Latest / Parsing the Truth: One Byte at a Time / Casey Anthony Lessons Learned

Transcript

Casey Anthony Lessons Learned · Parsing the Truth: One Byte at a Time

0:01
Join former FBI Senior Forensic Examiners Becky Passmore and
0:05
Stacey Eldridge as they dig into the world of digital forensics
0:08
one bite at a time. Now leading their own consulting
0:11
firms and educating the next generation of cyber sleuths,
0:14
these badass babes of digital forensics bring sharp insight,
0:18
real world case experience, and a dose of humor to the bits and
0:21
bites that filled today's investigations.
0:23
From deep dives into business e-mail compromise and ransomware
0:26
attacks, Becky's specialty, to cracking the complexities of
0:29
iPhone forensics Stacey's obsession, this podcast delivers
0:33
insider knowledge for professionals, students, and
0:36
true crime techies alike. If you've ever wondered what
0:39
really happens when the digital trail is all that's left, TuneIn
0:42
and start parsing the truth. Welcome back to another episode
0:53
of Parsing the Truth One Bite at a Time.
0:56
I'm your Co host Stacey L I'm your Stacey Eldridge and as
1:01
always, Becky Passmore is right here with me all.
1:05
Right. Good evening everyone.
1:06
We're very excited to bring you another episode of Parsing the
1:09
Truth, One Bite at a time. Now, we've spent 5 episodes
1:14
reviewing the digital evidence and testimony related to the
1:18
Casey Anthony case. We've reviewed the testimony of
1:22
the three expert witnesses who testified in this case, Sandra
1:26
Osbourne, Kevin Stinger, and John Bradley Bradley.
1:29
Now, John Bradley, who testified for the prosecution, chatted
1:34
with us in Episode 14 reviewing his testimony.
1:39
And then we also spent episode 15 speaking with a defense
1:43
expert, Larry Daniel. Now, in this episode, we're also
1:48
going to be bringing in some discussion that we got some
1:51
inside tips straight from the people who worked for the Orange
1:55
County Sheriff's Office. Now, clearly we've done a lot of
2:00
work on this, and we've done this so we can get to the root
2:04
cause of the myths, the alleged problems surrounding the digital
2:08
evidence in the case. And we're going to talk about
2:11
everything we've learned from it and how it can be applied to
2:14
digital forensics today, 14 years later.
2:18
What is the problem with the digital evidence in this case?
2:21
It really centers around the fact that different tools
2:24
produced different results when parsing Internet history, and so
2:30
this is the myth of the 84 searches of chloroform.
2:33
Specifically, this digital evidence centers around the
2:37
deleted MORC database that contained Firefox history.
2:42
Remember, this file was manually carved from unallocated space,
2:46
and in court it was revealed that it was parsed with both
2:50
both net analysis and cash back. In the first bizarre twist, the
2:55
state had John Bradley testify about the cash back report.
3:00
Remember, he's the one that is the developer of this software.
3:05
They had him read into the record that there was a visit to
3:09
the chloroform website. We're going to share that later
3:12
on. And that website is the
3:14
www.scispy.com chemistry core form dot HTM.
3:19
Later in the series of this bizarre things in this case, the
3:23
defense has Kevin Stinger testify that net analysis
3:28
reported that the same horror form website had only been
3:34
visited one time. Kevin Singer also testified that
3:39
the reports were different. And I think that's where a lot
3:42
of the the trauma for digital forensic examiners really
3:46
started. But before we started digging
3:50
in, we didn't have any idea where these discrepancies came
3:53
from, nor do we have any idea where this research and these
3:57
interviews with people would lead.
3:59
And it was certainly revealing to us to, to dig in and get all
4:03
of these facts assembled and put together.
4:05
And we've also talked to other examiners who remember this case
4:09
from, you know, 2011, the trial going on.
4:14
And let's just say they were surprised to learn what we're
4:18
going to be sharing with you in this episode.
4:20
And we hope that you're going to find this just as eye opening as
4:24
all of us. Yeah, it was completely
4:26
fascinating. I believe during this
4:28
conversation that we were having earlier in the week, we were
4:31
both mouth dropped wows yes, of the unknowns that we didn't have
4:37
the information on. So that was very eye openings.
4:41
What we have to remember is people have lots of feelings
4:44
about this case and that's for a variety of reasons.
4:47
The myths are plentiful in this case and along with some finger
4:51
pointing, it's easy to say it's a tool problem or a validation
4:56
problem or and a validation problem.
4:59
Now remember, we're not here to judge guilt or innocence, but to
5:03
highlight the critical role of digital forensics, digital
5:07
evidence, processes, methodologies, and expert
5:11
testimony. All right, it's a tool problem.
5:14
Review your results, people. End of episode.
5:17
I'm kidding. We've got lots more to say.
5:20
But once you take a step back and actually review the
5:24
testimony that was given in the case, the facts of the case and
5:28
not everything was known to the public or even everybody that
5:31
was testifying. But what's clear to us 14 years
5:35
later is there's no bad guy. There's no lazy guy who just,
5:40
like, ruined this case. It's a bizarre set of twists and
5:45
turns that were oh so common in this case.
5:48
Now, if you thought you knew everything about the Casey
5:51
Anthony case, this episode is for you.
5:54
We are very fortunate that we are going to share a lot of
5:58
insider knowledge today as we break down what happened while
6:03
presenting the lessons learned from this Casey Anthony case.
6:06
First up, the cause and the myth of the 84 chloroform searches.
6:12
So in the opening statement, the state mentions that you would
6:17
hear testimony that a user searched for chloroform and how
6:24
to make chloroform. Then Bradley comes in and he
6:28
reads into the record from the cash back report that there was
6:32
a visit to thatsizespot.com horror form.
6:38
When, when? So that's what happened when he
6:41
was called to read that into the record.
6:45
And then he only read the website and the date.
6:53
He did not read the number of visits during the initial
6:57
testimony and during the direct by the the prosecution in this
7:03
in this trial. Right.
7:04
So the key point there is initially when he revealed that
7:08
website he did not utter 84 when the state had him on direct.
7:14
No, he didn't. He did not.
7:16
He did just read into the record from the cash back report about
7:20
that URL. That's all he did.
7:23
But however, later on, on redirect, the state asked how
7:28
many times the size spot.com the core form site was visited and
7:35
then he says 84. Right.
7:38
And so on that redirect, remember it's the state went the
7:41
defense with and now the state, the prosecution is going again
7:45
on the redirect. That's right.
7:47
So the next morning, the defense on cross as asks Bradley.
7:53
Now, yesterday when you mentioned the 84 visits to
7:56
thesizespot.com, you don't have 84 URLs in your Internets
8:03
history, do you Sir? And his answer was no.
8:06
Yeah, exactly. And the defense later called
8:09
Stinger to the stand and he testified that net analysis only
8:13
reported one visit to that URL. And then Baez even had Stinger
8:19
walk backward through Internet history that it was in fact
8:24
Myspace that was visited 84 times and not the chloroform
8:29
site. And he actually had Stinger
8:32
walking it back by saying visit 84 two 83282 and so forth.
8:41
I feel like that was kind of like counting down 99 beers on
8:44
the wall. But anyway, even though in the
8:46
court they clearly discussed visiting the size spot.com core
8:52
form sites 84 times, or was it one time?
8:57
And then here comes the media and the media explodes
9:01
everything and doesn't understand the terminology.
9:05
And now they're reporting that it's 84 searches.
9:09
Yes, the media can push false information out there so easily.
9:14
And so then here comes the lessons learned.
9:16
This goes back to one thing and that is do not believe
9:21
everything you hear in the news, right?
9:23
The news does not understand the terminology.
9:26
They take something and they exploded into the news.
9:30
And then the other thing, watch the testimony and read the
9:34
transcripts versus relying on what the media has to say.
9:38
Right. Because I've been in the
9:40
courtroom before. I was there at listening,
9:42
testifying, etcetera. And then I come out, see some
9:45
news articles and I was like, were we even in the same
9:49
courtroom, you and me, Mr. Reporter?
9:51
Because this this is not matching what?
9:54
Happened, right? Exactly.
9:56
Yes. And I think part of this was
9:58
headlines for. Sensationalism, right?
10:02
And, and again, they hear the word Internet, they hear the
10:06
word at 84, and they just conclude with searches because
10:11
that's what they think that they're speaking about.
10:14
But that's not exactly what they were talking about in this
10:17
context of the courtroom, right? I think, Becky, you've mentioned
10:21
a great lesson learned here. You know, go straight to the
10:24
source for the facts. Don't rely on the media.
10:27
That's right. And if you don't understand the
10:30
terminology, ask someone who does like, hey, what do they
10:33
mean by this versus what do they mean by visits versus searches?
10:37
You know, right? Yeah.
10:38
And there had been a ton of media coverage in this case from
10:42
the beginning, from 2000. Now we've mentioned the
10:45
chloroform website. And so I thought it would be
10:49
interesting for us to show you that chloroform website.
10:54
Now, remember, in the trial, all they did was read URLs into the
11:00
record. They didn't show anything.
11:03
There wasn't any visuals. Imagine as a member of the jury
11:07
trying to keep track of, oh, they went to this website and
11:09
this website and they search for all these terms and they get
11:12
printouts of it later on. But this trial was more than a
11:18
couple of days long and if you can use a visual, as they say,
11:23
one picture is worth 1000 words showing these websites could
11:28
have been very, very powerful. So I am going to share my screen
11:33
here and I'll read through it in case you're just listening here.
11:38
Now, first I want to explain that I use the Wayback Machine.
11:43
The Wayback Machine is kind of like what it sounds like it is
11:47
going way back in time. You can pick certain dates if
11:50
they're available. The website
11:52
isactuallyweb.archive.org and they archive tons of websites.
11:58
And fortunate for us, you know, 14 years after the trial, 17
12:03
years after the investigation, we can pull up what this website
12:08
looked like in April of 2008. And you have to use your
12:13
judgment. Do you want to go a little
12:14
before the search date, the visit date, or do you want to go
12:17
a little after? And I went with a little after.
12:20
And you can see here that the archive date of this is April
12:26
6th, so it's not too far after March 21st.
12:31
And this is what I went with. And so this is the website you
12:34
can see down here at the bottom. It has the whole URL.
12:39
So this is the one that was focused on a lot in the
12:42
testimony where it's side-spot.com/chemistryslash/chloroform
12:49
dot HTM. That was the one that they were
12:51
hotly contesting. Was it visited 84 times or was
12:54
it visited one time? What this page is, is a stop and
12:59
read before continuing. This is just the warning page
13:03
and it says how dangerous chloroform is.
13:08
And throughout this, Becky, we learned really a lot about how
13:12
dangerous chloroform was. I had no idea.
13:15
I had no idea. So, so that's why they've got
13:18
this up there. And this is before it was
13:20
certainly out in the news, remember, because the reporting
13:24
of the missing child and everything and the Casey Anthony
13:28
arrest wasn't until the summer. This wasn't what the website
13:30
looked like in the spring. So they always had this.
13:33
And if you want to see how to make chloroform, you click on
13:38
the continue link. It opens up this other page and
13:42
this one was archived a little bit earlier on April 4th, and
13:47
I'll go down here and show you the URL at the end.
13:51
But this is the side-spot.com/chemistry/chloro 2
13:59
dot HTM and this was read into the record as well, but they
14:05
really didn't harp on this one. Now this is where you get into
14:09
the details. It tells you kind of more about
14:12
chloroform and then it gives you the procedures of how to make
14:17
chloroform. And I personally think this
14:21
would have been very powerful to show this during the testimony.
14:27
Talking So we're talking so many years ago, right again, where
14:32
this, that this case, like other cases, was the infancy of
14:40
digital evidence being entered into court and spoken about for
14:44
the first time that now it it would be very common for these
14:51
types of things to be brought in as evidence.
14:53
And I just feel like back then, maybe it just wasn't talked
14:58
about as much as it is today about bringing these in as
15:02
examples, exhibits, showing, demonstrating, looking at it.
15:08
Because I feel like if you as a juror, someone trying to make,
15:13
you know, go through this, the case details, seeing something
15:17
like that would be much more clearer, right?
15:20
Because they were expecting the jurors to put together.
15:22
OK, first there was this Google search of how to make
15:26
chloroform. Well, then they go to Scispot.
15:28
Chloro. What did they go to?
15:30
Chloro to what? Like what is the significance of
15:33
that? How does it tie together?
15:35
And you have to remember, the defense was like, oh, there was
15:38
this picture on Myspace on her boyfriend at the Times Myspace
15:42
page win her over with chloroform.
15:45
The story was Casey Anthony didn't know what chloroform was.
15:50
Right, right. And, and again, it goes back to
15:53
a visual you, you spoke about it and the fact that a picture or a
15:59
visual it, it speaks volumes. Yep, absolutely.
16:03
Within the so with that Wayback machine and that Internet
16:07
history, why was the cash back report even used?
16:11
And why was Bradley used to read that report in Stacy?
16:14
From what we're told, the prosecution felt like it would
16:18
be better to have the tool developer read the results in
16:21
because they were very nervous about things being challenged
16:26
and debated. They wanted to be very
16:28
conservative and they thought, well, if we have the tool
16:31
developer come and read it in, talk about it, he knows all the
16:36
things about the tool. He's very well versed in how it
16:39
was parsing. He's also very knowledgeable in
16:42
how the browsers work and Internet history.
16:45
And that was very obvious in our conversation with John Bradley
16:48
as well. Exactly.
16:49
That's right. And I think because they could
16:52
get Bradley there on the stand to do all of that stuff, I feel
16:56
maybe that's why they went with that cash back report.
16:58
Right. And it was, it had the details
17:05
that they wanted to be entered into court into as an exhibit.
17:13
Right, because chloroform was very important for a variety of
17:16
reasons that we've not discussed on this show, but it is very
17:20
important in the case. Absolutely.
17:21
So the rule was invoked and we've talked about that rule
17:25
being invoked previously. But what we didn't know was that
17:30
Bias subpoenaed everyone we've always talked about.
17:35
Wasn't it interesting that the defense calls in the state's
17:41
witnesses when he had his own witnesses?
17:43
He had his own expert witnesses that he never called to the
17:47
stand. And we're like, how and why?
17:51
Well, we learned through our insider.
17:54
And Larry gave us some insider tips too, as the defense expert.
17:57
Absolutely. That Baez subpoenaed everyone.
18:02
And we just found that out. We just found that out.
18:05
If the state subpoenaed them, bias bias subpoenaed them before
18:10
the trial. So whatever the state's
18:14
witnesses were, were now the defenses bias witnesses.
18:19
So that was, it was a jaw-dropping moment this week as
18:23
well when we we spoke about that.
18:26
So once the trial started, then there was no talking among any
18:31
of the witnesses. Which is pretty much the whole
18:34
Sheriff's Department by by the, you know, the time the trial
18:38
rolls around who didn't work on it.
18:40
Absolutely. You know, having to testify,
18:43
you're not allowed to talk about the case.
18:44
And none of these witnesses, Osborne, Stinger, they had no
18:48
idea what Bradley was saying, nor did Bradley have any idea
18:51
what Osborne and Stinger were saying.
18:54
They couldn't talk, you know, nor could they even just talk to
18:57
Bradley until the defense excused them.
19:02
So once they're excused from trial, then they can have a
19:06
communication about what was said and what was discussed.
19:09
But one of the things a lot of people wondered with this
19:13
conflicting tools is why didn't Stinger try to explain away the
19:19
conflicting tool report reports? Because he just said they are
19:24
different. And again, a lot of people and
19:26
digital forensics got really upset about that.
19:28
And, you know, that's why we brought up the rule.
19:31
We have to remember that that rule was invoked.
19:34
So Stinger had no idea what has happened in the courtroom.
19:38
And he had to keep it simple. And he just said they were
19:41
different. And he didn't know why at that
19:44
time, why they were different. And so he just left it as they
19:49
were different now when he was going into the trial and during
19:54
the trial, he was also under the impression the entire time that
19:58
they, as the prosecution were sticking only to the Google
20:02
searches. That's all they were going to
20:04
bring up from the cash back report.
20:06
They weren't going to read any of the other websites that were
20:08
mentioned, you know, especially not that side. spot.com singer
20:13
was very clear with the prosecution.
20:15
He wasn't comfortable with that web.
20:18
Site and the results about the 84 versus the one he didn't know
20:22
why they were different and he believed they were going to
20:25
stick clear of that. So he just said they're
20:28
different. The defense didn't press him any
20:30
more than that on. So that's that's the way it's
20:33
ended. And I thought Becky here would
20:35
be a good discussion point of like, how much is too much to
20:39
stay on the stand and where is that line of like short and
20:43
sweet and explaining it all away?
20:46
Well, we also have to understand that sometimes saying too much,
20:50
it opens up that area of questioning, right?
20:54
To keep it simple and not open up that line of questioning in
21:02
hopes that your counsel will come and redirect and ask you
21:07
more questions to be able to explain the information.
21:11
It appears that that's not what happened here.
21:14
It appears that it was just left as they were different.
21:19
And I think you and I have had the discussion this week about
21:22
the fact that sometimes you just you can't say anything else
21:26
because what happens if now you're pushed into the corner
21:31
and how do you get out of the corner without, you know, of
21:34
trying to explain yourself even more?
21:36
So there's nothing wrong with saying they're different.
21:38
There's nothing wrong with saying I don't know on while
21:40
testifying, right. And again, it goes back to the
21:44
strategy and the understanding of the prosecutors.
21:48
You stated here Stanger was under the impression they were
21:52
sticking to only to the Google searches because when Stinger
21:57
communicated with the prosecutor, that was what he
22:02
recommended because he knew they were different.
22:07
And because the prosecutor didn't stick to what Stinger had
22:12
recommended, it opened up this other line kind of questioning
22:17
where all Singer needed to say was they were different in hopes
22:21
that the prosecutor could come back and hope to explain why
22:25
they were different. And that didn't happen either.
22:27
Right. And to your point, he was a
22:29
witness for the defense. So the defense got the first
22:33
shot at all the questions, but after he answered those
22:36
questions, the state had the chance to do the cross on their
22:41
own witness. But obviously it's like they're
22:44
witness, so they want to make him look good and keep his
22:47
answers in line with their story.
22:50
So the state could have asked him to explain it or justify it
22:55
or clarify it or any number of those things.
22:58
But ultimately they didn't. And I don't know if it was
23:03
because I thought, you know, let's just leave it at they're
23:05
different and we're not going to dig the hole any deeper with
23:09
these conflicting reports. Or maybe they didn't know what
23:13
to ask to make it better. And you certainly never want to
23:18
be the witness on the stand going but but but but or being
23:21
like and like making crap up as you're on the stand either so.
23:25
Absolutely. You never want to do that.
23:27
And that's the other thing is you're expert for the
23:30
prosecution when communicating with them and recommending where
23:33
to stay, what lane to stay in. When that line is crossed, it
23:37
really puts the pressure on the witness sitting at the stand to
23:40
say, OK, I have to answer truthfully.
23:43
Certainly going into this, even Osborne when she was called
23:46
first before Stinger, they had no idea what the defense was
23:49
going to ask them when the defense called them as their
23:51
witnesses. You're out for yourself here on
23:53
the stand. And you know, I'm sure they
23:55
could have role played it and guessed what crazy things might
23:58
have been asked or pointed out on the stand.
24:02
But, you know, rely on the facts.
24:05
Exactly. Rely and report on the facts.
24:07
Exactly. That's all you can do.
24:09
Yeah. So let's talk, talk about those
24:11
conflicting tool reports, right. So how do we end up with two
24:15
different tools reporting different results and then how
24:22
did those conflicting reports end up being key part of the
24:27
defenses strategy to shed doubt on the reliability of the
24:32
state's evidence. So if we tackle, if we tackle
24:37
the first part of that, the first part of the questioning,
24:41
the two different tool reports, we found out this week that it's
24:45
actually four. I know different tools, not 2
24:50
that was only brought into the testimony and the courtroom and
24:54
the readings and all that of cash back in that analysis.
24:57
But there was 4 tools, four different tools, and we got that
25:03
inside scoop and it was that analysis and case cash back and
25:11
FTK, all four tools produced different results.
25:15
First of all, that just gives me like anxiety thinking about it,
25:19
right? It just like, Oh my gosh, I have
25:21
4 tools and they've reported differently.
25:24
So it was said in the court that Stinger didn't like the fact
25:28
that net analysis could not handle daylight savings time,
25:34
which was included in that Mork database.
25:35
He went on to go out there and search for a better tool to help
25:41
him validate, understand, verify the evidence.
25:46
And that's where we get 4 different.
25:49
Tools, he kept looking and looking and I mean, four tools
25:53
later and really at that time that that was kind of all there
25:56
was because you got to remember N Case and FDK were the two big
26:00
forensic tool suites. And then Net Analysis and Cash
26:04
Back were the only ones outside of the big tool suites that
26:09
could do the parsing of that Mork database.
26:13
Right. So at the time of this
26:15
investigation, you used the four main tools that examiners were
26:21
primarily using back then and it was reporting on that
26:25
information and evidence, different results.
26:28
And that's where understanding our tools comes in.
26:32
Like just don't report on what the tool is reporting on.
26:35
I mean, just don't communicate what the tool is reporting on,
26:39
Understand it. And I think this is very clear
26:42
that that's what Stinger was after, the answers to the
26:45
questions as to why this was being done this way.
26:50
Ultimately, the Orange County Sheriff's Office was unable to
26:52
validatethatsighspot.com, which was the core forum site visit,
26:58
and they even tried manually walking through the data and
27:03
could not get there. So the prosecution strategy, as
27:06
they conferred with Osborne and Stinger, was to be very
27:12
conservative, to not use any of that Internet history that could
27:17
be easily debated or challenged. And that's exactly what
27:22
happened. And so it was challenged in
27:24
court, and the testimony was supposed to be focused primarily
27:29
on the Google searches only. Again, a breakdown in
27:33
communication. Orange County Sheriff's Office
27:37
had it right. They had it right because they
27:39
used multiple tools to try to validate the evidence.
27:42
They had it right because they knew that it could be challenged
27:46
or debated and what they felt like the best evidence to be
27:51
presented in court was. And ultimately, the state
27:54
prosecutor, the lawyer has Bradley read in that side spot
27:58
com website and other websites into the record.
28:00
Yep. And then she has him go back on
28:03
the redirect to be like and how many times was it visited?
28:07
And then that's when the 84 comes in and then it just
28:10
waterfalls down from there of a lot of back and forth.
28:14
And then during that recross after after Baez is trying to
28:19
get what we assume is the net analysis report results of the
28:24
one visit to the chloroform site in through Bradley.
28:28
The state's going to object on that.
28:30
So that conflict doesn't come up later until Stinger is there.
28:35
But what it tells us is that the defense is well aware of the
28:39
conflicting number of visits and again is trying to use that to
28:45
their defense strategy. Right.
28:48
And it came out in the trial, right.
28:49
So there was the 84 in the chloroform and then Baez is
28:52
trying to get that net analysis report in with the one hit
28:55
through through Bradley and and the state picks up on it because
28:59
Bradley's like what what is this, This isn't my report.
29:03
And then the state's like, this isn't your report And they start
29:06
objecting and so it doesn't get in.
29:08
Larry told us as much in his interview that they knew that
29:13
there was conflicts and the results didn't match up.
29:16
So they knew that what their strategy was ultimately with
29:21
without the state bringing up the 84, who knows?
29:24
Again, we also know that as a trial is moving along, their
29:29
strategy is changing like a chess board.
29:32
They're looking to see what's going to benefit them as
29:37
evidence is brought into court. So there's three things to take
29:40
away from this, the ability to follow this information, the
29:44
role of tool validation and your role as an expert versus the
29:48
role of a lawyer. Being able to have those
29:51
attorneys understand what you're trying to communicate is
29:57
critical. That is so key in in in
30:00
investigations, especially in trials.
30:02
Right. If they don't understand what's
30:05
important, then they might not ask about it, they might not
30:08
harp on it. And if they don't understand,
30:12
like in this case, why it's so important to not use something,
30:16
they don't understand the can of worms that they're opening.
30:22
And the thing we have to remember as expert witness is
30:27
what's our job as the as the expert witness?
30:30
So Becky, like what's our job as the expert who's testifying
30:35
versus the lawyer's job? I mean, our job is to tell the
30:38
truth. Our job is to state the facts.
30:40
Our job is to articulate the findings that we have located
30:44
and be just very clear in explaining the details.
30:52
Our our role is to communicate not those findings to our
30:57
investigator, but to the attorneys and ultimately make it
31:02
very clear if testifying to the jurors.
31:04
Right. And this is so much different
31:06
than the role of the lawyer because the lawyer gets to ask
31:10
the questions and the lawyer gets to decide what evidence is
31:15
brought in during the trial. We can certainly talk to her
31:19
blue in the face before the trial about what we think and do
31:23
our recommendations. But ultimately the lawyers are
31:27
up there doing the the song and dance with all the witnesses and
31:31
bringing in the evidence that they want in the case that
31:34
supports their strategy for the case.
31:37
Right. And again, that makes a perfect
31:40
point of you have a prosecutor, a defense and a judge.
31:45
Ultimately those three are the people that allows evidence to
31:49
be entered into court. It can be ejected.
31:52
It could be a hearing could take place beforehand to even have
31:55
evidence not submitted into court.
31:57
So again, in the end, that's the role of the attorney.
32:01
Our role is to clearly understand the evidence, to be
32:05
very clear and concise in what that's evidence is stating.
32:09
And like Stinger, you have two reports here.
32:12
Those two reports are entered into the court as an exhibit,
32:16
and they're different. And I think we've hinted at
32:18
this, this information in the trial, even going back and re
32:22
watching testimony and re reading transcripts, it's hard
32:26
to follow what is happening. And I understand digital
32:30
evidence, and I mean, granted, we're looking for some very
32:32
particular things here about like the 84 and who to introduce
32:36
what in what order. But when we're trying to go back
32:39
and dig through that, that was very difficult.
32:41
Bradley's testimony alone was nearly 100 pages.
32:44
So it's a lot of information to absorb.
32:47
Just imagine the jury trying to follow just this part.
32:51
And then they got all of the other stuff that they had to
32:53
listen to as well during the trial.
32:54
Absolutely. So let's let's talk a little bit
32:57
about validating. So do you have to validate
33:00
everything? In my opinion, you don't have to
33:05
go through every single time in every single case and validate
33:10
every single record. However, I do validate manually
33:16
or with another tool, the smoking guns of the case.
33:20
If especially if I'm going to be going to court and testifying on
33:25
this, those specific records are the ones that I'm going to be
33:29
double checking and making sure that they match up, that I
33:34
understand them, that I understand how the tool produced
33:37
what it produced. Do you, do you disagree, Becky?
33:40
Do you have to do them all? No, you, I mean, obviously
33:44
there's mounds and mounds of data when any case, whether it's
33:48
a cell phone or a computer, whatever type of case you're
33:51
working on. So did the tool report properly?
33:56
And if it didn't report properly, then validating with
34:00
another tool or manually validating it.
34:04
And there's nothing wrong with doing a comparison, looking at
34:06
the raw data, calling the vendor, asking questions.
34:11
And I'm pretty sure that that's exactly what happened in this
34:16
case too, that more than one vendor was actually called to
34:19
ask questions about what the tool was reporting on.
34:24
And, and I think you and I both have done that in other
34:26
investigations throughout our career is what we're expected to
34:30
see. And what we're seeing doesn't
34:32
match with that comparison of manual raw data.
34:38
And so why is the tool not reporting properly?
34:40
Is there a bug? Is there a problem?
34:43
And so again, it goes back to through a lot of casework,
34:50
knowledge, skills, ability, training, experience, you have
34:54
to understand the important you call them smoking guns, call
35:00
them findings of a case that needs to be truly validated to
35:06
make sure that there is no issues once the evidence is read
35:10
into court. Right.
35:11
And a lot of this assumes that you know how your tool as a
35:17
whole really works and what it's doing with the data.
35:20
And as you've been there for a while and been doing some cases,
35:24
you have picked up the understanding of what is normal,
35:28
what looks normal, and then you can spot the abnormal because of
35:32
that. So obviously if you're a brand
35:35
new examiner, you've not got that like, oh, this looks weird,
35:39
I haven't seen this before sort of situation because when you're
35:42
new you're like, I haven't seen any of this stuff yet.
35:44
Right, right, right. And that's why a new person
35:48
should should have a person with them that has some experience
35:52
to, you know, help explain some of the details that might look
35:58
OK to the new person, but definitely a standout anomaly to
36:03
a more experienced person. Yep, and I think Stinger got a
36:07
bad rap because everybody was like Oh my God, push button
36:11
forensics at its finest. And they meant that in a bad way
36:15
because they thought he just was like, click, click, left it
36:18
alone, conflicting reports, whatevs.
36:22
But he tried the Sheriff's Office tried four different
36:25
tools to generate reports. They tried validating.
36:28
And by the time they went to trial, they just didn't have any
36:31
explanation. And their strategy was to avoid
36:35
it, right? And their strategy was right.
36:38
Their strategy was to communicate that to the
36:41
prosecutor, to be able to make sure that they stayed within the
36:46
lane, that they could validate and communicate about the
36:50
findings and not to cross that line.
36:52
And unfortunately, again, goes back to who's in control of that
36:56
evidence and those exhibits that are being entered into court.
36:59
And those are your attorneys and your judge.
37:01
When us as examiners are left out of that decision, we have to
37:04
roll with what were put on the understand to talk about.
37:07
Yeah. And that we even found out there
37:09
was when this whole hullabaloo of the 84 versus 1 and the
37:13
conflicting reports, apparently there was a lot of motions and
37:17
sidebars and back and forth because the lawyers were
37:21
apparently arguing about this quite a bit.
37:24
And at one point, I guess the judge was just like, you're
37:27
going to have to end this and live with it.
37:29
It is what it is at this point. And so that's other stuff you
37:32
don't see, right? Because the jury, they can't
37:34
hear the sidebars or anything, any of that sort of stuff.
37:38
And some of this stuff is obviously happening behind
37:40
closed doors. So the media didn't hear any of
37:43
that either because there was a break between Bradley's
37:47
testimony. You know, he went on like all
37:50
afternoon. They got dismissed for the day,
37:52
and then he had to come back on the the next morning.
37:54
So apparently there's a lot of fighting that night.
37:57
We're actually told there weren't supposed to, they
38:00
weren't supposed to use that spot, size spot.
38:02
Now, the state did have a digital forensic examiner from
38:05
another agency sitting in the courtroom.
38:08
Didn't know that that was there to help with the digital
38:11
evidence stuff as it came up. And that was a good strategy,
38:15
right? Like being able to explain some
38:16
of the terminology that's being spoke about, being able to help
38:20
with a line of questioning to move the case forward.
38:24
So that was a good strategy. I wonder if it was the guy who I
38:27
was asking Larry about earlier, if that was their guy talking to
38:31
him. And he's like, no, that wasn't
38:32
our guy. Because there was some guy that
38:35
was always on his BlackBerry and I couldn't remember exactly
38:37
where he sat. So maybe this was the digital
38:40
forensics expert sitting there for the state trying to help
38:42
them out. Yeah, exactly.
38:44
But they they didn't have a strategy for what to do with the
38:47
defense introduced that conflicting results and they
38:50
clear and and clearly that different.
38:53
You know, that was the defense strategy.
38:55
And, and again, it goes back to the fact that if there's
38:58
discovery of data sitting there and one lawyer doesn't speak
39:03
about it, but another lawyer does speak about it, it's
39:07
discovery, right? And so it's open for discussion.
39:10
It's open for getting that evidence in through an expert.
39:16
And whether it's the defense's strategy or the prosecution
39:19
strategy, the prosecution clearly didn't understand the
39:24
can of worms that could be opened up by avoiding 1 area of
39:30
the evidence and only speaking about the other area of the
39:33
evidence. Right.
39:34
Because even if your strategy was to avoid, let's not discuss
39:38
this, let's not mention it up, you have to remember the
39:42
discovery includes all of the hard drives and laptops in this
39:46
case. So certainly the defense expert
39:48
can run all their tools and just see all that stuff.
39:51
But in this case, clearly a net analysis report was entered in
39:55
to evidence as derivative evidence.
39:57
So they saw like immediately there was a cash back and a net
40:01
analysis report. And you know, we never did here
40:04
was any report written that said this is all conflicting.
40:07
We don't know why. And then, you know, you could.
40:10
Talk about amongst yourselves. Is that a good idea to be like I
40:14
don't know why they don't match or just kind of like not
40:16
document it? I don't know.
40:18
Right, right. It's it's, it's a difficult
40:22
situation to be in. I think I would have documented
40:25
certainly what I was trying to do.
40:28
Sure, you know all the different things I did that would be in my
40:31
case notes. And then you got to write up
40:33
what you did in your case notes. And I don't know that I would
40:36
have had a conclusion of WTF because that clearly that was
40:41
the conclusion before they went to trial.
40:44
Right. I don't know what it is.
40:46
Yeah. I've never seen a digital
40:49
forensics written report that says that.
40:51
I mean, I think we may feel like that from time to time, but you
40:54
know, we dig deeper and sometimes you just run out of
40:57
time that's got no answers and you're stuck and and that's what
41:01
happened here. Yep, exactly.
41:02
So, yeah. So sometimes those lawyers skip
41:04
important questions, and sometimes the lawyers introduce
41:08
things that weren't involved in the plan in the first place.
41:11
Yep. And Speaking of plans, you know,
41:14
the defense strategy basically is throwed out everywhere.
41:19
And that certainly couldn't be more true than when it comes to
41:21
this digital evidence and the conflicting reports.
41:24
And we have to remember that Larry Daniel is behind the
41:27
scenes working on the digital evidence for the defense.
41:31
And he told us, you know, he looked through the cash back
41:34
reports, the net analysis reports, the written reports,
41:36
all the stuff that the state had generated.
41:39
And then he went in, did his own examinations as well.
41:43
So he knew there was a conflict between the 84 visits or the one
41:47
visit to that side spot chloroform website.
41:50
And I will say the only advantage you have as a defense
41:55
expert is you can see everything that the government did 1st and
42:01
you can choose how you want to approach it.
42:04
You want to just look at the raw evidence 1st and build your case
42:08
based on what your lawyers have told you is going on and what
42:12
they need to know. Or do you look at all the state
42:15
stuff first, the government stuff first?
42:17
Or do you look at a little, take a peek, and they go back and
42:20
forth? I mean, there's all sorts of
42:21
different ways to handle that. But I mean, it certainly is an
42:25
advantage. And I use that to my advantage
42:27
whenever I can. It's like, well, looky, looky.
42:30
What did somebody else come up with?
42:32
Do I agree? Do I disagree?
42:35
Did I find more? Did I find less?
42:38
If I found less, why did I miss something and then figure that
42:42
out exactly so? What have we learned?
42:45
We've learned a lot in this case, Stacey and 1st, I'd like
42:48
to take the opportunity to say thank you to all of our visitors
42:54
and insiders that shared this information with us, that helped
42:59
us to understand the testimony and the transcripts and what we
43:03
didn't know. I like to thank them openly for
43:06
coming and taking time out of their busy schedules to speak to
43:09
you and I about it so. Everybody had stuff that they
43:12
wanted to say that they wanted to get out there 14 years later
43:16
because so much of what we've discussed today, like the four
43:19
tools that had never been mentioned before.
43:22
So there's lots of stuff out there that's never been said.
43:26
So people think they know Casey Anthony case and why it went the
43:29
way it did and who did what and who to point that finger out and
43:32
bad guy one and bad guy 2 and lazy guy 3 and all that sort of
43:36
stuff. It's so, so much more
43:38
complicated than that. Absolutely.
43:40
There were never, there were never any 84 searches for
43:44
chloroform. We know that for sure.
43:45
And on top of that, we also know that the media exaggerated that
43:51
they got it wrong. Wrong word.
43:54
Yeah, wrong word. It was visits, not.
43:56
Searches. It was visits, not searches when
43:59
communicating that the media, you know, explodes things out
44:04
there for people to misunderstand, and that's what
44:06
happened here. Yep, Yep, for.
44:08
Sure, like you said, four different tools were used with
44:11
all conflicting results, which the Orange County Sheriff's
44:14
Office was not able to validate before the trial even when they
44:18
tried. And they definitely tried.
44:20
So I think there is a huge impression out there that they
44:25
just trusted the tour results and did no validation.
44:28
And that is totally not the case here.
44:30
They tried and they did everything to figure out what
44:34
the conflicts. Were now it does sound like they
44:37
probably could have done a better job of sharing those
44:42
trials and tribulations of the tool validation with John
44:46
Bradley. But I know John Bradley was in
44:48
the position of I can't see what other vendors do because I don't
44:53
want to be accused of stealing their intellectual property.
44:57
So that's another sticky wicket thrown into this case as well.
45:00
And because that rule was invoked, Osborne and Singer had
45:04
no idea what happened during Bradley's testimony or during
45:08
anyone's testimony. They weren't able to discuss it.
45:11
They weren't able to communicate, they weren't able
45:14
to listen. And so that also was a situation
45:19
where it was an unknown for them.
45:21
Bradley didn't know that there were four tools used to try to
45:25
validate. He didn't know the prosecution
45:28
was not supposed to introduce the side spot chloroform site,
45:32
let alone the visit count of 84. Likely that knowledge of, you
45:38
know, was left out from being communicated to him that hey,
45:43
we're going to stick with the Google searches and the Google
45:45
searches only. Well, and let's remember, before
45:47
he took the stand, he was under the impression he was only
45:50
talking about the tool itself. So he thought he was going to
45:53
get really geeky with it and explain and demonstrate how it
45:56
does this, that and the other. He had no idea who is going to
45:59
read a bunch of URLs into the record.
46:01
Their URLs on reports that he didn't create.
46:04
It was his tool and he was speaking about his tool, but
46:08
because he was so well known of the tool, he was used to read in
46:13
the the report. Now, wouldn't that have been
46:15
fascinating if Baez would have picked up on that and objected
46:19
and been like, you can't read that in, it's not your report.
46:22
Like, I wonder how that argument would have played out in court,
46:25
what the judge would have ultimately ruled.
46:27
Would he have said, yeah, go ahead.
46:29
You developed the tool. Read in all this stuff that your
46:32
tool generated. Again, a defense strategy.
46:34
You could go this way or you could go that way and Baez went
46:38
this way. Yeah, I don't.
46:39
Yeah, I don't know if he knew at the time that it wasn't.
46:43
See, we've spent like 40 bajillion hours doing all these
46:47
podcasts, episodes and the research and and I still have
46:50
more question of things we didn't ask because was it Baez's
46:54
strategy to let Bradley read that?
46:56
All that stuff in knowing and hoping that he's going to
47:00
introduce the conflicting information?
47:02
Because I think it's stronger for the defense if the state
47:06
brings in something and then you go, oh, this is shady.
47:12
And This is why. Because sometimes there's
47:14
rulings and I've dealt with this, that the judge is like,
47:17
oh, you defense, you guys can't bring in this potentially
47:21
exculpatory information. You can't introduce doubt of
47:25
this nature like that, the third person and that sort of stuff.
47:28
So who knows what sort of stuff happened in the hearings that
47:33
made some of this stuff go down the way that it did.
47:35
Exactly. And so that's, you know,
47:37
everything just sort of unraveled with the state
47:40
revealing that 84 visits to the size spot on redirect.
47:44
And then could the conflicts still have come out once it was
47:48
time for the defense to produce their case?
47:50
Maybe. Who knows?
47:52
Probably. But we'll never, you know, we'll
47:54
never know. And again, it goes back to what
47:57
strategy was being used to try and navigate the trial to the
48:03
testimony, right? What is going to benefit which
48:07
team the best? Yep, that's how it works.
48:09
So I think, you know, we've we've thrown out a lot of new
48:14
information and we've talked about the lessons learned here.
48:18
But let's start wrapping up finally on on Casey Anthony.
48:21
I have my adult beverage here. This whole episode and
48:25
celebration of coming to the end of Casey Anthony.
48:29
Cheers to adult beverages. We want to come back and be like
48:33
this. This stuff is still important 14
48:36
years later. How does this apply today?
48:41
If you are out there anywhere on the Internet and following
48:45
digital forensics people and if you're going to classes about
48:48
your tools, you are still going to hear validate your tools.
48:53
Don't do push button forensics. Don't blindly trust you know how
48:58
your tools work. Take a look at those results.
49:01
Call the vendor, ask them questions if.
49:04
Phone a friend. Phone a friend, utilize your
49:09
network right? Yes, if there's something new
49:13
that you haven't seen, call up a friend and say, hey, help me try
49:17
to understand what's going on here.
49:19
Hey, what kind of tool would you look at?
49:21
Would you use to look at this type of data?
49:23
I'm seeing something that doesn't look normal.
49:26
What would you do next? Dude, there's nothing wrong with
49:30
reaching out to your network and brainstorming some different
49:33
ideas. It's it's, it's part of, it's
49:36
part of today's digital evidence because it changes so often.
49:40
Yes, it changes so often, so fast.
49:43
There's so much more of it from so many more different services
49:49
and sources. And I think that's kind of the
49:52
other part of it too, is stay in your lane to a certain extent,
49:58
depending what it is. There's a lot of things you can
50:01
do with a lot of different evidence sources coming in, like
50:05
a computer and the cloud and emails and the phone and sort of
50:09
stuff. But at a certain point, if it
50:12
gets very technical, then you might have to pass part of it
50:17
off to someone else, or start calling and asking somebody else
50:21
to guide you through this and that, or to tell you some
50:26
different things to. Absolutely.
50:28
There's a lot of different avenues that can be taken there,
50:31
absolutely. And then Speaking of, you know,
50:34
your role as the expert witness versus the role of the lawyer
50:39
that still pertains today. We still have to remember that
50:43
today. And I don't know that I hear
50:47
enough about that. I don't know that I've said much
50:50
about it ever, like even when I'm teaching classes.
50:53
And I think it's something I want to start incorporating
50:56
more. We all so our role as the expert
50:59
witness is to produce the facts and make them easily understood
51:04
by the jury. But we also have to remember the
51:08
lawyers are in, the judges are deciding what even gets in as
51:11
evidence in the first place. Yeah, it was stated this week
51:15
we're the witness. We are there to provide the
51:19
information that needs to be read into court and the and the
51:23
attorneys and the judge are there to make the decision on
51:27
what gets into court. Well, I hope you found the
51:30
insider knowledge revealed in this case as fascinating as we
51:34
did. We also hope you found that this
51:36
case was very interesting and how it all came down.
51:41
So we ultimately learned there wasn't a bad guy who bought the
51:44
digital evidence. There wasn't anybody just
51:47
pushing buttons in their tools and blindly trusting the
51:51
results, thank goodness. It was complex.
51:54
It was complex evidence, and unfortunately the conflicts
52:00
didn't get resolved before trial.
52:02
With that, until next time, stay safe, stay sharp, and as always,
52:07
keep parsing the truth one bite at a time.
52:12
If you enjoyed this episode, make sure to follow us to get
52:15
notified the next time a new episode drops.
52:18
If you can do more, head on over to parsingthetruth.com and
52:22
donate by clicking on the donate button.
52:25
Parsing the Truth is a nonprofit organization and we are raising
52:28
money to send a new digital forensic examiner to I Asus
52:32
training next year in Orlando. Thanks.