April 29 weekend of Sleuthiness

[momof7]

Did you not see court video yesterday? They didn't have the money to pay experts. Additional funds were denied. There is your logical explanation for not using the other 2 experts that were on their list. Again JW and GM were both pro bono.

I have not gotten to yesterday's testimony. That is bothersome in its entirety. Are we are aware what the criteria is for getting additional funds?

It is becoming more clear to me that I am not on the fence about anything when I take what has been presented so far clearly into account.

Kelly

 

[ncsu95]

So, in other words, she was the link to all the missing items. Not necessarily found them but knew where they were?

Thanks!

I had deleted my post because someone else answered it better. But when were BCs phone and the necklace ever missing? You keep saying that but I have no idea where you get that from. The only thing "missing" according to the CPD and the prosecution were the ducks, and even they weren't missing. They were in the house the whole time (past when BC was arrested) and CPD had complete access to that house. My guess is the "missing shoes" were in the house too. If I was Kurtz, I certainly would point that out. There is a difference between "missing" and "not looked for".

 

[SleuthinNC]

You think she bought ribs, wine, and what seemed to be a bunch of other things for $20? The testimony of friends was that she had no money that day because BC didn't give her any, now you want us to believe he gave her some to tide her over?

She also bought sandwiches at Village Deli for herself and HP for lunch, but of course she had no money.

 

[macd]

A couple of things I'm wondering about with the new router info. showing up on the event log:

1)Are we *sure* the router was supposed to be in the home? I know BZ said that, but I don't trust his word. IF the router was supposed to be in the home, why did Cisco do a complete search of the labs looking for it?

2) IF BC was hooking up this separate router to plan to spoof the call, why would he use the Thinkpad, knowing it would be the main thing they would look at for evidence? Even, why not the home computer?

3) Does the information on the "event log" showing the router used match the router identifiers from when we know it was in use in Jan/Feb '08? That would be good to know.

1) Doesn't matter where it was supposed to be. Windows system event log will show that it was connected locally.
2) Which computer BC used was not the worst decision he made that night. I'm not going to debate how good a job a he did constructing a false alibi as part of proof he did or did not construct a false alibi.
3) The MAC address is burned into the router at manufacturing time. It does not change. There are 300 trillion possible mac addresses, if someone wants to start a spoofed mac address discussion.

 

[momof7]

I had deleted my post because someone else answered it better. But when were BCs phone and the necklace ever missing? You keep saying that but I have no idea where you get that from. The only thing "missing" according to the CPD and the prosecution were the ducks, and even they weren't missing. They were in the house the whole time (past when BC was arrested) and CPD had complete access to that house. My guess is the "missing shoes" were in the house too. If I was Kurtz, I certainly would point that out. There is a difference between "missing" and "not looked for".

You are correct, my understanding was they were being looked for and I took that as 'missing'. Just a different take on what initially was offered. I was initially under the understanding no one knew where the cell phone was and it was found later with or by BC's mom. So I interpreted them as missing, but I was also 'assuming' they had been looked for. I see now, with further information there is a good chance that the 'looking' was an assumption.

Kelly

 

[macd]

You can disagree with me, but DON'T tell me "watch that part again".

I don't need to watch it again. Everyone knows JW discussed the size of the router. That was it. The rebuttal should only be related to the size of the router, not log files!

I apologize. I agree with your point here. Everyone knows what was said. Even the judge. It's his job to know and he was looking at a copy of the transcript.

The judge was not tricked.

 

[SleuthinNC]

I mean this with all respect, but to say someone is obfuscating the truth implies that you actually know what it is, beyond a shadow of a doubt. There are very few absolutes, and the truth is an enormous gray area containing lots of room for perception. In fact, if truth was as easy to grasp hold of as all that, sitting right there in front of our faces, we'd not have a trial and we'd not be having this conversation.

Saying things like JW talked about CSA logs, so we should be able to talk about CSA logs, CF works at Cisco, he's not testifying as an expert (JW was which is the only reason he was allowed to talk about the CSA logs) so it's ok for him to just chat about CSA logs and oh by the way, the relevant information didn't actually come from the CSA logs, but just listen to what CF has to say, it'll be OK.

Not what I would call truthfully putting evidence before the court.

 

[macd]

The ADA clearly doesn't understand the tech. of computers, that's why he called on the witness for clarification. He was stumbling over his explanations, IMO, because he is NOT TECH smart. I saw only respect for the judge. (From both sides...)

Good point. I think the judge is more tech savvy than the ADA.

The judge got clarity on the points he wanted clarity on:
1) Where was the original windows system event log? (On BC's hard drive)
2) What is this router code? (Burned in unique address, kind of like a serial number. Judge compared it to cell phone unique identifiers.)

These are two of the main points that the judge based his ruling on.

 

[macd]

I have not gotten to yesterday's testimony. That is bothersome in its entirety. Are we are aware what the criteria is for getting additional funds?

It is becoming more clear to me that I am not on the fence about anything when I take what has been presented so far clearly into account.

Kelly

That was a sticky part of discussion.

BZ crossed the line with one statement. He said the defense could not call on their expert witnesses because they looked at the evidence and could not draw any conclusions that would be helpful to the defense. T said that was false and they just ran out of money. (one poster here said they blew their wad on jury selection.)

 

[Cheyenne130]

I understand the fine points being made about JW testifying and CF testifying. It would actually be better to compare the AT&T guy testifying but not as an expert and CF. CF is the security guy at Cisco. Cisco is where Brad worked. The job that CF is charged with involves looking at these logs and files. As he is the/a security guy at Cisco. I would love to hear his explanation for how malware got on a secure computer.

 

[ncsu95]

I am ignorant with all these technical details and don't really know how to ask this question but here goes... on my home network/computer I have a printer and my computer has drivers for said printer. Even when my printer isn't connected to the network software still tries to find it when a print is attempted. Are these attempts to find that printer logged? If so, is it obvious in the logs that the attempt failed? Would this same type of thing happen (attempt/fail) if a router had been configured for use but then disconnected? Could the 7/11 log entry be an attempt rather than actual use?

No, it sounded (from the little that was broadcast) like an IP address confliction. The thinkpad would be set to use dhcp, which means it is dynamically assigned an IP address by the home router (not the 3825). If the 3825 was connected when the thinkpad wasn't, it could have been assigned the IP address the thinkpad usually gets. Then the thinkpad, when it connects, could try to obtain the same IP address, but would be told that there is a conflict with the 3825 since it already has that address. Of course, I could be way off on this, so somebody please correct me if I am wrong.

If this is what happens, it would explain why there was only 1 event log. Since the thinkpad would then get a different IP address, there wouldn't be future conflicts with the 3825. So, theoretically (again, someone correct me if I am wrong), he plugged the 3825 into the network the night of the 11th, then turned his laptop on, which had the conflict and needed to get a new IP address via dhcp. Then you wouldn't see anything else about the 3825 because both would now have valid IP addresses.

 

[ncsu95]

Watch that part again. Judge was looking at the JW transcript and saw what JW testified to. The judge prompted Trenkle to come clean that routers were discussed in the defense case.

Only the size of the router was discussed. That's it. Network activity concerning routers was not discussed.

 

[Danielle59]

I guess no money is relative. If she spent her last $20 at the store, she had no more money. BTW, $20 to supply groceries for a family of four is NOTHING...as I'm sure yaw'll know.

First, she had not been buying groceries for four for a long long time, she was only buying groceries for her and the children and BC was still picking up incidentals. Her Divorce attorney testified that NC wrote her many months back and said BC bought his own groceries.

She was at the store just before 3PM, she had been calling BC all day before that because of no money is the understanding, so why would she do that if she had money?

I also doubt that she spent less than $20 on what she bought considering she was buying ribs for a party full of people and we also saw she bought wine during that trip plus some other items.

I know many think he is guilty, but I think it is important that we don't embellish evidence that is before us to make the case.

 

[ncsu95]

Another issue upon which to agree to disagree...I have no preconceived notions about NC justice, the specific individuals, etc. I attended college in NC years ago. I do not know anyone now. My dad was a judge; my daughter is a lawyer. I watched the video on WRAL. I DO have a pretty good hinky meter.

The ADA clearly doesn't understand the tech. of computers, that's why he called on the witness for clarification. He was stumbling over his explanations, IMO, because he is NOT TECH smart. I saw only respect for the judge. (From both sides...)

BTW, not being totally familiar with NC laws, I do have an understanding that evidence is allowed to be submitted until the time the case goes to the jury. If this isn't so, would you please refer me to the NC statutes forbidding this.

Not specifically directed at you, but I am seeing and hearing some frustration and bias in comments about this ruling. That's natural...I guess. However, if one is seeking real justice, shouldn't we see and hear all the evidence?

But that is where the frustration comes in. We aren't hearing all the evidence. The defense was denied the opportunity to present their witness because of the whole expert question. I think all of us expressing frustration are expressing it due to lack of fairness, not wanting to keep the information out.

 

[ncsu95]

I have not gotten to yesterday's testimony. That is bothersome in its entirety. Are we are aware what the criteria is for getting additional funds?

It is becoming more clear to me that I am not on the fence about anything when I take what has been presented so far clearly into account.

Kelly

It's even worse than that....the prosecution team made a snide comment about not using their witnesses. That's when the defense called them unethical and said they knew they couldn't because they didn't have the money to do it. In fact, earlier in the week, Trenkle offered to pay for it himself.

 

[ncsu95]

Saying things like JW talked about CSA logs, so we should be able to talk about CSA logs, CF works at Cisco, he's not testifying as an expert (JW was which is the only reason he was allowed to talk about the CSA logs) so it's ok for him to just chat about CSA logs and oh by the way, the relevant information didn't actually come from the CSA logs, but just listen to what CF has to say, it'll be OK.

Not what I would call truthfully putting evidence before the court.

Yeah, he did throw the whole csa log discussion out there. I was glad the judge asked him if it came from the csa log, which Boz had to admit that it didn't. But he was twisting this stuff left and right before the judge.

 

[Cheyenne130]

Only the size of the router was discussed. That's it. Network activity concerning routers was not discussed.

What was the defense point in bringing up the size of the router required to operate with an FXO port?

 

[ncsu95]

I understand the fine points being made about JW testifying and CF testifying. It would actually be better to compare the AT&T guy testifying but not as an expert and CF. CF is the security guy at Cisco. Cisco is where Brad worked. The job that CF is charged with involves looking at these logs and files. As he is the/a security guy at Cisco. I would love to hear his explanation for how malware got on a secure computer.

But he isn't a forensic expert. And that was what prevented JW from talking about the same logs. So just because he works at Cisco, that means he is qualified to talk about network related logs that a network security expert is not qualified to talk about?

 

[Cheyenne130]

But he isn't a forensic expert. And that was what prevented JW from talking about the same logs. So just because he works at Cisco, that means he is qualified to talk about network related logs that a network security expert is not qualified to talk about?

On Cisco's own network, yes. Just as the AT&T guy was able to testify to his company's log's and records.

 

[Danielle59]

Another issue upon which to agree to disagree...I have no preconceived notions about NC justice, the specific individuals, etc. I attended college in NC years ago. I do not know anyone now. My dad was a judge; my daughter is a lawyer. I watched the video on WRAL. I DO have a pretty good hinky meter.

The ADA clearly doesn't understand the tech. of computers, that's why he called on the witness for clarification. He was stumbling over his explanations, IMO, because he is NOT TECH smart. I saw only respect for the judge. (From both sides...)

BTW, not being totally familiar with NC laws, I do have an understanding that evidence is allowed to be submitted until the time the case goes to the jury. If this isn't so, would you please refer me to the NC statutes forbidding this.

Not specifically directed at you, but I am seeing and hearing some frustration and bias in comments about this ruling. That's natural...I guess. However, if one is seeking real justice, shouldn't we see and hear all the evidence?

There are some rules of law that I see being not adhered to regarding rights that are not specific to NC, but to everyone person in the US.

On your bolded comment, absolutely, so the Defense should be allowed their expert witnesses, right? Why is the state arguing against that so hard?