Casey Anthony Murder Trial: The Computer Evidence (Part 1)
Computer evidence was introduced into the highly publicized trial where mother Casey Anthony has been accused of first degree murder for the death of her toddler, Caylee Anthony. Three computer forensic experts were used by the prosecution: Detective Sandra Osborne, Detective Sergeant Kevin Stenger, and Mr. John Bradley. I also expect the defense team to have a computer forensic expert or two in order to dispute the evidence presented against Casey Anthony, as so far it seems to be the only evidence I have seen that could show premeditation. In a series of blog articles I hope to discuss the computer evidence and the use of expert witnesses in the context of this trial.
If you did not watch the testimony, or do not have the time watch the recorded version, I will attempt to summarize the general findings in this article and follow up with additional points in my future blog posts so that they can be taken in context. This is by no means a play by play of the testimony, but is my perception of what can be taken away from the testimony. There was so much content presented during the testimony of these three witnesses that you would stop reading this article before it was over if I tried to mention all of it!
Detective Sandra Osborne
Video of her testimony: http://www.myfoxorlando.com/dpp/news/060811-sandra-osborne-testifies
Detective Sandra Osborne was the first computer forensic expert to testify. She began by explaining the cell phone evidence in this case and how she acquired it using Cellebrite. She stated that it is not typically her job to review the data from mobile phone acquisitions, but instead she passes it off to the detective running the case so that he or she can review the content. Other than the presentation of various seemingly irrelevant pictures from the series of phones, one of which was Casey Anthony’s phone, no further big findings from the phones were presented by Osborne.
During her testimony, Detective Osborne also discussed the acquisition and her limited analysis of two computer systems used by Casey Anthony and in law enforcement’s possession. In short, through standard keyword searches of the data, Osborne discovered some internet searches performed by someone using the computer systems and elevated her findings to her supervisor, Detective Sergeant Stenger. Osborne testified that she was not prepared to speak about the specifics of the computer searches and indicated Stenger was more experienced in that subject area.
What struck me most about Detective Osborne’s testimony was that it felt like she was not prepared for a number of the prosecution’s questions. Usually, before a trial, there is preparation time with the attorney so that the expert witness generally knows the flow of questions and how they will be asked during the direct examination. It seemed as if that flow was not there between Osborne and the prosecutor. In addition, Osborne clearly let it show when she was not confident in her answer. This may result in the jury questioning her confidence in her conclusions. When the defense attorney asked a question and Osborne seemed unsure, her voice changed and was very meek. I believe rather than trying to meekly answer a question, she may have been better off and more persuasive either being 100% confident in her answer and stating it or passing it to Detective Sergeant Stenger, who reportedly had more experience in this area.
Sergeant Detective Kevin Stenger
Video of his testimony: http://www.myfoxorlando.com/dpp/news/060811-kevin-stenger-testifies
Sergeant Detective Stenger testified immediately after Detective Osborne. Stenger testified that he performed his own analysis of the computer systems and discovered some internet searches potentially relevant to the murder case. Stenger supported his findings by sharing the details of his analysis, such as identifying suspicious Google searches and other destinations the user visited (such as MySpace) during March 2008 while he was executing keyword searches on the electronic evidence. Stenger testified that he discovered the use of the Firefox web browser which, at the time, utilized an internet browsing history file that implemented the Mork format to save information. Stenger said that he preferred to use Cacheback, one of a number of tools available to computer forensic examiners to reconstruct internet web browsing history, to view the destinations that this web browser had visited on the internet. Stenger further explained that he extracted approximately 3.2 MB of contiguous data he discovered in the unallocated space (i.e. free space) that contained a complete deleted history file for Firefox’s web browsing activity. Stenger testified that he could see the suspicious activity when he viewed the raw data and that he attempted to extract the full set of activity from the 3.2 MB Firefox browsing history file using Cacheback. Stenger testified that due to a bug in the software he was unable to extract the contents of the deleted Firefox history file with Cacheback and contacted the author of the tool, John Bradley, who testified in this trial next.
It is important to note a few things about Stenger’s testimony. First, I found it incredible that a deleted 3.2 MB internet history file was contiguous and intact on a computer. Files are usually fragmented across a hard disk in small “chunks”, and for a much larger 3.2 MB file to be contiguous as Stenger testified to would seem to be a rare occurrence. Although I do not have the evidence or report in front of me to examine, it seems like the probability would be against an investigator finding and recovering a deleted file in the situation Stenger did. Secondly, it is important to note that Casey Anthony is accused of murdering her two year old daughter in June or July of 2008, so this activity was in a prior month to the alleged murder. Therefore, this testimony could be evidence that the alleged murder was premeditated. That could be the difference between a guilty verdict that carries the death penalty versus another outcome for Casey Anthony’s trial. I will get into the exact searches that were discovered in my next blog article because this aspect of the testimony was detailed much more in depth by the next witness, Mr. John Bradley.
Read the second part of this series here: Casey Anthony Murder Trial: The Computer Evidence (Part 2)
