Outcasts

Outcasts

Forum for outcast sleuths.


    Digital Media Recovered and Digital Forensics Implications in the Case

    Share
    avatar
    dangrsmind

    Posts : 676
    Join date : 2010-02-16
    Location : San Francisco

    Digital Media Recovered and Digital Forensics Implications in the Case

    Post by dangrsmind on Tue Mar 09, 2010 10:34 am

    A fair number of digital devices were taken as evidence in this case both at the Niederbrock home in Farmville VA and at the McCroskey residence in Castro Valley California.

    I created a separate place for general discussion of digital forensics here: [You must be registered and logged in to see this link.]

    I'd like to reserve that location for more general discussion of digital forensics tools and so forth. Here let's talk about the media that was seized by the police and issues related to the various online presences the principles in the case created.
    avatar
    dangrsmind

    Posts : 676
    Join date : 2010-02-16
    Location : San Francisco

    Re: Digital Media Recovered and Digital Forensics Implications in the Case

    Post by dangrsmind on Tue Mar 09, 2010 11:08 am

    Digital items taken:

    Kodak digital camera
    Patriot thumb drive
    4 GB SD memory card
    X-box Live Card (provides information in relation to an online account)
    HP Pavillion PC
    LG Verizon Photo Cell Phone
    Sandisk 80GB Storage device
    256 MB thumb drive with Longwood Logo

    More here: [You must be registered and logged in to see this link.]

    I am not sure if this list includes Sam's computer from California.

    DoctorZ

    Posts : 90
    Join date : 2010-02-26
    Location : Northern VA, aka Hell

    Re: Digital Media Recovered and Digital Forensics Implications in the Case

    Post by DoctorZ on Tue Mar 09, 2010 11:57 am

    Do you have any idea about the 4 hard drives? Did the police remove them from the computers, or where there four external or removed hard drives?
    avatar
    dangrsmind

    Posts : 676
    Join date : 2010-02-16
    Location : San Francisco

    Re: Digital Media Recovered and Digital Forensics Implications in the Case

    Post by dangrsmind on Tue Mar 09, 2010 12:34 pm

    DoctorZ wrote:Do you have any idea about the 4 hard drives? Did the police remove them from the computers, or where there four external or removed hard drives?

    It would be standard practice to remove and secure the hard drives under most circumstances in order to ensure that the contents are not modified. Analysis would be done on an image or copy. This ensures the contents of the original drives aren't changed simply by normal operation of the computer or by accident.

    There are some exceptions where you instead want to examine the machine "live", but I don't think that applies here.

    DoctorZ

    Posts : 90
    Join date : 2010-02-26
    Location : Northern VA, aka Hell

    Re: Digital Media Recovered and Digital Forensics Implications in the Case

    Post by DoctorZ on Tue Mar 09, 2010 12:41 pm

    dangrsmind wrote:
    DoctorZ wrote:Do you have any idea about the 4 hard drives? Did the police remove them from the computers, or where there four external or removed hard drives?

    It would be standard practice to remove and secure the hard drives under most circumstances in order to ensure that the contents are not modified. Analysis would be done on an image or copy. This ensures the contents of the original drives aren't changed simply by normal operation of the computer or by accident.

    There are some exceptions where you instead want to examine the machine "live", but I don't think that applies here.
    My guess would be that one drive was from the laptop, one from the Compaq and two from the "custom tower." That leads me to wonder if Sam did bring his computer. It is possible that the custom built PC belonged to Emma, but to me seems likely to be Sam's for photo and video editing. Who knows though, since we don't know more about the components inside. If it were found to have a nice video card that would further my thinking that it may have been Sam's.
    avatar
    dangrsmind

    Posts : 676
    Join date : 2010-02-16
    Location : San Francisco

    Re: Digital Media Recovered and Digital Forensics Implications in the Case

    Post by dangrsmind on Tue Mar 09, 2010 12:47 pm

    At least one computer was taken from the home in Castro Valley. I'll have to look for the article that stated this...
    avatar
    dangrsmind

    Posts : 676
    Join date : 2010-02-16
    Location : San Francisco

    Re: Digital Media Recovered and Digital Forensics Implications in the Case

    Post by dangrsmind on Tue Mar 09, 2010 2:53 pm

    Here's the article: [You must be registered and logged in to see this link.]
    avatar
    Percy
    Moderator
    Moderator

    Posts : 1274
    Join date : 2010-02-16

    Re: Digital Media Recovered and Digital Forensics Implications in the Case

    Post by Percy on Tue Mar 09, 2010 3:35 pm

    Thanks for starting this thread, we needed a seperate area to discuss this part of the case.


    _________________
    Ask me about $cientology, E-Meters, Xenu, The R-6 Implant, Body Thetans, Engrams and the State of Clear.
    avatar
    dangrsmind

    Posts : 676
    Join date : 2010-02-16
    Location : San Francisco

    Re: Digital Media Recovered and Digital Forensics Implications in the Case

    Post by dangrsmind on Tue Mar 09, 2010 6:12 pm

    Although the horrorcore element is more sensational, the real case likely will hinge on forensics, both in relation to DNA and blood evidence from the bodies and collected from Sam as well as from all the digital media collected.

    At the very least there is the question of the deletions from Sam's MySpace page. Those can likely be tied to one of the computers here.

    Any emails, text messages, images, prints, etc. that were circulated can very likely be traced to the originator even if they succeeded in fully deleting the original images themselves.
    avatar
    Percy
    Moderator
    Moderator

    Posts : 1274
    Join date : 2010-02-16

    Re: Digital Media Recovered and Digital Forensics Implications in the Case

    Post by Percy on Tue Mar 09, 2010 6:18 pm

    dangrsmind wrote:Although the horrorcore element is more sensational, the real case likely will hinge on forensics, both in relation to DNA and blood evidence from the bodies and collected from Sam as well as from all the digital media collected.

    At the very least there is the question of the deletions from Sam's MySpace page. Those can likely be tied to one of the computers here.

    Any emails, text messages, images, prints, etc. that were circulated can very likely be traced to the originator even if they succeeded in fully deleting the original images themselves.

    Absolutely agree, the actual case itself will be about a lot of shit we havent even discussed such as the stuff listed in this thread and other forensic evidence. The horrorcore element may not even be menitioned unless used as backstory in an opening statment.


    _________________
    Ask me about $cientology, E-Meters, Xenu, The R-6 Implant, Body Thetans, Engrams and the State of Clear.
    avatar
    ziggy

    Posts : 950
    Join date : 2010-02-16
    Age : 57
    Location : Sonoma County CA

    Re: Digital Media Recovered and Digital Forensics Implications in the Case

    Post by ziggy on Tue Mar 09, 2010 7:03 pm

    What if you have potential jurors who don't even have email? Seriously I talk to people over 50 every day that still don't email. Won't all the computer forensics really confuse them? Would the defense try to get those people or would it be really impossible to seat someone that out of touch with the internet for a case like this?

    Retirees without computers need not worry about jury duty Smile
    avatar
    dangrsmind

    Posts : 676
    Join date : 2010-02-16
    Location : San Francisco

    Re: Digital Media Recovered and Digital Forensics Implications in the Case

    Post by dangrsmind on Tue Mar 09, 2010 7:11 pm

    I seriously doubt this is going to be a difficult case from the computer forensics perspective. Sam doesn't strike me as the super hacker type, and if he deleted anything he likely just did it the naive way which will be easily uncovered in a forensic evaluation of the computers.

    All the prosecution's expert is going to have to say is that they found evidence of some image/file/message on a specific computer and what the contents of that object are if they know. They may also explain the chain of custody of the digital evidence or in the case of phone records how they were obtained. I don't think it is any harder to understand than blood/DNA evidence once you get beyond the issue that deleting a file on a computer isn't really erasing the data from the hard disk.
    avatar
    Percy
    Moderator
    Moderator

    Posts : 1274
    Join date : 2010-02-16

    Re: Digital Media Recovered and Digital Forensics Implications in the Case

    Post by Percy on Tue Mar 09, 2010 7:36 pm

    ziggy wrote:What if you have potential jurors who don't even have email? Seriously I talk to people over 50 every day that still don't email. Won't all the computer forensics really confuse them? Would the defense try to get those people or would it be really impossible to seat someone that out of touch with the internet for a case like this?

    Retirees without computers need not worry about jury duty Smile


    Being that it is a university town I seriously doubt the juror pool would consist of enough people not internet-connected to make it a concern. I could be wrong, it IS small town southern USA after all, but I would think a good percentage of the juror pool for any case in that city will be made up of at least 50% of people connected to the university in one way or another. Isnt Longwood that big a part of Farmville?


    _________________
    Ask me about $cientology, E-Meters, Xenu, The R-6 Implant, Body Thetans, Engrams and the State of Clear.
    avatar
    Percy
    Moderator
    Moderator

    Posts : 1274
    Join date : 2010-02-16

    Re: Digital Media Recovered and Digital Forensics Implications in the Case

    Post by Percy on Tue Mar 09, 2010 7:38 pm

    dangrsmind wrote:I seriously doubt this is going to be a difficult case from the computer forensics perspective. Sam doesn't strike me as the super hacker type, and if he deleted anything he likely just did it the naive way which will be easily uncovered in a forensic evaluation of the computers.

    All the prosecution's expert is going to have to say is that they found evidence of some image/file/message on a specific computer and what the contents of that object are if they know. They may also explain the chain of custody of the digital evidence or in the case of phone records how they were obtained. I don't think it is any harder to understand than blood/DNA evidence once you get beyond the issue that deleting a file on a computer isn't really erasing the data from the hard disk.

    I would concur. The myspace stuff could get a little confusing to an older crowd, I dont even have myspace myself, even those connected could get confused about all that myspace stuff but that should only be a small part of the case.


    _________________
    Ask me about $cientology, E-Meters, Xenu, The R-6 Implant, Body Thetans, Engrams and the State of Clear.
    avatar
    dangrsmind

    Posts : 676
    Join date : 2010-02-16
    Location : San Francisco

    Re: Digital Media Recovered and Digital Forensics Implications in the Case

    Post by dangrsmind on Tue Mar 09, 2010 7:59 pm

    I think the MySpace stuff is going to be limited to simple ideas like these people were friends on MySpace or sent each other messages on MySpace.

    Private messages sent on Myspace are similar to email and not hard to understand. Perhaps the idea of posting a message publicly on someone else's MySpace page could be a bit confusing.
    avatar
    Percy
    Moderator
    Moderator

    Posts : 1274
    Join date : 2010-02-16

    Re: Digital Media Recovered and Digital Forensics Implications in the Case

    Post by Percy on Tue Mar 09, 2010 8:03 pm

    dangrsmind wrote:I think the MySpace stuff is going to be limited to simple ideas like these people were friends on MySpace or sent each other messages on MySpace.

    Private messages sent on Myspace are similar to email and not hard to understand. Perhaps the idea of posting a message publicly on someone else's MySpace page could be a bit confusing.
    \


    There isnt anything much more confusing than DNA and other scientific/forensic evidence so a good lawyer should be able to explain all of this in a way that anyone can understand, they did a very good job of this with the Simpson case IMO, that was really a case of DNA for dummies, the lawyers and experts did a good job of allowing Joe 6 pack to understand some pretty complex stuff. Its more about the lawyers than the jurors I would say.


    _________________
    Ask me about $cientology, E-Meters, Xenu, The R-6 Implant, Body Thetans, Engrams and the State of Clear.
    avatar
    ziggy

    Posts : 950
    Join date : 2010-02-16
    Age : 57
    Location : Sonoma County CA

    Re: Digital Media Recovered and Digital Forensics Implications in the Case

    Post by ziggy on Tue Mar 09, 2010 8:34 pm

    Yes I suppose so. The messaging and MySpace stuff is so totally confusing to those who have never seen it or done it. I suppose in deliberation other jurors could clue them in.

    DNA is difficult to understand. What mucked it up was understanding contamination imo.

    Anywhooo, no doubt they will be able to narrow down a better time line using this evidence AND find out if Sam contacted anyone and what his state of mind was after the killing.

    It was my assumption and piXy can correct me if I'm wrong, but he may have gone in and listened to his own songs via a computer he had access to either right before or after the murders?
    avatar
    piXy

    Posts : 241
    Join date : 2010-03-04
    Location : South of Hell

    Re: Digital Media Recovered and Digital Forensics Implications in the Case

    Post by piXy on Tue Mar 09, 2010 11:42 pm

    Why searching of all the myspace pages? I know mine was one of them and my world wasnt turned upside down like the media said it would......
    any ideas about what theyw ere looking for or if they read IMs or msgs?

    Sponsored content

    Re: Digital Media Recovered and Digital Forensics Implications in the Case

    Post by Sponsored content


      Current date/time is Tue Apr 24, 2018 10:01 am