Sidebar for Caylee Anthony's forum #14

[zippitydoda]

Hi Everyone,

I'll be on Levi's spreecast at 10 PM Eastern tonight. In about 10 minutes.

Hope you join me.

http://www.spreecast.com/events/fridays-with-tricia-griffith--3

Tricia

````````````````

Maybe I've had too much turkey...but some red head is sitting in Tricia's seat....:what:

 

[Nore]

I understand what you're saying here. He did choose his words well. But are our courts that dumbed down not to be able to read between the lines?
I just have a real problem with our court system allowing fables and fairy tales to be substituted for facts, evidence, aka the truth, all with only one purpose in mind, to mislead the jury.

I mean, when did it become acceptable in the courtroom for an attorney to spin such a tale, with nothing to back up the false allegations. He might as well have been reading Mother Goose, IMO. I just have a really big problem with the whole thing. But, I guess that's just me...

___________
Hi neesaki, I agree with you. Above all the jury should have caught those words. They didnt catch much of anything and I think B knew it. I dont think we will ever see such a farce of a trial again in our lifetime. I hope not. I cant even get over JP allowing all of the carp B put out there. :seeya: IMO

 

[CaptainKangaroo]

Well, he couldn't shift the burden of proof, because it was all on the prosecution (as it should have been) from the beginning.

BUT ethically he needed to have some belief that the evidence would actually show what he said--because he was planning on putting Casey on the stand, or thought George might "crack" on the witness stand, or...something, anyway. Maybe he explained this in his book. I don't know.

See, that's why I am not a lawyer. LOL I know that the burden of proof is all on the prosecution. But, I thought that since in his opening statement he told "what happened" as opposed to the usual....the state can't prove it's case and here's why, that he "shifted the burden of proof".

I don't know if he explained it in his book, either. (and unless someone tells me he did, I will never know)

Thanks for straightening me out.

 

[com n sense]

BBM. Again, in your opinion. There is absutely NO proof it didn't happen. Period. And cause it's only an opinion, it's not perjury.

You are correct - it did really happen.... On South Park.

 

[windrower]

But nonetheless, so be it, they had difficulty with Firefox, but when you know you're befuzzled, ask for help from higher up! Linda had no clue that there were problems extracting the data, she assumed she got what she asked for. In a case of this magnitude, the FBI should have been in charge of handling the computer forensics to begin with or at the very least, a professional service provider. (snipped)

Depending on how the computer search information was presented and processed, maybe the folks working on it didn't know they were befuzzled (or should be befuzzled). You know how sometimes, if you don't ask the right question (which AZLawyer said happened to Tony when he was requesting copies of the computer file info), you have no hope of getting the right answer. And then, you may not know you don't have the right answer, maybe don't know you have the wrong answer, or are missing an answer altogether. Whatever is found may not be handled properly or verified, and whatever is not found isn't even on the radar.

It kinda sounds like whoever looked into the Anthony computer searches, and in particular the Firefox history, for the prosecution may not have realized there was pertinent information not accessed or processed.

AZ or JWG, is that possible, in light of what you know and found?

 

[K_Z]

Hi Everyone,

I'll be on Levi's spreecast at 10 PM Eastern tonight. In about 10 minutes.

Hope you join me.

http://www.spreecast.com/events/fridays-with-tricia-griffith--3

Tricia
````````````````

Great discussion, Tricia. Appreciate your comments. Looking forward to your Monday show!

Thank you!

 

[Steely Dan]

I came in too late to see it. :banghead:

 

[2goldfish]

That whole phony story of Casey being raped while waiting for the school bus in the morning....TOTAL PERJURY by Baez, imo.

ahhhh but he never said she was, he only said she could have been.

 

[RR0004]

The SO (Sheriff's Office) was clearly able to do at least a cursory read of Firefox v2 data early on in the case, because that is how they discovered the Google searches for chloroform in September of 2008. So even if their tools were broken with respect to time stamps, visit counts, and other details, they worked well enough to tell them what sites were visited on what dates.

If they had run those files even through their flawed tools, they would have seen that someone did a Google search for fool-proof suffocation on June 16. They would also have seen that the same someone was very active that day on social media.

At the end of the day it seems that the investigative protocol at OCSO did not involve timeline reconstruction. I know we at Websleuths devoted a great amount of time trying to reconstruct the timeline for June 16 and July 15 / 16, as well as June 17, 18, 19, and 20. We also worked to establish behavior patterns prior to June 16 to see if, for example, the "flurry of phone calls" on late afternoon June 16 was unusual or not (it was not).

As a layman, all I can say is that it seems there was a lack of curiosity on the part of the SO as to what Casey was doing on the days from June 16 to July 16. They did not seem to try to marry the cell phone, computer, and interview record together in a cohesive manner.

...and I would really like them to address this lack of interest.
Doubt if they will.

 

[RR0004]

"Dinosaur" just posted this over at Hal's blog at the Orlando Sentinel:

O/T:From the Clerk’s Site:

11/15/12-Amended Notice of Hearing 12/18/12@9:30am
**
11/21/12-Notice of Withdrawal of Witnesses

Can someone explain this? TIA

 

[ecs5298]

I came in too late to see it. :banghead:

Click on the link, Steely. It will replay from the beginning!

 

[KALI]

The missing information that the prosecution did not get in regards to fool-proof suffication.
Honestly. I followed this trial from start to finish. The characters involved were like a <modsnip>.

To Baez's credit-. Talk about a <modsnip>. EVEN YOU beat our judicial system.
It will never stop astounding me, how human beings can destroy.

Another-to Jose Baez.

In my opinion, YOU defended someone, that you knew, was guilty of the worst crime that a person can do. The "PLANNED MURDER" of their child.

There is NO defense for this.

Casey Anthony has wrecked havic not only on the child, she killed (*sue me), but on our whole system, where, we need grandma and grandpa to help,

OK. I feel, a bit better.

With that said.

I am really pooped. Also, surprised at myself for being so upset about all of this.
I have a brand NEW anger towards Jose Baez.
In My opinion. He absolutely knew, or surmised that Casey Anthony murdered her 3 year old innocent baby girl.

Yet. He still, not only defended her. But he accused the murderer's father of unreal crimes.

I'm not a big religious person. However. Living Beings, who defend, known baby killers=Hell.

**********************************************************
Jose. I hope that you have not sold your soul for fame and money.
But, it certainly, appears that you have. Only YOU know the truth,
**********************************************************

 

[RR0004]

Depending on how the computer search information was presented and processed, maybe the folks working on it didn't know they were befuzzled (or should be befuzzled). You know how sometimes, if you don't ask the right question (which AZLawyer said happened to Tony when he was requesting copies of the computer file info), you have no hope of getting the right answer. And then, you may not know you don't have the right answer, maybe don't know you have the wrong answer, or are missing an answer altogether. Whatever is found may not be handled properly or verified, and whatever is not found isn't even on the radar.

It kinda sounds like whoever looked into the Anthony computer searches, and in particular the Firefox history, for the prosecution may not have realized there was pertinent information not accessed or processed.

AZ or JWG, is that possible, in light of what you know and found?

Well, all I can say about that is here they had Casey claiming a nanny stole her child and she "supposedly" had contact with that nanny. You would think they'd have every reason in the world to examine EVERYTHING that pertained to that date...uncover EVERYTHING on that computer that would prove whether that person REALLY existed. There was a missing child, FPS.
OT- there was a case in NC. A husband was accused of murdering his wife. It just so happened that he was some kind of computer and cell phone wiz. The forensics in the case were mind boggling...I still don't understand it all. But, the FBI really went all out on this. Why wasn't this done with the As computers???!!!
ETA: BC, the man in NC, recently filed an appeal based on the judge allowing certain evidence, not allowing them to counter with their own expert testimony, yada yada yada.

 

[AZlawyer]

See, that's why I am not a lawyer. LOL I know that the burden of proof is all on the prosecution. But, I thought that since in his opening statement he told "what happened" as opposed to the usual....the state can't prove it's case and here's why, that he "shifted the burden of proof".

I don't know if he explained it in his book, either. (and unless someone tells me he did, I will never know)

Thanks for straightening me out.

I think I know what you mean now. Sometimes people will informally say that the defense attorney "shifted the burden of proof" by giving a story of "what really happened." This doesn't mean anything really happened to change the burden of proof (which remains on the prosecution)--it just means that MOST jurors will then (improperly) side with the prosecution if they don't buy the defense story.

Depending on how the computer search information was presented and processed, maybe the folks working on it didn't know they were befuzzled (or should be befuzzled). You know how sometimes, if you don't ask the right question (which AZLawyer said happened to Tony when he was requesting copies of the computer file info), you have no hope of getting the right answer. And then, you may not know you don't have the right answer, maybe don't know you have the wrong answer, or are missing an answer altogether. Whatever is found may not be handled properly or verified, and whatever is not found isn't even on the radar.

It kinda sounds like whoever looked into the Anthony computer searches, and in particular the Firefox history, for the prosecution may not have realized there was pertinent information not accessed or processed.

AZ or JWG, is that possible, in light of what you know and found?

Well, not really, because the SO computer person was completely aware that she had tons of unread internet history in her possession, including internet history for June 16.

 

[donnam]

Great job AZ and JWG! Excellent interview on Levis broadcast Tricia. I am so proud right now to be a member of this community!!!!:great:

 

[K_Z]

Like many here, I really liked and respected Sandra Osbourne, when we were first introduced to her during the trial. She has a really interesting career with OCSO-- here is a link to an interview where she describes in detail her career path, and connections to Jeff Ashton, etc. Like many here, I don't know exactly what may have transpired to cause the Firefox history from June 16 for the Anthony home computer to be missed. I do hope that OCSO processes this as a "morbidity and mortality" occurrence, and tried to trace the "why", so it doesn't happen again.

But it is hard not to respect Sandra Osbourne's stellar career history.

http://forensicsource.blogspot.com/2011/07/exclusive-interview-with-sandra-osborne.html

We rarely conduct "find all" examinations anymore. We focus the exam on the specifics of the search warrant and only that. Of course, any other contraband located will be dealt with appropriately. If there is no warrant (consent), we still try to focus the exam as much as we can. Conducting an active file preview is very important and it helps cut down on time. Examine the obvious files that the user has access to before going to the obscure, harder to find stuff. Knowing where to find files of interest on the OS you are working with saves times too. If you can tell immediately the difference between WinXP and Win7, than you know that the user files are not in the same place by default. Merely poking around the drive to see what you can find is not a very efficient way to conduct a thorough exam.

 

[K_Z]

Gosh-- I completely overlooked Part 2 of the interview with Sandra Osbourne! Part 2 deals with the Caylee case.

http://forensicsource.blogspot.com/2011/08/exclusive-interview-with-sandra-osborne.html

The IE history alone covered 4.5 years, from 2004 to July 2008. I felt I provided detectives with everything relevant to what they requested. From the looks of the HDD contents, it seemed the computers were used very rarely for academic study or Word processing. It was apparent to us as well that someone began dumping loads of files from the desktop computer right about the same time we began investigating this case. We believe that’s why the deleted Mozilla Firefox MORK database was so intact when we got the computer. There were 9,075 records in one deleted Internet history record. There’s only one way that could happen. It was dumped and we shut down the box.

Detectives honed in on July 16, 2008 rather quickly into the investigation. I'm not sure how or why they did, but they asked me to conduct a timeline that showed the use of the computers for that day. The original timeline I conducted was through the functionality of EnCase. I set the program to look at July 16 and July 17, 2008 and provide an indicator of the computer's activity during those 48 hours. EnCase gathers the information for the timeline by the file system dates and times; created, accessed, modified and deleted. EnCase then shows which files were active during that time. What I didn't realize at that time (but I know now) is that this was not the best approach. My timeline showed large gaps of time where it seemed there was no activity at all on the HP home computer. Therefore, I reported those gaps in time to detectives. They were working off the presumption that large gaps of time away from the computer could possibly mean that was the time frame when something may have happened to Caylee. I looked very closely at July 16th again just as the trial was starting. I filtered all the files on the HP computer to show only the 24 hours for that day. I sorted every file first by creation time and then by accessed time. What I learned was that the temporary Internet files were being accessed and created during some of those large time gaps when I thought nothing was going on. What I didn't think about in 2008 was that the index.dat files are stored in a database (hence the file extension .dat - DUH!). The EnCase timeline function reported the MAC times for the database itself and not for the individual records it contains. So, while the user is accessing the Internet, the index.dat file is not being updated the whole time it is in use. What I discovered was an AIM Logger chat (not about Caylee), lots of MySpace activity and local files being created and accessed to the desktop\pictures\shotgirls folder during the times I thought there was nothing going on. This activity goes on all day, from just before 0800hrs with a break for lunch time for about an hour and a half. At 1330hrs or thereabouts, the activity picks up again, after everyone has gone to work. What that means is that someone is one the computer from 0756hrs until 1146 hrs on the 16th of July, 2008. George (Casey’s father, Caylee’s grandfather) testified that Caylee and Casey left at about noon. The computer activity stops at 1146 hrs, right on time. George leaves for work; Cindy (mom) is already at work earlier that day. The same type of Internet and local file activity resumes after 1330 hrs, when everyone is supposed to be gone. The AIM logger chat was between two users who identified themselves in the chat by name; Casey and the other user. The MySpace appeared to be Casey’s as did the shotgirls photos. Casey was dating a DJ at a local night club at this time and although she didn’t work at the club, she promoted the local talent there and “hired” girls to work the bar serving shooters. So, it makes sense that she would be researching the clothing the girls should wear. There were many pictures in this folder, some of which were created/downloaded from MySpace that day that Caylee went missing. I was prepared to testify about this new information as soon as Mr. Baez announced in his opening statement at trial that the baby drowned in the family pool the morning of July 16, 2008. Well, the computer tells us a story that indicates either this traumatic event never happened or the computer user ignored the crisis completely.

BBM

 

[RR0004]

Beach, I know you're probably sleeping now...but...I've been reading through some old threads and noticed it's been about a year since we heard about a Q and A thread for MM. Anything new?

 

[K_Z]

JWG, if you come by, can you comment/ explain this in plainer language?

Sgt. Stenger was not very familiar with this old database, so he enlisted the help of John Bradley, the creator of CacheBack. Mr. Bradley was asked to verify that this was in fact a MORK Mozilla Firefox Internet history database. CacheBack is a great tool for parsing Firefox (and other records) and rebuilding web pages. The class John gave us a few years ago here in Orlando was very intense and informative. He knows IE, Firefox, Chrome, and Safari very well. Because this record had been deleted, Sgt. Stenger named the file history or Header.dat (I think) and imported it into CacheBack and into Net Analysis. Net Analysis reported many of the records but not all of them. It did, however report the page visit count for the sci-spot "chloroform" search in Google as "1" where CacheBack interpreted the page visit cout incorrectly at "84". From what I understand about the MORK database, if a web page is visited only once, the page count is left at "0" and will not increment to "1" until the second visit. This was apparently the case with the sci-spot "How+to+make+chloroform" google search page. Because the page visit count was only "1", the byte value for that was null. CacheBack did not interpret that data correctly, so it went down the database list of records until it came to a page visit count it recognized. That happened to be the MySpace.com page with a visit count of "84". Consequently, CacheBack inserted the "84" into where it thought that value should go; in the sci-spot page visit count. CacheBack also did not return the correct number of records in this large database.

Craig Wilson, creator of Net Analysis, submitted a very detailed explanation of how the MORK database works. You can read it at http://blog.digitaldetective.co.uk/2011/07/digital-evidence-discrepancies-casey.html. Both Mr.Wilson and Mr. Bradley have re-evaluated their tools as a result of this misunderstanding. Both, now report the correct number of records in the deleted history at 9,075.

During the trial, Sgt. Stenger was asked to testify about the CacheBack report, specifically the "84" hits on the sci-spot page. He testified as to what the report said was the page visit count of "84". John Bradley was also asked about the "84" page count, to which he testified that he did not create the report (Sgt. Stenger did), but that the CacheBack reported that the sci-spot page was reportedly visited 84 times. Nothing more was said for several weeks. Defense brought Sgt. Stenger back to the stand later to challenge the CacheBack report. Mr. Baez walked Sgt. Stenger through the report and asked several questions to dispute the "84" count. Mr. Baez basically concluded that CacheBack mis-interpreted the data and that the "84" count actually belonged to the MySpace page. Obviously, Mr. Baez had been contacted by a forensic expert to come up with the conclusions he did; but nontheless, his conclusions proved to be correct. As a result of the testimony provided, Mr. Bradley re-evaluated the way CacheBack interpreted the database and realized that it was incorrect. He worked non-stop to correct the errors and reported it immediately to Sgt. Stenger and the prosecution. At some point, the data was provided to Craig Wilson. Net Analysis has also been re-evaluated and is now interpreting the data correctly.

Neither Sgt. Stenger nor John Bradley were brought back to the stand to testify about this issue. It is not up to the witnesses to dictate the course of the trial. It was the position of the prosecutors that the CacheBack issue had been visited, revisited and corrected. Mr. Baez made his point in court and Sgt. Stenger conceded the fact that the report appeared to be incorrect. In response, Mr. Baez's closing statement was that the Computer Evidence was fraudulent. They are upset because the prosecution didn't apologize to them for the mistake. To validate more then 9,000 records that were carved from UC is literally impossible, especially since we can't recreate the scenario. I am curious to hear from others about how the validation of the tools used with this particular record could have been performed. If the creators of the tools didn't know about the errors, then I'm not sure what more could have been done at that time and with the information we had. It is unfortunate these "bugs" in the software were discovered during such a public event, however mistakes happen. It is not unusual that examiners catch mistakes in all kinds of software. We see it every day on the list serves. It's just not pleasant to be on the losing end of the mistake. The bottom line is and always has been, validate, validate, validate WHEN YOU CAN and seek several opinions when in doubt.

I conducted a very specific time line of computer events for June 16, 2008 and submitted two reports regarding that evidence that I never got to testify to. Defense counsel stated that Caylee drowned in the family pool on the morning of June 16, 2008. The home computer shows a user (&#8220;caseyomarie&#8221 logging into AIM Chat beginning at 0756 hours and chatting with &#8220;whiteplayboi&#8221; until 0806 hours. They called each other by name during this chat session; &#8220;whiteplayboi&#8221; referred to the other user as &#8220;Casey&#8221;. Meanwhile, Firefox and MySpace were launched and pictures were downloaded and saved two folders deep into the &#8220;Shot Girls&#8221; folder on the users&#8217; desktop. Casey claimed to be a self-appointed &#8220;shot girl&#8221; manager for the night club where her boyfriend works. All these pictures were of scantily, clad women wearing barmaid or cheerleader outfits. Other local files were accessed during the time frame of 0756 and 1146 hrs that day. There were no significant breaks in the user activity time, which indicated that the user stopped using the computer long enough to handle a family crisis, such as your child drowning in your pool. As an expert, I would have been permitted to state my opinion about this user activity to the jury. If asked, I would have stated that my opinion is that one of two things occurred; 1) either the user of the computer completely ignored the family crisis or 2) that crisis didn&#8217;t happen. I believe the jury would have been able to see through that smoke screen. It&#8217;s not often, if ever, that we get to say who is actually sitting at the keyboard, but that&#8217;s about as good as it gets.

BBM

Worth remembering that Casey was on the computer from before 8 am till nearly noon that day, continously. Then made a sham of leaving with Caylee and "going to work". Then as soon as GA left, circled back to Hopespring, and started googling "fool-proof suffication" to help her figure out what to "do" with Caylee that day.

I'm sickened.

http://forensicsource.blogspot.com/2011/08/exclusive-interview-with-sandra-osborne.html

 

[AZlawyer]

Gosh-- I completely overlooked Part 2 of the interview with Sandra Osbourne! Part 2 deals with the Caylee case.

http://forensicsource.blogspot.com/2011/08/exclusive-interview-with-sandra-osborne.html

Quote:

Detectives honed in on July 16, 2008 rather quickly into the investigation. I'm not sure how or why they did, but they asked me to conduct a timeline that showed the use of the computers for that day. The original timeline I conducted was through the functionality of EnCase. I set the program to look at July 16 and July 17, 2008 and provide an indicator of the computer's activity during those 48 hours. EnCase gathers the information for the timeline by the file system dates and times; created, accessed, modified and deleted. EnCase then shows which files were active during that time. What I didn't realize at that time (but I know now) is that this was not the best approach. My timeline showed large gaps of time where it seemed there was no activity at all on the HP home computer. Therefore, I reported those gaps in time to detectives. They were working off the presumption that large gaps of time away from the computer could possibly mean that was the time frame when something may have happened to Caylee. I looked very closely at July 16th again just as the trial was starting. I filtered all the files on the HP computer to show only the 24 hours for that day. I sorted every file first by creation time and then by accessed time. What I learned was that the temporary Internet files were being accessed and created during some of those large time gaps when I thought nothing was going on. What I didn't think about in 2008 was that the index.dat files are stored in a database (hence the file extension .dat - DUH!). The EnCase timeline function reported the MAC times for the database itself and not for the individual records it contains. So, while the user is accessing the Internet, the index.dat file is not being updated the whole time it is in use. What I discovered was an AIM Logger chat (not about Caylee), lots of MySpace activity and local files being created and accessed to the desktop\pictures\shotgirls folder during the times I thought there was nothing going on. This activity goes on all day, from just before 0800hrs with a break for lunch time for about an hour and a half. At 1330hrs or thereabouts, the activity picks up again, after everyone has gone to work. What that means is that someone is one the computer from 0756hrs until 1146 hrs on the 16th of July, 2008. George (Casey’s father, Caylee’s grandfather) testified that Caylee and Casey left at about noon. The computer activity stops at 1146 hrs, right on time. George leaves for work; Cindy (mom) is already at work earlier that day. The same type of Internet and local file activity resumes after 1330 hrs, when everyone is supposed to be gone. The AIM logger chat was between two users who identified themselves in the chat by name; Casey and the other user. The MySpace appeared to be Casey’s as did the shotgirls photos. Casey was dating a DJ at a local night club at this time and although she didn’t work at the club, she promoted the local talent there and “hired” girls to work the bar serving shooters. So, it makes sense that she would be researching the clothing the girls should wear. There were many pictures in this folder, some of which were created/downloaded from MySpace that day that Caylee went missing. I was prepared to testify about this new information as soon as Mr. Baez announced in his opening statement at trial that the baby drowned in the family pool the morning of July 16, 2008. Well, the computer tells us a story that indicates either this traumatic event never happened or the computer user ignored the crisis completely.

Thank you--I had forgotten that Sandra had done this interview. But see, this is what confuses me. She says she was asked to construct a timeline regarding use of the computer for June 16--which is consistent with what Linda now says. (Sandra says July 16 in this interview, actually, but from context she clearly means June 16.) Then she says she looked "very closely" at this critical date as the trial neared. It sounds like she did, in fact, figure out much of the Firefox internet activity that was going on that day (although her times are off), including the shotgirl outfit searches. So why didn't she find the foolproof suffocation search?? She was so so so close. I can't understand it.