Jones Dykstra & Associates
- Category: Blog
- Published on Tuesday, 14 June 2011 12:00
- Written by Keith J. Jones
- Hits: 5031
In my last blog article, I discussed some of the computer evidence introduced into the highly publicized trial where mother Casey Anthony has been accused of first degree murder for the death of her toddler, Caylee Anthony. Three computer forensic experts were used by the prosecution: Detective Sandra Osborne, Detective Sergeant Kevin Stenger, and Mr. John Bradley. In the last article I summarized the testimony of Detective Osborne and Detective Sergeant Stenger. In this article I will summarize the testimony for Mr. John Bradley, which contained the meat of the computer forensic testimony for the prosecution. Bradley’s testimony was broken between two days.
If you did not watch the testimony, or do not have the time watch the recorded version, I will attempt to summarize the general findings in this article and follow up with additional points in my future blog posts so that they can be taken in context. This is by no means a play by play of the testimony, but is my perception of what can be taken away from the testimony. There was so much content presented during the testimony of these three witnesses that you would stop reading this article before it was over if I tried to mention all of it!
Mr. John Bradley
Video of his testimony (Day 1): http://www.myfoxorlando.com/dpp/news/060811-john-bradley-testifies
Video of his testimony (Day 2): http://www.myfoxorlando.com/dpp/news/060911-john-bradley-testifies
Mr. Bradley is the author of Cacheback, one of many tools computer forensic examiners can use to reconstruct internet browsing history. According to the testimony, Bradley was brought into this case because Detective Sergeant Stenger decided to use Cacheback to reconstruct the Firefox web browsing history from a computer system used by defendant Casey Anthony. While using Cacheback on a 3.2 MB Firefox internet history file recovered from unallocated space, Detective Sergeant Stenger experienced a bug in the software and could not reconstruct the activity. It was then, he testified, that he contacted John Bradley to assist in reconstructing the data.
It is important to note that Bradley testified that he only had access to one file in the case: the 3.2 MB Firefox web browsing history file recovered from unallocated space by Detective Sergeant Stenger. The internet activity Bradley testified about contained web browsing activity for March 2008, which is important because it potentially shows premeditation since it precedes Caylee’s death in June or July of 2008. Bradley could not testify about any of the other computer data in the case since he had not examined anything else. However, Bradley testified that he was able to determine that the file provided to him by Stenger was from Firefox version 2 and it employed the Mork file format. Bradley testified that the Firefox file had “anomalies” within the data. He also testified that he worked on the bug in his software program for approximately three days until it was able to parse the data Stenger provided him. Then, he testified that he cross checked the results from Cacheback on this file with a third party “reliable” software package and they matched.
During his live testimony in front of the jury, Bradley went through the detailed Cacheback report line by line and discussed the Google searches a user at the computer conducted. Bradley also discussed the articles viewed as a result of the Google searches, such as articles found on Wikipedia. Some of the searches and article titles accessed by the user at the computer consisted of:
- Self defense
- Hand to hand combat
- Head injuries
- Middle meningeal artery
- Ruptured spleen
- Chest trauma
- Internal bleeding
The user at the computer also visited Facebook, MySpace, and PhotoBucket, which were accounts Casey Anthony also reportedly frequented. In addition to the searches listed above, the prosecution focused on the searches and article titles containing the following phrases:
- How to make chloroform
- Making weapons out of household products
- Neck breaking
On cross examination the defense attorney zeroed in on the bug in Mr. Bradley’s software that originally brought him into the case. During cross examination Bradley also testified that he was not paid by the prosecution for his testimony. Bradley made a statement that there were discussions about payment by the prosecution, but it would be worked out after the trial and he was not there for the payment. The defense attorney then asked Bradley about the time difference between the user browsing the chloroform content and then browsing other subject material not related to chloroform. The period of time was approximately three minutes, according to Bradley and the Cacheback report he read from. The attorney then asked Bradley if three minutes was the longest time the user at the computer could view this particular chloroform material. Bradley answered that he was correct.
On redirect examination, the prosecution used a line of questioning that may have been headline of the computer forensic testimony in this trial. Bradley testified that it was recorded in the internet activity that the web browser had visited one particular website that potentially contained content about chloroform at least 84 times. A user visiting a website at least 84 times could show that the browsing was not accidental.
In case you were wondering, the defense attorney attempted to establish that Bradley was unable to determine which physical person was sitting at the keyboard in front of the computer and browsing this content. This is a common line of questioning because, in general, it can be difficult to determine which person initiated activity without additional information. Such additional information could be the act of logging into specific accounts belonging to a person, or perhaps the computer user knowing something only one person could know.
This was the end of the testimony on the first day. Personally, I disagreed with Bradley’s testimony about the user browsing chloroform content for only three minutes. I do not believe you can have that opinion, given the facts. For example, Firefox version 2 had support for tabbed browsing and the user could also open multiple browser windows. Every time a user visits a new site in a new tab or browser, a new entry is made into the internet history file (or the “visited” counter is incremented). Firefox version 2 internet history files will not record the time a browser or tab is closed, or when the subject matter can no longer be viewed by the user. I feel the defense attorney was trying to demonstrate that the user could not possibly have enough time to read about “how to make chloroform”, but in reality, in this case, it seems as if we are unable to tell how long the material was available to the user on the screen. However, Bradley did state that the article for chloroform was visited 84 times by a user on this computer. I believe this is strong evidence to support that a person had been reading the material numerous times in the past, and the amount of time the user spent reading about chloroform could not be accurately established with the data used in Bradley’s testimony.
The next morning Bradley finished his testimony. I was happy to see that the prosecution finally asked Bradley about tabbed browsing and if multiple tabs could be open. They also established that Bradley was unable to give an opinion on whether or not a web page could have been printed out. Although there are some artifacts in Windows that could potentially show that a web page was printed out, Bradley only had access to the one 3.2MB Firefox history file. I believe the door was left open to assume that the user could have printed the chloroform web pages to review at a later time. Mr. Bradley was excused and the trial continued with other witnesses not as relevant to the computer evidence. The only additional noteworthy testimony came from Casey’s brother who said he did not delete the internet history manually on that computer system and did not recall surfing to those sites in that timeframe.
Although potentially technically strong, I believe that the prosecution’s presentation of the computer evidence in this trial may have downplayed its potential importance. All three expert witnesses either read from their law enforcement report or from the output of a tool designed for computer forensic examiners, not jurors. The experts were limited to the words they could conjure up on the stand trying to explain relatively simple aspects of computer forensics. People, and this includes jurors, do not want to work hard imagining something someone is explaining to them. They also want to feel empowered… that they have the ability to look at the same data and make the same determination the expert made. Imagine how much more credible that would have made the computer forensic experts seem? Not one computer forensic expert witness used a picture to help convey their ideas to the jury. In my next blog article I will address the issue of giving technically strong expert testimony but not being effectively persuasive in the context of this trial more in depth.
Read the third part of this series here: Casey Anthony Murder Trial: The Computer Evidence (Part 3)