Tuesday, July 19, 2011

Casey Anthony - More on the chloroform evidence

I was reading the comments by readers of the story that appeared in the NY Times on July 18, 2011 regarding the chloroform searches in the Casey Anthony case.

Software Designer Reports Error in Anthony Trial

Several people commented that they didn't understand why John Bradley didn't notify the defense team or the media of the discrepancy in the 84 searches for chloroform in the Casey Anthony case.

First of all, the defense team was notified of the discrepancy by me as I was in Orlando during the trial and gave Jose Baez the questions to use to clear it up once it came out in testimony.

However, there is a valid reason why John Bradley did not notify the defense team or the media:  That would be against the rules.

What happens in cases involving experts is that the expert has an ethical obligation to notify the attorney he is working for of any mistakes or errors that he or she notes in the evidence so that the correct facts can be presented to a jury.  What the attorney does with that information is not up to the expert.

Also, experts on opposing sides of a case cannot discuss the case in any way as that would also be unethical.

I have also received numerous questions about why I didn't testify in rebuttal since I was working for the defense team.  Mostly from fellow experts in other countries that have rules different from the US legal system.

In the US, in order for an expert to testify, they must be disclosed to the other side prior to testimony, and are put on the witness list.  I was originally on the witness list, but was taken off so that I could assist in other areas of digital forensics as a consulting expert.  Since I was not disclosed to the other side as an expert any longer, I could not testify at trial.

The defense team had a testifying expert on the witness list, but he withdrew from the case prior to trial.  So by the time trial started, the defense team did not have any testifying witnesses for the computer forensics.  Everything that had to be done regarding the computer forensics testimony at that point had to be done via cross examination or during rebuttal testimony, which is much less powerful than having an expert testify.

While there was an error in the results of the analysis by Cacheback, it is the responsibility of the computer forensics experts to verify the results and check the reports of any expert on a case. 

There have also been reports that both programs' analysis contained errors.  However, the difference was in how substantial the errors were.  Based on my analysis of the evidence, the NetAnalysis errors were not substantial and had no impact on the results from an evidence standpoint.  The CacheBack error was substantial in that it presented evidence that would have substantial impact on the understanding of the jury as to the facts in the case. 

The expert's job is to assist the triers of fact in understanding the evidence.  That means that the expert has to make sure that the triers of fact hear evidence that is accurate, independent of the impact on the case.

Enhanced by Zemanta

Tuesday, July 12, 2011

John Bradley Responds to Chloroform Search Discrepency in Casey Anthony Trial

John Bradley who testified about the chlorofrm search hits at the Casey Anthony trial responds to the questions about his testimony.

This is well worth reading if you want to get the inside scoop on what occurred regarding the Internet History in the Casey Anthony case regarding the chloroform searches, according to Mr. Bradley.

The link to John's response is below:


Monday, July 11, 2011

Casey Anthony Digital Evidence - Chloroform Searches

Digital Detective posted an excellent analysis of the MORK file that was part of the Casey Anthony trial evidence related to the computer searches, particularly for chloroform.

Here is a link to the post. Digital Evidence Discrepencies - Casey Anthony Case  it is highly technical, but I would expect no less from the people who make NetAnalysis, a forensic tool I have used for several years now.

I don't know how they got a copy of the history.dat file used in the case.  However, as the consulting expert that assisted the defense team in this area, I can say that based on the analysis I did of all of the digital evidence in the case, that Digital Detective got it right.

The history.dat file was carved from unallocated space.  At the time I carved it from the hard drive, I knew is was not a complete history file as the end of the file was not "clean".  However, what was carved from unallocated space could be parsed.  At the time that I did the original analysis, I used NetAnalysis, since at the time, there were no other forensic tools I was aware of that could parse a MORK file.

I also went and found the programming documents describing the MORK file format and studied it to make sure that what I was seeing matched the construction of the data.  This was also critical in making sure that was what carved from unallocated space was as complete as possible.

When John Bradley of SiQuest, makers of CacheBack, testified that there were 84 hits for the chloroform page, I was shocked.  That certainly did not match my analysis results or those of Sandra Cawn Osborne.  So I went back and reparsed the file using the most current version of NetAnalysis and compared it to the original parse results I got back in 2008.  They matched exactly.

An immediate red flag to me about the 84 hits was that the normal progression you see in Internet history records was missing.  I went back and re-analyzed the data and came to the conclusion that the other program had incorrectly parsed the MORK database file.

Anytime you examine Internet history, you are looking for certain things that indicate that the history file parsed correctly; Dates and times that are in the correct order, the proper progression of visit counts, and the presence of correct headers, page titles, etc.

Since I was a consulting expert and could not testify at trial, I supplied the cross examination information for Jose Baez to use in confronting the 84 hits when the opportunity came at trial.

I think Jose did a great job using the information I prepared for him and exposed a glaring error in the evidence presented to the jury.

Friday, July 8, 2011

A Digital Forensics Innocence Project

Any digital data storage device can be used to...Image via WikipediaJoe Windish posted an article on the need for a computer forensics innocence project. For A Computer Forensics Innocence Project over at the TheModerate Voice.  What he advocates makes a lot of sense.

"What we need is a Computers Forensics version of the Innocence Project. We need experts who believe in the presumption of innocence and are willing to spend the time it takes to dig through logs, registry entries and hard drives to find exculpatory material when present. Prosecutors who look for – and presume – guilt do selective searches for data supporting guilt; those accused rarely have the resources to counter such selective evidence."

I agree with him in principal, considering that there are people who are charged with crimes who do not have the resources to hire experts.   And in cases where the client cannot meet the standard to be declared indigent and receive funding for an expert, I believe that we as experts in the field should be willing to take on a reasonable number of pro bono cases.

It is our policy at Guardian Digital Forensics to take on pro bono cases when we can spare the resources.  The Casey Anthony case was one of our pro bono cases.

I am a firm believer in the presumption of innocence, not matter how heinous the crime a person is accused of committing.

I can speak for the other examiners at our firm and state that we would gladly support the formation of an innocence project for digital forensics.  However, one firm cannot do it alone.  I invite my colleagues in the field to start a conversation on how we could make this a reality.  If you are interested in working on creating an innocence project for digital forensics, contact me and let's see where we can take this.
Enhanced by Zemanta

Tuesday, July 5, 2011

Casey Anthony Verdict

Having spent two and a half years as a consulting expert in computer forensics and cell tower forensics on the Casey Anthony defense team, I have to say that Jose Baez was a pleasure to work with and did an herculean job in defending Casey Anthony.  Somehow he managed to juggle thousands of facts, dozens of experts and witnesses while under the intense scrutiny of the media and general public, the majority  of that being negative.  He persevered where many might have fallen away or caved under the intense pressure of such a high profile case.

While many will not agree with the verdict returned today, it is fortunate that public opinion is not the driving force behind the justice system in the United States.  The only opinions that matter are the 12 people sitting in the jury box who get to hear all of the testimony, listen to all of the arguments and review all of the evidence that is presented by both sides.

The rule of law prevailed today and that is gratifying to see, independent of popular or other opinions.

At the end of the day, the jury was not convinced that the state met the burden of proof beyond a reasonable doubt.  It is important to remember that to render a verdict in a case like this, all 12 jurors must be unanimous whether the verdict is guilty or not guilty.

While some may believe that vengeance is what is needed, that is not the purpose of our justice system and this case reminds all of us that justice must be blind to any factors or pressure beyond the evidence presented.

It would be a sad day in America if our court system was reduced to meting out vengeance rather than justice, no matter how much we as observers may like or dislike the outcome.