Latest / Parsing the Truth: One Byte at a Time / Casey Anthony: The defense's hidden expert

Transcript

Casey Anthony: The defense's hidden expert · Parsing the Truth: One Byte at a Time

0:01
Join former FBI Senior Forensic Examiners Becky Passmore and
0:05
Stacey Eldridge as they dig into the world of digital forensics
0:08
one bite at a time. Now leading their own consulting
0:11
firms and educating the next generation of cyber sleuths,
0:14
these bad ass babes of digital forensics bring sharp insight,
0:18
real world case experience, and a dose of humor to the bits and
0:21
bites that filled today's investigations.
0:23
From deep dives into business e-mail compromise and ransomware
0:26
attacks, Becky's specialty to cracking the complexities of
0:29
iPhone forensics, Stacy's obsession, this podcast delivers
0:33
insider knowledge for professionals, students, and
0:36
true crime techies alike. If you've ever wondered what
0:39
really happens when the digital trail is all that's left, TuneIn
0:42
and start parsing the truth. Welcome back to another episode
0:53
of Parsing the Truth One bite at a time.
0:56
I'm your Co host Stacey Eldridge and tonight I have with me the
1:01
beautiful Becky Passmore. Hello everyone, welcome back.
1:05
We've got a special episode for you tonight as we continue to
1:08
dive into the digital forensics of the Casey Anthony case.
1:13
If you've been listening, you might have caught the hints.
1:15
And we've got a guest tonight, Becky, who do we have?
1:18
So. Tonight, we are very fortunate
1:20
to have the defense to have a defense expert with us to talk
1:24
about this case. We have Larry Daniel.
1:26
We're very excited to chat with him because many people didn't
1:32
realize, did not even realize that the defense even had their
1:37
own digital forensic expert. It's a logical assumption since
1:41
the defense did not put their expert, Larry Daniel on the
1:45
stand. But rest assured, he was working
1:47
tirelessly behind the scenes and now we're going to get the
1:51
inside better knowledge straight from him, Larry.
1:54
Let me start the first question off with.
1:56
Can you tell us what your job or your position was when you were
1:59
approached to work on the Casey Anthony or I guess maybe I'm
2:03
assuming you were approached to Casey to work on the Casey
2:06
Anthony case. How did that all start?
2:08
Well, oddly enough, it all began with Nancy Grace.
2:13
OK, happened to catch her program, didn't know who she
2:16
was. And just watching her program
2:18
and the way she approached the whole top mom thing and just her
2:23
vehemence and demonization, you know it.
2:26
It compelled me to have Leslie Kaufman, who worked in our
2:29
office, contact Jose's office and say, have you got a dispense
2:33
expert because you're going to need one.
2:34
And as it turned out, he did not have one.
2:38
OK. And that's where I got to go
2:39
work on the case, Anthony case for the next couple years.
2:42
How long had you been doing like digital forensics work slash
2:46
even doing defense work? I started in 2000.
2:50
OK. Oh, so you were closer to a
2:52
decade then? Because she was arrested and
2:55
everything in 2008. And do you recall, was it like
2:59
2008 or 2009 when you volunteered?
3:02
2009 would be closer to it. OK.
3:04
So I'd been going on for a little bit, All right.
3:07
So Larry, what's the, what's the five second overview of what
3:11
you've been doing in the last 14 years since that trial?
3:14
Well, since that trial, because I think that back then that was
3:18
also the early days of mobile forensics.
3:21
So I had gotten started in Mobile Friends.
3:23
It's probably a year or two before that.
3:25
And in the 14 years since I say I wrote two books, I've probably
3:29
testified an additional 80 times, maybe collected 10
3:34
different certifications, taught hundreds of presentations on
3:39
different aspects of digital forensics to attorneys, to
3:44
attorneys, prosecutors, public defenders, whomever, work with a
3:48
lot of different people, not a lot of great people.
3:50
It's been fun, fun. I had an Internet radio show
3:52
called Block Talk Forensics, which you can still catch on
3:55
iheart. It's on iHeartRadio now.
3:57
Believe it or not, it was also on.
3:59
OK. Now, Larry, when you said you'd
4:01
work the case, did you know how big it would be when it actually
4:06
got to trial? I had no idea that it was going
4:09
to turn into the circuits that it turned into because after I
4:11
got involved in it, I actually, we started watching Nancy Grace.
4:15
And only because it was interesting to see.
4:18
And this was something that just kind of honestly messed with my
4:22
head a little bit because I'm all about integrity and ethics.
4:26
And the number of people who got onto the defense team just to
4:30
get inside information to go sell it and then get off the
4:34
defense team was just as it, as they say down here in the South.
4:40
It would grind my gears, man. I tell you, it just made me mad
4:44
that people would do that. They're like, oh, I'm going to
4:46
go. And then they'd go sell pictures
4:48
or whatever they'd get their hands on, you know, if somebody
4:51
wanted to make money. I had everything.
4:54
I had every picture, every video.
4:57
I had her, all her friends phones.
5:00
I had all the computers. I had everything.
5:03
Yeah, I I should've just got a bitch.
5:04
But as it turns out, and I don't know if the server came out or
5:08
not, but the cost to defend her, the people who got paid, and I
5:12
wasn't one of them, it cost about $600,000.
5:15
And that was all made by selling pictures of things to the media.
5:20
So the defense team was selling and the family was selling
5:24
things, making money and making money on interviews to pay for
5:27
her defense. Interesting, I did not have
5:29
that. Yeah, I didn't either.
5:31
So when did you start working on the case?
5:34
Probably not too long after I got involved because Sandra
5:38
Osborne, she was working on the case as the primary and under
5:41
the supervision of Sergeant Stinger.
5:43
So I started getting her reports and I got copies of the hard
5:46
drives that they had at the time.
5:48
That's when I started working on it.
5:49
So, and I'm trying to remember the exact date, but I had a
5:53
meeting with Jose in Denver at the American Society of American
5:59
Association of Forensic Science. They were having a big meeting
6:02
out there. So I went to the that meeting.
6:04
I did have a meeting with Jose and a bunch of the forensics
6:07
people. The guy from John Jay College
6:10
that was one of the criminologist was there, the bud
6:13
guy was there, the entomologist watch other folks and all that
6:16
effort. I went to to go to and end up
6:19
meeting with Jose for like 15 minutes.
6:22
Wow, really? Which I could have done that
6:24
over the phone, right? But it was important to meet
6:27
with him because at that time, and I'm trying to remember what
6:30
year that was, but it was at least a year before trial.
6:33
And I had already done the more database thing, had already done
6:38
the net analysis work, because Sandra had already done the net
6:41
analysis work. So we knew how many visits to
6:44
the core form side there were. I had already found the other
6:49
Internet history from Internet Explorer and things like that
6:52
for things that never came out in trial.
6:54
So they were. OK, OK.
6:57
That was one of our questions, yeah.
7:00
Always wondering as we're listening to the testimony, was
7:02
it really only Firefox? They didn't use any other
7:04
browsers or wasn't any other Internet history.
7:07
There was there was Internet Explorer history, OK, which had
7:12
things on it for how to make household weapons or how to make
7:16
weapons household objects. Then there was the full proof
7:20
suffocation part that came out, which was supposedly George
7:24
looking for how to kill rhododendrons or so I don't
7:28
know, or rats in his rhododendrons, I forget.
7:30
But anyway, that was in there. And one of the things that I
7:34
noticed was that there was just stuff in the Eric's War history
7:39
that regarding Universal Studios down there and things like that.
7:43
And then other things that came out later on, but I don't think
7:47
it was relevant. And I'm not sure I even couldn't
7:49
validate it. So but yeah, the big thing was
7:52
the Internet searches because, you know, and I tried to go to
7:55
the website that they were from. And what happened is when it
7:59
came out that that website was involved because it was just a
8:02
weird little chemical. It was a chemistry website.
8:06
That guy got so overwhelmed with traffic that he probably went
8:10
broke and had to take it down. But anyway, here's what I
8:14
remember and this is what was stuck in my brain the whole
8:16
time. And this never came out at
8:18
trial, but I explained it to Jose because the what happened
8:23
was, and the chart you guys have were going to ask me about, I
8:26
think later on, was a chart that I created for Jose to use a
8:29
trial that showed the actual what was going on with that
8:34
browser and what it was. Asin was obsessed with Myspace.
8:39
Myspace was big back then. I had several cases involved in
8:42
Myspace and she had gone to Myspace 81 times.
8:47
Somebody, I don't know if it was her or someone else, went to
8:50
that website that had that one page that contained chloroform,
8:54
sat on it for 54 seconds and went to Myspace again.
8:58
So that was the only chloroform search or visit ever that was
9:04
found on this. So that's hardly in my mind
9:07
enough to establish that somebody's learned how to make
9:09
core form from a web page that they sent on for 54 seconds and
9:14
they did not print, they did not screenshot it, they did not save
9:17
it. So I think, quite frankly, it
9:20
was Much Ado about nothing. Interesting.
9:23
Now you mentioned Jose, is he who you mainly dealt with on the
9:26
legal team or who were you interacting with and like doing
9:30
the updates and sharing the report and asking, well, what do
9:32
you want to do next? Only with Jose.
9:34
I only worked with Jose during that time.
9:37
Yeah. And it was interesting because I
9:39
think you were going to ask me. I know you're going to ask me.
9:41
Why didn't I testify? So here's one of the things.
9:45
Well, one of the things that happened which was interesting
9:48
to me is that we had a guy who was going to testify at trial.
9:52
And in order to testify, you had to be on the witness list.
9:56
And originally I was on the witness list and then Jose took
10:00
me off because this was Jose's First Capital trial.
10:04
He'd never been through a capital trial.
10:06
And by then I'd already done 10, I think.
10:08
And so he was very nervous about what I might get asked if I went
10:14
to trial to testify because he and I talked about a lot of
10:18
things during my time with him. And I spent time with him in
10:22
Orlando on multiple occasions. We did a lot of talking about
10:26
the case. And so I think he got to the
10:28
point where he felt like I knew too much about the case, which
10:31
it which, if you understand how it really works at trial, they
10:35
can't really ask you things outside of the report much.
10:38
I mean, they can't just go off on a tangent and start asking me
10:40
about, but what did you and Jose talk about at lunch?
10:42
Right, Exactly. But Jose got kind of nervous
10:45
about it. So we found this other guy, or
10:47
he found this other guy that's going to testify who was
10:49
actually a PhD smart dude. And so they put him on the
10:53
witness list. But apparently he also did some
10:56
work for the Sheriff's Department down there.
10:58
Who informed him then, if he this is my what I understand
11:01
this is maybe fifth hand information, but my
11:05
understanding is that he was told that if he testified for
11:08
the defense, he'd never worked for law enforcement.
11:10
And that's the way it always was in my dealings with a lot of law
11:15
enforcement. It's like it was one side or the
11:18
other. You couldn't go and do anything
11:20
else, and if you testified for the defense, you were a right
11:24
betrayer, so he's going to work for that.
11:27
Did you ever speak to Casey Anthony?
11:30
No, no, I didn't. I've never even met Casey.
11:33
I only saw her from a distance. I spoke to Cindy Anthony one
11:36
time for just to say hi, but she was pretty strongly I guess.
11:43
So I did a laptop. I did do that desktop.
11:47
I did another desktop that was never given to law enforcement.
11:51
I had her phone and I had all the friends phones.
11:55
You remember there were a lot of friends that there was all this
11:58
texting going on and a bunch of other stuff.
12:01
So for some reason I got all the phones and imaged them and
12:05
looked all the phones and some of what I did was recover media
12:09
and provided that back to the defense teams, movies and
12:12
pictures and things from me. You received all of that
12:15
evidence through discovery and then you just analyzed it and
12:20
then provided the results, all doing this all on your own time.
12:26
I mean, if I think somebody's getting railroaded, I'm going to
12:28
help them, you know, whether they have the money or not.
12:31
And and I've done that. And she was one of the probably
12:35
the larger cases. I did that what that.
12:37
And it wasn't because it was Casey Anthony.
12:39
It was just because it was somebody who, and you could
12:43
thank Nancy Grace for this. Well, I thought what I thought
12:46
was getting railroaded. I mean, according to her, she
12:49
was going to burst in the flames at any moment in time, anyone.
12:52
And right up until the bitter end, all in the media was like,
12:56
oh, she's going to get convicted.
12:57
She's going to burn at the stake.
12:58
You know, it was it was interesting the day that she got
13:03
acquitted. But the thing that I wanted to
13:06
say is that, and I think you'll find this interesting, is I've
13:10
done a lot of computer work over the years.
13:12
And one of the things that you do computer forensics or cell
13:15
phone forensics, one thing you know is that when you start
13:18
digging around at people's computers, you're basically
13:21
digging around in their brain. You know, that's what they do.
13:24
That's what they're interested in, and that's where they go.
13:27
That's what they buy. You know, and I've had cases
13:30
where a lot of what I pulled out of the computer was the
13:35
psychology of the person to provide to the defense.
13:38
And the reason I say that is that as I went through all of
13:43
the computer stuff, I never saw anything suspicious.
13:47
Yeah. So you can think it should be
13:50
suspicious, and I didn't think there should be suspicious slip
13:53
in there. And I'm looking for it.
13:54
I promise you, I never saw any of the weird things that you see
13:59
in capital cases a lot of times. Interesting.
14:02
Did you receive the written reports from Stinger and
14:06
Osborne? I know from testimony Osborne
14:08
definitely wrote one and it did you get that one and did Stinger
14:12
write 1 and did you get one from him?
14:14
I believe I remember getting reports on them and what's
14:17
interesting and I didn't really find this out until a month
14:21
later. One of the big questions in the
14:22
case was about clock time and whether or not it was checked
14:26
and what was the offset. Because one of the first things
14:29
we all learn and any kind of forensics is first thing you do
14:32
is check the cloth against the real world clock and see what
14:35
the offset is. Yes.
14:37
So you know how to handle the time stamps, right?
14:40
And what I never received was that one report that had that in
14:45
it because I looked for it and I dug through files and there were
14:49
hundreds of pages of discovery in Jose's office.
14:53
And I dug through them trying to find that one report that would
14:57
give me that offset. And I never did find it.
15:00
And I didn't, it didn't find it until after the case was over.
15:03
I was back down there and I said, yeah, Jose, I never did
15:06
find this report from Sandra about this.
15:09
This is all I thought. I didn't try here.
15:10
I said, well, that's a lot. And remember I wasn't present
15:15
for the testimony of the trial. I was in Orlando and I think at
15:19
the time I can't remember what the Zoom equivalent was back
15:23
then. Go to meeting and something like
15:25
that. One of the attorneys.
15:26
Skype maybe? No, it wasn't Skype, OK, But it
15:30
was something like go to meeting and Oh yeah.
15:33
And they had had it set up in the courtroom, so when I was in
15:36
the safe house I could communicate with them.
15:39
So not with Jose, but with the attorney who was operating it,
15:42
who would send me questions and I'd send back answers.
15:45
I was wondering if you did anything real time during the
15:48
trial and how you did that So that answers that.
15:52
Was he doing it on his BlackBerry?
15:54
Because I saw the person, I think it was on behind Jose.
15:58
Somebody, a guy was sitting there and you could see him
16:00
here. I'm like, dude, are you even
16:02
listening to the trial? So maybe he was typing you
16:05
questions then? No, it was actually a female
16:09
attorney. OK.
16:11
She was really a great attorney. She was.
16:15
Was she an attorney or psychiatrist?
16:17
She was a female attorney. Yeah, and she was the one that
16:20
was operating. OK, so I don't know what that
16:22
dude was doing and I think it was on the I could always see
16:26
him on the defense side, but maybe he was sitting on the
16:28
prosecution. I don't know what he was doing
16:29
on his phone the whole time now then still.
16:31
So did you receive the extracted, recovered, deleted
16:35
Internet history file to analyze as well?
16:38
You mean the actual file that was just the more DB or
16:41
whatever? Yeah.
16:43
So when they sent me the hard drive and I have that, and then
16:47
not long after that or maybe even at the same time, I got
16:50
all, in addition to that, the more DB they had carved out of
16:53
unallocated space and I got the report about them carving it out
17:00
of unallocated space. Attached to that was their net
17:04
analysis report. OK.
17:05
That was yeah, my my next question.
17:07
Did you get the net analysis report?
17:09
I did. And so was that one generated?
17:11
It sounded like they generated 2, or maybe they reformatted it
17:17
because it sounded like in the testimony Osbourne created a net
17:20
analysis report and then Stinger had a net analysis report.
17:23
Yeah, I think they did reformat it or maybe they narrowed the
17:27
the scope. The columns, yeah.
17:29
Well, yeah, maybe even even the scope of how many records would
17:33
have been in it, because you don't need a month's worth of
17:35
net analysis. Yeah, it's 1000 pages, so they
17:38
probably just reduce the size of the report.
17:41
Right. And then at the same time, did
17:43
they give you that cash back report or did that come on like
17:47
later down the road? Action don't remember seeing the
17:50
cash back report. Did John, did Bradley create a
17:54
written report and what did it say?
17:56
Well, it was a Canadian expert report.
17:59
It said the will state of I think John badly.
18:02
I did this tonight. And then he went on to talk
18:05
about a little bit of his credentials, what he does.
18:08
And then the fact that he had was the author of cash back and
18:14
that he had parse that file and this was the result of parsing
18:18
the file. And I he wrote that report, I
18:20
think before he got the big surprise that his report was
18:24
wrong. Do you have any idea why Bradley
18:28
testified about that cash back report?
18:31
Because the way it comes off in the testimony and what he's
18:34
saying was he didn't generate that cash back report.
18:38
Stinger generated that cash back report.
18:41
And so he was testifying about a report that somebody else went
18:45
click, Click to generate on. Is that right or tell us?
18:48
What? I don't know.
18:49
I didn't hear the testimony. And the reason for that is even
18:53
though I was in Florida and I was not on the witness this list
18:55
and I was not allowed to go in the courthouse.
18:58
Right. You had to be on the list to get
19:00
in the courthouse. Jose still thought he might try
19:03
to call me the witness. So they can't be sequestered.
19:06
Yeah, from that standpoint. So I didn't watch it on TV or
19:09
anything. I always communicated with the
19:11
attorney via the humble connection.
19:14
Well, maybe you can answer it based more on just your
19:16
knowledge of what he said in his written report about like why he
19:21
was testifying about Stinger's cash back.
19:24
Well, it wasn't clear in his report to me that he was going
19:27
to testify about Stinger's cash back.
19:29
It was the way I read his report.
19:31
He was going to testify about his analysis of it.
19:34
In any event, whether, well, you know, it's kind of funny.
19:38
I don't know how he would have parsed the database without
19:40
creating a report using his software because that would be
19:44
nonsensical, right? So he had to have been able to
19:46
at least create a report. I don't think that he had a copy
19:49
of the database, though, when he left to go back to Canada after
19:53
he parsed it. And I don't know that he really
19:56
even thought much more about it after that because it wasn't,
20:00
you know, he's in wherever he is in Canada.
20:02
It's not, it's not Orlando. So he's not seeing Nancy Gracer
20:06
not and and he's not seeing people marching back and forth
20:10
in front of the house. So I don't know.
20:13
I just know that I read his report and I was surprised that
20:16
he said 81 visits and I'm going like, this doesn't make any
20:20
sense to me. That's what I saw, and that's
20:22
what I remember from his written report.
20:25
Oh, so he was talking about some of the data in the report itself
20:29
then? Yeah.
20:30
Interesting. Yeah.
20:32
So, so we know there was quite a few pieces of evidence and quite
20:37
a bit of data there. Describe at a high level your
20:40
methodology for digging into it. Like where did you start and how
20:44
did you approach it? I did the way I do every
20:47
analysis. I mean, first thing you do is
20:50
you have to go through and do all the processing, right?
20:53
So when you're using, I don't, I never used FDK back then.
20:56
I didn't in later years. But you're an NK shop.
21:00
That's right. I was an NK shop and net
21:03
analysis and Microsoft, Microsoft shop because what I do
21:09
is started doing forensics. You did it by hand.
21:11
You didn't have NK or anything. You just had to know where it
21:14
was and how to parse it out. But anyway, in cases back then,
21:19
it was a lot easier to use than it is today.
21:23
I mean, pre NK seven, it was a heck of a tool, but it was
21:27
pretty easy to work with. It was easy to go through and do
21:30
things with. But in case was not, you know, a
21:34
a really automated tool. I mean, it was something that
21:37
you could do stuff with it, but if you wanted to dig in, you had
21:40
to go find what you wanted to dig in and you had to do it use
21:43
it in case as as your hammer and saw.
21:46
But you would still had to be the brain, right.
21:48
So the only artificial intelligence involved with me,
21:52
but I would have gone through and I would have done all the
21:55
file recovery that you typically do because in any case, it does
21:58
depend on the file system. And I don't want to get too deep
22:01
in the weeds, but it automatically automatically
22:03
recover, recovers some deleted stuff.
22:06
And then you have to go through and do manual carving if you
22:09
want to or whatever. So you would always go through
22:12
and carve a certain kind of number files, right?
22:16
And in case had this beautiful thing where you could go in and
22:18
do filtering and you can go through and set up little
22:21
routines to run. So if you want to go get all the
22:24
media files, you'll get all the media files, right?
22:27
And you could exclude certain kinds because you know they were
22:29
going to be garbage. You could go through even and
22:31
recover the printer files and things like that.
22:34
Which is what I did. Because to me it was important
22:37
to know if anything got printed. And as it turns out, it was
22:40
important to know whether or not anything got saved or screen
22:43
printed or printed from that website.
22:44
So when the term came up as being such a big deal, yeah, I
22:49
went through and went back through numerous times, and then
22:53
fewer searches for chloroform, and then all through an
22:56
allocated space and everything else and looking for anything
22:59
related to it. Right.
23:00
And the thing about it, too, is that when you go through and
23:04
look at the way that Google does stuff and it still doesn't.
23:08
But back then it was even more obvious when somebody typed in a
23:11
word and misspelled it and then Google would correct it.
23:14
Where you'd get to Internet history records for that, the
23:18
idiot one and then the corrected 1.
23:19
So, and that's where some of the interesting Internet history
23:23
came from. Anthony Case was misspelling.
23:27
So somebody would go in and misspell word and then Google
23:30
would correct it. And then, you know, you get an
23:32
option at that point to click on a link to go to a site, right?
23:36
This means where it's been corrected.
23:38
So you may go in there and type in a word and misspell it maybe
23:42
fairly bad and Google will correct it and you'll go
23:45
somewhere you didn't intend to go because you just clicked on
23:47
the link, right? I'm not saying that happened,
23:50
but in the case of the floor form, I know it was initially
23:53
misspelled anyway and then Google corrected it.
23:57
Somebody clicked on the link and that's where they went.
24:00
And then then right after that they went box.
24:02
That's so. And the vast majority of the
24:05
Internet history on those computers, no matter which
24:07
browser it was. All my things.
24:10
What was your approach to finding and actually recovering
24:14
that deleted Mork database that had that Mozilla Firefox history
24:20
in it? Did you just like go and repeat
24:23
the steps that law enforcement did, or did you start completely
24:28
blind? Tell us about that.
24:29
Sanders report was pretty detailed as they all order back
24:33
then. It still should be.
24:34
But when she did the, when they carved it from unallocated
24:37
space, they'd give you the offset of where they found it on
24:40
the hard drive, right? Because it's, it's not somewhere
24:43
you can just like, oh, hey, go to this directory.
24:45
It's in an allocated state. So they give you a file set.
24:49
So I went to the file set and I decided that I would carve more
24:55
than she had carved. And you were doing it manually
24:57
so you could select I want to start here and there.
25:01
So that's what I did. I just carved what she had plus
25:05
on both ends. And when I did that, I got about
25:09
15 more records out of the more database than they did, but they
25:13
were not relevant reference, they were just telling
25:16
reference. Now we were talking about this
25:18
when we were prepping and I and I found this fascinating.
25:22
You're talking about how the more database worked.
25:24
And I said, well, you know, so since you found more records,
25:28
did they miss a little bit at the top, like they didn't get
25:31
started the header or did they not go all the way to the
25:34
footer? So do you want to go into some
25:37
techie details about that? Sure.
25:38
So most everybody today that does forensics is definitely
25:42
going to be familiar with the SQLite database.
25:44
Right now, SQLite database is a standard traditional relational
25:49
database. OK, so every table relates to
25:52
another table basically. So when you look at a table,
25:55
you're going to find foreign keys that tell you how to find
25:58
things, right, and how to look up, you know, a record that is
26:03
related to this table and another table.
26:05
So when you get all those tables together through those foreign
26:08
keys, you come up with a record that means something.
26:11
OK, that's how we understand it. So, and most people were
26:15
familiar with Microsoft Excel. And if you look at a database,
26:18
it looks sort of like Excel. You have rows and columns,
26:22
except them in a database, they have fields instead of cells.
26:26
And now it comes to more it looks nothing like anything of a
26:31
sane. What's the right way to put it?
26:33
An intoxicated person with what? Because when I looked at it, I'm
26:38
going, man, this ain't because I read the technical write up of
26:43
it by the guy that wrote it and I'm going, why?
26:46
Why didn't you do this? Because it was flexible.
26:50
In other words, it would have more records.
26:53
It would have more fields for a record based on the data, OK.
26:57
So if you didn't have this kind of data, then it would shrink,
27:01
OK. And then if you had more of this
27:03
kind of data, it would expand. It would have more films, if you
27:07
will. And it was very weird.
27:09
So you had to look for keys in the data.
27:11
So that's a little like Jason from that standpoint.
27:14
But you'd have something that tells you that it's the end of
27:16
it because of the formatting. But it wasn't the kind of thing
27:19
that was easy to interpret. And I think that's where Bradley
27:23
got messed up because, yeah, he probably looked at it and parsed
27:28
it based on a Usually when you're writing a query or
27:32
something that where you're going to iterate through
27:35
something, you know, you're going to go here, I'm going to
27:37
go look at this. I pretend you're going through
27:39
sentences and you're looking for words, right?
27:41
So I want to find every instance of I in the sentence or which.
27:46
But if all your sentences are the same when we, it's easy to
27:49
do, right? But if your sentences are not
27:51
all the same length, it gets more difficult.
27:53
And that's the way the more data is.
27:55
So I think that Bradley went at it like it would be a SQL
27:59
database or standard relational database and maybe got tripped
28:03
up by this flexible length of the.
28:06
Record when you recovered that MORG database, Did you run that
28:10
through net analysis? Yeah, I did.
28:13
Yeah. And.
28:14
Did your Did your results match Orange County Sheriff's Office?
28:19
Perfectly. And you know, outside of the
28:21
fact, like I said, I got a few more records than they did,
28:24
which was not relevant, but just told me that, you know, it
28:28
looked like good data. And, and I actually went into
28:32
the database myself and verified what net analysis said.
28:37
It said. And if you go to the net
28:39
analysis site, the dude that wrote that software, he did a
28:44
highly technical review before. I care to go through today about
28:50
that because he felt very vindicated.
28:53
That NEM analysis sparked it correctly.
28:56
And I don't want it, you know, that's you're trying to sell
28:59
something and you did it right. Never got it wrong.
29:01
Good for you. But it was.
29:04
Yeah. And like I said, it was quite
29:06
the firestorm when that came out.
29:07
And one of the reasons, I don't know if we even got here yet.
29:11
But, you know, I worked on that case for a long time and then no
29:14
one knew I was actually working on that case until it was over.
29:18
And I kept it that way because of the how acrimonious that case
29:23
was. I mean, people were losing their
29:25
minds over it and they were getting dangerous and I just
29:29
didn't want to deal with it. Yeah.
29:31
Were were people receiving death threats that were involved in
29:34
the case? Yes, to my understanding.
29:37
And there was this website called Web Suites, if you
29:41
remember them and they just, it was, it had turned into a cult.
29:46
I mean, it was crazy. I remember that the day, the day
29:50
that she got acquitted, later in that day, I saw on the news
29:55
where someone somewhere in the Midwest thought they saw Casey
29:59
Anthony get into a car and rammed it with their pickup
30:02
truck. I mean, it was just that crazy.
30:04
And remember, if you remember that when they acquitted her and
30:08
they left the courthouse, they had to leave in a secret
30:11
caravan. So they sent multiple caravans
30:14
out, kind of like they were trying to hide the president
30:16
during an assassination attempt. It was that crazy.
30:19
So when I was in Orlando, I had to make sure that no one knew
30:23
why I was there. I stayed in safe house.
30:27
So this was before Airbnb, but they actually had a house that
30:30
had rented for the defense team. When I went down to that's when
30:34
we stayed, was in a gated community.
30:36
Yeah. It was good times.
30:38
Wow. Now, some of the things that
30:39
have been said about the issue with net analysis was the issues
30:44
with handling the daylight savings time.
30:47
And so it was an issue with the daylight savings time on that HP
30:52
computer. Did you see the same time
30:55
issues? Like I shouldn't use net
30:57
analysis because it's not handling daylight savings time
31:01
correctly, I should try to use something else?
31:03
That would be not much of A fixed use, quite frankly.
31:06
I mean, there were a lot of tools that didn't have daylight
31:09
savings time back then. So, you know, if you what you
31:12
had to know was what was the offset from the computer time?
31:15
So if the record said 1:00 AM or 1:00 PM or whatever and the
31:20
computer clock was off by two hours, then you would know to
31:22
correct it, right? And even though the report might
31:25
say 1:00 PM, when you go to testify about it or actually
31:29
write your report around it, you would have to say, OK, these
31:33
records say 1:00 PM. But when you calculate the
31:37
offset, it was actually, you know, 11 AM and and that's the
31:42
way it would have been dealt with.
31:44
That's the way it should have been dealt.
31:45
With SO besides the daylight savings time, were there any
31:49
other problems? My rumoring that I saw with the
31:52
times, you know, one of the things that came up at trial is
31:56
my understanding was an issue with some searches that were
31:59
done related to, I think this was the foolproof supplication
32:04
or something. And it was whether or not Casey
32:07
was home at the time or George's home.
32:10
OK. And that was kind of a big
32:12
discrepancy. Nobody could tell because we
32:14
didn't know exactly what time the computer time was.
32:17
But in reality, somebody did know and it was in a report, and
32:22
I just never got the report. So how it was not known, it's
32:27
kind of a mystery to me because it was in one of Sanders reform.
32:30
Now besides, you know the MORC database, that Firefox history
32:35
that was recovered, was there any other browser history that
32:39
existed on the computer but wasn't introduced at trial?
32:42
Yeah, so the they used the Firefox and they used Internet
32:46
Explorer. And I, I don't remember what
32:48
version of Explorer was, it's probably three.
32:51
It was a long time ago. But I don't, I analyzed both of
32:55
them. And like I said, Internet
32:57
Explorer had some odd searches in it for how to make homemade
33:02
weapons for the zombie apocalypse.
33:07
And then part of it was pesticides.
33:10
Part of it was for some nursing related things.
33:15
Some of it was shopping, you know, because one of the things
33:17
I noticed that was Casey was shopping for toys for Kaylee
33:22
and, and bought some not too long ago before she disappeared.
33:27
And then one of the things that that I probably mentioned this
33:31
already, you know, having done a lot of death penalty cases,
33:34
because North Carolina has a death penalty case and a lot
33:38
states still did back then. And by then I had already done
33:40
multiple death bombing cases and quite a few first degree cases
33:44
too. And you always go through your
33:46
computers and you're looking for things to help the defense or
33:50
help. A lot of times I work with
33:52
providing information to the psychologist or psychiatrist
33:56
who's going to deal with the defendant, right?
33:58
And so they're looking for that and you get kind of used to
34:03
looking for things that stick out that don't belong, right.
34:08
So, you know, if somebody's on a, if somebody's in a, in a
34:13
discussion group talking about, you know, how to how do I
34:16
dispose of a body or how much line does it take for somebody
34:19
to disappear? Things like that, you know,
34:22
things that would stick out to you.
34:24
And I never saw anything like that, never looking for nobody
34:27
looking for body bags or how they conceal something or
34:31
anything like that. And usually and in case in like
34:33
Casey Anthony's case where Kaylee would disappeared, one of
34:37
the things that would look for would be how to to hide
34:40
something or how to keep from being discovered, right?
34:43
And there was nothing like that. And in the cases I've done in
34:46
the past, I count things like that every time something
34:50
something. So did you have to prepare?
34:54
Did you have a lot to prepare for trial?
34:56
Did you? What did you do for trial prep?
34:58
You're just trying to make sure that the attorney, if he's going
35:02
to ask a question, that he knows what the correct answer should
35:04
be so that he understands what he should be asking and what he
35:11
should be hearing. And you know, Jose did his own
35:14
thing for the most part. But what would happen is every
35:18
day I would, I had the evidence with me and I had a computer
35:22
with me and I had all my friends itself with me.
35:25
And you always have your key ring of dongles, right?
35:27
That's the thing that you do. Yep, still have them.
35:31
Yeah, yeah. That's because.
35:33
We're old and we don't like the cloud licenses.
35:36
That's right. I had all of the stuff with me
35:39
and I actually had the ability to go through and reparse all
35:43
that stuff. And I did.
35:44
And when I first got Bradley's report and he says, oh, there's
35:48
81 visits to the school reform site, I'm going, what the hell
35:52
did I miss? You know, because you always
35:54
have that initial moment of freak out.
35:56
It's like, wow, did they get it right and I got it wrong right?
36:00
So that's when you go through and you dig through it again and
36:03
you may retrace your strip your steps and completely redo the
36:07
exam. And that's what I did.
36:09
I completely redid the exam around that just to make sure
36:13
that whatever I was going to send Jose in there with was
36:17
going to be accurate. And one of the things that would
36:19
happen is, is every day. And then he was he would come
36:24
back to the house and he'd look whipped because it was, you
36:26
know, sitting in court all day was hard.
36:28
And of course, sitting out in the hallway sequester is harder
36:30
it. Is.
36:32
Right. But he would come by every night
36:34
and I was doing multiple things while I was there because part
36:36
of what I was doing also was doing all of the cellular
36:40
analysis for the location work because apparently somebody down
36:43
there had done the cell phone location work.
36:47
And back in those days, it wasn't like cellular analysis.
36:50
It's now where you get a lot of good data from the cellular
36:53
companies. Back then, you got just an
36:55
orientation, northern orientation or southern
36:57
orientation. And that was one part that I was
37:00
looking forward to. I was like, yes, because the law
37:03
enforcement guy had got it upside down and I was.
37:05
Going to say listen. It's going to be so much fun.
37:08
And they never did bring it in, but but Jose would come by every
37:11
night and we would review whatever I had found that day or
37:15
had done that day, along with whatever he wants to know.
37:19
And then he would come back by in the morning and pick up
37:22
whatever I had prepped for him for court.
37:23
So he may come by and say I need this or I want to know about
37:26
that. And when we were dealing with
37:28
the MEND analysis thing, I created a chart for him to use
37:32
in court that showed, you know, here's all the visits to
37:35
Myspace, here's the core form site, here's my space.
37:39
And I think that's the chart that came up in court.
37:41
I think that's where he had Stinger on the stand and he was
37:45
having him work backwards where he had Myspace start at 84 and
37:49
then he's like and now go backwards to the next day.
37:53
And I thought he was kind of rude about some of the language
37:56
he used with Stinger. I'm like just, I don't know that
38:00
that's called for. But yes, we get your point.
38:03
You're trying to say 84 -, 1 is 83 sort of situation, OK.
38:10
Did the state fail to admit into evidence in the net analysis
38:14
report before the defense through the prosecution's
38:20
witnesses? Well, what happened was the
38:23
prosecution never introduced in that analysis report, and
38:26
because the defense did not have a witness because our guy had
38:30
bailed on us and I had been taken off the witness list, the
38:33
only way to get it in was to call one of their experts back
38:37
as an expert and introduce it to them.
38:40
Wow, have you seen that done before?
38:42
Yes. Oh, OK.
38:44
Florida is an odd state. It's one of the few states where
38:46
you can actually propose expert witnesses in criminal trial.
38:52
Did you ever track what the jury said about them rendering a not
38:57
guilty verdict regarding the death of Caylee Anthony?
39:02
Yeah, I didn't hear about that. And one of the things that was
39:05
interesting in that trial and something that I think some of
39:08
the jurors said after the fact, once they were able to come out
39:12
of hiding, I think because they were people were mad at them big
39:16
time and I think they got death threats.
39:19
But one of the things that was a big factor in that case, I think
39:23
the digital forensics was a big factor.
39:25
But the other thing that was a big factor was all this these
39:27
other novel forensics things they tried to bring in that were
39:31
untested and untried. And the issue that the jurors
39:37
brought up was that, well, a couple of things happened in
39:41
that case that really drew things for a loop.
39:44
But one of the things that was a big issue was the fact that they
39:48
never got a cause of death for Kaylee.
39:50
So without having a cause of death, they couldn't determine
39:54
if she had died through nefarious means or through an
39:58
accident or anything else. I mean, if she had died just in
40:02
an accident, then the worst thing that it would have been
40:05
would just been, you know, high in the body, you know, 'cause
40:09
you got to prove that she was actually murdered in order to
40:13
get a homicide. Murder, right?
40:16
And they couldn't prove that. They just proved they found her.
40:18
She was dead, but they couldn't prove how and they couldn't
40:21
prove why or anything. I think that's where the kids
40:26
fell apart. And the Laura form was a such a
40:29
big part of the prosecution theory because they said, well,
40:32
you know, she went to this website and learned how to make
40:35
Laura form. So she was Kaylee Chloroform.
40:38
So she hired her in the front to a party, and she died in there.
40:42
Well, did you hear the thing about, you know, I'm sure people
40:46
are familiar with the nanny thing.
40:47
She said, Oh, I dropped her off with the nanny and then I never
40:51
SAR again. And people were saying Zanny the
40:54
nanny and then they were saying her friends were like, Oh my
40:58
God, she's using Zantacs to make her child sleep slash pass out.
41:04
They thought that that's why the IT was Zanny the nanny.
41:08
Who knows, I mean maybe, maybe there was some Zantacs involved.
41:12
But you didn't see any computer searches for it that you recall.
41:15
Nope. Nothing related to drugs.
41:18
And, you know, plenty of those pictures from the parties.
41:21
You know, she was. Yeah.
41:24
I didn't get a chance to talk to Casey, but my understanding is
41:28
that she couldn't tell you her name without lying about it.
41:30
And I've known people like that. I've had, you know, work cases
41:34
where the defendant was like that, where they, they couldn't
41:36
say a sentence without lying. And I don't think they know any
41:39
better, you know, And what's the definition of a, of a, of a,
41:44
what kind of wires that they they buy when the truth will
41:48
serve them better, you know? So that's, that's kind of where
41:52
she was, Yeah. So other than everything that
41:54
you've told us and some craziness from this case, was
41:58
there anything else that really just surprised?
42:01
I was in a hotel somewhere up north and just walking in, some
42:06
guy about my age came in and he was driving a pretty hot car.
42:10
And I said, man, it's a nice car.
42:11
And he says thank you. And we're standing in love with
42:14
the lobby talking and, and I don't know how it came up.
42:18
Something about the after the case.
42:20
He says, well, she did it, you know, and you know she did.
42:22
I said, I don't know that she did it.
42:24
I said I worked on the case a long time and I still don't know
42:27
what happened. He said well, she did it.
42:30
He said something that offended me.
42:31
I said I really don't care what you think.
42:33
I don't have any trial. Like I said for over 2 years and
42:36
I was had a lot of conversations with Jose and I would be in
42:39
Jose's car when he's talking to other people on the trial or on
42:43
the case and on the team. And, and one of the things that
42:48
you do, and this is true a lot of times in the cases that I
42:52
work with, is you do your work and then you move on and the
42:56
case might still be going on, right?
42:57
I mean, hadn't gone to trial yet.
42:59
Did your work a year before. And if you're not going to
43:01
testify, you know you're doing something else, right?
43:04
So you may never know what actually happened.
43:07
There have been cases where I've been so deeply involved.
43:11
And at the end of the day, you have to tell us people.
43:14
Sometimes the only people that know really what happened is the
43:17
victim and the murderer, period. No one else will ever know.
43:22
And that's what happened in the case and the case.
43:24
And the most shocking thing to me, and I started I guess to
43:27
drink with media kool-aid, was when she got a bit acquitted
43:31
because I just, I heard so much against her constantly that I
43:37
didn't think she could get a fair trial.
43:39
And I didn't think I see how independent of the evidence.
43:43
I thought she was going to get convicted.
43:44
And, and we've all seen cases where somebody got convicted
43:47
independent of the evidence, right?
43:50
That's right. And some of the best cases I
43:52
ever worked was where I got people out on my haggins.
43:54
That should never go on the kids so.
43:56
Well, Larry, I think you mentioned something like, you
43:58
know, on this case, you're a lot more into it and you kind of
44:02
stayed with it versus other cases.
44:04
And this was my experience in the FBI is I'm just working so
44:08
many things. I'm doing it.
44:10
I didn't know what happened with like 95% of my cases that I
44:16
worked, but now and I was so far removed from everything.
44:20
But now, now that I do stuff independently, I'll have some
44:24
criminal cases. I'm much more involved, have
44:27
much more touch base. And then I'm like talking back
44:30
and forth with the lawyers and it inevitably goes down a
44:34
tangent. It's not strictly business.
44:36
So they, you know, there's just much more personal involvement.
44:40
Not like personal nature, but I mean, you're just much more in
44:44
it and interacting with people, which is so different than my
44:47
experience in the FBI. Yeah, that makes sense.
44:50
I mean, because some cases and you end up doing weird things in
44:55
our business over the years, some of the cases that I've
44:58
done, you know, the service that I've had to provide was to sit
45:02
down with the defendant and his wife and his parents and explain
45:08
to them why he's going to prison, OK, Because he doesn't
45:11
want to tell them the truth because he's still embarrassed,
45:14
right. Or you sit down with an attorney
45:17
and a defendant and the defendant, the attorney's trying
45:20
really hard to help him. And the defendants just made a
45:23
jerk to him. And some of those defendants are
45:26
the ones that I'm happy to see go to jail and go go to prison
45:30
forever because that's where they belong.
45:32
And the way that all the twists and turns of some of these cases
45:37
are so interesting. And, you know, I did a case and
45:41
years ago, I ended up having to go buy a shotgun after the case
45:45
because I was concerned about my safety.
45:49
And you know, you just never know what's going to happen,
45:52
right? You don't, you don't Now have
45:54
you done any additional work or any other investigations
45:58
consulting with this legal team or any of the different members
46:02
of that legal team? I did the second time that Aaron
46:07
Hernandez was tried for homicide.
46:09
I caught that case with Jose and I didn't testify that case.
46:13
One of the guys on our team did. But I started on the case that I
46:16
did the work and then I turned it over to Jake Rain, who
46:19
testified, and Aaron Hernandez got acquitted.
46:24
And the reason he got acquitted was because the things that they
46:27
thought were very helpful for the prosecution turned out to be
46:30
not so helpful with the Internet records and things like that
46:34
because they didn't do the time offsets, because Internet
46:38
records could be very strange, right?
46:40
Especially if you're crossing state lines.
46:42
It's kind of like cell power records when you have a switch
46:45
sitting right on the boundary. Or if you got a switches in
46:48
Atlanta, but the phone's in New Orleans, but the switch doesn't
46:51
care and you have to manually fix it.
46:53
So things like that. Yeah.
46:56
So you've talked about working on with other high profile
47:00
cases. How many additional high profile
47:03
cases have you worked? I'm just list a few for you.
47:05
I did the Colorado theater shooting, which involved doing
47:11
300 hours worth of work. Oh my goodness.
47:13
Just to do all of the data analysis because I was putting
47:16
together all of the data analysis from the phones and the
47:20
computers into a single database that was searchable for the
47:23
attorneys. And then I did the Charleston
47:28
church shooting. I did the Pittsburgh Trio life
47:31
case. I did the well.
47:33
Name of a bunch of high profile cases I was probably the defense
47:36
action at. All Oh my goodness, you, you're
47:37
all over the country. Yeah, I did.
47:40
I did. A serial arsonist out in
47:42
California. Turned out to be a fireman.
47:44
It was set in Fires. I.
47:46
Think I remember that. That was a long time ago, too.
47:49
Yeah, I did. I might have been in LA then,
47:52
maybe that's why I remember. Could be.
47:55
I've done a lot of high profile cases over the years and I've
47:58
done, I did the case that was the largest breach in NSA
48:02
history. They lost 40 terabytes of
48:05
classified data. Oh my goodness.
48:06
So. I was.
48:09
Yes, Larry, we're going to throw a question at you.
48:12
Just your opinion. Do you think this case would
48:15
have had a different outcome today with the capabilities that
48:20
our tools have now and then, even the advancements in our
48:25
training that we can take? No, not at all.
48:28
And the reason for it is because even though our tools have
48:32
changed a little, the the data hasn't changed.
48:36
So there wasn't something else to find in that case that would
48:42
have made a difference in the computers and cell phones
48:46
because it just wasn't there. I mean, it's, it's the beauty of
48:51
things back then is the hard drives weren't as big.
48:53
We didn't have as much social media, we didn't have all the
48:56
chat apps that we have today. We didn't have encryption.
48:59
We didn't have all the barriers of doing good forensics today
49:04
and the complexities, I mean, because back then it didn't
49:07
have, you know, a half a billion apps on the App Store, so.
49:13
Yeah. I mean, it was a lot simpler
49:16
back then. I mean, not necessarily easier,
49:18
but it was, it was just not what it is today.
49:22
And a lot of it to the tools again don't really make the
49:25
case. I mean, it's really the sounder.
49:27
I don't know. When you go in to look at a
49:28
case, you have an example is you can take a framing hammer and
49:33
you can build a house or you can build a bank, right.
49:35
But your approach is not the same.
49:37
And that's the only forensic sense.
49:38
I mean, you have to go in, you know, the financial case, you're
49:41
going to do it this way. You don't homicide, you're going
49:44
to do it that way. You're doing see Sam, you're
49:46
going to do it a different way and you're going to be looking
49:48
for something different and you're a function be different.
49:51
So it's the examiner. It's just learning.
49:54
Use the tool. That's right.
49:56
Well, Larry, we've. Reached the end of our
49:58
questions. Yeah, Larry, thank you so much
50:00
for, you know, going through this with us.
50:03
Obviously, I had no idea until Stacy and I started talking
50:07
about, let's talk about the Casey Anthony case.
50:10
So we really appreciate you coming on and walking us through
50:14
some of this. Even though the testimony was
50:17
different and your role was a little different, it still gave
50:22
us a good understanding of what happened.
50:24
So thank you so much for your time.
50:26
Absolutely fun. I enjoy this kind of thing.
50:28
There's a lot of fun talking to you guys and I hope that people
50:32
enjoy it. Thanks again.
50:33
Yeah. Appreciate that.
50:37
If you enjoyed this episode, make sure to follow us to get
50:40
notified the next time a new episode drops.
50:43
If you can do more, head on over to parsingthetruth.com and
50:47
donate by clicking on the donate button.
50:50
Parsing the Truth is a nonprofit organization and we are raising
50:53
money to send a new digital forensic examiner to I Asus
50:57
training next year in Orlando. Thanks.