Monday, November 26, 2012

Casey Anthony - Detectives Miss Google Searches

Apparently, this is the case that will never be resolved, in spite of the fact that the case has been tried and the defendant acquitted.

When I located these searches on the computer in January of 2009, I brought them to Jose's attention so he would be aware of them.  I gave Jose anlaysis of the searches in February of 2009 at the AAFS conference in Denver, CO.

While I am not going to re-hash the computer forensics, nor will I get into a debate with other people who have examined the evidence after the trial, I will say that I verified the time stamps based on the evidence I had, which was the forensic images of the Anthony's computers, all of the OCSO computer forensic reports and supplemental or derivative data and I am confident in my analysis.

I watched Nancy Grace last night that made me reflect on this case a bit more.  First of all, if you watched Nancy Grace, and other media outlets for that matter, a lot was made of this missed evidence. 

What bothers me the most about the media reports, is that they are reporting on unverified results of an analysis done by someone far after the fact.  One of the major points that Nancy Grace spent a lot of time harping on was the time stamps.  Since she did not like the time stamp being an hour eariler than reported, she ignored it and kept showing the later time stamp in her program.  With comments, that of course, lead to the only possible conclusion, that Casey Anthony did these searches and she has to be guilty.  She had to be at the computer because of such and such. She opines that if only the OCSO had found the searches, the case would have concluded differently.

Then, later on she reports that "According to one expert, there were 84 chloroform hits".  Well, I addressed this eariler as did several other people in the forensic community.  The "other expert" was wrong.  This was verified by me personally before and during the trial,  as well as others who had the evidence after the trial.  But, those little "facts" don't seem to deter people like Nancy Grace and other media outlets from spouting all kinds of stuff, without verification.

I also find it interesting, that in all of this, Nancy Grace's opinion is that the way the defense team knew about the internet searches was probably because Casey told them about it.  Or, maybe the evidence just magically appeared, hovering in the air in front of the defense team lawyers.  All they have to do is read a little more of Jose's book to determine the source of the evidence provided to the defense team.  Or, they could simply take a look at the defense witness list that included only three names and was made public months before trial.  But, I suppose that is a little too much work to do.

It is funny in a morbid sort of way that Nancy Grace talks about how she cares about the truth, but apparently in her world, the truth has  nothing to do with facts.  Especially if the facts are an "inconvenient truth".

Probably the most disturbing thing I saw was Sandra Cawn-Osborne's response; "I wasn't told to search for suffocation."  One thing I will say to that is that she was not alone in the analysis of the computer forensics, she had help from her supervisor, who was a teacher in the Digital Forensics Master's program at the University of Central Florida.  Ponder that one.

That leads to what I really want to point out in this post;  It does not matter what "side" you are on in a case, what matters is that you understand what is at stake and act accordingly. 

This was a death penalty case and the stakes were the highest they can be: Taking a person's life. 
In the Anthony case, like many death penalty cases I have done, we have to ignore the media, the pundits and the arm chair experts and do our jobs without making any judgements about the defendant or anyone else in the case.  As a forensic examiner, our job is to find everything that may be of use in the case; good, bad or indifferent, and properly interpret that for the legal team.  Not to make moral judgements or drink the media coolaid.

That means that you have to be extremely thorough and that you have to keep asking yourself, "Did I miss anything?  Could I have looked elsewhere?  Did I follow good procedure to make sure I covered all the potential bases for evidence that may exist?"

What makes murder cases harder to do than some other types of cases is that your examination is not limited to a specific type of evidence artifact.

For instance, in child pornography cases, you are looking for a specific set of artifacts to support or attack a charge.  In financial cases, your focus will be on financial records, email between participants and so on.  In an alleged rape case you may be looking for text messages, videos, voicemails and email as well as internet history.

But in a murder case, you will be looking a much wider range of potential evidence, including evidence about timelines, computer activity, conversations, communications, and so on.  You may need to examine evidence involving witnesses and the victim.  All of this is to make sure that the legal team has everything that is related to the case, but not just a data dump.  Whatever you find and produce has to be properly presented and interpreted so the legal team can understand it in the framework of the case. And it must be checked and double checked for accuracy.  Is that time stamp what it appears to be? (See my recent post on computer time.)

The other thing we have to keep in mind, at least I do, is I always operate on the belief that anything I can find, they can find, and I conduct my examinations accordingly.

The media is acting like this is the first time someone has missed some critical piece of digital evidence in case.  Let me assure you, that is not the case.  What makes this such a huge deal is that it is an extremely high profile case that the media just loves to beat like a dead horse since it has a very large following of people who are invested in the case, for what ever their reason may be.  It's good TV and drives ratings.

For us as forensic examiners, this case should be studied as a cautionary tale.  Be thorough, verify, verify again, get help if you need it.

No comments:

Post a Comment

I have moderated my comments due to spam.