Latest / Parsing the Truth: One Byte at a Time / Casey Anthony: The State's Forensic Experts

Transcript

Casey Anthony: The State's Forensic Experts · Parsing the Truth: One Byte at a Time

0:01
Join former FBI Senior Forensic Examiners Becky Passmore and
0:05
Stacey Eldridge as they dig into the world of digital forensics
0:08
one bite at a time. Now leading their own consulting
0:11
firms and educating the next generation of cyber sleuths,
0:14
these badass babes of digital forensics bring sharp insight,
0:18
real world case experience, and a dose of humor to the bits and
0:21
bites that filled today's investigations.
0:23
From deep dives into business e-mail compromise and ransomware
0:26
attacks, Becky Specialty to cracking the complexities of
0:29
iPhone forensics Stacy's obsession, this podcast delivers
0:33
insider knowledge for professionals, students, and
0:36
true crime techies alike. If you've ever wondered what
0:39
really happens when the digital trail is all that's left, TuneIn
0:42
and start parsing the truth. Welcome back to Parsing the
0:53
Truth one bite at a time. I am Stacy and I have my Co host
0:57
the beautiful Becky with me tonight as always.
1:00
Hello everyone, and welcome. In this episode of Parsing the
1:03
Truth One Bite at a Time, we are going to explore how digital
1:07
forensics shaped the narrative in the nationally watched case.
1:12
Now remember, we're not here to judge guilt or innocence, but
1:16
just to highlight the critical role of process, methodology and
1:20
expert testimony. The testimony we're going to
1:22
examine reveals how different forensic tools yielded different
1:29
conflicting results. Also, the challenges of
1:31
attributing actions on a shared device and how overlooked
1:36
technical details like time zone shifts can alter the meaning of
1:40
digital evidence. Our focus is on the principles
1:43
that make digital forensics reliable in court with cross
1:47
validation, attribution, contextual accuracy, sound
1:52
methodology. In today's episode, we are
1:55
analyzing the infamous Casey Anthony case and it's from the
1:59
digital forensics perspective, so that's what we're sticking
2:02
to. Specifically, we're going to
2:05
really focus in on the so-called chloro foam searches and
2:08
everything related to that and the forensic fallout that this
2:12
caused. So Stacy and I have been very
2:15
lucky that we've been able to review the testimony of the
2:19
forensic experts that were involved in this case, which
2:22
were Sandra Osborne, Kevin Stinger and John Bradley.
2:26
We actually compared it to Cindy Anthony, which was Casey
2:31
Anthony's mother's testimony. And it's clear not all the
2:35
stories line up. And so this episode is going to
2:38
focus on the state's first two witnesses that were the digital
2:43
forensic examiners. We also will have some upcoming
2:46
episodes where we get to talk to some of these experts.
2:50
So we're looking forward to. Before we dive in, let's talk
2:54
just real quick about what we remember about this trial.
2:57
So to level set, the disappearance occurred in 2000.
3:03
Back in 2008 when this was all going on, I was actually TDY to
3:07
the Tampa division working on some trial prep and going
3:11
through a trial related to a terrorism case.
3:13
So I remember like being there and hearing some of those guys
3:16
talking about going to Orlando and having to go to the dump and
3:21
dive through all the garbage there.
3:23
But then when it came to the trial in 2007, obviously I knew
3:27
it was happening, but I'm just not one to really track any of
3:30
that stuff in the media. But obviously after it was over,
3:34
then I certainly heard about all of the things that happened
3:38
related to the chloroform, such chloroform search, and how that
3:42
had rippling effects through the digital forensics community.
3:45
What about you, Becky? Yeah, I remember I was on
3:48
vacation in Florida. My best friend lives in Florida
3:51
and I was there visiting her and it was the talk of Florida.
3:54
In fact, I believe I flew into Orlando and it was just the big
3:59
talk of everything and everyone had their opinions.
4:03
And I remember, you know, all of the crowds that were around the
4:08
courthouse and the television, and it was on every news
4:11
channel. And it was just very publicized.
4:15
And I just remember watching and listening to all the different
4:19
stories that were coming out and thinking to myself, will we ever
4:23
know the truth? Will we ever know the truth of
4:25
what happened? And knowing that we have a court
4:28
system that allows cases to go through the court.
4:31
And, you know, what is said in the courtroom is how it's
4:36
portrayed. And so that's what we're here to
4:38
talk about. Yes, we're strictly focusing on
4:41
the testimony. We have done research out side
4:43
of that, but we're going to keep our discussion to the testimony.
4:46
And that's one of the things that people have to realize.
4:49
The media might say stuff, I know they were televising it and
4:52
people could see like the sidebars, but the jury didn't
4:55
get to hear the sidebar. So we're trying to break down
4:57
the information as much as possible as it was given to the
5:01
jury. And so to start it off, we're
5:03
going to just get right into the witnesses.
5:05
And I personally think the order of the witnesses was interesting
5:11
because at first the prosecutor, the state calls 3 digital
5:15
forensics experts in order. And it's Sandra Osborne, Kevin
5:20
Stinger, both with the Orange County Sheriff's Office, and
5:23
then John Bradley, who was a digital forensic examiner.
5:28
But he also had his own company and his company him produced
5:33
this cash back software that's really relevant to this trial.
5:38
And then it gets more interesting because the defense
5:41
also calls Sandra Osborne and Kevin Stinger to testify for
5:46
them. So not only did the prosecution
5:48
call their own witnesses, but the defense calls two of those
5:53
witnesses back to testify when it's their time for the direct.
5:56
And they do this because they are using the state's original
6:01
witnesses to introduce digital evidence that was not introduced
6:06
through the state. And we'll try to dive into all
6:09
of that as we approach it. We're going to try to take the
6:12
testimony in order as much as we can.
6:14
Right. And, and so as we said, we
6:17
reviewed the testimony of those 3 forensic experts and also
6:21
reviewed Cindy Anthony testimony and, and there are, there are
6:26
some discrepancies, right. So we're going to explore these
6:29
discrepancies and get to the root causes and the facts of the
6:33
matter. We are approaching this as we
6:36
approach everything that we do from the perspective of a
6:40
dispassionate scientist, so we can learn from this this case,
6:43
and we can share with others so they can learn from this case.
6:46
Absolutely. So let's start off with
6:49
Detective Senator Osborne, who testified first.
6:53
She worked at the Orange County Sheriff's Office and basically
6:57
when she started working the case in 2008, she had been a
7:01
CFCE certified through ACE IASIS for about a year.
7:06
And it sounds like that is about how long she had been in that
7:09
position at that point, maybe a little longer to go through all
7:12
of that process. But so let's think about one
7:15
real year under your belt as a forensic examiner.
7:19
And then by the time she testified in 2011, you know, she
7:23
would have had maybe another three years under her, her belt
7:26
at that point. I thought her testimony was
7:30
really great. She was very calm and very
7:34
factual. She brought on her big, huge
7:37
binder full of case notes and reports and stuff.
7:40
So she was definitely prepared, and I thought she gave well
7:43
thought out answers. Now, in this case, she is
7:46
probably most known for finding the Internet history that
7:50
contained that infamous chloroform hit, but she actually
7:54
did more than that. Yeah.
7:55
She also discovered two key pieces of evidence used by the
8:00
prosecution. What were those, Becky?
8:01
So there was a picture of Kaylee Anthony wearing a pink shirt
8:06
with writing on it and a video of Kaylee at a nursing home,
8:12
which both of these were from Ricardo Morales's.
8:16
Devices and I've seen some confusion on that I've heard
8:20
like it was the family camera that that video was on.
8:23
But from what we could tell in the testimony, they were talking
8:27
about Morales's devices at that time.
8:30
And, and this, this is where this was introduced.
8:31
So we're going off of that testimony right now.
8:34
But Becky, if you could tell us why were these two pieces of
8:37
evidence, key in this case and key for her to to find so they
8:41
could be be introduced? Sure, absolutely.
8:43
So the pink shirt is the same on that was found with Kaylee's
8:49
body when she was found, and the video is the last evidence of
8:54
Kaylee alive on June the 15th, the day before her
8:58
disappearance. And so this is important to
9:01
bring these in because they're trying to, and by they, I mean
9:05
the state is trying to have a specific narrative and they're
9:08
working on a specific timeline. So they're like, here's the
9:12
video. The date and time of this video
9:14
is June 15th. This is the last day anybody has
9:18
seen her alive. This is the day before she was
9:21
reported missing. Or just they're trying to tie it
9:25
together. They're trying to find anything
9:28
that would correlate her last known location, her last items
9:34
that she was wearing, and these pictures are this picture and
9:38
the in this video are going to help with that.
9:41
Now one of the things Osborne does is she talks about checking
9:44
the BIOS and the system date and time of that computer of
9:48
Morales's computer. Right.
9:50
And that is so important because when you have a your BIOS, which
9:57
is your basic input output system date and time, that is
10:01
the computer date and time. So being able to check the
10:06
biosystem date and time and then when you're doing your analysis,
10:10
compare it against all of the file system dates and times of
10:15
the files on the computer. So if that's off, if the bio, if
10:19
the biosystem date and time is off by an hour, then the files
10:23
are going to be off the file system files, date and and times
10:26
it's going to be off by an hour and that's going to be critical
10:29
in your analysis. Right.
10:31
Because if you are relying on dates and times, and you tend to
10:35
do that in homicide cases, you better know if the dates and
10:39
times and the time zone of that device is correct.
10:42
Because if it's wrong and you don't know it, then it can ruin
10:46
the entire case. And that especially happens if
10:49
if you didn't know and you built this timeline in this case, and
10:52
then the other side finds out that all the dates and times
10:56
were. But here's the thing, when
10:58
you're working for the defense, you are relying on whoever did
11:03
the forensic imaging of those computers.
11:06
And so in this case, it was the Orange County Sheriff's Office
11:10
who was able to check the times and report what they found.
11:15
And the other thing is you have to make sure that the lawyers
11:18
know that the times are off to if they are off, you got to make
11:22
sure they're that they're clear because again, they're building
11:24
the narrative that they're going to use during the trial as well.
11:27
That's right. So let's talk about the
11:29
chloroform hit and Internet history that she felt that
11:34
Osborne found. So she.
11:35
Testified that she found the chloroform hit in some sort of
11:39
Internet database file. She tried to figure out what
11:42
type of file it was, if it was an Internet database related to
11:46
Internet Explorer, or what exactly it was.
11:50
She didn't have any luck, so she ended up calling her supervisor
11:54
Sergeant Singer over. Now we need to mention that this
11:57
hit for chloroform was found in unallocated space.
12:01
So that means it wasn't recognized as being an active
12:05
file that the user could interact with and see, and it
12:09
wasn't even recognized as a deleted files.
12:11
It's basically in some location on the hard drive that neither
12:16
the file system or the operating system know about.
12:20
And it wasn't like she was sure about where the start of the
12:23
file was, especially since she wasn't sure what it was from
12:27
exactly. And so based on the testimony,
12:29
it sounds like Sergeant Stinger is the one who ultimately
12:32
recovered it and he testifies about that.
12:35
Now Becky, to put you on the spot, how would you manually
12:39
recover this file or any file from unallocated space?
12:43
Well, and we've done this in IASIS.
12:45
That is part of that process that you go through when you get
12:49
certified. So you're trained very well in
12:51
IASIS under the CFCE process. But we're going to look for
12:55
header information. We're looking for headers.
12:58
We're looking for information that would allow us to find a
13:02
header and a footer of a file and carve it out.
13:05
So we're going to carve it out of unallocated space.
13:07
There's this thing as contiguous versus non contiguous files.
13:11
And basically if you think of contiguous as meaning it's
13:14
connected or it's touching something like it is all in one
13:18
place, that's going to be your contiguous file versus a non
13:22
contiguous file. It can be in different areas of
13:25
a drive and with, you know, not connected.
13:29
So in the context of you know that memory allocation or file
13:33
allocation part. It means being able to know
13:37
where the file is located and have the header and footer
13:40
information to sweep and. Recover, right And like our
13:44
tools will go in and look for known file headers and footers
13:49
when it's doing the data carving.
13:51
And clearly this wasn't carved out as recoverable.
13:54
And based on her testimony, I do think they did data carving as a
13:57
whole on this case. And you know, it just wasn't
14:00
carved out and not everything is.
14:02
But you've you've done that search hit and then you find it
14:04
and you kind of look around in context and you're like and
14:06
you're seeing like URLs and you're like, well, this is
14:09
something Internet related, but I'm scrolling up and down.
14:11
I can't seem define the header or the footer of every anything
14:15
I know about. So you you call her your boss
14:18
and you're like, dude, what do you think?
14:20
He looks through it and he's like, Yep, I see the header
14:23
here. And then it sounds like he found
14:25
the footer as well. But sometimes you can find some
14:29
stuff and unallocated where you can kind of recognize what it
14:32
is, but you don't have that header.
14:35
Or maybe you're missing the footer and you can still work
14:39
with it and you can kind of go and do a little bit editing so
14:43
it's nicely recognized and and put a header and a footer to
14:46
work with it nicely so you can parse it with another tool that
14:51
might do a better job of pulling out all the records.
14:54
There's certainly a call or a need for parsing out some stuff
14:58
manually, but if you have like 1000 records, you're probably
15:02
not going to be able to do that manually.
15:04
So you want to get it into a condition in which you can
15:06
actually work with it and see if there's anything meaningful in
15:10
here. Like what is the context of
15:12
chloroform showing up in here? You know, that was very
15:16
important to the case. So someone could have probably
15:19
carved out that one record manually, but then it's like,
15:21
OK, this has something that was meaningful to the case.
15:24
What else is in there? What else should we look for?
15:26
Yeah. Absolutely.
15:28
And and, and to put it in layman's term for for our
15:31
listeners that are maybe not as technical, you, you think of it
15:36
as when you're looking at something in a general file
15:39
system, it's going to look like a library where all the books
15:43
are nicely and neatly placed together, right.
15:46
You can go from book to book just like you can go from file
15:50
to file contiguous arrangement where you have to go and pull a
15:54
book from one area and pull a book from another area.
15:58
It's just scattered in different places and that's what happens
16:02
when data is not together and you would have to recover it.
16:07
And the other thing that's important to know, especially as
16:11
a digital forensic examiner is how the file system and the
16:14
operating system interact with this.
16:16
Because I did mention earlier that the the stuff in
16:20
unallocated space, the file system and the operating system
16:24
don't know about that. And so I think that's worth
16:26
digging into. But to kind of do it like roll
16:28
down and dirty, right? Just high level stuff is the
16:31
operating system has access to the file system and you as the
16:36
user are using the operating system.
16:39
That's the thing in between. And then the file system
16:43
actually has access to the files itself.
16:47
So your file system is your go between between the operating
16:52
system and the storage device, such as your hard drive, thumb
16:56
drive, stuff like that. The file system has to be
17:01
structured in such a way that the operating system can also
17:05
recognize it and decide where to store and retrieve the files
17:09
from. Right.
17:10
So that file system, it's going to act as an interface between
17:15
that physical storage, storage that you have on your computer
17:20
and the operating system. And this interface or this
17:23
intermediary connection makes it easier for the users and the
17:29
applications that you have stored to be able to access the
17:32
files without having to deal directly with hardware.
17:36
So it just makes it more user friendly for a user to access
17:41
their files. And there's sometimes a common
17:44
misconception like when you see that black screen, a terminal or
17:48
a command prompt and people are just typing like that's the file
17:52
system. It's it's not, it's still a go
17:55
between between yourself and the file system that is not the file
18:00
system. Now, Sandra's testimony wasn't
18:02
really too terribly long. And the only thing interesting
18:06
that comes up during the cross, and this is my opinion that it's
18:09
the only interesting thing that comes up, was a nice discussion
18:13
on how keyword searches works, but it's not discussed in any
18:17
detail until the redirect. She's asked about searching for
18:22
chloroform on Ricardo Morales's computer.
18:26
And there's some back and forth and she goes in there.
18:29
She's like I specifically stated in my my report that I didn't
18:33
find any web pages or pictures referencing chloroform on his
18:38
computer. Yeah, and then the defense asks
18:42
her if she's seeing a specific picture, and she says yes and
18:47
eventually describes it as a man and a woman.
18:51
A woman is sitting in the chair, apparently dining in a black
18:55
evening gown. The man is looking over her
18:57
shoulder with a white cloth in his hand, reaching around behind
19:02
her her shoulder, and it has the words win her over with
19:07
chloroform. Now how is that possible, Stacy?
19:09
How is it possible that she didn't find it?
19:11
Well, the state is quick to clap back on that on the redirect
19:15
because the defense has everybody thinking like, Oh my
19:17
God, there's this picture and she didn't find it.
19:20
And she's like, because it's known to exist.
19:22
And this is where it's interesting is they're going
19:25
back to the keyword searches and the state is asking if the pixel
19:30
pixels embedded in a picture are accessible in a keyword search.
19:35
And she explains that they're not because they are pixelated
19:39
and they are represented as hexadecimal in that picture when
19:43
you're looking at it in the computer language and it just
19:46
looks jumbled up. Right.
19:48
And so the picture was posted on Morales's Myspace page that
19:54
we're going way back when we're talking about Myspace.
19:56
Right, right. Remember 14 years ago too.
19:59
So that's like some of that fancy searching we get now.
20:02
All when we're trying to find something in a picture, we don't
20:05
have none of that. Right, so it seems the defense
20:07
is trying to introduce doubt to imply that Osburn didn't find it
20:14
because it wasn't keyword searchable.
20:17
But that doesn't negate the ability to look through all the
20:21
pictures and still find a match. Based on her testimony, it
20:25
sounds like this is what she did.
20:26
So let's move on to the state's second witness.
20:29
That's a digital forensic examiner.
20:31
Who is that Becky? So that was Sergeant Kevin
20:34
Stanger, who is a Sergeant of the computer crimes at the
20:37
Orange County Sheriff's Office. No surprises here that his
20:40
testimony starts off regarding the recovery of that Internet
20:45
history file containing the core form hit that Osborne testified
20:50
about earlier. He goes on to explain it was in
20:54
unallocated space, as we already discussed a little earlier.
20:58
He further explains that most know when it's deleted, it's not
21:03
really deleted, then uses the good old card catalog example
21:09
that we've all used in the past to explain. 14 years ago we were
21:13
using that. That's right.
21:15
And I kind of just used it a few minutes ago, you know, like the
21:17
books are scattered all around. So Stacey, could you still use
21:21
that card catalog analogy example today to help explain
21:25
deleted versus unallocated? I mean, you'd have to look at
21:28
the people sitting in the jury next to you in the courtroom.
21:31
But I think it's probably be a little outdated today because
21:35
even if you do go in that library, which is still full of
21:38
physical books, you are not, well, at least around here, I've
21:42
not seen any physical card catalogs that you can go
21:45
thumbing through. So today I think we can still
21:49
relate it to books, but I think perhaps a better example would
21:52
be using an index. Of a book, perhaps?
21:56
Because then you could, you know, do the example like, we'll
21:59
see, here's all the pages of the book.
22:00
Everything's still written. But then when I RIP out the
22:04
index, you can even use the the table of context as well.
22:08
But you know, the index gives you a lot more specific things.
22:11
So that's why I like to use the index.
22:13
So you can still RIP out one page of the index, or you could
22:17
back out with a marker, maybe some specific keywords of the
22:20
index, but that information is still going to be there as you
22:24
flip through the book. You just don't know how to find
22:27
it. Yeah.
22:28
Yeah. And I mean, you could even go to
22:30
the filing cabinet and have OK, you know, organized in the
22:35
filing cabinet by the different files and the master file that
22:40
indicates what all files are in that file cabinet is missing.
22:44
But all those file, all those file folders are still in that
22:48
filing cabinet. You can still get to the data,
22:51
you just don't have the master file telling you what is in
22:56
which filing cabinet. Yeah, yeah, great example.
22:59
So he also reveals that that they recovered A MORC database
23:06
for Mozilla Firefox. The MORC database was a horrible
23:12
database, so let's talk next about why that MORC database was
23:17
just so awful. So it is a text based but it's
23:21
not human readable. Former Netscape engineer, and
23:25
I'm going to mess up his last name, but Jamie Zawininski has
23:30
called it the single most brain damage to file format that I
23:37
have ever seen in my 19th year career.
23:41
And so that was actually written in Mozilla's Bugzilla report in
23:45
2004. Well, and some other people
23:48
might be like, well, why is the former Netscape engineer talking
23:52
about Mozilla? Well, if again, if we jump
23:55
further back in time, there was the browser wars.
23:58
And if, if you want to know more about the browsers wars, there's
24:01
a show on AMC called Halt and Catch Fire and they go through
24:05
all of that sort of stuff. But basically Netscape, as they
24:09
lost, eventually became Mozilla and Firefox.
24:12
So that's where that comes in why he's talking about.
24:14
And so my thoughts are initially without looking into anything,
24:18
if somebody's saying it's brain damaged, it's probably going to
24:22
be hard to parse. And it actually is.
24:25
It's not even efficient when storing the Unicode text because
24:29
it still takes three to six bytes per character.
24:32
So that's a lot of overhead right there.
24:34
And if you guys are interested in more on seeing how this is
24:38
parsed out and just how problematic it is, you can head
24:41
over to digital-detective.net. They are the folks that produce
24:47
that analysis and they actually have a really great write up
24:52
breaking down parsing this Mork database that was from this
24:56
case. And I'm going to read to you
24:58
what they say here just because I think it's important.
25:00
I'm going to read it word for word.
25:02
So Digital Detective describes the basic Mork content model is
25:07
a table or also known as a sparse matrix, and it's composed
25:11
of rows containing cells where each cell is a member of exactly
25:16
1 column, but each cell is 1 attribute in a row.
25:21
The name of the attribute is a literal designating the column
25:26
and the content of the attribute is the value.
25:30
The content of the cell is either a literal or a reference,
25:36
and each reference points to a literal or a row or a table.
25:42
So a cell can contain another shared object by reference.
25:47
Becky, did your head just explode trying to follow that?
25:51
Yes. Yes.
25:52
And if I was a forensic examiner and knew back then that I had to
25:57
parse something like that or try to even understand it, I I don't
26:01
know that I wouldn't be doing what I'm.
26:02
Doing today well I just would have been like boss I need some
26:06
money to buy this tool called net analysis so my head doesn't
26:10
explode and you don't have to find a new examiner.
26:14
That's right. That's right.
26:15
But again, head over to digital-detective.net to see
26:20
more about that. We're not going to try to walk
26:21
you through that any more than we just did on this episode or
26:25
ever. Or ever.
26:26
So back to the testimony. Stingers asked how he recovered
26:31
it. He was asked how he recovered
26:33
it. And he explains he used the
26:36
header and the footer, which was what we were talking about
26:38
earlier. You identify a header of a file
26:41
and the footer and you can recover it.
26:44
But the header began with Mork. Once he identified, he then
26:48
manually recovered it using a forensic tool called N Case.
26:53
So what he's doing here is he's going through his file structure
27:00
and identifying the header of that database and then sweeping
27:06
to through the sectors and the clusters that he needs to tie it
27:10
all back together, finding the footer and then exporting it out
27:14
using N case in this situation. So Stacey, he's got it
27:18
recovered. Why is this file so contentious
27:22
in this case Singer? States in his testimony that the
27:25
trouble was with the fact that this Internet history file
27:29
crossed daylight savings and it contained the dates of March 4th
27:33
through 1st in 2008 and that's why he ended up using cash back.
27:38
He created 2 cash back reports, one for March 17th and one for
27:43
March 21st because those dates had hits for chloroform.
27:48
Now we did go back and look up when was daylight Savings time
27:52
starting in 2008 and it started on March 8th.
27:55
Now the reports that he generated the 17th and the 21st
27:59
weren't on the Daylight Savings time day date change.
28:04
Now, why do you think this is a big deal, Becky?
28:06
Well, obviously when you are adjusting again we're talking
28:11
about BIOS time, basic and put out put system, you have your
28:15
bio state and time. If the system does not adjust to
28:20
the daylight savings time, that's going to indicate one
28:25
hour difference. And if that was not indicating
28:29
as daylight savings time, current daylight savings time
28:33
and it's referencing before daylight savings time
28:36
adjustment, the file time is going to be off.
28:39
And the other thing is in 2007, they started doing the daylight
28:45
savings time earlier. So it started 4 weeks earlier,
28:49
just one year before that. And so if you didn't have all of
28:53
your updates and patches apply to your computer, your computer
28:58
might not automatically update like it should, so your times
29:02
might be off for a month. Yeah.
29:04
So how could you account for that, Stacy?
29:07
Well, as the forensic examiner, you could go in and check the
29:09
the update slash, the patch level of the Windows operating
29:13
system, and then go back and cross reference that with what
29:17
Microsoft said you needed to have or where you needed to be
29:21
at in terms of those updates and patches to make sure that you
29:24
wouldn't have any issues further for those four weeks.
29:28
Now, is there anything else that you can think of, Becky, that
29:31
might pose an issue with these time changes and daylight saving
29:35
time? Well, I mean, obviously
29:37
programs. So in this situation, Stanger
29:41
reports that net analysis didn't handle daylight savings time.
29:46
So we checked and net analysis even verified that the version
29:51
at the time the Stinger was using 1.37 had no option to
29:56
present the time stamp as a local value adjusted for
30:00
daylight savings time. Only did the Standard Time and.
30:04
So maybe if enough of us forensic examiners write to our
30:08
Congress people, we can just get rid of daylight savings time so
30:11
we have one less thing to deal with in terms of the problems of
30:15
time. That's correct.
30:16
That's correct. Is there any way to compensate
30:19
for net analysis inability to do the daylight savings time?
30:23
So you could have. You could you could add a column
30:25
in the report to reflect the correct time, which which now as
30:29
experienced examiners you, you find ways to to address and make
30:35
things reflect correctly without modifying anything.
30:39
So so you could add a column in the report to reflect the
30:42
correct time, but I can see where where you'd want one tool
30:47
doing everything correctly without having to make any of
30:51
those changes. And the testimony never revealed
30:54
build one way or another if the computer was on the appropriate
30:58
patch level or not. I'm not surprised this didn't
31:00
come up, but we wanna know, right?
31:03
Of course. That's not the way testimony
31:04
works, and the digital forensic examiners don't get to say
31:07
whatever they want. They gotta answer questions.
31:10
But anyways, you know, I was thinking, would it have been
31:14
appropriate to only produce net analysis reports for March 17th
31:20
and March 21st, since those were the only two dates with activity
31:25
concern and those were the only two dates introduced in in
31:29
court? You could just easily be like,
31:31
here's the adjustment, you know, be done.
31:34
And, and you could try to only produce those two dates and
31:39
those two reports, but you'd, you'd certainly have to be aware
31:44
that the defense could ask about all the other dates and ask why
31:48
reports weren't created, produced or introduced for the
31:52
remaining dates. You know, the defense could go
31:55
even further as to imply that the state was trying to hide
32:00
exculpatory information, which would then probably add even
32:04
more reasonable doubt to the jurors.
32:07
Yeah. So I think when you explain it
32:09
like that, it makes sense about why Stinger would be looking for
32:13
a tool that could handle the daylight savings times natively.
32:17
Becky, let's discuss, as we already hinted to why times are
32:21
a pain and how do it handle explaining times, especially
32:25
when you're doing it in the courtroom.
32:26
Yeah, absolutely. You know, there's Standard Time,
32:30
there's daylight savings time, there's UTC times, some programs
32:35
and operating, I mean, and information represents it as GMT
32:39
time. There's 12 hour versus 24 hour
32:44
clocks. And then and then there's what
32:45
is your tool doing? And then do you need to go in
32:49
there and manually parse out the file system hex file, throw it
32:56
into a calculator, and manually convert it to a date and time
33:01
using decode? There's so many different ways
33:04
that dates and times are affected in what we do.
33:08
Yeah. And then it gets worse because
33:10
it's like, what time zone is your evidence in?
33:13
What time zone is it from? What time zone are you sitting
33:17
in and having to adjust for that?
33:20
And especially at this time frame, I was on an end case
33:24
user, so I can't speak to that. But in FTK it was such a pain in
33:28
the butt. And there was, even though we
33:30
talked about it a lot in the FBI, it was still like, OK, you
33:34
want me to do what with my exact exam machine?
33:36
Can I compensate for it in the tool?
33:39
You know, so you it was always like find a known thing and then
33:43
make sure like the times and dates are matching.
33:48
So like that's where like correlation to something else
33:51
can be really helpful. Just don't be like, I'm going to
33:54
look only on this one thing on the computer.
33:56
Is there anything else that people have from something else
33:59
where we know the time and we can make sure that this is all
34:02
correct and being processed correct and we're not going to
34:04
be totally wrong about everything in this case that
34:06
relates to date and time? Absolutely.
34:08
And and then you have to go back to was it downloaded?
34:11
What was the original date and time of that file before was
34:15
download? Was it copied and pasted from
34:18
one location to another location?
34:19
Because then that starts to adjust those various time frames
34:24
and what those times, times and dates and what they mean.
34:28
And so I think these are some just really good points for
34:31
everyone to keep in mind when it comes to times that don't just
34:36
rely on one situation and one file and one date and time.
34:41
Because there is going to be something that is could adjust
34:45
that and it could put you in a corner when having to
34:48
communicate about dates and times.
34:51
Yep. And at this point in his
34:52
testimony, Stinger concludes by stating that he gave that same
34:56
MORC file, that database that he recovered to John Bradley and
35:01
asked him if he could get cash back to parse it out.
35:05
And we'll talk more about that when we get to the Bradley
35:09
testimony coming up later. Yeah.
35:12
And so now we move on to the Stinger testimony crossed by the
35:17
defense. And the defense has Stinger
35:20
confirm that the Firefox Internet history file was a
35:24
deleted file and that he didn't know when it was deleted.
35:29
And and people do delete when their computer is running slow.
35:35
And at this point, he gets into a a little bit of like what
35:39
information was in that Mark database with Internet history?
35:44
And he's talked about how long some of the site visits were to
35:48
some different sites, specifically the one mentioning
35:51
chloroform. He says it's about 10 seconds
35:54
before the user goes on to Myspace.
35:56
And he also states that he doesn't know what is on that
36:00
Chloroform site because they were not able to recreate the
36:05
page. Yeah, and he's also asked about
36:07
about the win. He's also asked about the win or
36:13
her over the chloroform picture that was on Morales's Myspace.
36:19
And singer is also aware of it. So he, he, he's, he's asked
36:23
about this and, and he confirms and acknowledges that he's
36:27
aware. Of it.
36:28
And so I wonder if during this, the defense is trying to
36:31
introduce more doubt by bringing this up again and asking if he's
36:34
aware that it's on Morales's Myspace.
36:37
Page, yes. So Stinger clarifies on redirect
36:41
that cash back can only rebuild pages from unallocated space.
36:47
Yeah, so the state is demonstrating like we didn't
36:49
just do this halfway, we could not do it.
36:53
The defense wrapped up Stinger's testimony and at this point,
36:56
Stinger has only gotten in his cash back reports as exhibits
37:00
from March 17th and March 21st. The state didn't ask him
37:05
anything about those reports, only the defense did.
37:08
All they did was get it in as evidence or as an exhibit, and I
37:13
thought that was a little interesting.
37:14
So Osborne and Stinger have each testified once.
37:18
At this point, they still haven't gotten into the 84 times
37:22
that the core form site has been visited.
37:25
Stinger has only discussed how long the user was on the site
37:30
before moving on to the next website.
37:33
And we'll get to the 84 times in the next episode.
37:37
Until then, stay safe, stay sharp, and as always, keep
37:42
parsing the truth one bite at a time.
37:46
If you enjoyed this episode, make sure to follow us to get
37:49
notified the next time a new episode drops.
37:52
If you can do Morehead on over to parsingthetruth.com and
37:56
donate by clicking on the donate button.
37:59
Parsing the Truth is a nonprofit organization and we are raising
38:03
money to send a new digital forensic examiner to I Asus
38:06
training next year in Orlando. Thanks.