ricardo was talking about myspace and the screen shot we had was of Facebook. :doh:

Like KC and many others, Ricardo had both.

Now it made sense. The chloroform image was floating around myspace in early 2008, as I quickly found it posted on a number of pages with dates from early January to mid-March, 2008. :sleuth: I believe Ric ran across it on one of those myspaces sites and posted it to his own. This posting occurred before March 17. A few days later, he cross-posted it to his Facebook.

On March 17, KC sees the image and wonders what is chloroform? :waitasec: Old people like me know what it is, but ask a senior in high school (such as my honors-student daughter) what it is, and most will have heard of it but not know what it is. I am betting KC fell into that category.

Here are the clicks from March 17:

17-Mar 9:36:12 Clicked a Google-hosted ad from a myspace page
13:43:41 Search chloraform
13:43:41 Search chloroform
(Google automatically suggested correct spelling)
13:54:26 Search alcohol
13:54:42 Search acetone
13:55:34 Search peroxide
13:53:25 to 13:58:38 Wikipedia searches for inhalation, chloroform, alcohol, acetone, peroxide, hydrogen peroxide, death


One should note that KC uses the default 10 results per page, and only once does she look at results 11 - 20. Using such generic terms and spending so little time between term, I believe she is doing nothing more than very high-level information gathering. At least that is all I got when putting the above into Google searches (adding -anthony).

Now let's look at the clicks on March 21:

21-Mar 14:16:30 Search how to make chloraform
14:16:30 Search how to make chloroform (Google automatically suggested correct spelling)
14:19:16 Clicked a Google syndicated ad
14:20:32 Search self defense
14:21:14 Clicked a Google syndicated ad
14:21:58 Search household weapons
14:22:01 Clicked a Google syndicated ad
14:23:08 Clicked a blog poll hosted by Google http://www.google.com/reviews/polls/...kclr=%235588aa
14:25:12 Clicked a Google syndicated ad
14:25:33 Search household weapons
14:25:54 Clicks http://books.google.com/books?id=_QMJNJIOKPEC&pg=PA79
14:26:18 Clicks http://books.google.com/books?id=_QMJNJIOKPEC&pg=PA79
14:26:24 Search neck breaking
14:28:18 Search shovel


Notice that one of the links is a women's self-defense book (visited twice) and the other is a zombie poll. :mummy: All of this "research" was done in the span of 12 short minutes...and we do not know what other non-Google websites were visited.

IMHO KC did not do anything with chloroform. However, the searches did plant a seed on how to deal with her "Caylee problem". :furious:

"What was the problem JWG", you ask? :waitasec:

IMHO, Caylee was napping inconsistently. She would not go down easily. Her changing sleep patterns were causing her to behave poorly at times (it is what we used to call the "terrible twos"). While KC could foist Caylee off on Cindy many nights, daytime was KC's problem.

She read the parenting books and the advice to hold the line on tantrums. Then, as she is researching chloroform for a completely unrelated reason, she notices the Google ad-sense ad that says: Get Your Baby to Sleep.

View attachment 3203

About 2 months later KC and Caylee both get sick, see the doctor, and get meds. KC discovers the meds...help...Caylee...sleep.

Stream of consciousness....
 
Thanks as always JWG. :clap:

Obviously KC did do this very fleeting research on "C" so both LE and us amateurs had to see where it might lead.
Frankly I think it has lead NOWHERE.
As I have said before: even if (big if) KC did use chloroform (or OTC meds), the only hope of proving it was in toxicology results from Caylee's remains. Since these results have been released, showing no drugs or "C" IMO it is not a viable theory for prosecution to pursue.
However we do have the body of a 2 year old found with a 2" strip of tape still in place across mouth (and nose). I would think that would be a good "Cause of Death" to argue before a Jury?
 
Thanks as always JWG. :clap:

Obviously KC did do this very fleeting research on "C" so both LE and us amateurs had to see where it might lead.
Frankly I think it has lead NOWHERE.
As I have said before: even if (big if) KC did use chloroform (or OTC meds), the only hope of proving it was in toxicology results from Caylee's remains. Since these results have been released, showing no drugs or "C" IMO it is not a viable theory for prosecution to pursue.
However we do have the body of a 2 year old found with a 2" strip of tape still in place across mouth (and nose). I would think that would be a good "Cause of Death" to argue before a Jury?

Agreed Hercule...no chloroform involved in death.

I am still undecided about the duct tape. Given KC kept the body in the trunk nearly three days tells me she was hesitant to part with it. The duct tape may have been used to prevent decomp fluid from continuing to seep into the trunk, thereby prolonging her ability to keep it in the trunk?
 
Agreed Hercule...no chloroform involved in death.

I am still undecided about the duct tape. Given KC kept the body in the trunk nearly three days tells me she was hesitant to part with it. The duct tape may have been used to prevent decomp fluid from continuing to seep into the trunk, thereby prolonging her ability to keep it in the trunk?

Ok! See, I have always agreed that the tape may have been placed on her to keep the fluids from leaking, but I can't wrap my brain around her handling her child that has been dead for 2 or 3 days now and is starting to decompose! That is just....so....gross! I can't see how she could do that! But, then, I can't see how she could kill her own child, so......
 
Ok! See, I have always agreed that the tape may have been placed on her to keep the fluids from leaking, but I can't wrap my brain around her handling her child that has been dead for 2 or 3 days now and is starting to decompose! That is just....so....gross! I can't see how she could do that! But, then, I can't see how she could kill her own child, so......

Getting a bit OT for computer forensics.

I'll move this to Theories about Caylee thread:

http://www.websleuths.com/forums/showthread.php?p=3728890#post3728890
 
I'm not so sure KC didn't have a purpose in mind when she googled chloroform. After all, she does stand accused of murdering her 2 year old child and using the trunk of her car to secrete the body until she could dispose of it. I think we will hear more about computer forensics in the coming weeks.
 
Please direct me to any info related to the registered owner of Casey's laptop before I completely lose my mind.....:Banane13::Banane13: (spent the whole morning looking in media documents):boohoo:
After going over a list of key players I noticed a "Bobby" who apparently was Casey's tattoo artist.
Is there a connection with the "bobby" whose computer files are on the laptop? Was this previously his computer or are these files that he shared with Casey?
 
Please direct me to any info related to the registered owner of Casey's laptop before I completely lose my mind.....:Banane13::Banane13: (spent the whole morning looking in media documents):boohoo:
After going over a list of key players I noticed a "Bobby" who apparently was Casey's tattoo artist.
Is there a connection with the "bobby" whose computer files are on the laptop? Was this previously his computer or are these files that he shared with Casey?

IKWYM, Lucky. Here's a link to a thread search on this thread for the keyword "Bobby". It returned 9 posts. I'm sure one of them will give you the answer.

HTH.
 
OK...first things first.

Note that the Encase report shows for the laptop on Tuesday, 6/17:
2-3PM: 80% activity (e.g. perhaps 48 minutes)
3-4PM: 0% activity

*cropped just to get a talking point*

BJB and JGW, I have a question. The table that you posted, JGW, was that created by you? If not, can you link me to the source? If so, how did you determine "percents"?

Also, let's talk about the EnScript Timeline view. That is showing file activity. If we were able to view the actual screen, the files would show in different colors according to whether they had been created, modified, deleted, etc. Each square under a timetag represents a file that was active in some regard.

It appears they split each hour into 3 20-minute intervals and then place the files into the respective 20 minute time sector. I'll get back with you in a bit on this. Please ignore me if I'm telling you something you already know. :p
 
*cropped just to get a talking point*

BJB and JGW, I have a question. The table that you posted, JGW, was that created by you? If not, can you link me to the source? If so, how did you determine "percents"?

Also, let's talk about the EnScript Timeline view. That is showing file activity. If we were able to view the actual screen, the files would show in different colors according to whether they had been created, modified, deleted, etc. Each square under a timetag represents a file that was active in some regard.

It appears they split each hour into 3 20-minute intervals and then place the files into the respective 20 minute time sector. I'll get back with you in a bit on this. Please ignore me if I'm telling you something you already know. :p

Val, I hafta scoot, but, quickly...

The version of the Encase report you see in the posts is one JWG transcribed so it could be posted. The actual Encase report is in the released docs (a screenshot of it anyway). Sorry I don't have a link handy @ the moment.

ETA: [ame="http://www.websleuths.com/forums/showpost.php?p=3033912&postcount=94"]Post #94[/ame] this thread gives all the details, incl. pagenums from the released docs for ref... and the original transcription via JWG.

Ditto, "Please ignore me if I'm telling you something you already know." :)
 

Members online

Online statistics

Members online
104
Guests online
774
Total visitors
878

Forum statistics

Threads
596,479
Messages
18,048,409
Members
230,011
Latest member
Ms.Priss74
Back
Top