Latest / Parsing the Truth: One Byte at a Time / The Mushroom Murders Part 1

Transcript

The Mushroom Murders Part 1 · Parsing the Truth: One Byte at a Time

0:01
Join former FBI Senior Forensic Examiners Becky Passmore and
0:05
Stacey Eldridge as they dig into the world of digital forensics
0:08
one bite at a time. Now leading their own consulting
0:11
firms and educating the next generation of cyber sleuths,
0:14
these bad ass babes of digital forensics bring sharp insight,
0:18
real world case experience, and a dose of humor to the bits and
0:21
bites that filled today's investigations.
0:23
From deep dives into business e-mail compromise and ransomware
0:26
attacks, Becky's specialty to cracking the complexities of
0:29
iPhone forensics, Stacy's obsession, this podcast delivers
0:33
insider knowledge for professionals, students, and
0:36
true crime techies alike. If you've ever wondered what
0:39
really happens when the digital trail is all that's left, TuneIn
0:42
and start parsing the truth. Welcome back to Parsing the
0:53
Truth One Bite at a Time, where we focus on facts and artifacts
0:57
to reveal how digital investigations really unfold.
1:01
I'm your host, Stacey Eldridge, and as always, I'm joined by my
1:04
Co host Becky Passmore. Now today we're leaving the
1:08
United States and we're headed to Australia to talk about
1:13
mushrooms. Becky, what case are we going to
1:16
talk about tonight? Wish we were really going to
1:18
Australia. Right, next time.
1:20
Next. Time, next time.
1:23
So this is an odd situation, a family lunge in rural Australia
1:29
that turned deadly, followed by an investigation into what
1:33
really happened, an arrest and a nine week trial. 9 weeks as
1:39
digital forensic experts were. We are especially interested in
1:44
how investigators used online activity, phone data and digital
1:48
artifacts to make their cases. So today we're going to jump in
1:52
and start talking about the Aaron Patterson case, the
1:56
mushroom murders from small town from a small town outside
2:02
Melbourne, Australia. Yep, and this.
2:05
Timing of this episode might be good with all of the holiday
2:10
family events coming up. You know beware of what you eat
2:15
at those family gatherings, right?
2:17
Becky know who's preparing your food and what they're preparing
2:22
it with. Right, so, but in all
2:25
seriousness, this case begins back on Saturday, July 29th,
2:31
2023. Erin Patterson hosted a lunch at
2:34
her home and and I'm going to butcher all of these names from
2:39
Down Under. My apologies to the Australians
2:42
who are now listening to us. Right?
2:44
That's right. So Leon Gatha Victoria, it is 2
2:48
hours southeast of Melbourne. I may have driven through this
2:53
area or somewhat near to that town.
2:56
This one time when I drove with a couple of friends from
3:00
Melbourne to city to excuse me from Sydney, we thought that
3:04
would be a great little road trip.
3:05
So we did that. But anyways, I digress.
3:08
The her guests were her estranged husband's mother and
3:13
father and aunt and uncle. Her estranged husband declined
3:17
the invite. On the menu was Beef
3:20
Wellington's little individual ones, which I had for the
3:24
appetizers at my wedding, and I was not trying to poison anybody
3:29
there, but we did have individual little beef
3:31
wellingtons. Again, I digress.
3:33
So later that night, every, everyone except Aaron became
3:38
violently ill in the courtroom. They go into great details about
3:43
all the symptoms and the the nasty things that were happening
3:46
with the bodily fluids. We will not be doing that on
3:49
this podcast. We will, we'll spare you that.
3:52
That's not digital evidence. We're we're not concerned with
3:54
that. Not the bodily.
3:55
But anyways, within days, three of the guests died from
3:59
suspected death cap mushroom poisoning.
4:03
Aaron herself went to the hospital two days later, whereas
4:07
the guests went to the hospital the very next day, and that
4:11
timing was certainly some focus of attention from investigators.
4:16
And prosecutors? Interesting.
4:18
And from there, the investigation focused on where
4:22
the mushrooms came from. So Aaron told the Department of
4:26
Health and the police that she bought some from an Asian
4:30
grocery store and some from a local supermarket.
4:34
But that explanation eventually raised doubts.
4:37
The health authorities couldn't find any evidence those stores
4:42
sold death caps. That LED police to look at her
4:45
digital footprint, what she'd been searching for, what her
4:49
pictures were and who she'd been communicating before and after
4:55
the lunch. The police dug the leftovers out
4:58
of the trash and those leftovers did test positive for the toxins
5:03
that are found in death cap mushrooms.
5:05
And basically this is one of the deadliest mushrooms in the
5:09
world. No surprise that it's found in
5:11
Australia because if you're not familiar with Australia,
5:15
basically there's a lot of stuff there everywhere that can easily
5:20
kill you. There's lots of songs about it.
5:23
My favorite song about it is called Deadly Animals by Scared
5:29
Weird Little Guys. Give the song and listen if you
5:32
want. It's kind of a catchy tune.
5:34
Like I said, lots of songs. I'm unsure if any of them
5:38
actually mention death cat mushrooms, but maybe that is a
5:42
new song now coming after this trial.
5:44
And another fun fact from this trial in Australia, the jurors
5:49
got to use iPads. So I guess they're getting like
5:52
digital versions of everything to kind of swipe and search
5:54
through instead of like big paper binders.
5:57
Well, day two of the trial is where we first get to some of
6:01
the digital evidence and the text between the text messages
6:05
between Simon and Aaron about the lunch were read in court.
6:10
Oh, and I should interject, Simon is the estranged husband.
6:14
OK, that makes it make more sense now.
6:16
Right. And Simon said he was
6:18
uncomfortable coming and could they discuss things related to
6:24
her health and all other things later.
6:27
And Aaron texted back that it was disappointing and comments
6:31
on how much effort she had put into and making the dinner and
6:36
may not be able to do it again. Simon never replied nor did he
6:40
attend that daily. And I mean that deadly lunch.
6:44
Excuse me? I'm being ahead to day four of
6:46
the trial. We get to some Facebook
6:49
evidence, kind of the the people that she was in this Facebook
6:54
group. It was like a true crime
6:56
Facebook group provided some testimony about her group posts.
7:00
And the group was really nothing about true crime.
7:03
I guess that's how it started. But then they just kind of
7:06
stayed there and hung out and talked about whatever they
7:08
wanted. And two of the witnesses
7:10
described Aaron posting in the group about her purchase of a
7:14
dehydrator and how she was using it to dry mushrooms and put them
7:19
in food. And she was was even talking
7:22
about hiding mushrooms ground up in the brownies for the kids.
7:26
And they also detailed Aaron asking the group about how to
7:30
make beef Wellington in the weeks before the lunch.
7:34
And also she was complaining about how hard it was finding
7:37
the appropriate cut of meat for those little mini beef
7:40
wellingtons. Interesting.
7:42
So now we get to the 4th week of the trial and on May 18th and
7:48
18th, telecommunications expert Doctor Matt Matthew Sorrell
7:52
starts off by describing how mobile phones and cellular
7:57
networks work. He then discussed cellular
8:00
records provided by Aaron's cellular provider.
8:03
Mr. Sorrell told the court that the records from a phone
8:06
registered to Aaron Patterson showed the handset and connected
8:11
consistently to a Lock S base station for about 43 minutes on
8:19
the morning of May the 22nd. 23. This was suggesting she remained
8:25
in and around the Township. So later that morning Miss
8:28
Patterson's phone hooked into the Outram base station almost
8:34
exclusively for 25 minutes. Witnesses in the trial told the
8:39
court they observed death cap mushrooms growing near both of
8:45
these locations around the. State So from what I've read,
8:49
this was a very technical testimony and there were
8:53
certainly comments to that degree from the reporters and
8:56
other people in attendance as they took to the blogs and filed
9:00
their reports afterwards. So we're going to get into the
9:03
weeds a bit here because that's what we do.
9:05
But Doctor Sorrell sets the stage by talking about base
9:10
stations, so talks about all that techie goodness and what
9:13
they do and how it works. And then he spends a lot of time
9:17
talking about the differences between passing through a base
9:21
station and staying at that location.
9:25
And he also discussed how a person does not have to be
9:29
actively using their phone, like touching and interacting it
9:33
because there's all of these numerous background tasks that
9:36
are always going on that require data.
9:39
So think checking your e-mail, the I messages coming in, things
9:44
like that, that's happening without you having to do
9:46
anything. He also discussed the handovers
9:49
or handoffs between base stations as you travel,
9:53
especially like when you're in a car, you're moving much faster,
9:56
right? And so at one point, the judge
9:59
interrupted and asked if going through all of these examples
10:04
were really necessary. So we're talking about how much
10:06
they were going through and explaining here.
10:08
It was so much so that the judge was like, hey, hey, hey, you
10:12
know, do we need this? And so let's kind of go through
10:15
some of the facts that they talked about on the stand.
10:18
They're talking about how Aaron's phone was pinging an
10:21
outram on May 22nd. And he said as part of their
10:26
analysis, they looked at the occasions when her phone stayed
10:30
in one area for prolonged periods of times versus the
10:36
other occasions where it just appeared to be passing by.
10:40
Lots of tables were shown in the court, but one of them was
10:43
documenting the events on May 22nd, 2023.
10:47
And it shows SMS and data activity from 10:30 AM to 12:55
10:54
PM that day. The cell phone starts at Leon
10:58
Gatha, however you say it, the hometown of Aaron, before
11:03
shifting to Outram at 11:18 AM. Now connections to Coonwura and
11:10
Cardella take place at 11:21 AM and then Outram at 11:31 AM
11:17
before connecting back to her home base station at 12 O 3:00
11:21
PM. It's important to note that her
11:24
phone is stationary near Outram for about 25 minutes, and so
11:30
Doctor Sorrell really starts drilling down into that hour
11:34
between 11:00 AM and 12:00 PM on that day in question, so May
11:39
22nd. In that short period, it appears
11:43
that her phone has made more base station connections and so
11:48
she's going through numerous base stations.
11:51
So clearly she's traveling most likely in a moving vehicle,
11:55
right? So her hometown 1 the outrim,
11:58
Kunwara, Cardella and Mirabu N This is a fun places to say.
12:04
Sounds like it and. As Doctor Sorrell said earlier,
12:07
these phones are greedy. Greedy.
12:10
He was telling the jury all about this.
12:12
And so they're often going to go searching for the best possible
12:15
state base station with the strongest signal.
12:19
And he talks about like all the geographic things and the things
12:22
that can make like one base station not preferred, even
12:27
though like it might appear to be closer.
12:29
So it's it's not so simple as draw a straight line and that's
12:32
the base station you're going to connect to.
12:34
But so the phone is always looking for the best possible
12:38
base station that's giving them the strongest signal.
12:41
Now he also is, as he's continuing to drill into that
12:46
11:00 AM to noon time frame, he really drills down into a window
12:51
between 11:24 AM and 11:49 AM where that phone is constantly
12:57
connected to that out from base station.
13:00
And then apart from that, it did hook into a new station at
13:04
Foster N for just a few minutes. And so his testimony was that it
13:09
indicates that at that point that phone was relatively
13:14
stationary. Yeah.
13:15
So then the prosecution claims that Doctor Tom May made an
13:21
online posting about death cap mushrooms in Outram on May the
13:26
21st, the day before Aaron Patterson's phone allegedly made
13:32
this possible visit to the same area.
13:35
So I gotcha. Yeah.
13:36
So according to this evidence, this is Patterson.
13:39
Miss Patterson's phone has connected to a base station that
13:44
appears very close to where these mushrooms were allegedly
13:47
growing. It is possible there was a visit
13:50
to Nielsen Street at that time. Dates Doctor Scroll of Miss
13:55
Pattersons movements on May 22nd, 2023.
13:58
So the attention now shifts to a potential trip Miss Patterson
14:03
made to lock on on April 28th, 2023.
14:08
This is 10 days from a witness from earlier in the day where
14:13
she testified that she spotted death caps in that area.
14:18
A chart on the screen shows Miss Patterson's phone connected to
14:21
the Korumbura base station at 8:59 AM before a new connection
14:27
to a cell phone tower at Lock at 9:08 AM.
14:31
The device then hooks into a tower at Lock South and and
14:35
returns to the Lock tower at 10 O 2:00 AM Doctor Sorrell
14:42
qualifies this as not a guarantee that the phone
14:45
remained in the Lock Township for that entire period.
14:49
So then phone records show a second trip to Lock.
14:53
The court is shown another detailed chart and this is a
14:57
possible return ship from Leon Gatha to lock on May 22nd, 2023.
15:05
The records show Miss Patterson's phone connected
15:08
consistently to a lock S tower from about 9:18 to about 10 O1.
15:15
This points to the phone being in or close to.
15:19
The lock. Township and Doctor Sorrell says
15:22
it can't be moving very far. So the second trip to Lock on
15:27
May the 22nd is the same day as the visiting to Outram and this
15:33
was before the visit that visit to Outram.
15:37
So we're not exactly familiar with all these towns in
15:40
Australia. In fact, we can't even properly
15:43
pronounce the towns. Yeah, again, our apologies.
15:47
Exactly. But the point Dr. Sorrell is
15:50
trying to make is Aaron first went to Locke on April 28th,
15:55
then she returned to Locke the morning of May the 2nd.
16:00
May 20, Bed. Then she returned to Locke the
16:03
morning of May 22nd. After visiting Locke, she headed
16:08
over to Outram. The inference being this is
16:11
important because Outram and Locke both had posts about death
16:16
cap mushrooms being present. Furthermore, these visits may
16:20
have one wondering if Aaron went to Locke on April 28th and May
16:25
or may not have found the death cap mushrooms then returned on
16:30
May the 22nd and possibly found none that she tried to look for
16:36
some at the second location and outram keep it in mind.
16:39
Death Cap mushrooms were reported being spotted just the
16:44
day before on May the 20. And on the cross examination,
16:49
the defense attacks the usefulness of these phone
16:52
records as evidence. The defense attacks the
16:55
reliability, and they talk about how inclement weather can impact
17:00
perception. This has happened to me.
17:02
And I'm not even talking about cell phone tower stuff.
17:04
The defense does get Doctor Sorrell to agree that phones
17:08
connecting to the Outram base station could also be in two
17:12
other towns. I guess they're close enough to
17:15
hit that base station as well. The defense continues to focus
17:18
on the Outram visit and has Doctor Sorrell share that
17:22
initial call records didn't indicate that that visit to the
17:27
Ultram base station initially, but later he received event
17:33
based monitoring records. Now these event based monitoring
17:37
records are going to be generated when your phone does a
17:40
task that requires data again such as checking that e-mail.
17:45
But so anyways, once he got those event based monitoring
17:49
records, that's when he was able to determine this location of
17:54
outram in this in this time frame on my 22nd.
17:58
The defense went on to highlight that Aaron's phone connected to
18:01
two other base stations, one that was 36 kilometers away and
18:05
another that was 38 kilometers away.
18:08
And these were on either side of the outrim event.
18:13
You know, it was like 36 kilometers away for one Outram
18:18
and then to another one that was maybe 38 kilometers away or you
18:21
know, flipped it. But so there's some movement
18:24
happening with the location of the cell phone.
18:27
Now, Doctor Sorrell conceded that the phone may have never
18:31
been an outrim. The defense launches a similar
18:34
attack on the connections to the lock back base station as well.
18:37
Now, I read lots of commentary from the reporter about Doctor
18:42
Sorrell showing lots of maps. And he was like, oh, boy, we're
18:47
great. We got more testimony coming up
18:49
from Doctor Sorrell. So not sure I, you know, I don't
18:52
have the timing, but it seems like he may have been on the
18:55
stand for a minute or two. Right, right.
18:58
And you never know how long you're going to be there, right?
19:02
So. Yeah.
19:02
You think it's going to be I'm going to be in and out, you
19:05
know, an hour 1/2 a day or whatever and then you're 2 days
19:09
coming back the next day sort of situation.
19:11
That's right. And he probably had to still do
19:14
that in this case. So on May the 20th, we get to
19:17
some more digital evidence. We're talking about computers,
19:20
cell phones and tablets. The police had seized several
19:24
computers and mobile phones from Aaron Patterson's home as part
19:28
of the investigation. The digital evidence was
19:31
examined using forensic software tools including Axiom and
19:35
Celebrate. The desktop computer contained 3
19:39
solid-state drives, specifically 120 gigs twice and then 256 gig
19:46
SSDs. So the records show that one of
19:49
the computers in her house had accessed the website
19:52
inaturalist.com approximately 14 months before the deaths.
19:58
The user had visited specific pages showing sightings of death
20:02
cat mushrooms around the Melbourne area.
20:05
Now remember Aaron lives in around the Melbourne area as
20:09
well. The search engine used to find
20:11
the I Naturalist was bing.com. The court heard that on May
20:16
28th, 2022, a visit was made to the I Naturalist website used by
20:21
citizen scientists for observations of.
20:25
Flora and Fauna. The title of one of the visited
20:28
page included words F CAP from Melbourne, Vic, Australia on May
20:35
18th 2022. Another search conducted on May
20:39
28th 2022 was for the Korumba Pub venue not far from Aaron's
20:46
home. And so here's where it gets
20:48
interesting, in my opinion, I could find no evidence in the
20:52
testimony that was accessible to me stating that there were any
20:56
website visits made in April or May of 2023.
21:01
Remember these websites that we just talked about and their
21:04
visits was a year prior to that, so in May of 2020, two that in
21:10
the notes of of the trial that I've been reading, they keep
21:14
talking about these posts to the Eye Naturalist website that were
21:19
made in April and May of 2023. Now, the prosecution did have
21:24
witnesses testify that they made those posts.
21:28
And so, you know, the question is how did they track down these
21:34
witnesses that were making these posts?
21:36
And they have one of the investigators later testify that
21:40
he basically took some of these URLs of websites visited from
21:44
this old Internet history, plugged in him into the computer
21:48
he was currently using connected to the Internet to see what was
21:51
going on like a year later in 2023.
21:54
So that's how they kind of tracked all of that stuff down.
21:57
And we'll kind of dive into some more of that later, but that's
22:01
where it was coming coming from. And during the testimony, as
22:05
they're getting into the digital forensics part of the case, the
22:09
witness for the prosecution presented a PowerPoint slide
22:13
deck that began with some very basic digital concepts.
22:18
The first slide asked, what is a computer?
22:22
Now? Many courtroom observers
22:23
repeatedly thought, well, we're in for a long day.
22:27
And the judge also asked a series of foundational
22:30
questions, including questions like what is software?
22:34
And the examiner also introduced concepts such as what is a file?
22:39
What is a folder? Then the discussion eventually
22:41
turned to file system metadata. They specifically went into
22:46
created, modified, and last access days.
22:49
And the forensic expert compared the properties tab that you can
22:53
see in Windows as kind of the place where you can gather all
22:57
of this metadata at to kind of give people an analogy of what
23:01
these sorts of metadata things are and what they can contain.
23:05
Now, he did say that the last access date represents the time
23:11
someone last tried to open a file.
23:14
So now we have to pause here and have some discussion about the
23:18
digital forensics testimony getting kicked off.
23:22
So the first thing I want to talk about is do we have to go
23:26
this basic like what is a computer?
23:29
What is a file? Because this reminds me of like
23:32
my first testimony, which was like way back in 2005, I guess
23:37
it was like 2006, I think the first testimony.
23:40
So like 20 plus years ago and we talked that we thought this was
23:44
sort of foundational back then, but like now it's 20 years
23:47
later. Do we still have to go that
23:50
basic? What do you think, Becky?
23:52
Well, I mean, I can understand when we had to do that way back
23:58
20 years ago when we were testifying and, and get down
24:01
into the very basics of what is a file, what is a folder, what
24:05
is a computer, What is, how do they work, right?
24:08
Because back 20 plus years ago, people really didn't understand
24:13
it, right? They they didn't have the, the
24:16
computer, which is the phone in their pocket every day.
24:19
Many times we will have the computer that's the phone in
24:21
their pocket every day and they don't know how to use it and
24:24
they don't know how it works. They just use it, they don't
24:26
know what the things are called. Right, right, right.
24:28
So unless Australia does not use computers on a regular basis, I
24:36
don't. I mean they.
24:37
Do have the Outback I? Know so I know.
24:41
Maybe not a lot of computers in the Outback.
24:43
I know. So I'm, I'm feeling like they
24:46
should, I mean, but maybe they maybe they understand their
24:49
jurors more. Maybe they want them to be very
24:53
specific. Maybe they want people to
24:55
understand we are talking about a computer.
24:58
We're not talking about a cell phone, right, Because we are so
25:02
used to using our cell phones. Maybe the strategy that the
25:07
attorneys are using is we are very specifically talking about
25:13
hard drives, SSD drives, computers, not your daily use of
25:19
mobile devices. And he, you know, the commentary
25:22
also was, you know, he covered a lot of this very basic
25:25
foundational tech talk very quickly.
25:29
So it wasn't like he drone on and on and on.
25:30
It sounds like it was pretty quick definitions, but basically
25:33
that what was happening up front, it was sort of data dump
25:36
of. Terms.
25:38
All at the beginning. So it's just, you know,
25:40
Spitfire, like what is a computer, What is a file, What
25:43
is software? So another thing to consider is
25:46
this data dump, like give all the the dictionary definitions.
25:50
Is that a great concept to just dump it out all here at the very
25:53
beginning? Or is it better to sprinkle it
25:57
in as you as a long as you go, right?
26:00
I don't know how do you like to do it?
26:01
Becky, you have a preference. If if I'm the one on the stand,
26:05
I want to talk about it when it becomes relevant in the
26:08
conversation. I don't want to describe all
26:11
these things upfront. And then as we get to the middle
26:14
of the testimony, I'm either having to describe them again or
26:19
true, I'm passing them on like, well, it's worth it's
26:24
referenced, you know, two hours ago when I was telling you what
26:27
a computer and what a file and what a folder and what all these
26:29
things are. So I would say in my mind it
26:33
makes more sense to talk about it as we get to it.
26:37
Yeah, that's how I like to do it too.
26:40
And I mean, some of these testimonies these days, you can
26:43
be on a stand talking for stuff like 2 days and then just on
26:49
your side and then the cross. So I mean you can be up there
26:51
for days. And so if you dump everything at
26:55
the beginning, to your point, you might be reiterating it
26:59
again two days later because, you know, if they're not
27:02
familiar with these concepts, how are they going to remember
27:05
them from 2 days ago anyway? Now, I'm sure since there was a
27:08
PowerPoint presentation, I assume it was an exhibit and
27:12
then so the jurors were going to get a copy of that.
27:15
So maybe that was the purpose of that.
27:17
The only way they could give them these definitions to
27:20
reference later was just to dump it all out in the beginning
27:23
because otherwise, you know, if it is an exhibit, then you guys
27:26
to go through all that Hemming and Hahn of it.
27:28
Now put this back up in the screen and OK, now stop showing
27:30
it. And you know, I don't know.
27:32
And Australia is a different country.
27:33
I imagine the rules different. It is a little bit from ours.
27:37
So maybe that's just how they they do it and that's their
27:39
tradition. You know that that's just how
27:42
they do it. We're not saying it's right or
27:43
wrong. We're just talking about it from
27:44
a different perspective of of what we like and we happen to be
27:49
a very similar, you might like something else and that's fine
27:52
too. I mean, you're the person on the
27:54
stand. You got to do it in a way that
27:55
makes you comfortable so you can talk through it all.
27:58
That's right. Not like a robot.
27:59
A file is a, a folder is a. See that's that's my concern
28:04
with like just dump it all out of the beginning.
28:06
You might sound like all engaged in interjection, but when you
28:09
get to like page 4 definitions robot mode.
28:12
Might be engaged. Yes, exactly.
28:15
Now the other thing I want to talk about is the mentioning of
28:18
the last access dates. And he said a last access date
28:23
is the date of file was last open.
28:26
So let's talk about how accurate or inaccurate that can be.
28:31
And there was no mention of the operating system on here.
28:35
So I don't know if it was XP, I don't know if 7/10/11, there's
28:39
lots of things to choose from. It was a tower.
28:41
It was a specific brand. So I do know it was Windows
28:44
based and obviously Bing as a search engine.
28:47
Clearly Microsoft Edge with the default search engine of Bing
28:52
was in use here. And this was within the last
28:55
couple of years too. Right, right.
28:58
So it's not like we're talking about a case that was
29:01
adjudicated and went to trial and 20 years ago, right?
29:06
Right, so as we do. I know as we do we.
29:08
Like to get old or get old do old things.
29:10
Yeah, exactly. Interesting.
29:13
That is always can you know, always a very delicate topic to
29:19
discuss in the 1st place, because you want to make sure
29:22
that you are articulating accurately about the modified
29:27
access created dates on a computer or in this situation,
29:31
opening a file, right? And I mean, way back when, I
29:35
mean, that used to be a pretty reliable indicator, but we're
29:40
talking like XP time frame. It was, it was somewhat
29:44
reliable, but then like believe it was Vista rolled out and then
29:48
it had by default the updating of the last access dates was
29:52
turned off. Was it Vista?
29:53
I think it was Vista. And then so, so that was shut
29:56
off. So then they were no longer
29:57
updating, but then, you know, you could turn it back on.
30:01
That was maybe more common in, in corporate environments.
30:04
But then we also became familiar with all the other things that
30:07
would start triggering last access dates to be updated.
30:11
And it was such minor things such as mousing over the files
30:16
that it wasn't a true indicator of openings.
30:20
So it really became hard to say as access date was updated on
30:26
May 22nd, Clearly they opened this file on May 22nd.
30:30
We really can't do that anymore. But there are certainly better
30:34
artifacts to indicate interactions with files that we
30:38
can use today. Yes.
30:40
So do you off top of your head, Becky, put you on the spot?
30:42
What, what do you think? What would you what would you
30:44
call out here? I mean, I would avoid, I mean,
30:49
I'll always avoid this situation unless they're very descriptive
30:55
like you said with the file system, the operating system
30:59
discussing last access dates, opening a file, how accurate and
31:03
inaccurate can that be? I would start to like you and I
31:07
always talk about match other artifacts to that evidence that
31:12
would then solidify and would not be as specific about a date
31:19
but more of a pattern when it comes to evidence.
31:23
Right. And so there's certainly a lot
31:25
of stuff we could get out from like the registry for example,
31:29
that would give us a lot of things, specifically the NT user
31:32
dot DAT for that user. And so we're talking things like
31:36
the Mr. us the most recently used file link file.
31:39
Exactly. Things like that would give you
31:43
a lot more insight and accurate information.
31:48
Yeah, your jump list for sure. Yep, jump list.
31:51
Yep. I have not had to do anything
31:54
with like the Windows timeline artifacts yet.
31:58
I forget the name of that database, but that could
32:01
certainly have a wealth of information.
32:05
I have not done anything at all even on a personal level with
32:09
Copilot, like I don't even have it turned on.
32:12
But you know from from the rumblings, it's certainly very
32:15
noisy. So if you could get that data,
32:17
I'm sure that would give you sorts of clues as to what the
32:22
heck has been going on on that. Computer, absolutely.
32:24
There's lots of things you can do to demonstrate interaction
32:30
and use of files. And of course, sometimes these
32:33
interactions and use of files is used to demonstrate knowledge of
32:38
these things happening and purpose and intent and, and all
32:42
of those things. That's why we would kind of dive
32:44
into it. It's just not for Ha Ha's.
32:47
Let's talk about all the last access dates on the computer.
32:50
I mean, that's not the reason. That should not be the reason.
32:54
We want to talk about the evidence strategically and have
32:59
a point to why we're talking about it.
33:02
That's right. We don't want to just drown you
33:04
in data for the sake of it. Yeah.
33:06
Exactly. And so in this situation, the
33:09
testimony then moved on to Internet browsers and how they
33:14
actually store evidence. Then the examiner explained
33:17
pivot icons, Internet cache, and cookies, noting that cookies can
33:23
provide clues about which websites were visited.
33:27
They also covered e-mail file types, I mean dot emls and dot E
33:33
ML X's, as well as Windows timeline activity and private
33:37
recovery recovery URLs. Now we are finally going to get
33:41
into the testimony regarding the artifacts.
33:44
The record showed that a Bing search was performed for the I
33:48
Naturalist website on May 28th, 2022.
33:53
As spoken about before, this was approximately 14 months before
33:59
the lunch in question. The I Naturalist has several
34:03
witnesses in the trial that explained is it's a citizen
34:08
science website where users can post the locations of different
34:13
species, including in this case, the sightings of death cap
34:19
mushrooms. Additional web searches from the
34:21
seized computer were also analyzed.
34:24
A search artifact from Google Chrome which was dated the same
34:28
day, May the 28th, 2022, that an Internet search had been
34:33
conducted for Korumburra Middle Pub.
34:39
That search occurred only a few minutes after the I Naturalist
34:44
search. The records further indicated
34:46
that additional Bing searches for the Team I Naturalist later
34:50
that evening were conducted. At that point, the reconstructed
34:55
digital timeline for May 28th, 2022 appeared as at 720 PMA.
35:00
Bing search for natural I Naturalist was performed 721.
35:05
The I Naturalist was visited at 723.
35:09
A search for Korumba Middle Pub was performed.
35:12
More detailed browsing records showed visits to the I
35:16
Naturalist website between 7:22 and 7:23 on that same date.
35:22
Now one of the URLs specifically corresponded to an I Naturalist
35:27
observation page showing a death cat mushroom sighting in
35:32
Melbourne. And the title of that web page
35:34
was listed as Death Cat from Melbourne, Vic, Australia on May
35:39
18th, May 22 at 2:36 PM by And there was the name of the I
35:44
Naturalist user and then it says Bric a reserve or Robin a
35:49
naturalist. All these great terminologies in
35:51
here. But during this portion of the
35:54
testimony, the judge cautioned the jury not to attempt to surf
35:59
or verify any of these URLs on their own.
36:03
And he told them don't be tempted to put these URL
36:06
searches into Google and conduct your own investigations.
36:11
Nice warning. Glad he said it right now.
36:13
Later on, the concept of focus was introduced into the digital
36:19
evidence testimony and after a series of detailed questions
36:24
about the extracted computer data, forensic examiner Mr. Fox
36:28
Henry explained that these focus records to show how long a
36:32
device displayed or was focused on a particular web page.
36:38
And so he gave the example of the I Naturalist front page and
36:43
he noted that the records indicated that it had been in
36:47
focus for approximately 8 seconds before the user
36:50
navigated to a different page. So here again, I want to talk
36:54
more about this focus artifact. Now there is a focus artifact
36:59
that comes from the user assist registry key in the NT user dot
37:03
DAT. Again, lots of great information
37:06
is being tracked and then registry about what those users
37:09
are doing. And this artifact specifically
37:12
is tracking how long something is in focus, as in when the app
37:17
or the program that you're using is in the foreground.
37:20
And when we say foreground background, we mean the app
37:23
that's on top of everything else.
37:25
But what it's tracking is the total time for the app or the
37:29
program. There's no like individual
37:32
traces of like per session, like maybe there's 10 entries or
37:37
something like that. No, it's just the app total time
37:40
ever. But there's not an in focus
37:42
artifact for individual pages. Now there is different in focus
37:48
artifacts for cell phones, but at this point we're just talking
37:51
about the web history on the computer, the Windows computer
37:55
that was seemed from Miss Patterson's house.
37:59
And so you know, what are they, what is he talking about when
38:03
he's talking about this web page being in focus for 8 seconds?
38:07
What do we think he was actually using to come up with the 8
38:13
seconds here? Yeah, that's interesting.
38:15
What do you think he is using that identifies those 8 seconds?
38:21
Have you dealt with that before? Well, we we both have.
38:25
Becky, do you remember the Casey Anthony?
38:27
Case, of course. Yes, Yes.
38:29
Yes, yes, yes. So that Casey Anthony was the
38:32
first thing that popped into my mind when they started talking
38:35
about, you know, oh, she was on the web page for 8 seconds.
38:38
Because this was some of the stuff that John Bradley ended up
38:41
reading into is like she was on this side.
38:43
And then, you know, he was going in how to try to determine, you
38:46
know, if it was actually a website being visited or was ads
38:49
running in the background on the page and all that, sort of.
38:53
Stuff. Because if you look at it based
38:57
on the specific URLs, there was at least four web pages visited
39:02
within 3 minutes, if not more. So normally when they're trying
39:06
to bring this sort of evidence in, they're trying to say they
39:09
were on this website for a really long time.
39:12
So surely they must have been reading it and studying it and
39:15
gaining information. But the one record, it was like,
39:18
oh, she was on it for 8 seconds and then ultimately at the end
39:20
of the day, she went to this pub website.
39:23
I don't know why they keep bringing it up because they keep
39:25
bringing up throughout the trial and the fact that she bought
39:28
food there and had it delivered and blah, blah, blah.
39:31
I never saw how it played a key role in anything that went on
39:34
with the death cat mushrooms. But it's in there and they keep,
39:37
they keep talking about it. So the only thing I can think of
39:40
is he's just going through the browser history and using the
39:43
times this page hit at this time.
39:46
This page hit at this time. This was 8 seconds, 30 seconds.
39:49
You know, basically the only thing I can.
39:51
Basically showing a user's interaction with the computer,
39:56
yeah. Yeah, Yeah.
39:57
I think that's where we're at with this.
39:58
That's that's where it was coming.
40:00
From right, right? Yeah.
40:01
So the day concludes with some discussion on Gail's Samsung
40:07
phone, mainly text messages between her and Aaron.
40:12
GAIL was the I believe she was the aunt.
40:16
Oh my goodness, I forgot. Well, she was.
40:17
She was one of the poor ladies invited to the lunch that ended
40:22
up dying from the from the beef Wilmington.
40:25
Yeah, very sad case. But on this note, I think this
40:28
is going to be a good place to stop from this week's episode.
40:32
So, I mean, we've we've been here talking for a while.
40:35
Remember the trials 9 weeks long and we've only really now just
40:38
started getting into the actual digital evidence and like we put
40:44
the cell phone tower records in here, but that's like a little
40:48
bit of a different digital evidence because we're not
40:51
extracting it from the devices that is being provided from,
40:55
from the cell phone provider, the service provider, sure.
40:59
But you know, it's still, it's still kind of in our wheelhouse,
41:01
but it's, it's special unique thing.
41:03
But now we're really getting into what's on the devices that
41:06
people have in their hot little hands.
41:08
Yeah. And so with that, we'll dig into
41:12
those devices and get more details out to you.
41:15
But until next time, stay safe, stay sharp, and as always, by
41:20
parsing the truth one bite at a time.
41:23
Join former FBI Senior Forensic Examiners Becky Passmore and
41:27
Stacey Eldridge as they dig into the world of digital forensics
41:31
one bite at a time. Now leading their own consulting
41:33
firms and educating the next generation of cyber sleuths,
41:37
these badass babes of digital forensics bring sharp insight,
41:40
real world case experience, and a dose of humor to the bits and
41:43
bites that build today's investigations.
41:46
From deep dives into business e-mail compromise and ransomware
41:49
attacks, Becky's specialty, to cracking the complexities of
41:52
iPhone forensics, Stacey's obsession, this podcast delivers
41:55
insider knowledge for professionals, students, and
41:58
true crime techies alike. If you've ever wondered what
42:01
really happens when the digital trail is all that's left, TuneIn
42:05
and start parsing the truth.