I’ve been asked a few times about the “zenaida” searches on the Anthony desktop, and suffered through some misunderstandings concerning this myself, so I thought I’d bring this to an article, do some explaining, and then solicit assistance from some of our more computer savvy readers concerning some questions that remain about these particular points in the computer forensics released to date.
In particular we are looking at the following searches containing the name “zenaida”:
search term: zenaida
Name: history.dat
Description: File, Archive
File Created: 10/22/07 01:13:21PM
Last Accessed: 07/16/08 12:03:24PM
Last Written: 07/16/08 12:03:24PM
Full Path: 08-069208\S013J10X237614\D\Documents and Settings\casey\Application
Data\Mozilla\Firefox\Profiles\mfhaxjkl.default\history.dat
http://friends.myspace.com/index.cfm?fuseaction=user.viewfriends\ =203461948897ec12-9984-4944-b65e-
6dcef3d5a590=zenaidaName: index.dat
Description: File, Archive
File Created: 06/12/08 11:15:29PM
Last Accessed: 06/12/08 11:15:29PM
Last Written: 07/16/08 04:20:12PM
Full Path: 08-069208\S013J10X237614\D\Documents and Settings\casey\Local Settings\Temporary Internet
Files\Content.IE5\index.dathttp://clk.atdmt.com/RUC/go/whtpgreu0210000164ruc/direct;at.rucreu00001670;ct.1/01?dispatch=show SearchRegistration&action=peopleSearch_wp_resultcount&city=&mname=&peopleSearchFrom=wp&affiliate id=131&searchFirstName=zenaida&searchLastName=Gonzalez&searchAge=25
Name: index.dat
Description: File, Archive
File Created: 06/12/08 11:15:29PM
Last Accessed: 06/12/08 11:15:29PM
Last Written: 07/16/08 04:20:12PM
Full Path: 08-069208\S013J10X237614\D\Documents and Settings\casey\Local Settings\Temporary Internet
Files\Content.IE5\index.dathttp://preview.ussearch.com/preview/ala/newsearch?&searchLName=Fernandez&searchState=FL&searchCi ty=jacksonville&searchFName=Zenaida&adID=303014F936&adsource=8&TID=0&cid=people&searchtab=people •ð-•newsearch[2]
Now, first to clear up some confusion. The above findings do NOT state that the term “zenaida” was searched on October 22, 2007 or June 12, 2008. They don’t state they WEREN’T searched on those dates either! The confusion, and the inability to state when zenaida was first searched is that the searches themselves did not create a “file” that is listed above. When you go to a website you create an entry in an existing file either in Firefox or Internet Explorer, depending on what browser you are using. So we are not looking at “search files”, we are looking at “history.dat” and “index.dat” files that had a “zenaida”-containing URL logged to them. So when you see the “creation” date above, you are seeing the creation date of the history.dat file and the index.dat file.
Let’s look at “history.dat”. That’s the Firefox file that logs your internet history. This shows that the history.dat file was created 10/22/07, and the last time it was written to was on 07/16/08 (the morning Cindy and Casey were supposed to be doing whatever the heck they were doing on myspace, etc.).
The “index.dat” file is just a big dumping ground of a database on just about everything you do on line and it’s used by Internet Explorer. There are also more than one index.dat files that IE uses, three to be exact – one for cookies, one for history, and one for cache. So for the index.dat listings, the index.dat file was created June 12, 2008 and it, too, was last written to on 07/16/08.
BUT HERE IS WHAT I CAN’T ANSWER…the index.dat files are locked files that CANNOT BE DELETED if Windows is running. In order to delete these files you either have to go into DOS without Windows running and hunt them down in multiple locations and manually delete them, or you have to use a cleaner software that basically does the same thing.
So why is the index.dat file creation date 06/12/08? I can’t answer this. For a family who has a history.dat file associated with their Firefox that dates back to December 2007, why would some one go to the trouble to purge the index.dat file from the computer – apparently on or just before 06/12/08?
To be clear, when you clear your history, temporary internet files, etc. from Firefox or IE, YOU DO NOT DELETE THE INDEX OR HISTORY.DAT FILES…you don’t even adjust their size. And if you go into either browser and adjust the days you want the computer to keep your browsing history – YOU DO NOT AFFECT THE SIZE OF THESE FILES. Short of the steps above, nothing you do in Windows can make either of these files go away.
I’m by no means a computer guru, so maybe there is something I’m not understanding. But according to my limited knowledge on this subject the index.dat file should be as old as the FIRST VERSION of IE on the computer. Because, according to MY understanding (and I may be wrong!), even upgrading IE DOES NOT DELETE THE ORIGINAL INDEX.DAT FILE.
I can’t answer this. Maybe some one else can.
Valhall.
Related posts:
- An Update on the zenaida myspace.
- The Google Searches
- A hack on the zenaida Myspace – UPDATE!
- The Google Searches and Cindy’s Judas Moment
- Zenaida? Benhaida? George the Gigolo?
Click here to join the discussion
