Crazy Like a Firefox
Posted by thedarwinexception on June 9, 2011
Court starts with Baez renewing his objections, you gotta give the guy credit – he is persistent. The judge explains to Baez again that this is a matter of evidence that the jury will have to be presented so they can decide how to weigh it and how much credit to give to it.
First up is Kristin Brewer. She is the dog handler from Osceola County who took over the dog “Bones” from officer Forgey in 2005. Officer Brewer says that she is not a full time dog handler – that is just something she does on an “as needed” basis. Her full time position is Road Supervisor.
When she first received Bones, she was aware of his background and his previous training. She had some experience with dog training before, she says that this had been a hobby of hers. When she received the assignment for K-9, and handling Bones, she spent several weeks simply playing ball with the dog and getting to know him and bonding with him. She was in touch with Officer Forgey, and he helped her with advice and told her things about the dog to help her in the bonding and training process.
Although Bones had already been through training, Officer Brewer had not, so she went through training with the dog several hours a week, and kept training logs of these times. She also attended several schools with Bones. One of the schools she attended was the same Sarasota School Officer Forgey went to. At this school Bones had no false alerts and no misses, and he had a perfect record for finds.
Bones and Brewer also attended a water seminar together for training. This school trains for a dog to alert in water finds – either on the shoreline, in the water or in submerged areas. Bones had no false alerts, no misses and was able to locate all the targets during this training.
Bones then attended an Advanced Land training seminar. This was training that focused on buried remains and hanging remains. This is also when Bones received his NNDDA – National Narcotic Detector Dog Association – certification, which recognizes Narcotic and Cadaver dogs.
Bones has been trained on residual odors. A ceramic tile was wiped with human blood, and then wiped clean and Bones successfully alerted to which ceramic tile had been wiped with the blood. Bones has also been exposed to crime scenes where the medical examiner had removed a dead body and Bones alerted to where the body had been.
Bones is rewarded for good performance with a tennis ball. He is never rewarded with food.
On August 23, 2005 Bones was called out for a search. Bones did not alert. Later digging revealed a deceased dog. August 1, 2006 Bones was called out to a location to determine the location of remains. There was no alert. The area was searched and a dead animal was located. May 10, 2006, Bones was called out. Bones did not alert. The area was dug and a deceased dog was found. September 5, 2006 Bones was called out. He did not alert. The area was searched. A dead possum was found. June 6, 2009, Bones was called out. Bones did not alert. The area was searched. Small animal remains were found.
Bones has never falsely alerted with this handler. Bones has alerted and had finds. March 31, 2007, Bones was called out. Bones alerted to several small human bones. October 8, 2007, Bones was called out to a possible dead body in the woods. Bones alerted at the location where the body was later dug up. October 28, 2007, Bones was called out. There was an elderly female missing. Bones alerted to a particular location where they found the elderly female. September 30, 2007. Bones was called out to a landfill. Bones searched for several days and alerted to a comforter a baby was born on and was later discarded in the trash with. March 26, 2008, Bones was called out. A skeleton was found and Bones was called to find other bones. Bones alerted to additional human bones.
May 14, 2009 Bones was called to a water search. Young male had drowned – they did a boat search with the dog. Bones alerted to a specific area – a buoy was dropped and the area searched and the young male was found.
February 9th, 2010. Bones was called out. The body had been burned and Bones was able to lead officers to where the body was located. December 20, 2010, Bones was called out. 2 Bodies had been buried in the same hole in an orange grove. Bones alerted to a specific area that was later dug and the bodies were found.
Bones is a single purpose dog – he only locates cadavers. He gets called to many out of area searches. Many times there is no alert at all.
Officer Brewer and Bones were called to the Anthony home on July 17th, 2008, at 8:00 in the evening. It was fairly dark at this time. This dot not affect Bones at all. Upon her arrival she met with Officer Forgey, who told her that they would like her to search the backyard. She was not told if there were any prior alerts in the backyard by Officer Forgery’s dog.
Brewer brought Bones into the backyard on lead. When they got just past the gate, she put his heavier collar on him as an indication to the dog that they were going to search. She gave Bones his search command. Bones went around the yard, checking the pool and lanai areas, and the corners of the yard. He showed interest in one particular area of the yard, and kept returning to it, finally returning and giving his final trained alert in this area. This area was just in front of and to the side of the playhouse – the same place where Grus had alerted.
Brewer and Bones returned the next day, after the scraping of the yard had been completed. Bones gave no alert at this time. Brewer suggests that whatever Bones was alerting to had been removed or disturbed.
Cross examination – Baez asks about the commands that she gives to her dog – that there is only one command – she doesn’t separate the commands into “find bones”, “find blood”, “find decomposition”. Brewer agrees. The dog can be alerting on blood, or bones, or tissue.
Baez asks about the training vehicles – he has the witness testify that for training purposes they try to use vehicles with known histories – because they don’t want t use a car that may have been in an accident where the occupants had injuries. Brewer agrees – she also agrees that her dog is a tool, not a conclusive indicator, and says that he is trained to find the strongest source – whatever that might be.
Baez asks the witness about the fact that Forgey had told her his dog alerted 6-8 feet away from where Bones alerted. Baez tries very hard to get her to say that 6-8 feet would bring them closer to the pool area.
Baez asks is she ever deployed her dog in the house or on the lanai – she says she didn’t.
The witness is excused.
Sandra Osborne is next. She is a computer examiner for the Orange County Sheriff’s Office. She has been with the OCSD for 21 years. She used to be in sex crimes child abuse, homicide. She has 700 hours of Forensic Computer training and is certified. In the last 4 years since she’s been in this job she has conducted several hundred examinations of all kind of digital evidence. She conducts searches of not only computers, but Iphones, Cell Phones, PDA’s, and kind of device that might contain a digital file.
The witness is accepted as an expert.
Osborne testifies she received several items to examine that were involved in this case, including Casey’s cell phone. To examine the data on the phone Osborne used a program called Cellebrite, which is the standard in the industry. Using this program it is possible to retrieve contact lists, text messages, incoming calls, call histories, picture and video files, whatever the phone offers. There are many ways the extraction can be hampered – sometimes the phone manufacturer can make the data files inaccessible to a third party tool, sometimes the data port on the phone can be disabled by the carrier, sometimes the software itself isn’t designed to retrieve data from certain makes and models of phones. Cellebrite updates their software periodically to include new phones and models.
Osborne received the phone and was asked to determine if a Zenaida Fernandez Gonzales could be located. The initial data retrieval process garnered only the contact list and several music files. This was a limitation of the Cellbrite hardware. This was the only data that could initially be retrieved.
Burdick asks the witness about the “Sim card” in the Nokia phone that belonged to Casey. The witness explains that a sim card is the “chip” that goes in the back of a cell phone to allow the phone to connect to a network. Sims cards are often interchangeable. Casey’s phone had a sim card. The Cellebrite hardware allows for the sim card to be “plugged into” it to retrieve data from the sim card.
Osborne examined the cell card from the Nokia Cell phone but got no different information than she had from the phone. Osborne did not see any information regarding Zanny, but that is not her function – she simply compiles the data into a report and hands that report to the detectives. The Cellebrite software generates a report that is web based and easily readable
Osborne received both a laptop and a desktop computer associated with case, as well as a Polaroid and a Nikon Coolpix digital camera. Osborne testifies that to retrieve data from digital cameras she uses a program called EnCase. Using this software she can gather information from SD cards. That is what she did int his case – she retrieved the SD card from the back of the Nikon camera and used EnCase to retrieve the information it held. Using EnCase she found video and still pictures on the SD card. The date on the video was June 15th, 2008. This was the video taken at the Nursing Home with Cindy Anthony’s father.
She knew this date was correct because the camera itself will embed information in to the video file – including the cameras brand and model, the date and time and sometimes shutter speed or GPS location. She determined that the date she actually had the camera and the setting on the clock were the same – with a small 2 minute difference – so she knew the camera held the correct date for the video file.
The desktop computer (it bugs me that she calls it a “floor model”) Was a HP520N. It had a 160GB hard drive. Osborne used the EnCase software to examine this computer.
EnCase can be used to extract every 0 and every 1 that is on a hard drive. It can be used to recover every piece of information on a hard drive -whether the user can see that information, or not. In order to preserve the original condition of the Hard Drive from the HP computer, Osborne attached the drive to a write blocker, to ensure that her forensic tool did not alter the original information on the hard drive in any way. She then copies all the information from the hard drive to the server as well as another hard drive and puts the original back into evidence and works from the copy.
Unlike cell phone information, Osborne does evaluate the data she retrieves from computers.
Osborne explains about the EnCase software and what it allows her to examine. Using this software she can see all the information in allocated space – the data that a user actually can see – she can also see the system files and she can see the information in the unallocated files are – the information that has been deleted bu t has not yet been written over with new files.
To record the internal clock of the computer, after the hard drive was pulled, Osborne went into the BIOS and recorded the date and time. The internal clock was perfectly matched to the actual date and time.
The HP was running Windows XP, Internet Explorer, Firefox, Safari, MS Office Facebook and MySpace were also accessed. AOL Peer to Peer messaging and Yahoo messenger were also available.
There were two user created accounts – one was “Owner”, one was “Casey”. The “owner” account was password protected with the password “rico23”. This password was set early in 2008. (Ricardo Morales???)
Initially Osborne was just going on a fishing expedition – just to find Zanny or any information that might help in locating Caylee.
To complete this “fishing expedition”, Osborne first went into the user files and folders to see exactly how the computer was being used. She started at the desktop level to see what programs were being accessed regularly then went into the browsers history to see where on the internet the users have been going She then looks for any phone lists, phone contacts or resumes to see what information can be gleaned. This is what she generally does on all computers – she tries to create a profile of who is using the computer and what it is being used for – whether it’s a social computer, a business computer or just a gaming computer.
Osborne found references to a Zenaida Fernandez Gonzalez in the temporary internet files of the desktop computer. These are the cached files that the computer stores on the hard drive every time you visit a page on the web. The computer does this so that the next time you visit that page the computer won’t have to re-load the page from scratch – it can pull from the temporary internet files, speeding up the loading of the page you are visiting. This snapshot of the web page visited also holds information about when the user visited the page, what user account visited, as well as the URL of the page.
There were several searches all around the same time frame – in the morning on July 16, 2008 for a Zenaida Fernandez Gonzalez – including one on peroplesearch.com, some high school reunion websites, a Myspace search, and google searches. There were also specific searches done searching within the Orlando and Jacksonville areas and within a specific age range of 22-49. Prior to the morning of July16th, 2008, there were no references to Zanny.
In her examination of the desktop, Osborne found that this desktop was on and running a good deal of the time. It appeared to her that the users of the computer didn’t use the computer in an office or student type of way – there were few documents on the computer besides a couple of resumes for George. She did find 4 and a half years worth of internet history – it appears they never cleared that file.
The internet history is an actual recording of the pages that a user visits – the temporary internet files are a physical snapshot of that page. Osborne copied the files from the temporary internet files and analyzed those files with a program called “NetAnalysis”. This program retrieves all the history files, the temporary files and all the cookie files and puts them in spreadsheet format for her to analyze. This spreadsheet allows her to look at the files in different sort formats.
The temporary internet files will show which user account visited the site referenced. It will also show in the internet history which user account was accessing the web site. Once a file is deleted, however, the unallocated file space will not show what user account originally created the file.
Yuri Melich asked Osborne late in August of 2008 to search the computer files for any mention of the word chloroform. Osborne entered this as a keyword in the EnCase software (spelled correctly and spelled incorrectly) and got computer search hits on both spellings. The words appeared in unallocated space on the computer – showing it had been deleted. She got a complete history record from Mozilla Firefox. This file had not been overwritten with new information. Wen she found this data she turned the information over to her supervisor.
She received an Apple Macbook computer purportedly belonging to Ricardo Morales on October 28th, 2008. She saved this hard drive in the same way as the Anthony computer. The date and time in the BIOS was set to the right date – London time – 4 hours difference from EST. She was asked to perform a search ont his computer for specific keywords, as well as find any pictures of Caylee that showed her wearing a pink t-shirt with specific writing on it.
Osborne found the photo of Caylee (the one with the bruised eye) on the computer by looking through all the graphics files. The same data that is embedded into a camera file is embedded once the photo is uploaded to a computer, so Osborne was able to determine the date that the photo was taken.
Baez asks the judge to read the same stipulation he read to the jury the last time this photo was shown – the one stipulating that the bruise under the eye was not due to child abuse.
Based on the data embedded in the photo, the date the camera was set to when the photo was taken was January 28th, 2008.
Osborne also found the photo that depicts Casey and Caylee on the couch with the guitar. This photo appeared on a thumb drive given to her by Melich. This photo also appeared on Ricardo Morales computer. The photo was taken by A Canon Powershot camera. It was taken, according to the camera settings, on March 19th, 2008.
Cross by Baez: Baez asks about the user profiles on the computer. There are two user created profiles on the computer – but that doesn’t mean that only two people are using it. Osborne found various searches under both profiles. And a password only means something if the password is only known to one person. And if the user logs out after using the password. Osborne didn’t ascertain how long the user stayed logged in if the computer went into a hibernate or sleep mode. Osborne testifies that she never examined the Canon digital camera and doesn’t know if the time/date stamp was correct.
Osborne ran a search for the word “chloroform” on Ricardo’s computer. She found no pictures of web pages referencing that word. Although the cartoon of “win her over with Chloroform” was posted to Ricardo’s MySpace page. Baez wants to know how this photo would not have showed up on his computer. She says that this could have been for a number of reasons. He could have posted it from another computer – from a phone, or from this computer and then the file was later deleted and then overwritten within the unallocated space.
Re-Direct – if you are doing a keyword search, would the pixels embedded in the picture be accessible? Osborne explains that no, the pixels are in hexadecimal code, and the words in the picture are not “tags”, they are “code”. They don’t appear as “words”. And are not readable as such.
Re-Cross – Osborne reiterates that there were no references to searches, pictures or web pages containing the word “chloroform”.
The witness is excused. The next witness is Kevin Stenger, he is the Sergeant of Computer Crimes at the Orange County Sheriff’s Office. He has been with the OCSD for 25 years. The computer crimes department was formed in 2002, he was the first Sergeant. He has a masters degree in digital forensics. He is a guest lecturer and subject matter expert at the University of Florida. The computer crimes department specializes in hacking, child pornography and the forensic investigation of people’s computers.
The witness is recognized as an expert.
He supervised Osborne in the recovery of data from the Anthony’s HP computer. He reviewed Osborne’s work. Also, if she needed help with anything, he was there to assist her. Stenger was made aware of a keyword search for the word “chloroform”. Osborne found data related to a hit for this word in a search, but was unfamiliar with the context of this search, so she went to Stenger for assistance.
Stenger recognized the search as being a file in unallocated space, and of the structure of a Mozilla Firefox internet history file. It was an old version of Firefox. The history would have had to have been deleted manually. Mozilla Firefox does not store the user’s name in it’s internet history files. Explorer keeps this name even after the file is deleted.
Stenger identified where the search file containing the word “chloroform” began and ended (from the headers and footers) then manually extracted information from the file. He then put this file through EnCase to copy the file, then he used a number of different tools to examine the history records. The record covered the dates from March 4, 2008 to March 21, 2008. Stenger says he was able to use a program called CacheBack to examine this file. This program was able to show the dates and times correctly regardless of the date of his own computer. Stenger created two reports on data contained on March 17th and March 21st, the two dates with information relating to chloroform searches and other searches in the Firefox program. He provided these reports to Mr. Bradley.
Cross- Baez asks about unallocated space – which is deleted files. Stenger can’t say when the files were deleted – or why. When the computer is running slow, some people will delete the history file. These searches were done in March – months before Caylee went missing. The search for chloroform shows up at 2:43:41 pm on March 17th, 2008. The next activity is an ad. At 2:43:48. Baez thinks that this means that the “chloroform page” is only showing for 7 seconds, but he is not taking into account that a lot of ads are appearing in sidebars and the time is showing that this ad is showing up. But Stenger has no way of knowing what exactly was on the screen. But Stenger does say that from the URL not changing, he can say that the person was on the same page. But 10 seconds later, the URL does change to “MySpace” so someone is looking at a page they searched for that says chloroform, then 10 seconds later the person went to MySpace.
Baez then asks about the chloroform pictures that appears on Ricardo Morales’s MySpace page.
Re-Direct – Burdick asks why Stenger cannot reconstruct the page that appears in the history. He says that when you go to a URL on the web, that where you went is kept in one place (history files) and what you saw is kept in another place (temporary internet files). When you delete that information, some of the deleted files may be able to be recovered, but sometimes not. Stenger might be able to find one, but not the other.
Re-Cross – Baez says that since Stenger cannot recreate the page and what it was, that this page may have been a blog, or something else, and Stenger has no way of knowing what the page was or who the author was. Stenger says he can tell that the search was run from Google. It was a specific search for Chloroform. But Stenger cannot tell what came up.
The witness is excused.
John Dennis Bradley is the next witness. He is a self employed software developer. He wrote the program “CacheBack” that Stenger just testified about. He used to be a police officer in Canada He led the technological crimes department. He has been certified an expert witness in Canada.
And now he is accepted as an expert witness in the US!
Bradley explains what the cache is – it’s basically a series of folders that holds temporary files for quicker accessing by the computer.
Bradley’s program accounts for time changes within the files on the computer – especially when considering daylight savings and international times.
Bradley taught a course using his software to the Orange County Sheriff’s Department. He met Sgt. Stenger at this training course. Stenger asked Bradley to look at a file that he had taken from a hard drive in the course of an investigation. This was a complete file, even though the file had been recovered from the unallocated file area. Bradley copied the file onto his forensic computer that he had with him at the time. He initially conducted a cursory review, it appeared to be correct, and he located the keyword “chloroform”. He also located the header and footer.
The file was about 3.2mb. Because the file was so large, he concluded that the hard drive must not have been used to write files that often, or had experienced a period of inactivity. But he can not say when the file had originally been deleted. The browser would not have deleted the files – that would have had to have been done manually.
Once Bradley did his preliminary review, he ran the file through many tests. He was able to decode the file by improving the software to overcome the anomaly’s in the file. He was able to corroborate the work he did by using another program. He then generated a report from “CacheBack”.
Bradley then goes over the report and what it means. The report lists a number of things that can be determined from the deleted file, including the URL, User profile (for Explorer). They then go to some of the actual data.
Bradley says that initially the web address of Google was accessed. The first line entry in the report after the google website was accessed shows that a search was conducted – in English, for the word chloroform. The “& = spell 1” means that the word was initially spelled wrong by the person querying – and the user accepted the suggested spelling Google presented as an alternate.
The Anthony computer had a spyware program on it called “doubleclick”. This program also shows on the report presenting ads and tracking activity.
One line item on the report shows a bookmarked URL to photobucket.com. There is some photobucket activity revealed on the report.
Bradley then goes through all the user searches that resulted in pages that were clicked. He is able to determine that there was a Google search for “Chloroform”, “Alcohol” and “Inhalation”. The Google searches for “Chloroform” and “Alcohol” resulted in the user accessing search results from Wikipedia. There was also a Wikipedia article accessed that came from a search value of “death”. Wiki articles were also accessed titled “hand to hand combat”,“head injuries”,“ruptured spleen”, “chest trauma”, and “internal bleeding.”(articleworld.org also has an article accessed titled “internal bleeding.”)
Facebook RDP’s is shown to have been visited 8 times. Nothing sinister here – RDP’s is “Random Daily Posts”.
On the 21st of March a page was accessed directly- either from a search or a bookmark, entitled http://www.sci-spot.com//chemistry/chloroform . Someone visited this site 84 times. Burdick asks if the site would be the same today as it was on the day in 2008 when it was accessed. Bradley explains that if the site is static – like a dictionary, that the content may well be the same. But if the site is dynamic, like a blog or newspaper site, the content may be dynamic and changing all the time.
Actually this is a dynamic site – the site now carried this message on the Chloroform page:
NEWS; 8-30-04 PROJECT REMOVED
UNFORTUNATELY, I HAVE BEEN DISAPPOINTED AT MANY OF THE EMAILS AND ATTENTION THIS PROJECT HAS GENERATED. AS MANY LINKS AROUND THE WEB EXIST, I AM LEAVING MY ORIGINAL CHLOROFORM PAGES IN PLACE, BUT REMOVING LINKS FROM MY OWN SITE. I APOLOGIZE FOR THE INCONVENIENCE, BUT I’M AFRAID THE INTERNET IS NOT MATURE ENOUGH FOR THIS INFORMATION.
Then there is a query “How to make chloroform” – and then there is another query and URL quite similar to the first – only with the word chloroform spelled differently.
Selected from a search result is a page at instructables.com – on how to make weapons out of household items.
There is also a Google search on the phrase “neck breaking”.
Direct is done. Everyone can wake up now……well, no, Baez is going to cross. And you know he knows next to nothing about this stuff…..go back to sleep.
Baez asks if the way Bradley got involved in this was because there was a bug in his software. Bradly defends his software and blames Firefox. Bradley was here for a conference, Stenger approached him and Bradley stayed up all night trying to fix his software. (Well, a few nights….) Bradley was here to teach a course for three days. Before Bradley left he was able to fix the software. Then he was asked to testify in this case, and Bradley said yes.
Baez asks if he is being compensated. Bradley says they have talked about it, but that’s not a concern yo him. Baez asks if he’s here for the advertising. Bradley pretends not to know what he means. Baez asks about Bradley’s website, and if there is advertising on it about this case. Bradley says he put a link up a few weeks ago to an article about this case that mentioned his name and his software. Baez asks if this is advertising – Bradley says yes, but it’s subtle.
Baez asks the witness, in the first search, the one for chloroform on March 17th, how long the user is actually on the page before they switch to another page. The witness says 7 seconds. But Baez gets something out of that that I didn’t get. The witness actually says that the first “time” is the Google homepage – the second “time” is the Google results page. Which isn’t really the answer to the question of “how long was someone looking at the chloroform page”
Baez asks the same question for the 2:53 time stamped search. One second later after visiting Wikipedia – another page comes up. (I think the second page “coming up”might be an ad – the second time stamp doesn’t necessarily mean a navigation away from the page – it could be a pop up ad loading, or a sidebar ad.)
One of the Wiki links clicked was “hand to hand combat” Baez asks the witness if he was informed that hand to hand combat had anything to do with this case – the witness says no, Baez asks the same thing about “head injuries” or “ruptured spleens” the witness says no. Baez asks if :chest trauma” has anything to do with this case. The witness says no – and then again with “internal bleeding”. And these pages were looked at for much longer times than the other pages were.
On March 21st, there was another reference to chloroform – this time at the sci-spot site. 17 seconds later, there’s a Google search for chloroform. 2 minutes and 25 seconds later there’s a hit again at sci-spot/chloroform. The next page is a hit at druglibrary.org – about some guy in the 1800’s that had a chloroform habit. This was 21 seconds later.
The next hit was that “making weapons out of household items” page. Baez again asks the witness if the detectives had told him that this was relevant to the case – that someone was making weapons in the house. Bradley says no.
The next search was for “neck breaking”. Baez wants to know if prior to this search if there was anything about a Google search regarding self defense books for women. The witness can’t find the reference. They then decide they might be looking at 2 different reports. Lovely. Kind of like the “two different cans” thing with Dr. Vass.
They straighten that out, and Baez asks the witness about a URL that the witness hadn’t gone over with the state – about a visit to the morning news site, to a sub-page dealing with Kevin Fanning and his security methods.
Then there is the hit on the page about the zombies coming to get us all – which, you know, they are….eventually……
Baez then asks if all this surfing is taking place rather quickly – and the witness says that there is the stuff that’s happening that the user can see – then there’s a bunch of this stuff that’s going on in the background. The morning new link, for example, could have been something the user clicked, or it may have been made available as a link via a cookie.
Baez points other URL’s that are listed in the report – like Funny.co.uk – which is a page about funny household weapons And there’s a bunch of banner ads – and at the same time the “neck breaking” reference. And only a few seconds later – 1 minute 54 seconds – the next click is to fightingarts.com – which is a kung fu site.
Then there is the Wiki page hit for “shovel” – and Baez asks if the witness is aware of a movie called Shovel. And thank you very fucking much, Baez. Because I KNEW nobody would search for the word “shovel”. That’s just fucking stupid. A MOVIE named shovel makes sense!
Baez asks if the witness was consulted in 2009 – he was. That was a few months after this case came about. A lot of these websites would have still been active at the time. So the witness could have gone to all these sites and seen what was happening. Baez asks if the better evidence would have been the actual pages, rather than a link. Some of these websites were self defense, and funny household weapons, and chemistry and medical facts and movies.
At the end of the day – very little can be gleaned from this without the actual pages, right? Baez asks. The witness says that the context can be important. Baez lists off the times – 1 second, 7 seconds, 1 minute, 2 minutes….there wasn’t a lot of time spent on any one page. The witness says this is Firefox all by itself – they could also use Explorer. (But this is still only 3 minutes – total, for these searches…and this witness has no idea how much the computer was used total…)
Re-direct-The issue Stenger ran into was decoding the Firefox history files. There was scarce documentation available for doing this, and no tools to do so. Bradley used his own knowledge to figure it out himself using his software. And this was in December of 2009. The searches happened in March 2008 – the websites would have probably changed in the 18 months between those dates.
Burdick asks about the time between searches – this was surfing about chloroform, weapons and neck breaking and “how to make chloroform” – and maybe when someone types in “how to make chloroform” maybe they are trying to figure out how to make chloroform. And they may have been on the page for 7 seconds – but we don’t know if those pages were printed out (good point). And the “how to make chloroform” page was accessed 84 times. (Good God).
Re-cross – Baez has his own report generated by Cacheback – that says the sci-spot site was only visited once. The State objects – there is a sidebar – then the judge excuses the jury for the day. The witness is confused – the judge says the state will explain it all to him.
The jury gets to see Hangover 2 and Xmen: First Class.