Ricardo's Computer Forensics

[nanny2five]

It shows "iphoto" on some of the data underneath, so I'm thinking it was directly from the computer. Also, just to be clear, we are not discussing the time or date the photo was taken but rather the date of 2 files being created for those photos on June 17, 2008.

sorry if i misunderstood
quoted from woe.be.gone's post that started my questioning:
What I mean is "file created" is not necessarily the day the picture was taken, correct? How is that determined? If the picture was take on June 17, 2008, and is of Caylee, there is a problem with RM's testimony that he last saw Caylee on June 10, 2008.

 

[scratchthatitch]

sorry i misunderstood

No worries! Several posts had the same misunderstanding and I was concerned that others might overlook W.B.G's astute observation.

 

[AZlawyer]

sorry if i misunderstood
quoted from woe.be.gone's post that started my questioning:
What I mean is "file created" is not necessarily the day the picture was taken, correct? How is that determined? If the picture was take on June 17, 2008, and is of Caylee, there is a problem with RM's testimony that he last saw Caylee on June 10, 2008.

The 6/17/08 files we are talking about are not even picture files. The dates the pictures were taken are established--Jan. 28 and March 19, 2008. These files are email files from RM to the Globe, which might not even have had pictures attached. All we know is that he sent emails to the Globe that have a "file created" date of June 17. We are considering the possibility that the "file created" date might reflect that RM was forwarding an email to the Globe, and the original email had been sent (or received?) by RM on June 17. We were then speculating what type of email RM might have sent to someone on June 17 that he later felt the Globe would want to see, and wondering whether it was an email to Casey attaching photos of Caylee.

 

[BondJamesBond]

The 6/17/08 files we are talking about are not even picture files. The dates the pictures were taken are established--Jan. 28 and March 19, 2008. These files are email files from RM to the Globe, which might not even have had pictures attached. All we know is that he sent emails to the Globe that have a "file created" date of June 17. We are considering the possibility that the "file created" date might reflect that RM was forwarding an email to the Globe, and the original email had been sent (or received?) by RM on June 17. We were then speculating what type of email RM might have sent to someone on June 17 that he later felt the Globe would want to see, and wondering whether it was an email to Casey attaching photos of Caylee.

Per the path (Sent messages.mbox) and filename (*.emix) he simply provided the Globe with a copy of emails he had originally created & sent on 6/17. Whether or not the emails had an attachment (i.e. pic) is anyone's guess. We can't determine that from the information provided.

IMHO, these were likely emails he sent to Casey. Otherwise, the Globe prolly wouldn't be all that interested.

FWIW, Casey was texting w/ Tony (in class @ Full Sail) @ the time these were sent, and there were a couple of MySpace notifications on Casey's cell phone. Perhaps Ricardo was multi-tasking and sent these emails and a couple of MS messages to Casey.

HTH.

ETA: Since Ricardo likely would've still had the original file of any pics it seems reasonable to assume these emails were provided to the Globe for their content vs. any pic they might've had attached IYKWIM.

 

[Sparky]

I confess, I'm extremely computer illiterate, but wouldn't you have to turn a photo from iphoto into a another type of file in order to email it?

Oops, my bad. Sorry Jolynna, I didn't see your post about the EMIX files

iphoto is a photo application used with Mac computers. I don't believe Apple has released it for Windows. At least I couldn't find it anywhere. I could be wrong though.

Anyways, you import your photos into iphoto and you are able from the program to hi-lite and email the photos. They are sent a jpg files.

So I would say whoever is using iphoto has a Mac Computer.

HTH

 

[BondJamesBond]

Bump now that posts have been moved over for discussion of Ricardo's computer forensics here. :thumb:

Discussion re: The Big Trouble shirt
Carry on here: [ame="http://www.websleuths.com/forums/showthread.php?p=4978161#post4978161"]Caylee's "Big Trouble..." Shirt Incl. Photos *Merged* - Page 15 - Websleuths Crime Sleuthing Community[/ame]



Discussion re: Anthony's Computer Forensics
[ame="http://www.websleuths.com/forums/showthread.php?p=4978056#post4978056"]Anthony's Computer Forensics - Page 23 - Websleuths Crime Sleuthing Community[/ame]

Carry on!

 

[LisaNY]

I use iPhoto a lot. I just put some pictures on my computer from my camera, that were taken in June of 2007 tonight. They show todays date as the date taken. Could that be what happened to the pics? RM had them on a camera, and loaded them onto the computer to send to KC on 6/17??

Just a thought.

ETA: I just went back and checked the photos. ONLY the ones I edited saved with todays date as the date taken. My mistake.

 

[Woe.be.gone]

EXIF = exchangeable image file

EMIX = ?

The camera used for the six pictures that we have seen the images of that were sent to the Globe was a Canon Powershot SD870.

LE reports "These six pictures of interest to this investigation were not the only pictures located on the hard drive whose metadata reveals they were taken with a Canon Powershot SD870 digital camera. The six images submitted for analysis were not located within the email files on the computer."

This note I assume means that the camera and computer both belong to RM.
Maybe they can tell then, if there are other pictures contained only within the emails, that those were taken with another camera? If one is not the author of a photo, can one sell the photo? Just because someone has a copy of a photo but you're not the photographer, can you sell it? Also, is it legal to sell images of people without their consent?

So many questions, so few answers. As far as I know RM didn't do what I'm asking about because the six photos were on his hard drive taken presumeably with his camera.

But if KC had emailed him pictures for some reason on June 17, 2008, would he legally be able to turn around and sell them?

I returned to this thread earlier and it was locked up and I thought 'now what?' I've tried hard to understand what all of the data relating to the Globe sales means but it remains over my head for now.

 

[Vanpet]

If the photo has a copyright and the photographer can prove ownership and has the original digital file it would be considered copyright infringement. There are gray area were taking pictures of people are concerned, the paparazzi laws inacted in January of 2010 put a whole new meaning to unwanted "people pics" Thats why I stick to photographing birds!

Depending on how you have your memory card date set (if accurate) it does not matter what date you transfer the pictures, the Original date picture was taking will be embedded in the picture code. It will have a creation date and modified date. Right click a pic on your computer and look at the properties goto the summary and click advanced it will show the creation date

 

[BondJamesBond]

EXIF = exchangeable image file

EMIX = ?

*snipped*

I returned to this thread earlier and it was locked up and I thought 'now what?' I've tried hard to understand what all of the data relating to the Globe sales means but it remains over my head for now.

Per the path (Sent messages.mbox) and filename (*.emix) he simply provided the Globe with a copy of emails he had originally created & sent on 6/17. Whether or not the emails had an attachment (i.e. pic) is anyone's guess. We can't determine that from the information provided.

IMHO, these were likely emails he sent to Casey. Otherwise, the Globe prolly wouldn't be all that interested.

FWIW, Casey was texting w/ Tony (in class @ Full Sail) @ the time these were sent, and there were a couple of MySpace notifications on Casey's cell phone. Perhaps Ricardo was multi-tasking and sent these emails and a couple of MS messages to Casey.

HTH.

ETA: Since Ricardo likely would've still had the original file of any pics it seems reasonable to assume these emails were provided to the Globe for their content vs. any pic they might've had attached IYKWIM.

Woe, answers to a couple of your questions in there. *.emix is Apple's file format for email messages.

 

[magic-cat]

On 6/17 at 2:30 pm, KC called Ricardo from the area of the A. home, at a time when many of us believe she was downloading bucketloads of information from the home computer to the laptop. Ricardo called right back from his work phone, and they were on the phone for 8 minutes.

The emlx files were created 6/17/08 after 9:00 pm, however.

Ok. At that point in time, Casey and Ricardos breakup was brand new and fresh, and supposedly it was she who wanted it and not him necessarily. Maybe when she called him that day-June 17th, she had requested him to email her those pics of Caylee and he sent only a couple of them, thinking that would give her another reason to be in touch with him again to get the remainder of them? If she did ask for them? Then I think she was busy trying to cover her tracks even then. She may have uploaded ONE to Photobucket and when she was doing the mass deletion saw that picture and it jumped into her head where it came from and that there were others...???:waitasec:

 

[Woe.be.gone]

Woe, answers to a couple of your :waitasec:email messages.

Oh thanks. We know then that RM created the email himself on June 17, 2008 and sent it to somebody (presumeably KC). We don't know what was contained therein. Later he sent the same email to the Globe (along with a corresponding email sent back from KC?) - I don't know, I'm asking.

But by 'emix' we know RM initiated the first email (as per someone's request possibly) versus it having been a received email? Is this correct?


o/t BJB, about the 17th of June :waitasec:, Tony stated that he took that day off from school to stay with KC. Yet it seems she's on the go all day and ends up at CS's house, he says at five o'clockish.
All the inconsistencies sure make it hard to put things together.

 

[Woe.be.gone]

If the photo has a copyright and the photographer can prove ownership and has the original digital file it would be considered copyright infringement. There are gray area were taking pictures of people are concerned, the paparazzi laws inacted in January of 2010 put a whole new meaning to unwanted "people pics" Thats why I stick to photographing birds!

Depending on how you have your memory card date set (if accurate) it does not matter what date you transfer the pictures, the Original date picture was taking will be embedded in the picture code. It will have a creation date and modified date. Right click a pic on your computer and look at the properties goto the summary and click advanced it will show the creation date

So the 'creation date' is the day the picture was taken? or the day it was put on your computer? is the day you put it on your comuter the file creation date? What do you mean by "depending on how you have your memory card date set (if accurate)?" How can I be sure it's accurate? Or, in the case of investigating, be sure their's was accurate?

Thank you, I'll follow your instructions on my own pic to see if I can make sense of it. Does "modification date" mean when you edit the pic if you do? And if you access a picture that doesn't mean you did anything but just look at it, no?

The reason this is hard because there are two concepts - the day the picture was taken on a camera (or card) and the day (which could be a year later) the picture was downloaded to a computer.

Why don't they just use the following terms? -
Picture taken on:
Picture downloaded on:
Picture edited on:
Picture last accessed on:

You don't create a picture but you do create a file when downloading a picture, right? I guess 'modify' means change so it's the same as 'edit', correct? Why not just say 'edit'?

Is this as hard as I'm making it or is something wrong with me?


I know, I know I'm infuriating. I won't ask you to explain electricity - ha.

 

[Gma Kat]

How can you tell? I can see that the March 29 pictures are the ones where KC is playing the guitar with Caylee by her side. It was speculated earlier that those pictures were taken right before Caylee died - now we know they were taken March 19. check.

But where there are no visual pictures attached to the data (where one can see what the actual picture is) how do we know what the picture is of and the correlation between what was found on RM's computer and what he sold to the Globe?

There is a subtle note by LE that says something like 'other pictures were found on the harddrive too'.

The date of June 17, 2008, jumped out at me. Now I'm hearing that KC hired JB on that day (per JB at indigency trial). Why would RM be messing around with pictures of interest to LE on June 17, 2008, especially if they were taken in January of 2008? More intriging though, is why would LE note that these pictures were sold to the Globe? RM wouldn't know to sell pictures until after July 15, 2008 - no? (I know he didn't sell pictures in June but I'm curious as to the images contained on those two pictures.)

Is it possible to match the upper list (pics taken from RM's computer) to those pictures that were sold to the Globe?

bbm: It could be coincidence? IIRC he took a trip around that time and may have simply uploaded the pictures from his camera to his harddrive to make room for pictures for his trip.

 

[Vanpet]

The initial powering on of your camera, you are asked to setup : Enter date
Enter time, etc..
I have several cameras (amateur bird photographer) my Sony H50 allows me to view pictures by folders of the date it was taken or by the digital image number example: DSC02113, when you snap a picture the picture is coded with dsc001#(digital still camera), the date and time, when you download your memory card from your camera , onto your computer and right-click then click on properties the created date=date this file was assigned to the folder (location from your card to your pc). Accessed date last time file was accessed, click on the summary tag it will show when you physically took the picture "date picture was taken:" date and time.
"Metadata is a term for the descriptive information embedded inside an image or other type of file. Metadata is becoming increasingly important in this age of digital photos where users are looking for a way to store information with their pictures that is portable and stays with the file, both now and into the future.
One type of metadata is the extra information which almost all digital cameras store with your pictures. The metadata captured by your camera is called EXIF data, which stands for Exchangeable Image File Format. Most digital photo software can display EXIF information to the user, but it is usually not editable.
(Darn it Daylight savings time I am an hour behind on all recent pictures because I forgot to set my time up and hour on my cameras.) google: EXIF metadata

 

[Woe.be.gone]

Sorry, last question and then I'll go away:blushing:

Is there a date for the seizure of RM's computer? I know there was something related to the chloroform "joke" but I'm not sure what time period.

It seems that LE took RM's computer on October 27, 2008. He didn't agree that LE could take it so they must have obtained a warrant and returned later.
RM called LE on November 4 and asked if he could come pick up his computer and they said that he could. RM was interviewed on October 27 and again on November 4, 2008 by OSCO.

None of the FBI interviews pertaining to RM have been released as far as I know; nor have the results of his Polygraph test.
It sounds as if the Poly revealed some iffy information but RM would not talk about the results.

If you go to the RM interview thread and read pages 4 and 5, you can follow along and get a picture of the main points of his interview and questions that he was asked about his computer but didn't want to answer.

RM got defensive and said that the Globe was not a secret yet he didn't bring it up either. He's not too forthcoming. At one point LE tells him something like, we're trying to get to the bottom of why a three year old girl is missing (like get with the program buddy, do you understand the seriousness of the situation?). At another time they say to RM that 'you're probably one of the closest things to a father figure the child ever had.' RM replied, 'I was never alone with the child.'

My heart is breaking for Caylee all over again. She didn't deserve the treatment she received regarding her bedtime, where she was expected to sleep, etc. It makes me sick that she was expected to adjust like that so that KC could have her bf. Plus CA is delusional and here's a clear example why. To top things off, KC and RM were an item all of a few months and KC walks in with her child and exposes her to a stranger man - sick, just sick.

Public service announcement to young mothers everywhere - WHEN YOU'RE DATING A GUY WHO HAS WEIRD MESSAGES ON HIS FB ABOUT CHLOROFORMING WOMEN ~ RUN FOR THE HILLS. Something's wrong with that picture imo.

 

[Woe.be.gone]

The initial powering on of your camera, you are asked to setup : Enter date
Enter time, etc..
I have several cameras (amateur bird photographer) my Sony H50 allows me to view pictures by folders of the date it was taken or by the digital image number example: DSC02113, when you snap a picture the picture is coded with dsc001#(digital still camera), the date and time, when you download your memory card from your camera , onto your computer and right-click then click on properties the created date=date this file was assigned to the folder (location from your card to your pc). Accessed date last time file was accessed, click on the summary tag it will show when you physically took the picture "date picture was taken:" date and time.
"Metadata is a term for the descriptive information embedded inside an image or other type of file. Metadata is becoming increasingly important in this age of digital photos where users are looking for a way to store information with their pictures that is portable and stays with the file, both now and into the future.
One type of metadata is the extra information which almost all digital cameras store with your pictures. The metadata captured by your camera is called EXIF data, which stands for Exchangeable Image File Format. Most digital photo software can display EXIF information to the user, but it is usually not editable.
(Darn it Daylight savings time I am an hour behind on all recent pictures because I forgot to set my time up and hour on my cameras.) google: EXIF metadata

Thank you so much for taking the time to explain all of this to me - I'm writing it down.

Oh my gosh. I just looked at my camera and the time is set one hour earlier than what the real time is now. Thank you and how timely for me. Our house got 'egged' two nights ago for the second time in two weeks and my husband is livid. It happened between 10:30 and 10:45 PM. I heard a noise and ran to the front door and sure enough - toilet paper, etc. But the eggs are a mess. My husband immediately jumped in his car to go to the house of the boy who we think is behind this to see if him and friends were home and to talk to the parents. I grabbed my camera and took some pictures in night mode and then regular mode, etc. Stuff was blowing (tampax and other girlie items) into my neighbors yard and I didn't want to leave it out overnight as it was very windy. Because of you, I realize now that all the pictures I took (and my husband a few more in daylight the next day) are one hour off timewise. Guess who did this to us? Teenage girls, yes, girls. The joys of having a teenage boy! The toilet paper and stuff is not a big deal but the egging went above the garage roof line and is difficult to clean, etc. My husband already delt with this a week or so ago. They left the two empty cartons laying adjacent to our driveway along with the chalk they used to write messages on our driveway. These girls probably didn't realize how damaging egging a home can be; they are about to realize it though because we're gonna teach them. Guess where we were able to gather further evidence? Facebook. The girls had planned it on Weds. and carried out their plans Thurs. night.

 

[TallyHo]

Thank you so much for taking the time to explain all of this to me - I'm writing it down.

Oh my gosh. I just looked at my camera and the time is set one hour earlier than what the real time is now. Thank you and how timely for me. Our house got 'egged' two nights ago for the second time in two weeks and my husband is livid. It happened between 10:30 and 10:45 PM. I heard a noise and ran to the front door and sure enough - toilet paper, etc. But the eggs are a mess. My husband immediately jumped in his car to go to the house of the boy who we think is behind this to see if him and friends were home and to talk to the parents. I grabbed my camera and took some pictures in night mode and then regular mode, etc. Stuff was blowing (tampax and other girlie items) into my neighbors yard and I didn't want to leave it out overnight as it was very windy. Because of you, I realize now that all the pictures I took (and my husband a few more in daylight the next day) are one hour off timewise. Guess who did this to us? Teenage girls, yes, girls. The joys of having a teenage boy! The toilet paper and stuff is not a big deal but the egging went above the garage roof line and is difficult to clean, etc. My husband already delt with this a week or so ago. They left the two empty cartons laying adjacent to our driveway along with the chalk they used to write messages on our driveway. These girls probably didn't realize how damaging egging a home can be; they are about to realize it though because we're gonna teach them. Guess where we were able to gather further evidence? Facebook. The girls had planned it on Weds. and carried out their plans Thurs. night.

Sorry about the mess Woe!! I have to take just a little trip OT to tell you how my sister in law handled the exact same situation a few months ago (except that the culprits were boys). She made them (after talking with their parents) come over and clean the entire mess up THEMSELVES. It was great - teenagers usually hate manual labor. And I know it's hard to believe they can be so stupid as to implicate themselves on facebook, but they do. I am constantly amazed at the things my son's middle school friends/classmates post. Many of them have gotten in trouble with school over things they couldn't keep from bragging about on FB. Good luck!!