Latest / Parsing the Truth: One Byte at a Time / Bizarre Tactics and Browser Trails and Bradley's Testimony

Transcript

Bizarre Tactics and Browser Trails and Bradley's Testimony · Parsing the Truth: One Byte at a Time

• 0:01
  Join former FBI Senior Forensic Examiners Becky Passmore and
• 0:05
  Stacey Eldridge as they dig into the world of digital forensics
• 0:08
  one bite at a time. Now leading their own consulting
• 0:11
  firms and educating the next generation of cyber sleuths,
• 0:14
  these badass babes of digital forensics bring sharp insight,
• 0:18
  real world case experience, and a dose of humor to the bits and
• 0:21
  bites that filled today's investigations.
• 0:23
  From deep dives into business e-mail compromise and ransomware
• 0:26
  attacks, Becky Specialty to cracking the complexities of
• 0:29
  iPhone forensics Stacy's obsession, this podcast delivers
• 0:33
  insider knowledge for professionals, students, and
• 0:36
  true crime techies alike. If you've ever wondered what
• 0:39
  really happens when the digital trail is all that's left, TuneIn
• 0:42
  and start parsing the truth. Welcome back to Parsing the
• 0:53
  Truth One Bite at a Time. I'm Stacy, and today we're
• 0:56
  diving into one of the most high profile digital forensic
• 1:00
  testimonies in American courtroom history.
• 1:03
  You've probably heard of the Casey Anthony trial, but what
• 1:07
  you may not know is how a digital forensic expert named
• 1:11
  John Bradley became a pivotal figure in this case.
• 1:15
  From browser history to courtroom drama, today's episode
• 1:18
  unpacks not just what was said, but how it was said and what it
• 1:23
  teaches us about the delicate role of expert testimony in
• 1:27
  digital forensics. And of course, I'm joined by my
• 1:31
  lovely Co host Becky, who's going to help us analyze
• 1:35
  Bradley's time on the stand. Yep.
• 1:37
  Welcome back everyone. Glad to be back to bring you
• 1:40
  this episode. John Bradley was a software
• 1:44
  developer and a forensic examiner who created a tool
• 1:46
  called Cash Back. I never used that tool safety,
• 1:50
  did you? I did not.
• 1:51
  It's designed to analyze Internet cache and browser
• 1:55
  history. He also trained law enforcement,
• 1:58
  including members of the Orange County Sheriff's Office, on how
• 2:03
  to use his software. And that connection is how he
• 2:06
  ended up examining a Firefox Internet history file in the
• 2:11
  Casey Anthony case. So what made his involvement
• 2:15
  unusual was that he wasn't even hired directly as an expert.
• 2:20
  He wasn't even hired in the beginning.
• 2:21
  He was initially consulted and formally to decode data and
• 2:25
  identify data in unallocated space that had been deleted but
• 2:30
  not yet had been deleted but not yet overwritten.
• 2:33
  Before we get too far into the details and the key takeaways
• 2:38
  for this episode, Becky and I wanted to talk about just how
• 2:42
  bizarre we thought this testimony is.
• 2:46
  Not like the things that were said, but really it was the
• 2:50
  nature of John Bradley's testimony that we find bizarre.
• 2:55
  Like why he was called in to testify about this stuff because
• 3:00
  John Bradley was not hired by anyone to work on this case.
• 3:06
  I don't know about you, Becky, but when I was watching it, when
• 3:09
  they get to this point where they give John Bradley the cash
• 3:14
  back report, like I can see on his face he is maybe surprised
• 3:20
  or just kind of like what, what the heck is this?
• 3:23
  Because as far as he knows, and we know at that point, he was
• 3:28
  called in to testify about cash. Back and again, it goes back to
• 3:32
  this whole case and the order of the witnesses and how the
• 3:38
  witnesses were called in and what the witnesses were called
• 3:41
  in to testify on. And the mere fact that John
• 3:45
  Bradley is the tool developer, cash back tool developer, He's
• 3:50
  that software developer. He understands the insurance and
• 3:53
  the outs, the front end, the back end of this tool, what it's
• 3:55
  supposed to produce as far as I can tell.
• 3:59
  And much like what you said, he was very surprised with that
• 4:02
  report that's placed in front of him almost to the sense that he
• 4:07
  didn't create that and he didn't analyze it and he didn't produce
• 4:10
  use that report. But because John has that
• 4:13
  knowledge inside and out about a cash back report, it serves the
• 4:18
  purpose that they want him to testify to it.
• 4:22
  And so that's what what's in my mind bizarre in this case and
• 4:28
  how the all the witnesses were brought to the stand, right?
• 4:32
  Because when he's given that report, he says something to the
• 4:35
  effect of this appears to be a cash back report.
• 4:38
  And right, that demonstrates he didn't have any direct knowledge
• 4:43
  about this report. And in general, Becky, what's
• 4:46
  the rule for like getting evidence into court as an
• 4:49
  exhibit? You're the one that with most
• 4:50
  knowledge about that report now a peer reviewer, someone that
• 4:55
  can go back and reproduce the steps that you took to produce
• 4:59
  this report and they can articulate the same results that
• 5:03
  you articulated. They can testify to to to that
• 5:08
  kind of report. In my opinion, it didn't appear
• 5:12
  that he even had knowledge that this was report was ever created
• 5:16
  with his tool. Right.
• 5:18
  I, I agree with you there. He he certainly seemed
• 5:20
  surprised. And you know, that's why we just
• 5:23
  keep saying this is this is so bizarre.
• 5:25
  Basically, John Bradley was just sort of doing a solid for the
• 5:30
  Orange County Sheriff's Office. He was there for a training
• 5:32
  class. But you know, that's why he was
• 5:34
  not like hired on as a formal expert.
• 5:37
  He's just doing right place, right time.
• 5:39
  Or maybe now he looks back at this as wrong place, this wrong
• 5:43
  time. Right, right.
• 5:44
  But this is important because in digital forensics, recovering
• 5:48
  deleted data is like recovering whispers from the past.
• 5:52
  It's fragile, it's easily overwritten and must be
• 5:55
  interpreted with care. Now Bradley Stool recovered a
• 5:59
  3.2 megabyte file with browser history in, including search
• 6:04
  terms like the chloroform, which would go on to play a central
• 6:08
  role in the prosecution's narrative.
• 6:11
  Yeah. So in many ways, Bradley's
• 6:13
  technical explanation was he was doing the Orange County
• 6:17
  Sheriff's Office a solid. He was just like, hey, I'm here
• 6:20
  to help out, understand, I wrote the tool, I've trained you all,
• 6:24
  what can I do? So he described how cash back
• 6:27
  worked. Obviously he's the developer, so
• 6:29
  he's going to know the insurance and outs and how it works.
• 6:32
  So he explained also what contiguous clusters and
• 6:36
  unallocated space meant and how he was able to acknowledge the
• 6:41
  limitations of what he could definitively state, even cross
• 6:46
  validated his findings with his third party tools.
• 6:50
  And obviously that's best practice in digital forensics
• 6:54
  and what we do on a regular basis.
• 6:56
  He was clear that he couldn't tell when the file was deleted.
• 7:00
  And that's true, you can't tell when it was deleted and he avoid
• 7:05
  overstepping his conclusions, which is exactly what you want
• 7:09
  from an impartial expert. And to be fair, when he was
• 7:12
  testing, he explained browser behavior very well, especially
• 7:17
  how the history logs store queries like how to make
• 7:21
  chloroform and how the visit counters and time stamps work.
• 7:25
  But as we'll soon see, the way you testifies matter just as
• 7:29
  much as what you. Say that's right.
• 7:31
  When it came to the cross examination, things seem to get
• 7:36
  a little rocky. The defense zeroed in on
• 7:40
  inconsistencies, and at one point Bradley claimed 84 visits
• 7:47
  to one site, even though only two URLs were logged.
• 7:52
  Let me just jump in here real quick, Becky.
• 7:55
  Now, when we said he claimed there was 84 visits, Bradley was
• 7:59
  just reading things in off of a report he did not generate.
• 8:05
  The defense asks him a question. You don't have 84 URL's in your
• 8:10
  Internet history, do you, Sir? And Bradley's responses?
• 8:14
  That's correct. They exposed that he hadn't
• 8:17
  reviewed some sites, didn't always know the content behind
• 8:22
  the URL's, and couldn't determine if a human was
• 8:24
  actually reading the pages. The 84 visits was based on a
• 8:29
  visit counter within the browser history, but without additional
• 8:34
  data or corroboration that could easily be misunderstood by the
• 8:39
  jurors. And this is the defense's
• 8:41
  strategy and defense teams have strategies on how to get
• 8:47
  evidence in and how to allow people to read reports that they
• 8:52
  have knowledge of, but but maybe don't understand the context of
• 8:56
  what the attorneys trying to get across.
• 8:59
  And this is a key take away because all that Bradley was
• 9:03
  doing on the witness stand, testifying based solely on URLs
• 9:08
  that you're just reading in from a report without actually
• 9:11
  analyzing the data is what happened here.
• 9:14
  And he really has no breadth or knowledge of what he's reading
• 9:19
  into the record because it's not his report, it's not his
• 9:23
  analysis. He basically handled the file
• 9:27
  before the trial for a brief period of time to get it to
• 9:30
  parse out, and then he was done with it.
• 9:33
  And I just still think his whole testimony, him as an expert
• 9:37
  witness is very unusual. But, you know, he was very solid
• 9:42
  in his knowledge and expertise and how browsers and browser
• 9:47
  behavior works, like when it's automatically refreshing.
• 9:50
  But he couldn't definitively say what was manual user activity
• 9:55
  versus what was background loading.
• 9:57
  And the defense appeared to make that doubt work in their favor.
• 10:01
  And at times, he wasn't even clear about the scope of the
• 10:05
  analysis, He admitted on the witness stand by stating I was
• 10:09
  only asked to try to decode it. Beyond that, I was not asked to
• 10:14
  do any continued review or experiments and that's what I
• 10:18
  was alluding to earlier. And that statement right there
• 10:21
  is a direct quote from Bradley on the stand.
• 10:23
  That's right. That's right.
• 10:24
  So then where things there are things get even more
• 10:28
  uncomfortable and I say uncomfortable and I don't know
• 10:31
  how Bradley felt about it, but someone that's watching him
• 10:35
  testify, it can get uncomfortable, you know, if
• 10:39
  we're watching appear to testify.
• 10:42
  So things get particularly uncomfortable when the defense
• 10:47
  questioned his objectivity. And these are areas that we
• 10:52
  always focus on our objectivity when we're testifying, when
• 10:57
  we're working cases. And they pointed out he had
• 11:00
  posted online about his software being used in this trial,
• 11:06
  raising questions about bias or self promotion.
• 11:10
  That line of questioning, whether fair or not, again,
• 11:13
  strategic by the defense, undercuts his credibility in the
• 11:18
  eyes of the jury. So we, that's why every time I
• 11:22
  teach digital forensics or talk to people who are like, I really
• 11:25
  want to do digital forensics, I'm like, you have to understand
• 11:29
  that there's, there, there may be times that not to attack you
• 11:34
  personally, but they may learn stuff about you personally that
• 11:39
  they want to ask you about on the stand.
• 11:41
  And it's more of are you impartial?
• 11:44
  And Stacey, I know that you talk about that more than anyone that
• 11:48
  I see. Is that being an unbiased
• 11:51
  examiner, always being impartial to any kind of work, case work
• 11:57
  that you're working on. And so the the defense says on
• 12:02
  the stand to Bradley, So if I go to your website, is there an
• 12:05
  article that you posted about your participation in this case?
• 12:10
  And Bradley stated on the stand, yes, it's a small something to
• 12:14
  support the validity of the software and it all goes back to
• 12:22
  being unbiased and impartial and even though that was nothing
• 12:28
  malicious or self promoting, it was presented that way.
• 12:33
  Yes, and let's be honest, Bradley's attempts to interject
• 12:36
  and his and explain himself, we're often shut down by the
• 12:41
  defense attorney. And and that's what happens.
• 12:43
  The defense or whoever the lawyer is that is asking you
• 12:47
  questions, that is the opposite side.
• 12:50
  Whenever they're asking you questions, they're going to to
• 12:52
  shut you down as much as possible, especially if you
• 12:56
  start to explain yourself, give background that they don't want
• 12:59
  out there. And what happens in this case
• 13:01
  and many cases like this, when you're shut down, the jury is
• 13:05
  going to be left with unanswered questions and there's these
• 13:08
  unresolved implications and he wasn't in control of his
• 13:13
  narrative. And many times you're not going
• 13:15
  to be in control of your narrative when you're on cross.
• 13:18
  And the worst thing is, the jury never saw the actual website for
• 13:23
  any of this stuff. All they saw was URLs.
• 13:26
  And that's because of procedural limitations and because they
• 13:29
  just saw the URLs and the way it was presented in court, I think
• 13:33
  it left a lot open to interpretation.
• 13:35
  Yes, absolutely. What can digital forensic
• 13:38
  professionals, people that are learning, people that are
• 13:43
  getting into this field, what can they learn from this
• 13:45
  testimony? 1 is, and we say this all the
• 13:48
  time, all the time, stick to what you know.
• 13:50
  Bradley knew a lot. He knew his tool.
• 13:53
  He knew how his tool worked. The problem was Bradley was
• 13:57
  reading from a report that maybe he didn't create or didn't
• 14:01
  understand the context of where it came from.
• 14:04
  And so if you haven't seen the site's content, say so if you
• 14:08
  don't know what that report is from, ask about it.
• 14:11
  You can talk about software development.
• 14:14
  And he created a great tool that has been used in numerous cases
• 14:19
  and has been successful, but it starts to break down your
• 14:22
  credibility and then always define your scope.
• 14:25
  You and I've had that conversation before, steady.
• 14:27
  You're like, how do I answer or like, what do we do about?
• 14:30
  And I'm like, what's that in the scope?
• 14:32
  You know, I always approach the scope and I say, what's in the
• 14:36
  scope of this investigation? And the fact that Bradley never
• 14:39
  clarified the parameters of his analysis weakened his authority.
• 14:44
  Again, I think that's a strategic move on the defenses
• 14:47
  side of the house where they know he has the knowledge, so
• 14:51
  they're going to ask him these questions.
• 14:53
  And because of the way they're asking him these questions, it
• 14:58
  gets out of the scope of what he was there for.
• 15:01
  And therefore it just causes more misinterpretation and
• 15:07
  misunderstanding from maybe Bradley's perspective and the
• 15:12
  jurors perspective and courtroom presence matters.
• 15:16
  An expert must always remain calm, credible and neutral, even
• 15:20
  under pressure. And I kind of smiled when I said
• 15:24
  that because I have been testifying in a hearing before
• 15:28
  where I I could feel myself getting nervous.
• 15:31
  And I wouldn't even say nervous, I would say angry about the
• 15:34
  questioning that was coming along.
• 15:36
  And I could feel myself like wanting to do the immediate
• 15:41
  defense mechanism of, of arguing back.
• 15:45
  But I had to remind myself, you have to.
• 15:48
  You have to remain calm so that you are found credible even
• 15:52
  under pressure. And I think Bradley did a fine
• 15:56
  job, given the bizarre nature of why he was called in to testify
• 16:02
  and what he did on the stand. He was calm, matter of fact.
• 16:06
  And I think as he should have, he was trying to explain things.
• 16:10
  And, you know, sometimes he just got cut off.
• 16:13
  But he certainly wasn't argumentative, in my opinion.
• 16:16
  I think he was very neutral even with this bizarre situation.
• 16:20
  Now, the other thing to take into consideration and remember
• 16:24
  in every single case is documentation is everything.
• 16:29
  What your tools are doing, what your findings are, and what your
• 16:33
  limitations are. It all needs to be very
• 16:36
  transparent and reproducible. And when we say reproducible it,
• 16:40
  we mean like another examiner could take your notes and
• 16:44
  they're detailed and sufficient enough that I could reproduce
• 16:47
  what you did and came to the same facts and artifacts and
• 16:52
  findings. Absolutely.
• 16:54
  And we always say that, you know, being able to peer review
• 16:58
  each other's reports, being able to peer review each other's work
• 17:01
  to have an understanding of, you know what, there's a gap here.
• 17:05
  There's no, you know, this doesn't make any sense right
• 17:08
  here. And so that's clear, absolutely
• 17:11
  transparent and reproducible. So this case and where we're
• 17:14
  talking about Bradley in specific, shows how digital
• 17:17
  forensics can shape the narrative of a trial, but also
• 17:21
  how easily that narrative can unravel under scrutiny.
• 17:26
  So testifying isn't just about data, it's about delivering the
• 17:30
  data responsibly, ethically, and with humility.
• 17:35
  And. So now the key thing that we
• 17:38
  want you to remember from the content of John Bradley's
• 17:42
  testimony is the chloroform hit that appeared 84 times in the
• 17:48
  cash back report. And I don't think we said the
• 17:51
  URL earlier. That website was
• 17:54
  www.side-spot.com/chemistry/chloroform dot HTM.
• 18:02
  And remember this, this chloroform site showed up 84
• 18:07
  times in the cash back report and John Bradley just read it
• 18:11
  into the record from a report that was generated by Stinger.
• 18:17
  And in our next episode, we're going to talk more about that.
• 18:20
  When we get into the defense experts that they call to
• 18:25
  discuss the digital forensics. We're going to come back to that
• 18:29
  84 hits for that chloroform website.
• 18:32
  That is the information that we have about John Bradley.
• 18:36
  Hopefully, we will have some more answers to the questions
• 18:39
  that we have in the near future. And until then, stay safe, stay
• 18:44
  sharp, and as always, keep parsing the truth one bite at a
• 18:48
  time. If you enjoyed this episode,
• 18:52
  make sure to follow us to get notified the next time a new
• 18:56
  episode drops. If you can do more, head on over
• 18:59
  to parsingthetruth.com and donate by clicking on the donate
• 19:03
  button. Parsing the Truth is a nonprofit
• 19:05
  organization and we are raising money to send a new digital
• 19:09
  Forensic Examiner to IASYS training next year in Orlando.
• 19:13
  Thanks.