Computer info debunking Neumeister claims
1) SIM cards missing: Not. They didn’t exist for the phones/service used by TA and JA
Originally Posted by gcharlie
I don't get it with these defense "experts". Seems like most of them so far have been long on ego and short on knowledge in their field. For example, BN saying that the three phones were missing SIM cards. Travis used Verizon and at that time, all of their devices were CDMA, which means they never had SIM cards. Same thing for Arias' Helio phone. BN also linked the Zblog virus with a media player for *advertiser censored* sites, with the implication that was the only source of the virus. Another false statement was that Apple QuickTime and Itunes cannot update automatically.
2) ActiveX is a video codec needed to view *advertiser censored* and is strictly for *advertiser censored* sites: Not. Soooooo. Not.
It’s not even a video codec:
“ActiveX is a software framework created by Microsoft that adapts its earlier Component Object Model (COM) and Object Linking and Embedding (OLE) technologies for content downloaded from a network, particularly in the context of the World Wide Web.” (Wikipedia)
3) Zblog can only be picked up by visiting *advertiser censored* sites: Not. Blatantly not.
Originally Posted by Caylee Advocate
This was quite informative concerning virus and *advertiser censored*.
http://www.nydailynews.com/news/mone...ticle-1.172602
Originally Posted by wendiesan View Post
I found the article--very interesting--here:
http://www.examiner.com/article/jodi...for-child-*advertiser censored*
Originally Postd by Shadowboy
http://en.wikipedia.org/wiki/Zlob_trojan
"The Zlob Trojan, identified by some antiviruses as Trojan.Zlob, is a Trojan horse which masquerades as a needed video codec in the form of ActiveX. It was first detected in late 2005, but only started gaining attention in mid-2006.[1]
Once installed, it displays popup ads with which appear similar to real Microsoft Windows warning popups, informing the user that their computer is infected with spyware. Clicking these popups triggers the download of a fake anti-spyware program (such as Virus Heat and MS Antivirus (Antivirus 2009)) in which the Trojan horse is hidden.[1]
The Trojan has also been linked to downloading atnvrsinstall.exe which uses the Windows Security shield icon to look as if it is an anti-virus installation file from Microsoft. Having this file initiated can wreak havoc on computers and networks. One typical symptom is random computer shutdowns or reboots with random comments. This is caused by the programs using Task Scheduler to run a file called "zlberfker.exe."
Project Honeypot Spam Domains List (PHSDL)[2] tracks and catalogs Zlob spam domains. Some of the domains on the list are redirects to *advertiser censored* sites and various video watching sites that show a number of inline videos. Playing the video activates a request to download an ActiveX codec which is malware. It prevents the user from closing the browser in the usual manner. Other variants of Zlob Trojan installation come in the form of a Java cab file masquerading as a computer scan.[3]
4) Spybot only runs if triggered by human intervention: Not.
Originally Posted by Nali87
I searched for spyware/malware/anti virus programs articles published in 2007/2008 and it seems like some programs like CCLeaner could automatically wake up your computer in sleep mode and scan it.
Attachment 65075
Spybot apparently does the same thing:
http://www.thespinningdonut.com/how-...earch-destroy/
(Well did back in 2008)
5) The downloads/modifications that happened on June 19, 2009, had to be “okayed” by human intervention: Not.
Several were likely initially downloaded on 6/10/2008, but not installed/configured until the computer was booted up on 6/19/2009.
Originally Posted by Shadowboy
Microsoft sends out bundles of Windows updates automatically on the second Tuesday of the month. June 10, 2008 was the second Tuesday of June. If the updates downloaded when TA's laptop was brought out of sleep mode, they would have automatically installed and configured when the laptop was turned back on (June 19, 2009). This configuration process is something that CANNOT be stopped.
Not sure what OS was on TA's laptop (do any of you know?) ... But if was VISTA, that was a PIG of an OS with loads of "extra" programs that opened upon start up. The overwrite/modification of thousands of "files" (not just .exe, but .dll, etc.) due to this process is quite conceivable.
Response from 04009margaret
It was Windows XP
Originally Posted by Val1
http://download.cnet.com/Apple-Quick...-10002208.html
by: Download.com staff on November 09, 2008
“After 10 years and with millions of users worldwide, Apple's QuickTime player still provides one of the best solutions for digital media….. Inclusion of the auto update and automatic-network-detection features make getting started and staying current easy. Overall, QuickTime 7 continues to be a must-have for anyone surfing the Web or looking to experience the best in digital media."
http://en.wikipedia.org/wiki/QuickTime
QuickTime 7.5 was released on June 10, 2008.
Originally Posted by 04009margaret
Here is the proof BN is an idiot lol. Automatic update for Apple software. Notice this article is from 2008.
http://www.zdnet.com/pictures/apple-...rosoft-update/
This is the information for Spybot V1.5.2.20 which was the current version as of Jan 30 2008. The next update release was June 6 2008.
http://www.afterdawn.com/software/se....cfm/v1_5_2_20
6) BN can prove certain *advertiser censored* URLs were accessed via “typing in” the site address: Not. No way.
And if he can, Mr. Tyler Mount expert (that’s a helicopter mount; read his CV) is the first in the nation to be able to prove this.
Originally Posted by Shadowboy
Here's an interesting article about how URLs can appear to be "purposely entered" ... but they are NOT keyed in.
http://crucialsecurityblog.harris.co...edurls-part-1/
"Not only is the TypedURLs key populated by the user typing in a website, for instance, it is also updated and populated with URLs completed by the browser’s AutoComplete functionality."
Part 2 is here:
http://crucialsecurityblog.harris.co...edurls-part-2/
"Another method growing in popularity which can populate this key without user interaction is through infection by malware.
Originally Posted by dasiydomino
I just started reading Computer Forensics InfoSec Pro Guide (which is, so far, an easy read & now I know for sure I never want that job.) Lo and behold in chapter 4 there is an example where an employee is being investigated because he has inappropriate images on his work computer. The chapter is about forming and testing a hypothesis, so this example doesn't go deep into the technicalities and the example employee only uses Internet Explorer. Evidently IE keeps a file called "index.dat" that keeps a log that has a "Typed URLs" section.
Originally Posed by gcharlie
I did find something after my original post that does say hand-typed URLs are stored separately in the registry. "For the Windows Internet Explorer, review Typed URL records in the NTUSER.DAT\Software\Microsoft\Internet Explorer\TypedURLs Windows Registry key. The keyboard was the source of the entries. For other browsers, such as Firefox and Safari, perform necessary forensic review."
What else? Let’s see:
7) The modifications that happened on June 10, 2008, and on June 19, 2009, constitute prosecutorial misconduct: Likely not.
The 6/10 goof up of bringing the laptop out of sleep is easily attributable to the exigent circumstance of discovering a badly decomposed murder victim and needing to determine time of death.
Also: The time the laptop “awakening” and the time the Mesa PD officially initiated/served the search warrant? That’s about a half hour gap. Seriously? I think some “just plain cop” on the scene screwed up by moving the mouse/stirring the laptop out of sleep. The boot-up a year later? The Mesa PD had already made a mirror of the drive. It was poor procedure to fire it up on June 19, 2009, but the DT – apparently – insisted on it. Changes made on that date were (in spite of BN’s insistence) likely automatic, resulting from the completion of installs/configurations initially downloaded on June 10, 2008, via auto-updates and from –possibly – anti-virus software doing its ‘thang’ upon boot-up.
8) Inability to find the *advertiser censored* is sheer incompetence: Likely not.
Neither the DT nor the State looked for *advertiser censored* “files” when the initial analyses were done. No one looked for *advertiser censored* until JA changed her defense strategy. Two experts, one from the State and one from the DT said they didn’t find any *advertiser censored* (although Dworkin tried to change his tune when the DT changed THEIRS, then got called out by JM).
10) *advertiser censored* “hits” found now: Likely due to advancements in registry investigation tools.
*advertiser censored* site “hits” are far different than downloaded and saved photographic files.
Originally Posted by Predator
Some old HWB didn't flag all the files (especially hidden ones) on the first go around and required additional effort to "decrypt" them, however modern HWB evolved over the past years and they don't require additional effort for such files to be dis(re)covered...
Originally Posted by 04009margaret
BN is comparing work that was done 5 years ago on an old program, so of course there is going to be a difference in the finished report. No doubt Mesa PD now use the current version of Encase as all law enforcement do. If they were to do a new clone on the current version of Encase the generated report will no doubt be different to the now 5 year old clone. Until this allegation surfaced there would have been no reason for Mesa PD to investigate this further. Here is a review of Encase 2008 & a link to the current version of Encase if anyone is interested in comparing the two versions.
http://whereismydata.wordpress.com/2...nsic-6-review/
“The first versions of EnCase Forensic 6.x, simply did not do what it said on the tin. Attempting to use the indexing feature was utterly futile, cases crashed, time was wasted and and anyone who paid for the upgrade to EnCase 6.0 no doubt felt cheated, again”.
https://www.guidancesoftware.com/pro...overview.aspx#
