The “Zenaida” Searches

I’m going to be passing the following question to my contact with Microsoft:

“If I upgrade my IE does it create a NEW index.dat file or will the creation date of that file remain the same?”

I’ll get back with all of you. I hope JWG stops by and shares on this as well.

Great questions Val. I will be checking back here for the answers. It’s odd to me that the file seems to have two creation dates. However, I have not a clue about computer forensics.

BUT HERE IS WHAT I CAN’T ANSWER…the index.dat files are locked files that CANNOT BE DELETED if Windows is running. In order to delete these files you either have to go into DOS without Windows running and hunt them down in multiple locations and manually delete them, or you have to use a cleaner software that basically does the same thing.
———————-

I’m anxiously awaiting a computer genius’s opinion on these questions, and I’m glad you posted them, Val. I think the computer history will play a big part in the premeditation aspect of this case.
Myself, I’m wondering if the cleaner software you reference is something one can buy at a local computer store? Or, is it something only computer specialists know where to get/how to use?
If it’s something that is readily available for purchase and not particularly hard to use, my bet is that PPP knows about it and used it on June 12. I just don’t know much about computers other than how to log in, search google, and come to TheHinkyMeter.

» Arden said: | Edit { Feb 9, 2010 – 06:02:31 }

Great questions Val. I will be checking back here for the answers. It’s odd to me that the file seems to have two creation dates. However, I have not a clue about computer forensics.

Well, the file doesn’t have two creation dates. We’re talking about two separate files. The history.dat file associated with Firefox and the index.dat file (one of three) associated with IE.

I posted this response on the other searches thread. Sorry.

http://www.thehinkymeter.com/?p=1650&cpage=4#comment-9593

I will add that it is fairly trivial to boot the computer using a different OS on dvd or cd – such as linux and then you can modify these files until your heart’s bursting with pride at your accomplishments.

Really, making changes to these files is no problem at all for anyone who knows anything about how the OS works. You can change the creation time on the files from a linux boot as well, if you are simply interested in doing that fir some reason. Of course, most people would not know this and would not want to go through the hassle of doing it if they did know it, as most people have nothing to hide about their internet search activities. 8)

Irrespective of the fact that your opinion of the listed tasks is trivial or not, it does not address the question as to why those steps would have been taken on the IE index.dat file(s) when the Foxfire history.dat file appears to be unaltered.

I would point out that messing with the registry (which I have no hesitation to do myself) is not something the typical computer user does. And I don’t see any of the Anthony clan being of the ilk to do that sort of thing.

“trivial” is a subjective term when it comes to this topic.

Okay, this is where I am confused now. Goggle searches on index.dat doesn’t clear something up for me. People have said that the index.dat is the creation date of the file. But what is not clear to me is: is it the creation date of a link to URL on that individuals PC, meaning that was the first search date or visit to the site? Or, does it mean that the index.dat contains the creation date of the actual URL, unrelated to the time that the individual first made the search?

I was previously under the impression that it was a date related to when the material was created. Now I’m not sure. I’m beginning to think that it has to do with the creation date on the PC itself.

William??

What is in the Index.dat files?
http://www.milincorporated.com/a_indexdat.html#ch3
As already mentioned, the index.dat files are binary files. Their content can be seen only with binary (hex) editor. We will examine an index.dat file from the Temporary Internet Files (Internet Explorer cache). First, let’s take a look to the index.dat file header:

Actually the index.dat header is much larger but this is the most important part of it. The first thing is the version of the index.dat file (Client UrlCache MMF Ver 4.7) – this particular file is from Internet Explorer version 4 but the index.dat file format is very similar in Internet Explorer 5, 6, 7 and 8.
The next important thing in the header are the names of the four subfolders in which the cached files from the Internet are located (they are not present in the headers of the index.dat files for cookies and history). These subfolders are located in the same folder as the index.dat file and in this case their names are 49EDE5UVC, GHIZ8LMVB, EBWNUZWLB and G48NSH4S. On your PC these folders can be more than four (depending on the size of the index.dat file) and their names will be different.
The real content of the index.dat files usually starts at byte offset 4000h or 5000h from the beginning of the file. The index.dat file is composed of many records of four different types: HASH, URL, LEAK and REDR.
HASH records are the largest but they don’t contain any private information. They are just hash indexes of the contents of the index.dat file. If the file is larger there can be many such records.
The vast majority of the index.dat records are of types URL, LEAK and REDR. They have fairly similar layout. Look at this sample URL record.
As you can see there is a lot of information here. First, there is encoded date and time of the loading of this picture (icon_hardware.gif) from the Internet. The date and time are encoded in binary format in the second row of the hex dump. Next, there is http://www.aceshardware.com/site/images/icon_hardware.gif, which is the full URL of the loaded file. The name of the local copy of the file (which is in one of the four subfolders of the index.dat folder) is icon_hardware.gif. The next thing is the full HTTP header of the response of the Web server:
HTTP/1.0 200 OK
ETag: “AAAAOl01l7Q”
Content-Type: image/gif
Content-Length: 1234
X-Cache: MISS from proxy.office.devolti.com
The last but not least bit of information in the record is the name of the user account: Administrator. Obviously all this information can be potentially dangerous because it tells us who and when accessed given Internet page and what was the response of the Web server. If you clean the Internet cache (Temporary Internet Files) then the local copies of the cached files are deleted but most of the index.dat file records are left almost untouched. The same is true for the history and cookies.
The empty space of index.dat files is filled with junk (most often zeros but it can also be various meaningless sequences) or in some areas – with “magic” sequence 0BADF00Dh (BAD FOOD). Obviously Microsoft developers are not without a sense of humor. BAD FOOD parts of the file are deleted records and they aren’t a privacy threat.

Sorry Val

I THINK you answered my question in a prior thread.

The file creation date is the date that the file was created. The access dates stored inside of the file are the last date that a particular URL was accessed. There is also a place in the registry where each first access to a particular URL is stored, however, this information is erased when the history and cookies are cleared.

Each temporary file created by IE will have a file creation date associated with it at the directory level. Associate that temporary file to the proper URL and you can know what the last date of access to that site was so long as a refresh was done on the information from the site – sometimes it is and sometimes it isn’t if nothing has changed – unless you have it set to always update, then it always updates the file creation times by creating a new variant of the files needed to display the contents of a particular URL.

The system does house keeping on these temporary files depending on how you have your system set up. For example, once the maximum cache size is exceeded the system starts erasing old temporary files in order to make space for new ones.

All of these pieces of information have to be checked and analyzed in order to figure out internet access history for a particular user.

Does that help?

My first clear understanding of computers was that they filled an entire room and had big wheels that spun around and all kinds of buttons and switches. My understanding of them since that time hasn’t changed much. I used to understand what was under the hoods of my cars and could make fairly complex repairs in my early days but now what I see under the hoods of cars is as familiar to me as my first clear understanding of computers. So, I’m going to be very excited to learn what is concluded here on this thread. I obviously will be able to contribute nothing as to what all this “computer-poop” means.
However, what I am most interested in is the answer to this question:
Does all this monkeying around with the computer (if, indeed we are dealing with monkeying) mean that, rather than trying to find Caylee from the comfort of the family den that morning, Cindy and Casey were together trying to monkey around with the computer in an attempt to hide rather than find things?
I never could understand their running to the computer that morning…what did they expect to “find” in there? I think, had I been Cindy, I would have been more likely to back my daughter up against a wall and demand answers rather than fire up the old computer. JMO.

Yes- Thanks William

I could see it happening because I just read a site about corrupted index.dat files. In that case, it would be a faulty path to a URL. I don’t know if windows might ‘write over’ a file in that case??

So it does appear that searches were conducted on the computer for Zenaida prior to the disappearance then, right? Or am I being particularly dense this AM?

NEED MORE COFFEE.

I never could understand their running to the computer that morning…what did they expect to “find” in there? I think, had I been Cindy, I would have been more likely to back my daughter up against a wall and demand answers rather than fire up the old computer. JMO.

A more relevant immediate response would be to dial ALL of the telephone numbers for Zenaida that AM. Or, during the interviews with police, hand over the last known phone number (even if no longer in service).

Oh, looks like you already figured it out. My bad. See how slow typing gets me every time?

Valhall:

The point was that it could have happened from a system roll back which included the .dats of IE and not the ones of firefox. It could also have happened by someone purposely tweeking the IE files and not realizing that the firefox files existed.

I do not think that there is a definitive answer on why one seems inaccurate and the other doesn’t. I would point out that if I were making changes to these files they would both still have their original creation and modification dates in place since I would reset the system clock to the appropriate date and time prior to doing the tweeks and then change it for the other set of files and do the same thing and then reset it to normal date/time.

But that is just me.

As for the registry – I agree that most people could not muck around with it and have their system survive the experience. I was not disagreeing with you in any respect. trivial in my comment was meant to convey the amount of work involved and not the skill levels necessary. I should have been clearer in my post. Sorry.

My last post was to Mimi. sorry.

If you used programs specifically designed to erase index.dat files, then you would have no control over surviving creation dates, right? They would just clean the slate of the index.dat files and then the creation date would be the next time you searched, I’m guessing.

Let’s face it…The monkeying isn’t going to work. If you were friends with the nanny for two years and she had a myspace or facebook account, and you are a person like Casey, there would be MANY hits to those sites. You wouldn’t need to be doing a search every now and then. She would have been IMing her from work (ahem-throat clearing)

William-
I apologize I’m a little slow when it comes to computers So are you saying that it doesn’t look like Casey tried to delete these files? That would make more sense to me because I would think if she was going to try to delete search files she would have also deleted the ones for chloroform, household weapons, 100th episode of One tree Hill, etc..

» WSH said: { Feb 9, 2010 – 08:02:16 }

I never could understand their running to the computer that morning…what did they expect to “find” in there? I think, had I been Cindy, I would have been more likely to back my daughter up against a wall and demand answers rather than fire up the old computer. JMO.

A more relevant immediate response would be to dial ALL of the telephone numbers for Zenaida that AM. Or, during the interviews with police, hand over the last known phone number (even if no longer in service).

Yes, because Cindy and George had some time after LE left the home to do some thinking and talking with Casey. (I doubt they just turned off the lights and had a Walton moment at that point.) I can’t really imagine they could have slept at all. Also…I think the computer stuff above shows it may have been Lee who was attempting computer forensics in order to try and track “Zenaida.” He said he slept until 12 to 12:30 but he might be wrong there. That early on he might have truly believed what Casey was saying.
Anyway, I’m butting out now after commenting on the WHY someone “toyed with the gears” rather than how it was done. I couldn’t understand in a million years but I know there are very significant computer footsteps here and I’m interested in knowing where “computer people” think they lead.

WSH:

IE often ends up with corrupted .dat files and then fixes them as best it can – sometimes this results in starting the file over, but mostly it results in excising particular records from the files to restore the correct format and save as much information as possible.

It is also often possible to look inside of small .gif files and find that they have information stored in them about particular web accesses since some sites use this as a hidden cookie capability so to speak. I do not think Google is one of these sites, but I would have to check.
It is entirely possible that a site that google gave as an answer to a searh might do this though even if google doesn’t.
8)

I am of the opinion that Casey was not providing any relevant info regarding ZFG, thus Cindy attempted to find her thru internet searches in desperation.

05/06/2008 Casey typed to(04:12:13pm): “I’m playing phone tag with both Zani and my mom ”

-this was to Tony R.

So she was referring to “Zani” well before the searches took place.

Sorry, I meant before the July 16th searches took place

Arden:

I am saying that there is not enough data to determine if any attempt was made to modify or erase the IE files. Also, the searches on weapons and chloroform and so on were on the desktop computer and not the laptop computer. So even if she were trying to destroy info on her activities she would have been left with the desktop traces since she had no physical access to that machine at the time.

I am also explaining that there are a large number of reasons why the IE files might have been erased at one point by the system and started over fresh or returned to an earlier date because of a system restore.

I am also explaining that there are a large number of reasons why the IE files might have been erased at one point by the system and started over fresh or returned to an earlier date because of a system restore.
______________________

as we know she made reference to “zani” before the 16th, so is the above scenerio what potentially occurred?

I would guess yes.

Val

Are you sure that there was an attempt to purge or manipulate? It looks like it was in “file archive”.
That doesn’t necessarily mean that it was purposefully taken out, right? Archive is storage not unallocated space, or is it?

NEED EVEN MORE COFFEE.

WSH’s point above should NOT be overlooked. THERE SHOULD HAVE BEEN MANY HITS IN THE HISTORY.DAT AND INDEX.DAT FILES for “zenaida”. Not just the URLs to searches made on 7/16/08.

What happens when you do a disc repair, or scan disc, or some other disc defrag utility?

Do these records become altered in some way? Will one of these or other types of utilies which “clean-up” your disc, moving things in/from unallocated files affect the dates/timestamps/history?

WSH, exactly what I said last thread, I am worry sick about my granddaughter and I sit at the computer searching for someone that I have never met that my granddaughter has been supposely staying with for the last year. I would go wild on that girl wanting to know where she is. Then your daughter goes and lies about all these jobs and places to law enforcement and you still believe her about the where abouts of your granddaughter. Would you not go directly to that jail and want to get at her after hearing all the bull—- and lies. Cindy’s reaction to her lost granddaughter is very odd to say the least. How can you begin to sweep the smell of the trunk away and begin to believe all the lies from your daughter.
Question, Do you think that the computer seaches will have a big deal in this case, or will the forencics when everything is in. I still believe they have a print and all is said and done. Still very interesting to read and to gain lots of knowledge.

Does anyone know if you access your computer using your Internet ready cell phone, would that create two sets of info for one search? My computer uses IE and my iPhone uses Safari. There are limits as to what you can do on a Internet phone, and some sites won’t even open for iPhone. My phone and computer are much smarter than me so I may not know what I’m talking about. Sorry in advance for being WAY out in left field….

So since the index.dat is a map/index of your personal PC history, and not the creation date of the site, then we are back to PREMEDITATION. She is looking up Zenaida mere days before Caylee goes missing. WTF?

ssnc

I think it will be all pertinent info to form the ‘whole’ of the case. I still think circumstantial evidence and behaviors are the strongest. Fingerprints would be icing on the cake for the prosecution; but not the cake itself.

When did Casey and Jesse break up? I wonder if the Oct ’07 date had anything to do with Casey telling Richard Grund that she was going to us a nanny??

Okay, be back later. This is very interesting.

Does anyone know what brand of cell phone Casey used? Everything I do on my iPhone is synced with my computer but I can tell which device did what because everything in my phone us safari and everything pc is IE in the history file. I’m going back to lurking now. Thanks

So since the index.dat is a map/index of your personal PC history, and not the creation date of the site, then we are back to PREMEDITATION. She is looking up Zenaida mere days before Caylee goes missing. WTF?

I believe this would be exactly opposite to what has been stated. The .dat files were created on certain dates – that has nothing to do with the dates of the zenaida-containing URLs.

Oops…..Uses safari. Sorry!

It is obvious that Casey was lying about Zani’s existence – even if she started the lies in May instead of later. The earlier date simply shows how much premeditation she did. The reason it is obvious is because I doubt that you could find one other person who Casey knew and interacted with which totally lacks any form of electronic trail. That is, Casey did most of her communicating by IM, email, SMS, cell phone, facebook, etc. Yet there is none of these traces available on communications with Zani. No end point to end point communication in whatever form – phone records, server records, email, IM logs, facebook messages and comments, and so on.

It is beyond reason that she would change her modus operandi in only this one instance! Also, she was reportedly close to her brother and yet he never heard of Zani during the three years that she alleges that she knew her? Beggars belief! Was she some state secret? Not according to Casey. Also, Lee had never met or heard of any of the other people who knew and introduced Casey to Zani? They were close?

Something is rotten in Denmark….

Zani only existed for a month or two and then only in the demented mind of Lying Casey….

The other place that you would expect to find some sort of trail for Zani is in the huge numbers of pictures that Casey took all of the time or got copies of such that almost every person that she ever interacted with is in at least one picture somewhere. Yet, not a single picture of Zany?

things that make you go hummmmmm….

Note that the file path to the files in question belongs to the “casey” account. George and Cindy used that account when they were on the computer. Casey used the “owner” account.

I point that out because the files would have been created as a result of George and Cindy activity, not Casey activity. And it makes sense that if Casey was searching for Zenaida with one of her parents the day of the 16th that she would NOT use her private account so as to prevent her parents from seeing what was there.

IIRC, BTW, George said in either an early OCSO or FBI interview that he conducted those searches that day.

VaL”I believe this would be exactly opposite to what has been stated. The .dat files were created on certain dates – that has nothing to do with the dates of the zenaida-containing URLs.”

Sorry Val. We are not saying the same thing? The index. dat files have a creation date that is relative to the time that they are first seen by your PC, no?

It looks like utilities such as ccleaner will remove index.dat, some others allow you to set the number of passes beyond even DoD

» JWG said: | Edit { Feb 9, 2010 – 09:02:58 }
Note that the file path to the files in question belongs to the “casey” account. George and Cindy used that account when they were on the computer. Casey used the “owner” account.

JWG, could you please clarify this statement? Are you speaking only to the activity of 07/16/08, or are you speaking to ALL of the time. Because if you are stating that George and Cindy were the users of the “casey” account going back to March, and Casey was using a different account, that completely changes the situation on the Google searches for chloroform.

I can’t tell what search engine was used. But if it were Google, LE could have subpoenaed all of the queries going back six months. I believe after that time, the data is left in a pool, but no longer IP specific. However, the searches could have been done one piece yahoo, one piece google, etc. Otherwise, they could have gotten a real comprehensive look.

Also, how long does facebook and/or myspace retain records?

I’m not on any of the social sites, so maybe someone can answer this: If you have a facebook account (or myspace), and you want to go to a friend’s, do you typically bookmark it, or do you search their name on the facebook search engine every time?

There is a link to go to your “friends” wall on facebook.
You go to your “friends” list and click on the friend you want

So Scratch
Don’t post it, but what would it look like? Is the following search from Casey’s myspace page looking at the friend wall? Or is this a search of a Zenaida myspace, and then Casey looking at that Zenaida’s wall of friends? Or is it impossible to tell? (EXCERPTED FROM ABOVE):
http://friends.myspace.com/index.cfm?fuseaction=user.viewfriends\ =203461948897ec12-9984-4944-b65e-
6dcef3d5a590=zenaida

If “zani” was not a friend on facebook, there would be no dynamic link to her wall. Also, friends need to accept you as a friend. You cannot see there history, profile, or pictures if the profile is set to private, and they haven’t confirmed (linked to you) as a friend.

The searches were generic searches looking for a “Zani” like person. Someone with records on the account similar to the critria entered in the search. Just as there was no cell evidence, there also was no social networking connection to zani. Though it is possible to unfriend someone. They could subpeona facebook records to see if there ever was a friend link I suppose

William, Casey’s story about a nanny named Zanny was established in spring 2006 when Richard Grund told Casey she would need to find a regular sitter for Caylee. Per Richard Grund’s testimony to OCSO, Casey told Richard she had found a sitter for Caylee, the nanny named Zanny/Zenaida she had met through a contact at the park – Jeff. The fabrication of the nanny story coincided with Casey’s job abandonment.

Shirley Plesea said she had heard the name Zanny since at least the summer of 2007. Debbie Bennett of Gentiva said during the same summer of 2007, Casey elaborated on the Jeff/Zachary story, even claiming to be dating Jeff.

Jesse Grund said he first heard the name Zani in December 2007. Prior to that, he had heard about a nanny but had never heard a name.

Ricardo Morales said he asked Casey when they were officially dating (February-April 2008) what the name “Zani” stood for, and he said she told him, “Zenaida.”

On my space, you’d click the tab find friends, put in the search criteria, and look for friends to add to your network.

If she already had Zani as a friend, again, she’d be in her friends list

Thanks Scratch

So, in your opinion, does that search appear to be a generic one, as opposed to someone’s actual account?

If I were searching for a friend to add to my network, that’s how I would do it.

If I had a friend, I wouldn’t need to search, I’d already be linked to them in my network.

Yes generic, Zani wasn’t in her network. They were looking for someone who fit Zani’s “profile”

Unless something significant happened in Oct of 2007, there are several explanations for the Zenaida search. Casey was looking for evidence, or to fake evidence or proof of Zenaida because someone ‘called her on it’, or someone in the house was already not buying the Zenaida story, and was checking up on Casey. I tend to think that it was Casey because of the firefox search. People like Cindy and George, not particularly computer savvy would go with what was comfortable, as creatures of habit, and opt for the Internet Explorer browser to do searches. But this is mere speculation, admittedly.

I welcome other suggestions.

Okay…I had to count to 10 so I wouldn’t break my own advice and say something in an emotional tone.

What part of YOU CAN’T TELL IF THERE WAS A ZENAIDA SEARCH IN OCTOBER 2007 are you guys not getting?

Seriously folks, the history.dat file was created in October 2007 (most likely because that’s when Firefox was installed on the computer)…YOU CAN’T TELL WHEN THE FIRST ZENAIDA SEARCH HAPPENED BASED ON THAT DATE.

With the exception of caps, I think i did alright…lmao.

What part of YOU CAN’T TELL IF THERE WAS A ZENAIDA SEARCH IN OCTOBER 2007 are you guys not getting?
_______________________

I agree, I wonder if there was a utility to remove index.dat, and history.dat, because there aren’t any searches, except those on the 16th.

I’m actually glad that you put it that way, because I really wasn’t getting it. I have never used a Microsoft PC, well just minimally, but don’t know it as a routine.

So, at the risk of sounding insanely stupid, ( I don’t care because I want to understand) , the index data has the creation date from the browser was first used ? So what happens if you update the browser? Does the old index.dat remain, plus a new one if the search is done again, or does it only keep the first one assigned to that browser, or are there multiples?

Scratch,

I think you are agreeing to something I didn’t say.

YOU CAN’T TELL WHEN THE FIRST ZENAIDA SEARCH TOOK PLACE.

period.

WSH

Please read the VERY FIRST comment under this article. I have submitted questions to my Microsoft contact and am awaiting the answers to those very questions.

Val,
I guess I’m saying the first one took place on the 16th. Which to me makes sense as these are generic searches. On a day that Cindy was determined to find Caylee.

I wondered if they had a .dat utility, which again makes sense to me, if Geo. did have an online gambling problem, he wouldn’t want his history known by anyone, so you have a need to purge it. (again, If)

Scratch,

I know exactly what you’re saying. And what I’m saying (repeatedly!) is you’re wrong to make that assumption.

One more time…you cannot tell when the first Zenaida search was done.

Maura:

Okay. So it is not necessarily a sign of premeditation. I still believe that it stretches incredulity that she (Casey) would have intereacted with someone for over two years and not have a single picture of the person, email from the person, phone call from the person on the Anthony phone or on her cell phone (her REAL cell phone), IM log, or other physical evidence of them in an electronic format given her life style. 6 – 12 hours a day on either the phone or the computer and the rest of the time partying. It also stretches incredulity that not a single one of her friends or family would have met this person in that length of time. Especially since she spent so much time running around with guys and girls seemingly in a romantic way.

She never picked up her cjild from the Nanny while anyone else was present. Bet that is not true of when she picked her up from one of her friends that she had conned into watching her….

intereacted/interacted

Val

It’s okay if you want to use all caps in response.

I’m not sure that I get why the Zenaida would be assigned to the index if it wasn’t searched in Oct. on Firefox… I’m not saying it was the first time, but why would a cache, cookies, etc be logged and noted at that point?

Does microsoft automatically assign a new index, not searched on that browser, if it was searched on another browser already? Is that was is happening? Kind of like importing bookmarks, if you will? Like it could have been a very old search, but since the browser was new, it made a new creation date …Am I finally grasping this?

THis is my last post, promise.

WSH,

Listen – the creation of the history.dat file has nothing to do with the term zenaida. That’s where you’re confusing yourself. The creation of the history.dat file has to do with using Firefox – at it’s creation it probably had nothing but header information and NO URLs at all.

The URL containing the term zenaida could have been looked at from October 23, 2007 and every day after until 07/16/08 for all we know, OR they could have never been looked at before 07/16/08. That is why I am trying to get clear that WE CAN’T SAY WHEN THESE URLs were first looked at based on the creation date of the .dat files.

I hope that helps clear this up.

also aren’t all these searches under the user name casey which i believe we learned cindy & geoorge used (go figure) and Casey was actually using the pword protect Admin account…do we know of any searches under the main admin account?

In other words, if I were on a PC, and I used IE and searched Hinkymeter, I can clear all of my caches, cookies and history, but a .dat would remain as a hidden path to Hinkymeter. Let’s pretend I did this 3 months ago.

Then, let’s say I decided today to scrap IE, uninstall it (or whatever PC people do), or on a MAC- delete it. Then let’s say I downloaded Firefox before getting rid of IE. I install it and start it up. Would all of the .dat stuff in my system then attach to Firefox, with today the new creation date ? Even though I searched Hinkymeter 3 months ago?

I hope when I return later I don’t find that Val’s head had burst into flames from my posts. lol

WSH,

No, what I’m saying is let’s pretend on January 2009 you installed IE. You immediately have an index.dat file with header information and no cache yet, no cookies yet and no history. So that index.dat file exists and has a creation date if you NEVER open IE. There are also index.dat files associated with your windows explorer. That’s how your “recent documents” work, etc.

Okay, now on 03/01/09 you visit the hinkymeter. and then on 06/01/09 later you visit the hinkymeter. If you list the following information on that index.dat to me:

file create date: 01/01/09

last write date: 06/01/09

hit against the term “hinky”

http:/www.thehinkymeter.com

I cannot tell you when the date was you FIRST visited the hinkymeter. I can’t even tell you if you visited the hinkymeter prior to 06/01/09.

All I can say is:

the index.dat file was created on 01/01/09 (has nothing to do with the hinkymeter)
and you went to the hinkymeter at least one time – presumably on 06/01/09, but I’m not real damned sure I can even say that because what if you went to the hinkymeter.com on 05/31/09 and then went to a new website on 06/01/09. That new website would show the index.dat file being written to last on 06/01/09, but that doesn’t have anything to do with you visiting the hinkymeter.

Val,

Casey was using the “owner” account as far back as 5/14 (when the password was changed), but who knows prior to that. I’m guessing she used it for quite some time.

Why do I say that? If you look back at the unfiltered internet history files released in September 2009, two files are from the laptop (the ones with “bobby” in the file name) and two are from the desktop (Unfiltered Temporary Internet History for Casey Profile.csv, and Internet History unfiltered.csv). The internals of those files indicate that the information was pulled from the casey account. No information was pulled from the owner account, which means there is a potential wealth of information that we have not seen.

Anyway, if you look at the history before Cindy grabbed Casey on the 15th, you will notice the desktop activity does not reflect the websites Casey is likely to visit, such as Myspace, Facebook, Photobucket, etc. Instead, it reflects mostly George activity with a little Cindy sprinkled in. Also, all of the history reflects Internet Explorer usage.

One can selectively delete history from a browser, but it is a pain and a whole lot easier to just delete all of it. So thinking of Casey taking the simple approach, if she surfed the web using IE on the “casey” account and deleted her history, the surfing history of George and Cindy would be gone as well. So in a round-about way I conclude Casey was not using that account.

Now look at the Google searches. Melich said in his report that he asked Sandra Cawn to look for the keyword “chloroform”, and a few days later she came back with the results. Because it took a few days, she probably found the information in deleted history files. And sure enough, the file name used by Ms. Cawn to record the searches is “Firefox from Unallocated Space HP Desktop Google Searches.xls”. If the file name Ms. Cawn used has meaning, she found deleted history from the Firefox browser.

Now, what about the search for a flea remedy? Looking back at the IE history you will notice an absence of the use of Google to perform searches (prior to the evening of the 15th). It would seem George and Cindy were not hip to using Google. I therefore speculate that Casey is the one who searched for the flea remedy, and she did it on behalf of her mother. I’m pretty convinced that is the case, because from 8:33 AM to 8:40 AM on 3/8 we see Google searches from the Firefox browser, and then starting at 9:18 AM to 9:45 AM we see a whole slew of activity on IE from the “casey” account.

So, I think Casey was on the computer and her mom asked her for some help, they did some searching together, and shortly after Casey finished, logged off her “owner” account and Cindy hopped on the “casey” account and used the Yahoo and MSN search capabilities to continue looking for a remedy. After a while Caylee came by and she and Cindy looked at the cute pictures on http://www.babyanimalz.com.

JWG,

I have a couple of problems with this.

1. The computer forensics showing the chloroform, one tree hill, and all that rot, is clearly attached to the “casey” account. If I have misunderstood this, please correct me.

2. Deleting history, cache, temporary internet files, etc. Does NOT affect the internal index.dat file. So if there were prior internet files of any type with “zenaida” in them, they should have hit against the forensic search.

the date of the creation of the index.dat files is not the same thing as whatever date the data for the search ‘zenaida’ or ‘zani’ or ‘zanny’ or whatever else was stored in that file. The only thing we know is the date of when the index.dat file was created by the computer. So the computer would arbitrarily assign those little streams of bits & bytes in those files. Normally the index.dat files are created when the computer is first used but like someone else said – if there is some sort of corrupted data stored in the files sometimes the computer will self-heal and sort the whole thing out by creating new files. I do not think that anybody (besides possibly Lee) was savvy enough to modify the index.dat files and if there was some sort of utility installed to erase previous use then the computer forensics folks would see a trail of that as well.

Think of it like your dresser drawers. You know when you bought the dresser but you don’t know necessarily the date that you put each pair of socks, underwear, etc. inside of those drawers. At least I hope not.

And I agree about the IE vs Firefox and Geo/Cin vs Casey use. I’m pretty sure Geo/Cin would just use the IE browser and Casey probably started using Firefox to better hide her trail from the parents until she finally hijacked the administrator login/password so she could have total control in case she ever needed to. I’m sure she came up with a tall tale about why they needed to just sign in with her account.

WSH said it best when it was stated that it looks even more devious to find only tiny bits of Zenaida on the computer than it would to find lots of solid, traceable evidence of Zenaida. Just enough to help her fill out the her story.

One thing I’m pretty sure of Casey was in erase erase erase mode when she was sitting at Tony’s. I think her intuition was telling her that Cindy was at the end of her rope and that something big was going to happen pretty soon if she didn’t produce Caylee. It’s easy to screw up the startup file if you’re not paying good attention to the files you’re deleting and start a domino effect that gets you to the dreaded BSOD.

I know just enough to be dangerous – and with 4 boys and 7 computers (4 pc’s, 2 laptops and one Macbook) and racked gear on our network at home as well as being a sales manager of 12 folks that sell & engineer Cisco voice and data gear – let’s just say I’ve had to beg/bribe my engineers to drop by the house occasionally to lend a hand. I’m used to having to explain things using everyday household furniture as examples! But, I am in no way an expert like quite a few others here!!

Tale a look at this site to understand the way index.dat is stored on the system. I will explain all of the stuff – it will take me awhile.

http://www.forensicswiki.org/wiki/Internet_Explorer_History_File_Format

The location of the index.dat file for IE:

On Windows 95/98 these files were located in the following locations: %systemdir%\Temporary Internet Files\Content.ie5 %systemdir%\Cookies %systemdir%\History\History.ie5

On Windows 2000/XP the files were here: %systemdir%\Documents and Settings\%username%\Local Settings\Temporary Internet Files\Content.ie5 %systemdir%\Documents and Settings\%username%\Cookies %systemdir%\Documents and Settings\%username%\Local Settings\History\history.ie5

In addition to this there will also be:

a daily index.dat
a weekly index.dat
a monthly index.dat

These will be located in subfolders of %systemdir%\Documents and Settings\%username%\Local Settings\History\history.ie5. The folders will be named MSHist

Okay, I doubt that anyone will have trouble following any thing up to this point in the page. Now comes the trickier stuff.

Yes, you misinterpreting. There is nothing about the computer forensics showing the chloroform, etc. searches being tied to any account. They were found in unallocated space. So they MAY have been done from the “casey” account using Firefox, but I find it more likely they were done from “owner” using Firefox.

Also, note that Firefox does not use index.dat. It is much easier to erase surfing history with Firefox and with IE.

I will note that Cawn’s report regarding “Zenaida” pulled the information from IE’s index.dat file. The surfing data found in “Internet History unfiltered.csv” shows two searches on the morning of July 16 around 5:23 AM for that name at Whitepages.com. The name is also found in “Unfiltered Temporary Internet History for Casey Profile.csv” but seems connected to the Whitepages.com search (i.e. – ads from ussearch).

Whew! Always glad to see JWG jump in when the computer forensics discussions come up!! Thank you!

The format of the files will be:

The hex numbers which represent the ascii string “Client UrlCache MMF Ver ?.?”

The next field in the file header starts at byte offset 28 and is a four byte representation of the file size. The number will be stored in little-endian format so the numbers must actually be reversed to calculate the value.

Not real important that you understand what this means exactly – just know that the numbers at positions 28, 29, 30, and 31 are representative ofthe size of the file.

Also of interest in the file header is the location of the cache directories. In the URL records the cache directories are given as a number, with one representing the first cache directory, two representing the second and so on. The names of the cache directories are kept at byte offset 64 in the file. Each directory entry is 12 bytes long of which the first eight bytes contain the directory name.

This directory name is relative to the location of the primary index.dat file location and offer a way for programs to insure that they are looking at the correct .dat file since they can compare the name stored her against the name of the file that they accessed to start reading the database.

Allocation bitmap

The IE History File contains an allocation bitmap starting from offset 0×250 to 0×4000.

An allocation bitmap is a segment of the file where each position corresponds to a used record location in the file if that position is set to 1 and an empty location if it is set to 0.

Record Formats

Every record has a similar header that consists of 8 bytes.

typedef struct _RECORD_HEADER {
/* 000 */ char Signature[4];
/* 004 */ uint32_t AmountOfBlocksInRecord;
} RECORD_HEADER;

The size of the record can be determined from the amount of blocks in the record; per default the block size is 128 bytes. Therefore, a length of

05 00 00 00

would indicate five blocks (because the number is stored in little-endian format) of 128 bytes for a total record length of 640 bytes.

The blocks that make up a record can have slack space.

Any additional questions on the remaining please ask, but I think it is pretty easy to understand.

One other thing I meant to throw out there.

Cawn’s forensic report stated that the last logon to the “owner” account was 07/16/08 04:57:56AM. Roughly five minutes later we see activity coming from the “casey” account and IE. I speculate that Casey hopped onto the “owner” account quickly in an attempt to cover her tracks – possibly deleting the Firefox history at that time.

So the first entry actually was a browsing history not an index.dat:
search term: zenaida

Name: history.dat
Description: File, Archive
File Created: 10/22/07 01:13:21PM
Last Accessed: 07/16/08 12:03:24PM
Last Written: 07/16/08 12:03:24PM
Full Path: 08-069208\S013J10X237614\D\Documents and Settings\casey\Application
Data\Mozilla\Firefox\Profiles\mfhaxjkl.default\history.dat

http://kb.mozillazine.org/History.dat
The file “history.dat” stores the browsing history (a record of visited pages) in Firefox 2 or below and in Mozilla Suite/SeaMonkey 1.x. (Starting in Firefox 3 and SeaMonkey 2, history.dat is no longer used and the browsing history, as well as bookmarks in Firefox 3, is stored in the file places.sqlite.)
Browsing history should not to be confused with session history which controls the Back and Forward buttons, or with download history which stores details of files saved to the hard drive or opened with external programs. The History Sidebar provides an interface to view and edit this file.
By default, the browsing history is stored for 9 days. If the history becomes long enough, the file can become large enough to greatly increase the startup time. To reduce the startup time, you can delete all or part of your browsing history, or you can delete the file.

This is interesting:

http://www.securityfocus.com/infocus/1827

Firefox/Mozilla/Netscape Based Web Browsers
Firefox/Mozilla/Netscape and other related browsers also save the Internet activity using a similar method to IE. Mozilla/Netscape/Firefox save the web activity in a file named history.dat. One significant difference between a history.dat file and an index.dat file is that a history.dat file is saved in an ASCII format rather than binary. This makes reviewing the file simpler than the corresponding IE file. The second difference with the history.dat file is that it does not link web site activity with cached web pages. Therefore, we cannot readily assemble views of web pages Joe visited in the same manner that we can with IE.
Firefox files are located in the following directory:

\Documents and Settings\\Application Data\Mozilla\Firefox\Profiles\\history.dat
Mozilla/Netscape history files are found in the following directory:

\Documents and Settings\\Application Data\Mozilla\Profiles\\\history.dat
The process of reconstructing web activity manually can be quite tedious. Fortunately, there are several tools, both free and commercial, that streamline this process considerably. The following sections present some of these tools. Please follow along with the web activity data you downloaded in the introduction to this article, and use the tools mentioned in this article to reconstruct the analysis.

yes good speculating, i’ll bet Casey used both..but def hers when she wanted to hide something

Valhall,

So is this part of your timeline of June 12th incorrect? (I am lost with the computer stuff now.)

12 – KC search reunion.com for “Zenaida Gonzalez” age 25.
KC search USSearch.com for “Zenaida Fernandez”, Jacksonville, FL

You must be looking at a very old version of the timeline, because that mistake was corrected some time ago (months to be exact).

http://www.thehinkymeter.com/?page_id=1024

Ouch…I think my head is spinning worse than Linda Blair’s.

Lily:

I think you could be on to something about Casey being in erase mode on the computer before Cindy showed up. We can’t forget that Cindy did call and leave a message with Casey about the car and a big problem. Of course, Casey knew what the problem was without Cindy having to tell her. I think she began to cover her tracks when she heard that voice mail from Cindy.

I agree and from the timeline it looks like it took quite a long time from the point Cindy picked Amy H up at the mall to the time they arrived at tony l’s …do we know of any text’s from Amy to Casey letting her know they are on the way?

I have dealt with programs that completely overwrite, and eliminate prior entries. With no traceability. Wacky timestamps, and all you have left is a snapshot, at a data point.

Also, to assume any searches were strickly done on the home pc would be wrong.

I was saying these were random searches that appear to be Cindy. (people search, us search, if you have the address, phone of a person, you don’t need to do this type of search. Also the my space, faebook searches were generic)

I’m saying this is the first time Cindy searched.

That you may choose to disagree with, but I believe it to be true, based on the tyoe and method of searching.

what and when, or where casey searched, I have no clue.

But I believe these are Cindy’s first searches

sorry type and method

So, in essense, i should go back and get a comp. degree to successfully understand the discussions in this thread?

One time I had a bad virus in a old computer I had. I went to Files. I had to find it manully. I did find it after day’s of searching. I than deleted it. Now what I am thinking. Can someone go to files. type in “zenaida” . Delete what ever pops up?

I don’t comit , I am a lurker. But enjoy this site alot. I have been following this case sense the day Casey on the news was arrested.

Thanks’ for all you do…

This conversation really brings home how much we depend on and expect from technology, and how it is neither straightforward nor understandable sometimes. I wish things were going to be easier for the state to explain to a jury.

The murder trial I was on a jury for had nothing more technical than a gun and a truck. It was all about the people.

This case is fraught with nebulus photos, odd duct tape, few if any prints, computer issues, cell phones, machines that analyse odor, etc. Each item can be picked apart, I suppose, but the totality of the forensics is beyond what can be reasonably explained away by Mr. Baez et al. Another interesting article and response everyone!

Thanks

Scratch

If Casey regularly emailed, IM-ed, texted, or called this woman for 2 years, obviously there would have been more on the computer and phone.( that LE wouldn’t have to dig for) Why wouldn’t Zenaida be in her email address book, or in previous recipients in email? Who types in a person’s entire email address every time they correspond-NO ONE. Even if she had two phones, (hypothetically), this person is watching your kid, you wouldn’t have that number programed into both phones? I agree that the searches conducted on 7/16 were either done by CIndy or Lee.

The curious thing to me, which Val is looking into is, the create date of 06/12/08. It does seem so highly coincidental that someone would decide to load a new version of IE days before Caylee goes missing, (if that would even start a new index). Unless something tremendously wonky occurred with the system prior, or someone used a cleaning program,( because I would assume that someone would have had to have used IE before that date), I can’t see anyone else than Casey skulking around at 11 at night to download a new IE. So, it still seems premeditated to me. AND how would it have served Casey to delete any prior index that would relate to Zenaida? She was lying about her for a long time, why not keep the trail going?

Unless of course, somehow other more sinister searches might be tied to older pathways, and she wanted those blown away. So the Zenaida ones get deleted; the baby out with the bath water? Either she started a new trail that very night looking up Zenaida, she was developing a story, or she proceeded to erase her past that night and start a new one, and then the only searches documented were those by Cindy or Lee on the 16th of July.

Although, I could see George potentially covering his tracks and trying to remove old data tied to his searches, but then why at 11 at night would he feel the need to start a new IE browser? Was he even home from work by that time?

This is definitely not something I can envision Cindy doing at that point.

Valhall, you have stated in the past that it was odd that lee got on the computer when he went to tony’s… LE went to tonys and picked up caseys cell phone then he and tony plugged in the computer in the kitchen and (?)
If LE went over there to pick up caseys belongings, then why not pick up the computer also? And if he/she went over to pick up only caseys phone, then why mess with the computer?

My opinion is that Lee went to get the phone and computer and caused the blue screen of death so nobody could see what a freak his sister was. And how bizarre a family. And how Zaniada must have taken Caylee, nanana boo boo prove otherwise. Not too bright. I think if he had a chance, he would have thrown the phone over the balconey. I have zero proof for this.

Midwest Mom said: { Feb 9, 2010 – 04:02:01 }
“Valhall, you have stated in the past that it was odd that lee got on the computer when he went to tony’s… LE went to tonys and picked up caseys cell phone then he and tony plugged in the computer in the kitchen and (?)
If LE went over there to pick up caseys belongings, then why not pick up the computer also? And if he/she went over to pick up only caseys phone, then why mess with the computer?”

Midwest Mom
I asked a similar question on another thread. I think since everything was in plain sight and it was Tony’s domain, that he probably gave permission to LE to look at stuff, or perhaps he may have mentioned it wasn’t working and LE found that curious. I don’t remember what permissions were given at that time by Casey or Cindy in removing and confiscating items. However, it would stand to reason that the phone might contain more immediate info, especially since Casey said the Caylee had recently called her. But I am at a loss as well as to why they didn’t take the laptop too.

I suppose if they were able to contact the nanny right away, the phone would have been given back. I’m thinking that they weren’t certain of what they were dealing with. They probably sincerely thought that they were looking for a kidnapped baby at that point, so they were looking for clues, vs. gathering evidence, until they discovered Casey’s lies and a different picture was being painted.

In one of Val’s articles we discussed the blue screen. I’m pretty sure that Tony said the blue screen was all they could get when Lee got to the house and they started the computer up. So, Lee would have had to fix the BSOD and then erase information all while standing in a deep conversation with Tony and his roommate. If I remember correctly, Maura posted a great comment that shows how the timing of this is nearly impossible with the drive time included and Tony’s recollection of Lee’s time spent at the apartment.

I just googled “how to get the blue screen of death” and read about how easy it is. Just a few seconds, and boom. If you have an entire minute, there is no recovery but reload. Many were college sites, and the posters were very amused with themselves. Please do not pass this on to your teenagers. Although I bet they already know. lol

Nothing about the encase data suggests that the files were tampered with. The only thing that seemed slightly suspicious was the file creation date of the IE data set. The problem is that this is only 1 of the data sets that IE would have kept on any given activity. If there had been tampering of this sort, then there should have been the same sloppy time stamp handling on these other instances of index.dat and encase should have flagged them. It didn’t, so there was no tempering.

The time stamp got changed due to a system level event of one sort or another. There are many which will produce this result. It would require absurdity to believe that this single file was tampered with but that all of the other damning information was allowed to survive. Especially when you also consider the time constraints that Lee would have had to operate under to pull off tampering and the fact that he would have had to do this prestidigitation in front of a live audience (Tony and roommates). Not even remotely possible when all facts are considered in tandem. 8O

William

Remember, we are talking about the desktop right now, not the laptop. We don’t know if any other files or history were not removed at this point, as far as I can tell. We are only looking at specific items of interest brought forth by LE. Who is to say that other index files were not removed at that point?

The problem with Lee causing the BSOD is that this would have been during the time that Tony was paying the greatest attention to what he was doing to the laptop. this is the reason why Tony mentions the BSOD in the manner that he does – when he and Lee turned on the laptop. Tony was right there paying close attention. It may only take a few seconds to cause a BSOD when you have practiced doing so, but those few seconds are different when you have someone looking over your shoulder and watching your every move.

He did not cause this, in my opinion, or Tony would have seen something weird.

On 7/16 the searches were done very very early in the morning. I thought it was deduced that it was either Cindy or Lee……because KC hadn’t been dropped off by police officiers until around…..7:00am I think…

Then later on 7/16 she was arrested.

If I remember correctly…..

Sorry. I meant the Desktop on that.

I mioxed up my two scenarios didn’t I? lol.

Brother, time for me to take a break. Maybe a long one.

He did not cause this, in my opinion, or Tony would have seen something weird.

I agree William. I argued this yesterday. At that point he wasn’t in a defending mode, he was trying to uncover info to find Caylee.

Yeah, Toney is the BSOD. The desktop is the encase time stamp.

8O Bye for now, embarrasment drives me off….

I don’t think any files were tampered with either. But I do think Lee is idiot enough to think a simple crash of the system destroys it. It wouldn’t take away from his “deep conversation” and is a few keystrokes. My Geeksquad guy told me my computer (after a year of my ignorance and 2 teenagers playing games without the right stuff on it) was a “gobblygook of nonsense”. He told me I had so many files over written, in the wrong place, deleted, etc. that it was hopeless to use. After $200 and a week, it was normal again.
It is possible that Lee knew enough to think he was ruining the computer, but only suceeded in slowing down the forencic geeks a little bit. I am sure what happened will come out in court (down to which keystrokes were used to crash the system) and the experts will try not to laugh on the stand at the feeble attempt.

WSH – you’re right. The discussion has gone all over the place from the desktop to the laptop. Val’s original discussion was about the Zenaida searches on the desktop. Sorry if I’ve contributed to the confusion.

One thing to add – some are saying that Casey had remote access to/from the laptop and desktop but I have seen no evidence of that whatsoever. The utilities required to do that would probably have come out in discovery somewhere so she wasn’t deleting or originating files remotely between computers as I’ve seen speculated. Also, I’m under the impression that the Anthony’s turn the desktop off when not in use.

William

Don’t feel bad. I have confused myself six ways to Sunday on this! LOL Plus, we are having multiple conversations at once, which makes you crazier…at least me.

Val beat me over the head with a 2 X 4 this AM, trying to get past my dense skull.

» lily said: { Feb 9, 2010 – 05:02:41 }

Yeah, I brought that up , guilty as charged…sorry

Its pretty clear that Lee did not have the opportunity to erase files on the laptop once you study the timeline. I will look for Maura’s excellent comment on this if I get a minute – the computer was in BSOD mode when Lee got to Tony’s – backed up by Tony’s statement. Lee stayed for quite a while chatting with Tony and the roommate and they all were in view of the computer. IMO Casey was erasing her computer trail much like she tried to erase her daughter. She just wasn’t smart enough to do it without trashing it at the same time. I’ll bet she panicked big time when she got the BSOD and wasn’t able to finish her mission before Cindy got there.

Val sorry for getting off topic on the Zenaida/desktop/laptop issues.

The link to Val’s article about the laptop is: http://www.thehinkymeter.com/?p=981

This is part of Maura’s comment to Val’s post Dec 9 12:12 (snipped)

From Tony’s SM comment, Tony and the deputy had taken the laptop to the kitchen counter and plugged it in while they were trying to get rid of the blue screen. When they could not resolve the problem, Tony said they shut the laptop but apparently left it plugged in on the counter. So when Lee got there, the laptop was plugged in on the counter and maybe had powered itself off automatically.
As far as I’m concerned, Casey screwed up the computer herself and was sitting on the couch either trying to fix it or was in the process of screwing it up when Amy knocked on the door around 7:00-7:15pm. Tony said Casey was sitting on the couch using the laptop when Amy knocked on the door, but Tony never said he could see the screen. She could easily have been tucked into a corner of the couch with the laptop turned in such a way that Tony could not see the screen.
Casey knew from Cindy’s text messages that a shoe had dropped:
4:27pm Cindy text to Casey: “Call me asap major prob”
4:44pm Casey text Cindy (unknown message)
4:45pm Cindy text to Casey: “Call me”
4:48pm Casey text to Cindy (unknown message)
I think Casey was trying to get Cindy to describe the “major prob” via text, but Cindy wouldn’t tell her (and Casey wasn’t going to call without knowing). We have no way of knowing what Cindy and Casey discussed during the phone calls at 12:58pm and 1:11pm, but my guess is Cindy mentioned a certified letter but said nothing about learning that the Pontiac had been towed. I am surmising that Cindy wanted all the details from Johnson’s before she confronted Casey and that Cindy wanted a face-to-face confrontation. At the very least, she didn’t want to give Casey any warning about the towing until Cindy had the all the towing details lined up before giving Casey a chance to “explain.”

I am still pretty sure that it is winter. Other than that I am confused most of the time.

I think Maura has provided enough information on both the laptop thread as well as this thread to show that the BSOD was there when Lee got there. We would have to assume Tony is a liar to think otherwise. There will also be an OCSO officer who will be able to verify this one way or the other.

Lee did have discrepancies in his interview with OCSO concerning this, but it appears it was BSOD’d when he got there. It will be established one way or the other at trial.

I think the main two points of interest here are:

1. Why is the creation date of the index.dat file 6/12/08? Waiting to get a response from the Microsoft contact on that one.

2. Why is there no “zenaida” hits prior to the index.dat?

Aside from those two questions I think we can establish that the returns from the forensics are most likely the searches done by someone on the morning of July 16th…it’s a safe assumption.

Val

Agreed, But it does seem sinister the loading of IE at 11 PM at night, right before Caylee disappears, hmmm.

I still think the searches with a timestamp of the 16th are Cindy searches, and you’d be hard pressed with the generic nature to convince me otherwise.
I don’t know when or where KC searched, bu these are Cindy searches

*(but)

I am not computer savvy regarding ‘computer stuff’, so I cannot effectively contribute to the interesting questions and/or findings.

I do find the fact that Casey and Cindy were on the ‘puter’ doing Zenaida searches rather, well, rather interesting (understatement of the year), given the crucial ‘time is of the essence’ , situation at hand.

One would think that, in between the day/time Casey left Caylee ‘at the steps’, and the day she was arrested, she would have gathered all kinds of info about ‘Zanny’, and maybe even come up with something USEFUL, since she was afterall, ‘frantic’ and
‘trying to find her on her own’.

Computer searches aside (not trying to minimize), however, the sheer FACT that there are no PHOTOS of the elusive, ‘ten’ Nanny, given Casey’s propensity for photography, and given the ‘Caylee’s with Zanny’ story of the past two years prior, speaks volumes.

Kudos to everyone’s intelligent input…

About to put some popcorn in the microwave, this is gettin’ good…

» Scratch my hinkey said: { Feb 9, 2010 – 06:02:49 }

I still think the searches with a timestamp of the 16th are Cindy searches, and you’d be hard pressed with the generic nature to convince me otherwise.
I don’t know when or where KC searched, bu these are Cindy searches

Agreed Scratch. I said that- now that I understand a little better.

However, IE is bundled in Microsoft, Firefox is not. The create date is still significant, because someone or something cleared the index, and a new index was created in June days before Caylee was missing. That is the point. WEIRD

I’m pretty lost when it comes to all this computer internal files brew ha ha. BUT I do know that one can allow for automatic updates from Microsoft. I do believe around the 06/12/08 timeframe there was an update because (I work for a telecom company) many of my co-workers received technical support calls because there was an automatic update that had something to do with “Zone Alarm” settings and it was causing people trouble with browsing. I double checked information I received on this and I was getting emails at work about this issue throughout June and July of 2008. Perhaps it was an automatic update? We’ll have to wait for Valhall to hear back from her Microsoft contact though before this really might mean anything anyhow.

To fully understand, you need the programming code (if not, then, if yes, then.)

I don’t know if this means anything, there were 7 security updates released from Microsoft on June 10, 2008.
Maybe they were actually manually downloaded by Casey on June12, 2008.
Somebody who knows more than me, please check this out.

“As part of Microsoft’s routine, monthly security update cycle, we released 7 new security updates on June 10, 2008.”

http://www.microsoft.com/security/updates/bulletins/200806.aspx

“one can allow for automatic updates from Microsoft.”

I can see that. At the same time, I can’t see that privacy advocates might be so alarmed by a “tracking device” that is constantly altered by periodic updates. **Especially by the virtue of threats supposedly always aimed against any Microsoft product, given that that happens all the time, and with its dominance in the computer world. Why wouldn’t old searches be saved, and transferred in history?

‘cuz they can be deleted. with DoD type securit.

And with C++ programmimg:
Date 00/00/0000 =(x) else

Sorry :
date(00-00-0000) <= (date) as 00/00/0000

» Scratch my hinkey said: { Feb 9, 2010 – 08:02:09 }

Scratch,
Elaborate, please.

If this is cake, then is it a non- issue?

Do most people “And with C++ programmimg:
Date 00/00/0000 =(x) else” ?

You ask a date.. if else not. so ask o6/12/06 else not, you get all records for 6/12

it was a general if else not statement

I’m learning something new every day about using computers but I am still very much a novice. I often just skim through what you guys are writing and am usually looking for your assessments and thoughts about WTH happened in this case!
To be honest, I have learned so much legal, medical, technical, forensic, etc info from this case, it amazes me. The internet is wonderful. The ability to learn so quickly from so many on this site just makes me want to say THANK YOU to everyone, but especially to Val for providing this forum.

My point is: do people who are not computer savvy use those directives or scripts, or programing language to clear their computers? And why?

For most people, not hiding things, oblivious to tracking mechanisms: why would they want to “reset”, it’s not like a cache slowing down start -up? Why would they dump it?

Unless Microsoft sets everything to zero. Which would kind of suck, if you didn’t bookmark stuff you wanted back after updates.

No, WSH. Its cake to some but not to us regular folks – including all of the Anthony’s. And let’s remember who we’re talking about. Casey didn’t even graduate from HS – not that that doesn’t preclude someone from being a code genie but then there is reality.

ps syntax varies code to code

The index.dat file would have not have been deleted by an automatic update to Windows or IE.

What we are waiting to learn is if it could have been deleted and recreated by an upgrade to IE. I suspect the answer is no.

This would have taken “extraordinary” measures to delete. That is not hyperbole. It is being used as defined – above and beyond ordinary measures.

if forgot my where clause:
where date (ooo/oo/oooo) = <(date)

Much more to a query than that..

This would have taken “extraordinary” measures to delete. That is not hyperbole. It is being used as defined – above and beyond ordinary measures.
_______________

with a scrubber?

Right, Scratch, that would be extraordinary measures. I’m not saying for some of us this would be hard, I’m saying it would have taken extra ordinary measures. Not just click – delete.

“This would have taken “extraordinary” measures to delete. That is not hyperbole. It is being used as defined – above and beyond ordinary measures.”

Val,

I am on the same page, “Dude” (facetiously).

Although I do not state this as a sanction to belt me in the head, in the future, with a 2X4!
( because you did so earlier)

ps I can qmf if I have the data dictionary

Right, Scratch, that would be extraordinary measures. I’m not saying for some of us this would be hard, I’m saying it would have taken extra ordinary measures. Not just click – delete.

aw, we are click in..pay no attention to the bubble

WSH stated:

Although I do not state this as a sanction to belt me in the head, in the future, with a 2X4!
( because you did so earlier)

LMAO! I did not! I just used lots of caps.

pfffft

» Scratch my hinkey said: { Feb 9, 2010 – 09:02:40 }

“ps I can qmf if I have the data dictionary”

Scratch
….WHHAH?

You’ve demonstrated that shit would not have been deleted with out an intent to destroy? Do you think Cindy knew this? Or George? I don’t even know WTH you are talking about.

http://www.brothersoft.com/index.dat-suite-136485.html

Index.dat Suite 2.3
Description

“Index.dat Suite is a rather unique program.”
EditByBrothersoft: Index.dat Suite is a rather unique program that allows you not only to delete the index.dat files, temporary internet files, temp files, cookies and history, but it also allows you to view the index.dat files on your system.

Index.dat Suite’s current features include;
View, delete and backup index.dat files
View and delete Temporary Internet Files (TIF)
View and Delete Cookies
View and delete History
View and Delete Temp Files
View and delete Recent Documents
Delete Typed URL’s
Delete Prefetch folder contents
Auto-generation of Batch file to assist in deleting the index.dat files in DOS.
Optional add to RunOnce, Run or WinLogon registry key
Optional deletion of Swap file (9x users only)
Optional defrag after file deletion
Optional backup/deletion of NTUser.dat.log file (2K/XP/Server 2003 users only)
Optional System Restore point creation
Full application logging you can free download Index.dat Suite 2.3 now.

I was re-listening to Amy and Tony’s timeline. KC avoided Amy for about 20 days. KC does though inform A.H. about he horrible smell on 6/25/08, and on 6/26/08. On 6/27/08 she texts she found the problem, the squirrel. KC says on 6/26 & 6/27 the smell was getting worse. 6/27/08 she got rid of the squirrel. From 6/30/08 until 7/15/08 KC is completely free of Caylee, so could she have driven around for shy of two weeks with the baby in the trunk? A.H. and T.L. time frame are pretty much the same as to being able to account for where KC was. IMO from 6/16/08 to 6/27/08 I think the baby was in the car that is why the odor of decomp was so bad.

I can query a DB , show me a dictionary of your tables, and let me know what you want to see.

You’ve demonstrated that shit would not have been deleted with out an intent to destroy? Do you think Cindy knew this? Or George? I don’t even know WTH you are talking about

____
They could.

my opinion:
the time line will get her off.

Over lay every thing. Cell, ‘puter, pings, comments, conversations, by timestamp….
do I want her to get off? No…

Timeline is gonna do it.. I think. Unless someone can [rove domthing else.

that was “prove something”

I have no idea where you’re coming from. The timeline will sink her.

» Valhall said: { Feb 9, 2010 – 10:02:12 }
I have no idea where you’re coming from. The timeline will sink her
as an analyst, perhaps.

as a farmer..maybe not.

A little OT, but still concerning the laptop -

Regarding whether or not Casey may have intentionally placed the BSOD on her laptop while sitting at Tony’s (July 15th), before Cindy arrived…

Not sure, as I am technologically challenged, however, in re-listening (this evening), to the Universal interview, something she said caught my attention, which led me back to the topic of the BSOD thread:

Universal Interview:
Detective: After not having seen your daughter for five weeks and you didn’t call anybody’ (yada, yada, yada)

Casey: ” I sat around yesterday trying to figure out what to do, I’m glad all that ended up happening with my mom, that all of that stuff happened, it happened for a reason’ (verbatim)

If one analyzes the above statement, it appears that she ‘was trying to figure out what to do’ BEFORE – the ‘all that stuff ended up happening’, which in my interpretation, she is referring to Cindy coming over-police involved, etc., and AFTER the ‘Major prob, call me’ text from Cindy.

We all know Casey combines lies with truth (and the kernels of truth she does divulge are USUALLY inconsequential details – sometimes inconsequential only in Casey’s mind, but telling nonetheless)…
Therefore, if indeed she ‘sat around yesterday trying to figure out what to do’ (which ‘yesterday’ would make it July 15th)…and as the evidence shows, Cindy sent Casey a text on July 15th (around 4ish something in the afternoon-I can’t recall the exact time, but I do know it was 4something pm), perhaps, Casey was aware (via logic, instinct, intuition), something was coming down – and quick- hence, perhaps she was ‘trying to figure out what to do’ and her ‘figuring out’ began with the laptop (and any pertinent evidence).

I’m no super sleuth, nor do I profess to be…just something that caught my attention…

as an analyst , I have data..

as a farmer. connect that data, show me how it matters.

Else it is nothing more than a picture. At a moment….a snapshot
(Devils advocate)

–I am a farmer

perhaps this is worthy of a blog entry.

What does matter

This is all very interesting, however, Casey wasn’t smart enough to ditch her car where it wouldn’t be found easily (like in a lake), so I have my doubts as to whether she tried to erase any of her tracks on either of the computers. She had no clue that she’d be face to face with Cindy much less the cops. I just don’t see her doing this.

Valhall,
In response to your question early today (Tues) about whether certain searches on the desktop were from the “CASEY” acct rather than the Admin acct (Casey’s), and how that would confuse the theory or timeline: Blink did an article just a few weeks ago regarding Casey and George/Cindy’s use of the computer during certain time frames (March) where they were all using the desktop and using the CASEY acct – Blink pointed out how it was possible to deduce who was using the computer by the use of Firefox or IE, even though Casey did not bother to go to her private admin acct (Blink described a scenario where people are just popping up and down on desktop computer for various searches during an afternoon for example but not closing down accts– a common scenario in my house) . I am sorry I do not have link.

Okay. My brain is totally fried from trying to follow all this info. I used to think I was somewhat computer savvy.

Apparently not. I’m considering ripping the hard drive out of my computer, putting it underneath the back wheels of my car and just putting the car in reverse. Then drive, then reverse, and attempting to destroy my entire hard drive since it appears (if I’m understanding this entire blog entry and the corresponding posts)…that I can NEVER get rid of anything on my computer I’ve ever searched for.

Not that I do anything illegal with my computer. Just based on what I’m reading here, though, the very fact that I’ve followed the Casey Anthony case, and tried to replicate her searches? Damn! Now my hard drive is FOREVER stamped with searches that can’t be erased?

I’m not defending Casey Anthony or anyone else in the Anthony family. I’m just saying it scares the eff out of me to know that LE might find some kind of reason to seize my own hard drive! If that would ever happen, they’d find a lot of “questionable” things on my own hard drive, too.

Damn!

Off topic to this discussion, but on my own hard drive, if LE ever had a reason to seize and run forensic software on my own hard drive, they’d find me searching for “ways to commit suicide” and terms like “how much antifreeze does it take to kill someone”?

Again, not defending Casey or any of the Anthony family. My own searches are personal and for reasons related to myself and no one else.

I’m still sitting here astonished, though, that once a person searches for something, there’s apparently no way to erase it…ever.

Sorry for going off topic, but truthfully, this scares me. I do believe Casey Anthony is a criminal, and guilty of either first degree murder, or (being generous), manslaughter at the very least.

What DOES scare me is how easily LE could use my own computer searches to attempt to prove I was attempting to harm someone else.

I’m really trying to follow the blog entry and corresponding posts, but I’m getting more uneasy by the minute.

» Curly said: { Feb 9, 2010 – 11:02:27 }

This is all very interesting, however, Casey wasn’t smart enough to ditch her car where it wouldn’t be found easily (like in a lake), so I have my doubts as to whether she tried to erase any of her tracks on either of the computers. She had no clue that she’d be face to face with Cindy much less the cops. I just don’t see her doing this.

Not try to delete or mess with files in the laptop for the big reasons that most people would ie; the murder…maybe and I guess I would have to agree. But, she might have figured at this point that Cindy was mad enough to re-claim her own laptop and she may have been trying to delete compromising photos and personal stuff rather than anything pertaining to Caylee. That, I can see her doing.

Wytchy:

No. You are not understanding this right. Getting rid of any searches is not that hard and then getting rid of it in unallocated file space is also not that hard. The free tool set that I posted above will delete any thing that you want gone. You can do this with a scalpel and only remove entries that you want gone from the databases or you can do it with a saw and delete entire databases. Your choice.

If you choose to delete the entire database, you can then make certain that it is really gone from the hard drive in an unrecoverable manner by using a utility which will overwrite the entire database files with a series of ones and zeros prior to deleting the file. This will prevent all of the information from being put back together in software. There may still be a few small bits of data which are recoverable but not much (recoverable by destroying the drive in the process of recovering the data).

Even without using a file overwrite utility, you can essentially force the OS to destroy all unallocated file space by deleting all files that you want deleted and then creating a file which uses up almost all hard drive space and then delete that file. There will be nothing left to worry about outside of the use of the process which physically destroys the drive and even that process will be able to recover only small unconnected bits of data at that point.

There are utilities which will do all of the above for you behind the scenes which were written to comply with NSA data cleansing standards.

Angela,

I read Blink’s article about the Google searches some time ago and absolutely understand what she is saying about that. And I also think that Casey or the Anthony user account being up in a single day and all members of the family popping on the computer while that account is logged in is a reasonable thing to occur.

BUT, that is not what JWG is saying. He is saying that there was a user account named “Casey” and that was for George and Cindy to use, and then Casey had her own account separate from that. And while I’m not sure I have EVER challenged JWG on his information, I’m going to have to this time.

Because in Cindy’s FBI interview on July 30, 2008, she specifically states that the user account her and George use on the desktop is named “Casa de Anthony” and that they were trying to get the password for “casey’s side of the computer” so that they could retrieve pictures and stuff.

So….while Cindy may be a big phat liar, in this instance, I don’t believe she’s lying. I do not believe the “Casey” account was for George and Cindy. It’s the one Casey used. And if there was Internet activity on it by George or Cindy, it was because it happened just as Blink speculates (i.e. the user account was left active and some one sits down to do some quick Googling, etc.).

Wytchy…

The files CAN be really deleted. You just have to do it outside of Windows.

lol – or with the car. But I would advise to follow up with a big phat magnet and a fire after the driveway process if you’re going to do it that way.

Scratch:

Being able to query the various databases will not do as you are suggesting since you also need to make certain that you have killed the data in all archived databases maintained by the system.

Additionally, I believe that you are totally off of the mark on the time-line serving to help Casey in any fashion. You are saying that it is too complex for the average person to follow so the farmers on the jury will not get it. I disagree. I think that there is little doubt that the prosecution will break it all down to the point that any person on the jury will be able to see that ONLY Casey could have killed her daughter. Farmer or not….

She is TOAST and she deserves to be TOAST as far as all released information tells me thus far.

The timeline will get Casey. And it’s simple, it’s very uncomplicated.

June 16th – this is the statement we have whether you choose to believe or not.

George saw a living Caylee leave the Hopespring Drive home after noon with Casey Anthony.

No one ever saw a living Caylee again after that moment.

George has to take the stand and COMPLETELY retract that statement in order for that to not be the last time a living Caylee was seen.

If George DOES, then the entire family comes under immense fire for not being able to actually state when the last time was they saw a living Caylee.

If George retracts that statement and Cindy says the last time she saw a living Caylee was on the night of the 15th, then it still deduces to the last time a living Caylee was seen was when she was in the care of her mother Casey Anthony.

There is no Zenaida Fernandez-Gonzalez kidnapping, murdering nanny and Casey had no reason to hand the care of Caylee to anyone else (and can’t even claim she did because that would take her getting on the stand and changing her story) because she had no job to require her to relinquish care of Caylee. Therefore, between the night of June 15th and the afternoon of June 16th, Caylee was murdered while in the care of her mother, Casey Anthony.

It’s about that simple.

Okay, okay. So there is simple and there is really simple. Valhall makes things really simple and I make things somewhat simple. I admit it. Good post, Val. lol

To use a young person expression (which I have not ever really understood the allusions to) – You are da bomb, girl!

8)

Well, and I’ll add to it, the following:

It doesn’t make a rat’s ass bit of difference when she made phone calls, when she searched for Zenaida, where she was on pings, when she was at locations, when she got rid of the body, how long the body stayed in the car, whether she talked to some one or didn’t talk to some one, whether she deleted files from the desktop or the laptop, whether she was visiting missing children’s pages or not, or whether she researched chloroform EVER…

Caylee Marie Anthony died between the night of June 15th and the evening of June 16th while in the care of Casey Anthony and the only story Casey Anthony has ever given on why her daughter went missing (and was ultimately found to be murdered) was a case plus a 12-pack of lies.

There have been plenty of murderers convicted solely on what I have just stated: THERE WAS NO ONE ELSE TO COMMIT THE MURDER. When you add Casey’s behavior from June 16th to July 16th (and onward) which displays a “consciousness of guilt”…she’s toast. There is precedent that she will be toast, and she will be toast.

She is not getting out of this.

Couldn’t agree with you more, Val! (Burnt Toast)

And I would also add that I don’t particularly care if Casey sold meth on the side, gave blow jobs in the parking lot of Amscot, ran with O-Town Finest, rented her virgina out or stole duffa bags…

Caylee still died in her care, and has been ruled to have died by manner of homicide, was dumped in a swamp with duct tape over her mouth and nose, and the person who had guardianship over her when she disappeared lied to prevent law enforcement finding her.

Casey, her virgina, and O-Town’s duffa bag are toast.

I actually put that in the wrong thread, but it works just fine here as well. lol I meant to respond to Monica’s post in the miscellaneous thread.

Hahaha OMG that is some funny!! Whhheeeeew!!

Re: The timeline

Jose Baez and Linda Kenney-Baden interviewed by telephone for InSession on January 4, 2010, and they both acknowledged the timeline is a problem for the defense, not the prosecution.

Baez was asked about the 30 days in which Casey did not tell anyone about Caylee’s disappearance and how the defense will overcome it. He said there are very compelling reasons for the 30-day issues. He said this case is extremely complex, and the defense has decided it is in Casey’s best interest to wait for the trial to lay out their defense even though it is is harmful for everyone to leave that fact [of Casey's failure to say anything for a month] “lingering” out there. He said they know they need to address the 30 days, are planning to address that issue “head-on” at trial, and believe they will [be able to explain the 30 days to the jury].

Baden was asked about the importance of timeline to the prosecution and defense. She said the timeline is very important to both sides because the prosecution believes the timeline is what will get the jury on their side and the defense has to deal with the reality of the situation, that the timeline and Casey’s behavior are things that the jury is not going to like.

Baez was asked about Zanny the nanny and if investigators are looking for this woman. Baez would not answer the question directly, only saying the question “goes into trial strategy” and that it is not in Casey’s interest to present her case in the court of public opinion. He said the media had reported facts inaccurately in the past, and he did not want her defense to be inaccurately reported, which is one of the reasons the defense would not discuss her defense strategy ahead of the trial.

Per November 26 discovery, set 10, page 2799, there are two user profiles on the HP (“Owner” and “Casey”, and there is one user account on the laptop (“Bobby”. SAMinside software was used to see if the user accounts required logon passwords. Results: the “Owner” user account required a password that was set to Rico23 on May 14, and there were no logon passwords for the “Casey” or “Bobby” user accounts.
The “Casey” account password on HP laptop was changed at 8:49am to Rico23 (this was the most recent password change to that user account when OCSO computer forensics examined the hard drive).

*****

From my notes of Cindy’s FBI interview on July 30, 2008:

Cindy and George’s password to get into the computer is “Casa de Anthony.” Cindy’s personal passwords are variations on Horace (the name of a family cat) and the names of her children (Cindy said she uses Horace a lot at work). Casey has her own password that was just changed from Rico234 to Timer55.

Maura,

Thank you! See – first time to push back on JWG, and I learn my lesson. So Cindy’s statement was toward their password and not the username.

But then you confuse me because you state the Casey account had no password, but then state the password was changed to rico23, but then state Cindy had her own password, and also state they had the Casa de anthony password.

So….

yeah. Pretty confused.

Hi Val,

You challenged me? Or as they say on the food network…are you ready for a computer forensic throw-down?

From Cawn’s report:

User name: casey

Full Name: casa de anthony
Type of User: Local User
Account Description:
Primary Group Number: 513
Security Identifier: S-1-5-21-121217872-2017380362-3718819000-1007
User belongs to group: Users
Logon Script:
Profile Path: %SystemDrive%\Documents and Settings\casey
Last Logon: 07/16/08 04:19:08PM
Last Password Change: 05/14/08 08:49:19AM
Last Incorrect Password Logon:

and then ….

User name: Owner

Full Name: case
Type of User: Local User
Account Description:
Primary Group Number: 513
Security Identifier: S-1-5-21-121217872-2017380362-3718819000-1003
User belongs to group: Administrators
Logon Script:
Profile Path: %SystemDrive%\Documents and Settings\Owner
Last Logon: 07/16/08 04:57:56AM
Last Password Change: 05/14/08 08:49:19AM
Last Incorrect Password Logon: 07/16/08 02:38:19PM

So Cindy’s FBI interview supports the notion that they used the “casey” account (which showed up as “casa de anthony” on the Windows login) and Casey used the “owner” account (which showed up as “case” on the Windows login)…because that was “her side of the computer” in the technical lingo Cindy employed.

rofl

Val – awesome posts this am.

LOL JWG! a forensics smackdown!

Thank you, and thank you, Maura, for clearing this up for me. I must have been in a hypoglycemic stupor when I thought I could challenge you guys.

Hahaha I wonder if they drew a line down the middle of the computer tower with tape like me and my sister did on the carpet when we used to have to share a room.

I’ll be ready with my popcorn for the Computer Forensics Smackdown 2010!!

You guys are hilarious and smart, all of you.

Thanks!

Back to shoveling….

Valhall, I couldn’t agree with you more or laugh any harder while reading your articles and comments. There has been so much absurdity, asininity, idiocy, insanity, lunacy, nonsensicalness, nuttiness, preposterousness, simplicity, wackiness, zaniness; fallacy, irrationality, and unreasonableness throughout this whole situation. It’s nice every once in awhile to enjoy some much needed comic relief.

I also wanted to mention when this is all over and we are enjoying the up-coming chili fest, I would be happy to bring the gatorade.

My screw-up. I contradicted myself. The Casey and Bobby accounts have no logon passwords per the forensics. The HP “Owner” account does have a logon password, and it was changed on May 14 to Rico23 per the discovery and had not been changed since.

I should have proofed before posting!

Sorry for the confusion.

wsh, are you in the chicago area? if so, did you enjoy our earthquake?

Hi all! I am not sure I have posted here before, but I recognize some of the names from another site I frequent. I have enjoyed reading here.
Valhall & Maura,
You seem to know the ins and outs of this case. I am wondering what the defense is up to. We know they are trying to accuse someone else of putting Caylee’s body in the woods. Do you think they are trying to find a connection between Kronk and one of the volunteers who searched the woods and possibly one of Casey’s frineds? It just seems as though they may try to say Casey was partying with “so and so” because she knew they took her little girl and she was trying to find out who had her or who was involved. I know it is far fetched, but isn’t everything they said thus far.

Maura, I’ve seen contradictory information regarding the password change on May 14. (1) Version 1: the “owner” password on the desktop was changed to Rico234 on May 14, and “timer 55″ was some other password for some other computer account, which was changed on that date or some other date (lol); (2) Version 2: the “owner” password on the desktop was changed FROM Rico234 TO timer55 on May 14, 2008.

Can you link to some document that clears this up? If timer55 was the 8:49 am May 14 new password, that would link up very conveniently with the fact that the PR trip was planned on May 14 (confirmed by a text from Casey to Amy also at 8:49 am on May 14), for a departure date of July 8 (55 days later).

» mycatcocoa said: { Feb 10, 2010 – 12:02:30 }

wsh, are you in the chicago area? if so, did you enjoy our earthquake?

Northeast…no point in shoveling now. A blizzard is supposed to come next.

All the Anthony lies seem to be coming back to bite them in the arse. Happy days!

WSH – we’re practically neighbors. I’m in southeastern Mass. College was closed due to the storm, which we haven’t seen yet – just some slushy rain. They say it will come in tonight. Take it easy with the shoveling.

Nauseated – With keeping with the thread, I think that would be “byte them in the….”

Okay, back to making snow angels, as it sounds like WSH, Naus and me are practically neighbors! Stay safe, all, and especially all stuck in Blizzard World!

bite / byte – ha ha – good one!

It’s been a good day to catch up on all the blog postings. I could have worked a full day today but the powers that be decided (due to weather forecasts) to keep the college closed. Good for me!

AZ Lawyer said: { Feb 10, 2010 – 01:02:26 }
Maura, I’ve seen contradictory information regarding the password change on May 14. (1) Version 1: the “owner” password on the desktop was changed to Rico234 on May 14, and “timer 55″ was some other password for some other computer account, which was changed on that date or some other date (lol); (2) Version 2: the “owner” password on the desktop was changed FROM Rico234 TO timer55 on May 14, 2008.

Can you link to some document that clears this up? If timer55 was the 8:49 am May 14 new password, that would link up very conveniently with the fact that the PR trip was planned on May 14 (confirmed by a text from Casey to Amy also at 8:49 am on May 14), for a departure date of July 8 (55 days later).

*****

I wish I could clear it up, AZlawyer, because the contradictions give me a headache. As you know, the computer forensics reports released in discovey are spread out in bits and pieces. I’m fairly certain that JWG has more computer discovery than I do (or else he has a legible version of it). I download the discovery to my hard drive, so I don’t have URLs, but what I do have is available everywhere (Valhall’s, Websleuths, docstoc, etc.).

Sandra Cawn’s report, titled “Summary of findings after August 20, 2008,” was released on November 26, 2008, set 10, page 2799. She reported three user accounts (casey and owner for the HP and bobby for the laptop), and she said only the HP’s “owner” account required a logon password. The following is verbatim:

“There are two user profiles being used on the HP desktop computer; “owner” and “casey”. There is one user profile on the Compaq laptop; “Bobby”. To determine whether or not either of these user accounts requires a password to log on, the software application “SAMinside” was utilized to analyze two Registry files; SAM and System. The HP computer “casey” account and the Compaq laptop computer “bobby” account require no logon passwords. The “owner” account on the HP desktop computer has an assigned password of “rico23” that was set on May 14, 2008.”

*****

In her July 30, 2008 FBI Interview, Cindy talked about passwords, but she’s not terribly clear (see for yourself).

Page 87

Cindy: . . . And Casey gave us a password for her comp . . . for her side of the computer. We have a desktop at our house that, um, my husband and I have a login under Casa de Anthony . . . which means house of the Anthonys . . . that anybody can use. And then Casey has her own password. Well, she just to change [sic] her password from Rico, which I’m thinking stands for Ricardo, and it’s the, like three numbers, and I’m not sure what it is, 234 or 230 or 262 or whatever it is, I’m not sure.

Scott Bolin: Why do you think those three numbers?

Cindy: Because I knew there was a 2 and a 3 in there. My husband knows what that is and so does Lee. They can tell you exactly what that is. That could be . . . Ricardo’s address. Her new, her new password is Timer55. We have no clue what Timer55 is. But she told Lee the other day, Timer55 means she has 55 days that she’s being taught that lesson that I told you. Remember I said that person . . . put her down on the ground and said, “I’m gonna teach you a lesson.”

Page 89:

Cindy: . . . And that Timer55, I’m not sure what date that was changed. I don’t know if it was changed. It’ll be interesting to find out from the sheriff’s department because they had our computer, when that password was changed to Timer55. If it was changed that day that . . . ‘cause Casey did have a little bit of access to the computer without me being there. I mean she logged on. I don’t know if she had opportunity to change her password on her side ‘cause she was doing the MySpace thing on her side of the computer. So, I happened yesterday to do a real quick search.

[Scott Bolin took a bathroom break, so we don’t know what she was going to say.]

Pages 207-208

Cindy: I’m not sure when she made Timer55.

Bolin: Okay.

Cindy: She may have made that right when she first . . . Caylee was first missing. Or she may have made that, um, the 16th, the morning of the 16th, when she actually came back in the computer. When she actually had been in and out of the house during this period . . .

Bolin: If they have your computer . . . they’ll be able to tell when that changed.

Cindy: Right, exactly. . . . And that’s something I did not know about – Timer55, and just till a couple of days ago. Lee found that out and Lee says he’s been sharing stuff with the detectives.

*****

JWG provided the following upthread, and I do not know the discovery page number or when it was released. I do notice for the “casey” account: “Last Password Change: 05/14/08 08:49:19AM.” I don’t know how to explain the password change given that the SAMinside software analysis reported no required logon password for that user account.

From Cawn’s report:

User name: casey

Full Name: casa de anthony
Type of User: Local User
Account Description:
Primary Group Number: 513
Security Identifier: S-1-5-21-121217872-2017380362-3718819000-1007
User belongs to group: Users
Logon Script:
Profile Path: %SystemDrive%\Documents and Settings\casey
Last Logon: 07/16/08 04:19:08PM
Last Password Change: 05/14/08 08:49:19AM
Last Incorrect Password Logon:

and then ….

User name: Owner

Full Name: case
Type of User: Local User
Account Description:
Primary Group Number: 513
Security Identifier: S-1-5-21-121217872-2017380362-3718819000-1003
User belongs to group: Administrators
Logon Script:
Profile Path: %SystemDrive%\Documents and Settings\Owner
Last Logon: 07/16/08 04:57:56AM
Last Password Change: 05/14/08 08:49:19AM
Last Incorrect Password Logon: 07/16/08 02:38:19PM

Just a thought…. when you have internet access…..doesnt it keep track of all sites you visited through the server. I know I can go on my laptop and go through my router to see what sites have been accessed. and through that connection they can tell what the name of the computer had accessed that site. I dont know how long internet companies store data, but just a thought. Also, I bet tony didnt have internet and she picked up an unsecure connection…. thinking out loud.

Val,

Maybe we will never know if KC actually sat down and did a Zenaida search at 11:15 pm on jun 12, 08. It wud be nice to see the exact history of that entire date…

I have always felt that June 12, 2008 is one of the most important dates for 2 specific reasons.

#1. The search in itself, looking to create the character, or better yet look to see if there were any messages from ZFG who went to the sawgrass (she possibly got many hits where she somehow saw some messages that mentioned a possible upcoming viewing at the sawgrass

#2. On account of what KC texted to Tony L. on the morning of Jun 12, 2008 it indicative that her plan for murdering Caylee was in full swing by her introducing ZFG and company along with her work buddies and boss..to Tony. She has already given up info on these ficticious ppl, to some of her other friends.

It is clear in the IM’s, that KC brought these ficticious names up, out of the blue, even where TL had changed the subject, and made sure she gave as much information to Tony L:, as she could so help him be able to corroborate….

Here are the texts the morning of Jun 12, 2008

Thursday, June 12, 2008L7Tone (8:51:08 AM):
yo
casey o marie (8:51:32 AM):
yo

casey o marie (8:51:47 AM):
so yeah, one of my coworkers walked in my office, just as we got off the phone, andkeeps making fun of
me

L7Tone (8:51:58 AM):
why

casey o marie (8:52:13 AM):
because she said that, “i’m in love”

L7Tone (8:52:18 AM):
you are

casey o marie (8:52:22 AM):
exactly

casey o marie (8:52:24 AM):

casey o marie (8:53:12 AM):
jules is a funny girl. she’s one of my friends that i’ve hung out with, at my nanny’splace.

casey o marie (8:53:18 AM):
it’s her daughter that plays with caylee all the time

L7Tone (8:53:25 AM):

oh yeah
L7Tone (8:53:34 AM):
cool

casey o marie (8:54:15 AM):
she’s going to try to come out tomorrow night, with my nanny, and her roommates, ifshe’s not stuck
working

L7Tone (8:55:07 AM):
hmm ight nice

casey o marie (8:55:27 AM):
don’t worry. i’m trying to get every girl i know to come out

casey o marie (8:55:33 AM):
that’s not many, but i’m trying

casey o marie (8:55:33 AM):
haha
L7Tone (8:55:52 AM):
good then you can hook me up with the hottest one
20 / 27

casey o marie (8:56:01 AM):
yeah, you’re right, i can

casey o marie (8:56:09 AM):
well, actually, you’ve already bagged the hottest one.

L7Tone (8:56:16 AM):
which is you

L7Tone (8:56:18 AM):
yep
‘
casey o marie (8:56:47 AM):
casey o marie (8:56:53 AM):
exactly.
L7Tone (8:57:18 AM):
you need to come over and get your cds

L7Tone (8:57:23 AM):
when you get off work

L7Tone (8:57:30 AM):
??

casey o marie (8:57:31 AM):
oh baby, i will.

casey o marie (8:57:40 AM):
as soon as i get off work, i’m heading over

L7Tone (8:57:49 AM):
when do you?

casey o marie (8:57:50 AM):
i’ll try and see if i can’t just leave cays with my nanny for a little bit

casey o marie (8:58:02 AM):
i’m done at 1-1:30.

casey o marie (8:58:05 AM):
we have a meeting at 12.

L7Tone (8:58:07 AM):
really

casey o marie (8:58:08 AM):
afterwards, i’m out

casey o marie (8:58:10 AM):
yep

casey o marie (8:58:12 AM):
short day

Page 8 of
9file:///Users/ngriffin/Desktop/Computer%20Forensic%20Report/Evidence…Fragments%20of%20conver
sations%20in%20allocated%20space/l7tone.html

L7Tone (8:58:16 AM):
sweet

casey o marie (8:59:11 AM):
that’s why my boss didn’t care. his exact words to me were ‘were you seriously
cominginto work at 6am,
after 2 weeks of vacation? are you still fucking stoned?’

casey o marie (8:59:15 AM):
he’s hilarious

L7Tone (8:59:26 AM):
haha
L7Tone (8:59:30 AM):
21 / 27
nice

casey o marie (8:59:48 AM):
tom is a pretty cool guy. shit, we’ve worked together off and on for almost 4 full years

L7Tone (9:00:04 AM):
so why dont you marry him

casey o marie (9:00:19 AM):
oh fuck you

casey o marie (9:00:27 AM):
because i’m in love with this boy…

casey o marie (9:00:31 AM):
like CRAZY in love

L7Tone (9:00:36 AM):
which boy

casey o marie (9:01:03 AM):
well, not so much a boy. not even close

casey o marie (9:01:05 AM):
i love my man

casey o marie (9:01:22 AM):
maybe you can meet him tomorrow night. he’s coming with my to fusion.

casey o marie (9:01:29 AM):
actually, i’m coming with him

L7Tone (9:02:03 AM):
fusian and i thought that you were meeting me up there

casey o marie (9:02:16 AM):
baby, you know i’m kidding!

casey o marie (9:02:20 AM):
i’ve been talking about you, crazy

casey o marie (9:02:28 AM):
what time are you heading up there tomorrow night?

L7Tone (9:02:30 AM):
i know

L7Tone (9:02:33 AM):
idk yet

L7Tone (9:02:57 AM):
not as early as i been but early to help anon and beatie out

L7Tone (9:03:21 AM):
and make sure every1 gets there early

casey o marie (9:03:38 AM):
well, let me know. amy and i are going to be home from jville early.

L7Tone (9:04:06 AM):
wait when you goin to Jville

casey o marie (9:04:31 AM):
tomorrow morning, i guess, to get amy’s car. we’re heading out at the crack of dawn,and will be home
well before 5

L7Tone (9:04:48 AM):
thanx for tellin me

casey o marie (9:04:58 AM):
i had mentioned that to you the other day

L7Tone (9:05:01 AM):
you lil sneaking bitch

casey o marie (9:05:06 AM):
you really have no short-term memory babe!
22 / 27

casey o marie (9:05:16 AM):
don’t call me a sneaking bitch

casey o marie (9:05:17 AM):
asshole

L7Tone (9:05:27 AM):
dont tell me what i have and dont have

casey o marie (9:05:32 AM):
you have me

L7Tone (9:05:48 AM):
i know what i have

casey o marie (9:05:55 AM):
good!

L7Tone (9:06:04 AM):
and thats a lil sneakin bitch for a girlfriend

casey o marie (9:06:15 AM):
hey now

casey o marie (9:06:34 AM):
i’m not sneaking. i had already told you about taking amy up to jacksonville for a fewhours, to get her car

casey o marie (9:06:45 AM):
i remember laying on top of you, on your floor, post fucking, and telling you that

L7Tone (9:06:46 AM):
ok

Page 9 of
9file:///Users/ngriffin/Desktop/Computer%20Forensic%20Report/Evidence…Fragments%20of%20conver
sations%20in%20allocated%20space/l7tone.html

L7Tone (9:06:58 AM):
stop being such a baby im only joking

casey o marie (9:07:06 AM):
yeah, you better be

casey o marie (9:07:10 AM):

L7Tone (9:07:11 AM):
oh really

L7Tone (9:07:15 AM):
fuck off

casey o marie (9:07:20 AM):
i already want to fuck ya
casey o marie (9:07:33 AM):
you can’t throw make-up sex at me again.
L7Tone (9:07:43 AM):
nope
casey o marie (9:07:55 AM):
it’s going to be a LONG few hours
L7Tone (9:08:33 AM):
i love you baby
casey o marie (9:08:47 AM):
i love you too!!!
L7Tone (9:09:15 AM):
ok class time bella mia
L7Tone (9:09:28 AM):
i will call you in a lil bit
23 / 27

On account of these texts, it seems clear that KC intentionally injected the players even after TL changed the subject more than once… After mentioning her “boss” to TL..it wasnt good enough and then she had to say his name Tom… and how they have worked on and off for 4 yrs… She even had to bring her “workplace” up after TL tried to switch the topic twice…

Here is where TL didnt catch her in a big lie…. KC tells TL that she is in her office and her coworker walks in….. SHe tells TL that she will see if she can drop Cays off at the nanny’s when she is finished work… Was TL supposed to believe that Caylee was in her office ??????

Also, we have not had the benefit of listening to any major questioning/answering of ZFG so we dont know what information she may have had on the internet or under what name. We also do not get to see what hits KC received when she enters the name in her search engine.. I do suspect she was following ZFG and possible other Zenaida’s in her premediatated plan. I am also of the belief that KC was going to kill her parents. The way she was talking to her friends about how her parents were not getting along and divorcing etc… I think she was going to kill them too, and somehow incorporate the nanny…One thing is for sure.. KC was leaving a breadcrumb trial for months, but Jun 12, 08 seemed to be very significant, especially where the texts 2 day before suggest the house will be hers that Saturday (Jun 14, 08) and that her parents were moving.

Maura stated:

Pages 207-208

Cindy: I’m not sure when she made Timer55.

Bolin: Okay.

Cindy: She may have made that right when she first . . . Caylee was first missing. Or she may have made that, um, the 16th, the morning of the 16th, when she actually came back in the computer. When she actually had been in and out of the house during this period . . .

Bolin: If they have your computer . . . they’ll be able to tell when that changed.

Cindy: Right, exactly. . . . And that’s something I did not know about – Timer55, and just till a couple of days ago. Lee found that out and Lee says he’s been sharing stuff with the detectives.

I’ve been working on a Timer55 article here recently and when Cindy made this series of statements it clinched it for me that Cindy was the full on, no holds barred, master-mind of the whole JBP/Timer55 fantasy.

Without a doubt, as far as I’m concerned – straight from the mind of Cindy.

My request to the Microsoft contact has been passed on to those who can answer many questions.

I hope to be able to share something soon with you all.

Valhall, I agree with you and all the other posters that Cindy was the source of the Jay Blanchard Park story. For one thing, I don’t think Casey was intelligent enough to switch stories midstream and throw in all that detail. Cindy, on the other hand, had had time to ‘brainstorm’ with George and Lee about ‘possible scenarios’ as to what had actually happened to Caylee. There it is, and they have all admitted it in their interviews, and for the life of me, I cannot understand why none of them have been charged with – at a minimum – interfering with an investigation, but perhaps that is coming and will hopefully happen in our lifetime.

“Don’t worry I didn’t say anything.” About changing the password???

Cindy: Because I knew there was a 2 and a 3 in there. My husband knows what that is and so does Lee. They can tell you exactly what that is. That could be . . . Ricardo’s address. Her new, her new password is Timer55. We have no clue what Timer55 is. But she told Lee the other day, Timer55 means she has 55 days that she’s being taught that lesson that I told you. Remember I said that person . . . put her down on the ground and said, “I’m gonna teach you a lesson.”

Hmmm. We have no clue what Timer55 is, but we all know it means 55 days that’s she’s being taught that lesson because Casey told that to Lee. There’s so much BS in Cindy’s statements. Val, I am looking forward to your article regarding all of this.

winterbelle:
Casey: ” I sat around yesterday trying to figure out what to do..”.( yesterday– being july 15th–she says after receiving the call from caylee –”she was trying to figure out what to do…

danny colamarino ( the tattoo artist) tells us what she DID do:

http://www.youtube.com/watch?v=8xltYcwks7U

..his interview was on july 17 2008, just 2 days later.

..he says she was there at the tattoo shop—–making an appt. tp get another tattoo on the following saturday.

..@ approx. 1:13 of the video.

awaiting justice:
casey o marie (8:57:50 AM):
i’ll try and see if i can’t just leave cays with my nanny for a little bit.

…good catch, if kc was AT the office , as she claimed to be, she would have said that she’d see if she could leave “cays” w/ nanny a little bit LONGER…

..for someone who thinks she’s so clever by clamming up now (or since jose told her to) —-way too late—-it’s what she said/texted way back when that will do her in.)

..and yes, she sure was trying to throw in a ton of ‘work info’ in those texts, whether tony wanted to hear it or not.
..given the “gift of gab” ( she inherited from her mother) , must be pretty silent in jail all day…..(boo hoo.)

Valhall said, ”
I’ve been working on a Timer55 article here recently and when Cindy made this series of statements it clinched it for me that Cindy was the full on, no holds barred, master-mind of the whole JBP/Timer55 fantasy.

Without a doubt, as far as I’m concerned – straight from the mind of Cindy.”

…And, without a doubt, I’m going to have to say your are 100% correct. Seeing as how the forensics won’t back up the day when this password was “changed” and seeing as how you are quoting how Cindy incorporates it into the “JBP Fictional Series, Vol. 234,” I no longer have any doubt either. But, I can hardly wait until you take us step by step through it all as only you can do.
I’ll do my part and force myself to go back and watch those FBI interviews again, promise. I’ll be more prepared for class!

Awaiting justice, yes, very good catch. Casey, if questioned, might have said something like,

~~~told you my boss was cool, remember I said short day? he’s cool with cays being here long as I don’t make it a habit, like you, my best habit~~~

As it went, I bet she never even noticed her own mistake.

I found a link to Jesus Ortiz’s Myspace page at Blink. When I viewed all of his friends, one was “Caylee is Missing” last logged in on October 12, 2008. I wonder who posted that and doesn’t that date have real significance?

Mimi said: { Feb 11, 2010 – 07:02:06 }
Awaiting justice, yes, very good catch. Casey, if questioned, might have said something like,

~~~told you my boss was cool, remember I said short day? he’s cool with cays being here long as I don’t make it a habit, like you, my best habit~~~

As it went, I bet she never even noticed her own mistake.

————

On account that this text conversation was done the morning of Jun 12, 2008…it seems to make sense that the “Zenaida” search showing up in the computer forensics on Jun 12, 2008 11:16pm was likely done at that very time… I have been looking for the activity of KC’s cell the night of jun 12 and have a feeling that she may have been busy getting her plan into action…

As we know, she had said her parents were moving to both Amy and Tony L. and KC wud have the house for good all to herself, in 3 days (which wud bring us to Sat Jun 14) and we already saw her create a alibi with Tony (for going to Jcksnvl with Amy) and we saw her create an alibi with Amy (father had a stroke) ….. she was going to have the whole house to herself starting saturday… I really believe she was going to kill the Ants, but something happened where her plan cudnt come into action….

I doubt it was “good judgment” !

I have wondered if KC was actually gonna use the the incident date as being Fri 13….reason is … she set the stage with both Amy and TL, that on Fri, she was clearly gonna be using the nanny…
Amy wud have known that the Ants wud be unavailable , due to GA’s stroke, and Tony L wud have thought that Caylee wud have to be at the nannys while KC is in jacksonville….
She created a very silly alibi to her immediate group, to show how Caylee was gonna be with the Nanny so if she actually killed the Ants, they cudnt say anything different….they’d be toast..
I think she was gonna say that the nanny and company did the family in, too….

I cant see how the Ants dont realize this or at least consider this… They must know their heads were on the chopping block too…I guess they dont take it personally….lol
They are the ones with the info as to what exactly happened in those few days…Jun 12 on…. I dont believe for one second that they dont know exactly what happened, and where…and how

I too think it was CA and LEE who created timer55 and the JBP scenario… You can see how CA brings the story to life everytime she relays it (LE and her Depo)… when she talks about them pushing KC down…lol her tone and the way she says the story, comes across as it is a believeable situation that one cud encounter..

I suspect Lee and KC talked enough in the garage to give Lee the heads up that he needs to muddy things every chance he gets including the computer at TL’s….It is also possibe that KC knew her game was over when CA arrived at TL’s and she knew she had to erase everything… I think KC knew a little bit about computers and she may have asked Lee questions early on as she was putting her plan into motion…

Valhall, I agree with you that the fact that George testified that he last saw Caylee alive with Casey and Casey lied to police about a nanny who doesn’t exist kidnapping her, Casey Anthony will be convicted of Caylee’s murder.

Since the defense unsuccessfully attempted to get the death penalty, first degree murder and aggravated child abuse charges dropped, I believe they are conceding that the state does have enough evidence to convict Casey of aggravated manslaughter of a child and four counts of lying to police.

Casey could get up to 30 years imprisonment, orlife in prison if found guilty of aggravated manslaughter of a child. But if she pleads guilty to that charge she could get a lighter sentence with a plea deal. That way she wouldn’t have to admit to murdering Caylee, just not reporting her missing and not assisting police in finding her before she was murdered.

Since the prosecutors believe Casey murdered Caylee by putting duct tape over her nose and mouth, I doubt if they would agree to a plea where Casey wouldn’t admit that she actually was the one who murdered Caylee. So even if Casey decides to plead guilty to aggravated manslaughter and four counts of lying to police for a lighter sentence, I doubt if the prosecutor would agree, since they wouldn’t agree to less than five years on the fraud charges.

I believe the prosecutors will take this to trial if she does not plead guilty to first degree murder, aggravated child abuse and four counts of lying to police in exchange for a life sentence without the possibility of parole.

The whole “Timer55″ password changing is VERY stupid on Casey’s part. She claims she changed it to that because she was going to be taught a lesson for 55 days, but she changed her password to that on May 14th…. a whole month before Caylee even went missing!! So this is either her premeditating the disappearance of Caylee, or there is a whole different meaning behind this password. If it was something as simple as ‘she looked around her house at a timer or something to come up with a quick password’ I think when asked what “Timer55″ meant, she would have simply said “I needed a new password, saw the timer in the kitchen and just used that”… Why would she involve this password into the disappearance of Caylee if she changed it long before Caylee went missing. I feel there is a lot more to this whole “Timer55″ thing!

I’m very confused val, you say I need “extraordinary” measures to delete index.dat,.. I used right click delete… worked fine… and yes I’m using the correct index.dat
C:\Documents and Settings\Administrator1\Local Settings\Temporary Internet Files\Content.IE5

my husband is a “computer person” and he just told me when i asked him your question everything about IE will change, including that file

correction, I’m logged in as administrator, not administrator1, that’s why it worked… how extraordinary

» Ada said: { Feb 11, 2010 – 10:02:06 }
I found a link to Jesus Ortiz’s Myspace page at Blink. When I viewed all of his friends, one was “Caylee is Missing” last logged in on October 12, 2008. I wonder who posted that and doesn’t that date have real significance?

Wasn’t Jesus Ortiz one of the possible father’s of Caylee who has been deceased for sometime now? And “Caylee is missing” i thought was what casey changed her myspace name to after july 16 ( it would also change the name for all of her previous post’s as well) but…was it a comment? what did it say?

trying to catch up on everybody’s great posts i’ve just dug out from 2ft of snow..AGAIN! 8O

Mrs. C. Hop

Caylee is Missing was listed as a friend of Jesus Ortiz. I am so computer illiterate that I don’t know how to access messages or anything else. I do not have a Myspace account so I don’t know if that limits access.

» Mrs C Hop said: { Feb 11, 2010 – 02:02:23 }
» Ada said: { Feb 11, 2010 – 10:02:06 }
I found a link to Jesus Ortiz’s Myspace page at Blink. When I viewed all of his friends, one was “Caylee is Missing” last logged in on October 12, 2008. I wonder who posted that and doesn’t that date have real significance?

Wasn’t Jesus Ortiz one of the possible father’s of Caylee who has been deceased for sometime now? And “Caylee is missing” i thought was what casey changed her myspace name to after july 16 ( it would also change the name for all of her previous post’s as well) but…was it a comment? what did it say?

GREAT OBSERVATION!!!!!!!!!

The friend “Caylee is Missing” is 100% Casey Anthony’s myspace account. She changed it to that right after everyone found out about Caylee’s disappearance and hasn’t been on since she was last out of jail.

I think it is wonderful that you found out she is his friend, because he has not been logged on since 2007 die to his passing, this just goes to show that maybe in fact this could be Caylee’s father, considering Casey was his friend long before Caylee went “missing”.

I have seen his profile before and never actually checked to see if she was his friend, I cannot believe I missed that!

If this is Caylee’s father I’m sure he did not know about it, and who’s to say Casey just didn’t make up the fact that it is his child, they could just be friend’s from a while back, but either way, great job with this!!!!

If true that Cindy came up with the J B Park story, how did she relay the newest version of that story to Casey? She told the FBI that story on July 30th and said that “Lee just found this out, and I am sure it will come out soon.” It is in part four of her FBI interview.

Or was Jose really passing letters back and forth between family members and Cindy/Casey were trying to create the story together? I just don’t see how Lee would get this information from Casey, as we have all seen all the jail visits and heard all the phone calls. Somebody needs to fess up to being a “storyteller!”

Mrs. C Hop –

Also, I just noticed he went to Colonial High School as well as Casey, she could just know him from there, maybe she pretended this was Caylee’s father because he passed away and couldn’t be questioned. I really do want to know who the real father is, I do not believe it was Jesus just because he is Latino, and I don’t believe Caylee was Latino at all, I think through all of the DNA and everything they would have come across this if she was.

I wish everybody that slept with Casey in that time frame would come forward and demand DNA tests because if this was my child, I would want to be a part of knowing what happened to her and getting her justice!

» QuestionMark said: | Edit { Feb 11, 2010 – 01:02:50 }

correction, I’m logged in as administrator, not administrator1, that’s why it worked… how extraordinary

Cute – now try something really extra-ordinary. Get out of your comfy little windows environment, go into DOS, and tell me when you find the index.dat file. Because you didn’t delete it. You only deleted the file showing up in the visual list in Windows. You can’t delete index.dat through Windows.

Colie – Def Agree

it’s kinda weird Jesus still has a myspace..or is it like a memorial thing? I cant see it…is it public or private? I’m wondering if there’s anyway we could see all the old comments to see if casey ever commented on there and what did she say? I don’t know if he is the father or not but i do not think you would be able to tell just from her DNA, especially if he was white hispanic..

LOL Val

get um girl …most people don’t even know DOS exists

I tried with .cmd and it was not found, but I’ll try a duel booting 7 later should produce the same result as using real dos.

QM,

I see what you are saying now. You are stating you created a second administrator account, logged into it, and then deleted the index.dat file of another account. I think that will work for some of the index.dat files (but not all of them).

When I first read your postings I thought you were saying you deleted it from your account.

Some of the index.dat files this won’t work for, but it SHOULD work for the ones associated with IE.

Yes, creating an administrator account to go in and manually delete index.dat files for a separate account you are trying to hide activity on would be an extra-ordinary measure.

Also, I’m sorry that I came off sarcastic the first time I posted, it was not my intent.

Sweet I don’t need to duel boot! TY

No problem. And sorry I took it that way. But I misread what you were stating as well.

“Yes, creating an administrator account to go in and manually delete index.dat files for a separate account you are trying to hide activity on would be an extra-ordinary measure.”
Yes but it doesn’t step out of the bounds of reason for someone like Casey, if we believe she had access to Cindy/George’s Account, while they did not have access to Casey’s account.

QM,

I think the greater point here is that IF this occurred because of an intentional act, it was done June 12th – 6 days before Caylee’s murder.

The point is still, some type of extraordinary measure (i.e. above and beyond the normal computer user’s activities) appear to have been taken on June 12th to wipe out the index.dat file and start a new one.

It’s possible. I’m currently studying computer science, and I understand what happens when you delete something (it’s still there), and even if you try and fry by fragmenting (it’s still there). If I had that problem I would use a data scrubber, however I’m approaching it from a computer science perspective. However, I was until this post completely unaware of Index.dat, it’s not common knowledge outside windows people. Now lets say I was NOT aware of how to cover my tracks but was interested in deleting my search history. It’s very possible in the google age that I could find that info and know absolutely nothing about computers. Then using maybe an hour of my time tinkering, I might be able to delete it but have it still exist. The fact that index.dat is deleted but still accessible fits that theory.

To rephrase, I mean that the person who wiped index.dat was had slightly above average knowledge of windows o/s, but very little knowledge of how a computer stores data.

» Lexi said: { Feb 11, 2010 – 03:02:38 }
If true that Cindy came up with the J B Park story, how did she relay the newest version of that story to Casey? She told the FBI that story on July 30th and said that “Lee just found this out, and I am sure it will come out soon.” It is in part four of her FBI interview.
—————————————-

Lexi:
Read the thread “The Jay Blanchard Park Scenario-Revisited.” ( top right).
..it has TONS of info..

Wonder if the Anthonys have life insurance? Sorry if this has already been addressed, but I’m wondering if Casey wasn’t planning to get rid of them, as some of you have indicated, and then collect the life insurance money and start her ‘beautiful life’?

Does anyone know something about this? It was on Blink.
Mr. Nejames is going to MOP THE FLOOR with Baez, and expect a good SMACKDOWN from Judge Strickland. Here’s the very latest from my excellent source in FLA:
1. Dom Casey has indeed turned on the Anthonys because he was facing a heap of trouble himself! He is in protective custody and has begun spilling ALL the beans to SAO. He knew poor Caylee was dead and was told where to find her remains by Cindy (pillowtalk??!). Cindy has been the ringleader for a small band of deluded jerks who are on a campaign to spread reasonable doubt. There is a lot of illegal stuff going on with the ‘Team Caylee/Yuku’ group and they are going down. Cindy and George (who is very P.O.ed at his wife, btw) are desperate to negotiate a plea deal for themselves because there is probable cause for Obstruction of Justice charges!!
2. Dom Casey also knows all about the (ahem) “inappropriate relationship” between Baez and Casey (yuk!) and SURPRISE there is SOMETHING on the jail tapes!!! Baez is going to removed as defense counsel and censured for unethical conduct.
All in all, it’s been a very interesting few days and look for the Baez and Anthony house of cards to come crashing down soon.

Awaiting Justice, Here in Northwest Arkansas and others who have stated same theory: When I read the texts between Casey and Amy with Casey promising that soon it would only be the 2 of them living in the family home, it was my first thought, too; that Casey intended to somehow eliminate Cindy and George from the picture altogether.
There have been true crime cases where this sort of thing has happened before so it was familiar to me…young people telling their friends that the family home would soon be theirs alone and then actually killing their parents (sometimes with the help of the friends.) Obviously, Amy was not privy to the whole plan if it was in fact, the plan. I have also wondered if George and Cindy have not had these same thoughts. Amy discussed and questioned Cindy about Casey and Amy moving in together to the family home with Cindy in the car on the way to Tony’s when Cindy wanted to confront Casey on July 15th. Cindy has had plenty of time to slow her thinking process down and think about this by now. I have no idea if or how Casey planned to execute a plan like this but I wouldn’t put it past her, in view of what she is now charged with. It would be very interesting to see if any of the changes made on the computer would support this theory. (Searches that we don’t know about…yet?)

Anything is possible, Mimi.
And while one would not normally even think such a thing about a ‘regular’ or ‘normal’ person, as we see more and more information about this family and its ‘quirks’ (trying to be nice) it makes the impossible, whatever that could ever be, seem quite possible. I hope Cindy has had a great deal of time, and used it, to reflect. And I hope she has come to the understanding that her ‘perfect’ little family was anything but.

» Mimi said: { Feb 11, 2010 – 08:02:48 }
Awaiting Justice, Here in Northwest Arkansas and others who have stated same theory: When I read the texts between Casey and Amy with Casey promising that soon it would only be the 2 of them living in the family home, it was my first thought, too; that Casey intended to somehow eliminate Cindy and George from the picture altogether.
There have been true crime cases where this sort of thing has happened before so it was familiar to me…young people telling their friends that the family home would soon be theirs alone and then actually killing their parents (sometimes with the help of the friends.) Obviously, Amy was not privy to the whole plan if it was in fact, the plan. I have also wondered if George and Cindy have not had these same thoughts. Amy discussed and questioned Cindy about Casey and Amy moving in together to the family home with Cindy in the car on the way to Tony’s when Cindy wanted to confront Casey on July 15th. Cindy has had plenty of time to slow her thinking process down and think about this by now. I have no idea if or how Casey planned to execute a plan like this but I wouldn’t put it past her, in view of what she is now charged with. It would be very interesting to see if any of the changes made on the computer would support this theory. (Searches that we don’t know about…yet?)

—————

You are absolutley right Mimi!

It wud normally be unimagineable but others have plotted it (some successfully..Mendez brothers) …

I suspect CA and GA have come to the same conclusion…It seems pretty obvious that CA and GA and LE have prolly read every page of discovery 100 times… They wud have seen the text messages and they know KC best … I wonder what that realization must have felt like?? I guess it really doesnt matter what KC did, the Ants do not want to admit their angel did anything, even though all the Ants know the truth….

i see what you’re saying—-but i wouldn’t consider the menendez brothers a success story. they only achieved 1/2 their goal–parents dead.

i can see kc fantasizing about life without george and cindy——-i can’t see her physically pulling it off.

then again, kc doesn’t think beyond 10 minutes into the future—-the fantasy was enough for her to spin it to her “friends”.

» ellejay said: { Feb 12, 2010 – 12:02:53 }
i see what you’re saying—-but i wouldn’t consider the menendez brothers a success story. they only achieved 1/2 their goal–parents dead.

—————-

lol Ellejay,

My choice word “success” was clearly a bad choice …lol

I used that word to show that some went through with their plan and actually did the killing, where as others have done the plotting but for whatever reason, didnt go theu with it… and IMO, one is no worse than the other…

I actually think something happened where KC cudnt pull it off….I do wonder if she was maybe going to chloroform them, in their sleep?? Whatever the case, thankfully for KC she didnt kill them, otherwise she wud have noone to lie for her….

Maybe …casey started testing out her plan by starting to get physical with cindy and thats when she got choked…but who knows…we’ll never really know..

Maybe this has already been brought up here (lots of comments), but did they have a registry/Windows cleaning program on their computer? I have had Window Washer on my computer for awhile because it frees up space and increases performance time. it does automatic or manual cleanses, and can erase the index.dat. There are many other programs out there that clean the registry and delete index.dat. It doesn’t have to be a complicated manual deletion of files to delete and overwrite the index.dat or other registry files. It can be quite easy.