Upload
robbiedj
View
219
Download
0
Embed Size (px)
Citation preview
8/11/2019 Accident Investigation Checklist
1/33
Appendix4AccidentInvestigationCheckList
Pre-field
investigation
[ ] Select investigationmethodology/protocols
[ ]DesignAItasks to takefulladvantage ofavailableresources.
[ ] Identify and define perceived self-interests of everyone affected by investigation[ ]
Negotiatewith others who might be investigating
[ ] Identify and control personalrisksto investigator
[ ] Define and order investigation tasks
Fieldinvestigation tasks
[ ] Dowalkaround/lookaroundtofamiliarizeselfwith scene
[ ]Identifyphysicalobjects likely to change
[ ]Identifypeopledata likely to change
[ ] Protect data sources againstprematurechange
[ ]Formulatequestions to generate needed data[ ] Document post-occurrencephysical states
[ ] Definepre-occurrencephysicalstates of involved objects
[ ] Define physical changes (damages) during incident
[ ] Document post-occurrence physiological states
_ ]Prepareinvestigation - photographs
[ ]Prepareinvestigation - sketches
r ]Prepareinvestigation - drawings
[ ]Prepareinvestigation - maps
[ ]Prepareinvestigation - charts or graphs
[ ] Defmepre-occurrencephysiological states
[ ] Define physiological changes (injuries)during incident[ ]Identify and define change makers that produced outcome
[ ] Define actionsrequiredto produce observed ending conditions
[ ]Acquiredata about interactionsfromwitnesses
[ ]Acquiredata about interactions from object sources
[ ]Transformobservations into form entries
[ ]Transformobservations into event descriptions
r ] Organize events sequentially
[ ] Focus energies onremainiagunknown events
[ ] Select events to break down or decompose
[ ] Define events pairs orsetsfor logic testing
8/11/2019 Accident Investigation Checklist
2/33
[ ] Apply cause-effect logic toeventsparis andsets^
[ ] Demonstrate causal relationships among interactions
[ ] Defmegapsin understanding of what happened[ ] Hypothesize bounded scenarios tofillgaps
[ ] Acquire data to verify hypotheses
[ ] Develop plans for any testing/simulations
[ ] Apply necessary/sufficient logic toevents
[ ] Separate relevant from irrelevant events/data
[ ] Do QualityControl check offinaldescription
[ ] Useeventsdescription to define problem relationships
[ ] Useeventsdescription to evaluate problems orneeds
[ ] Assess gravity of each need ( fix/don'tfix)
[
] Select problems/needs to address with recommendations
[ ] Identify candidate actions to address problems orneeds^
[ ] Useeventssetsto evaluate each candidate recommendation
[ ] Develop rationale for selecting recommendations to be proposed
r
] Develop recommendations effectivenessassessment plans and procedures
_
] Do objective quality assurance procedures for final investigation outputs
Post-field investigation
[ ]Prepare narrativedescription and explanation of what happened
[ ] Complete analysis to determine cause, causes, causal factors, root cause
[ ] Prepare final report[ ] Defendfinalreport
[ ]
Respond to media inquiries
[ ] Do objective quality assurance procedures investigation process
[ ]Arrangefor disposition of wreckage/debris/test objects
__]Arrangefor archiving of data sources
Leadinvestigator
[ ] Set daily taskprioritiesfor each investigator or group
[ ]Manage work force performance
[ ] Assure needed mformation exchanges among workers
[ ]Conductpublic and private briefmgs
[ ] Manage quality assurance procedures for team tasks and outputs
[ ] Manage recommendation development process
[ ]
Manage report preparation
Multinational investigations
[ ] Implement multinational investigating protocols
[ ] Implement customs and conventions of hoststate
8/11/2019 Accident Investigation Checklist
3/33
[ ] Managemulticulturalmultinationalinvestigation teams
[ ]Negotiateparticipationby non-government experts
[ ]Critiqueinvestigation process
8/11/2019 Accident Investigation Checklist
4/33
AccidentInvestigation Preliminary InterviewList
Interviewee/Title ReasonFor Interview PhoneLocation/Shifl/Company
AffiliationNotes
:
:
;
:
i
\
i
1
1 i
8/11/2019 Accident Investigation Checklist
5/33
DocumentaryEvidence Log
Item
No.
Item Description Source of Document RequestedBy Rec'd
Y/N
8/11/2019 Accident Investigation Checklist
6/33
AccidentInvestigationWitnessStatementForm
jName:
UobTitle:
iTelephoneNo.
iLocationat Time of Accident:
iHomeAddress:
ILocationof Accident:
[OccidentTime and Date:
tleasefully describe the accidentsequencefrom start to finish (use additional paper as needed):
Pleasefully describe the work and conditions in progress leading up to the accident (use additional
paper as needed):
jNote
anythingunusual you observed beforeor during the accident (sights, sounds, odors, etc.):
iWhatwas your role in the accident sequence?
8/11/2019 Accident Investigation Checklist
7/33
IWhatconditions influenced the accident (weather, time of day, equipment malfunctions, etc.)?
jWhatdo
you think caused the accident?
How could the accident havebeenprevented?
jPlease
list other possible witnesses:
lAdditional comments/observations:
Signature:
8/11/2019 Accident Investigation Checklist
8/33
PhysicalEvidence Log
Item
No.
Item Description Received
Date
By COC
Y/N
COC - Chainof Custody formexecuted
8/11/2019 Accident Investigation Checklist
9/33
EVIDENCETAGACCID ENT
ITEMDESCRIPTION_
INVESTIGATORAFFIXING TAG
DATE
ACCIDENT INVESTIGATION
EVIDENCE
WARNING THISITEMISEVIDENCEINANOFFICIAL
ACCIDENTINVESTIGATION.DONOT
DISTURBWTTHGUTPERMISSION
SampleEvidence Tag to IdentifyPiecesofPhysicalEvidence.
SamplePhotographic Log
PhotographicLog
Name:
Agency:
Address:
Date:
Time:
Accident Identification:
PhotoNo.(Roll/Exposure)
Subject ExposureInformation
FlashY/N
8/11/2019 Accident Investigation Checklist
10/33
C A S E N U M B E R
C A S E NAME INCIDENT DATE
DATE/TIME EVE NT ID EVE NT DET AIL DESCRIP TION SOUR CE O F DATA COMMENTS
8/11/2019 Accident Investigation Checklist
11/33
08-069208
ORANGE COUNTY SHERIFF'S OFF ICECOMPUTERFORENSICCELLPHONEREPORT
Pagel
CASE AGENT:YuriMelich
Detective
OrangeCountySheriffs
Office
Criminal Investigations Division
ChildAbuse/Missing Persons Squad
2500W.Colonial Drive
Orlando.FL.32804
COMPUTER FORENSIC EXAMINER:SandraG.Cawn
Detective
OrangeCountySheriffsOffice
CriminalInvestigations Division
ComputerCrimesSquad
2500W,Colonial Drive
S E A R C H andS E I Z U R E I J ^
August4,2008:
DetectiveMarkHussey, Orange CountySheriffsOffice HomicideUnitpresented this writer with thebelow
described cellulartelephoneand asked that all thetext messagesbe extracted. Thephonebelongsto Cynthia
Anthony, whogaveconsentfor the extraction.
P R O C E S S I N G andA C Q U I S I x f O N NOTES
TheCaseAgent provided this examiner thefoUov/ingfor processing:
CELLULAR TELEPHONE:
ITEM
Make: Motorola
Model Number: V3Razr
PossibleSerialNumber:23755930216
I M E I :
358921008652799
MSN:
SIM:890141042008900 40872
E X A M I N A T I O N SYNOPSIS
Thisexaminer received the listed cellulartelephonewhich was poweredon. An extraction of data via the use ofCellebrite
software andcabhngwas conducted. The contact list,calllogs,tejrtmssagesall dated either8/02/08
and8/03/08and image files were recoveredandreported on the attachedreportform.
DetectiveSandraG,Cawn Atigstt04-,2008-
8/11/2019 Accident Investigation Checklist
12/33
ExaminationReport Page1of 10
ExaminationReport Properties
SelectedManufacture: Motorola GSM
SelectedModel: MotorolaV3RAZR
DetectedManufacture: "MotorolaCE ,Copyright2004"
DetectedModel:GSM900 , GSM1800 , GSM1900 , GSM850 , MODEL=V3
Revision: "R374 G 0E.41.C3R B"
IMEi: 358921008652799
MSISDN; 14078084731
IMSI:
310410089004087
Extractionstartdate/time: 04/08/0809:28:47
Extractionenddate/time: 04/08/0809:30:34
PhoneDate/Time: 08/08/04,10:20:44+00
ConnectionType: US BCable-
U F E DVersion: Software:1.0.9.0U P E D . F u l lI m a R e : 1.0.1.9,TinyImage:1.0,1.9
ExaminationReport Index
1. Contacts
2. SMS- TextMessages
3. IncomingCalls4. OutgoingCalls
5. MissedCalls
6, hiiages
7. Ringtones
8. Audio
9. Video
Contacts
Total Entries:28
PBBMD5Hash:05C03A0E29O88C3F02B4D8815EAF8456
#1 DebbieAkin (Phone memory)
General:
#2 JodyParker(Phone memory)
Home;
#3 Roder B (Phone memory)
file://C:\Docujnents andSettings\Administrator\Desktop\Cindy
Anthony cell phoneVBackup... 8/4/2008
8/11/2019 Accident Investigation Checklist
13/33
nxammationReport Page2of10
Work: 17634798162
#4
Work:
DaveNltti(Phone memory)
#5
Work:
Nilsa(Phone memory)
#6 J Duckett (Phone memory)
Work:
#7Work:
Ryan(Phong memory)
#8 George@Work(Phone memory)
Work:
#9 ^ petectineMeUch(Phpne memory)
Work:
Work:
Carla
Dagkett(Phone memory)
#11 ChristinaChester (Phone memory)
Mobile:
#12 JasonFort(Phone memory)
Work:
#13 JoseBaez (Phone memory)
Mobile: ^ ^ ^ ^ I H B
Work: ^ I ^ M I
Work:i B l ^
#14 JohnAllen (Phone memory)
Mobile:
#15
General:
ALee (Phone memory)
file://C:\Documents andSettmgsNAdministrator\Desktop\CindyAnthony cellphoneVBackup... 8/4/2008
8/11/2019 Accident Investigation Checklist
14/33
ExaminationReportPage
3of 10
#16 AHome (Phone memory)
General:
#17 AGeorge (Phone memory)
General:
#18 Casey(Phone memory)
General:
#19 JimN B C (Phone memory)
Work:
#20 Kenneth(Phone memory)
Work:
#21 Annie(Phone memory)
Work:f:
#22 FoxHollyBristow QPhonememory)
Work:
#23 Don SilverLeadAllen (Phone memory)
Home:
#24 ChristinaBaez (Phone memory)
Work:
#25 SonnieCell(Phone memory)
Work:
#26 Ke nGagne (Phone memory)
Mobile:
#27 JessicaNever Lose Hope (Phone memory)
Work:
#28 SteuePeopleMag (Phone memory):;
Work:
^ ^ ^ ^
file://C:\Doeuments and Settings\Admmistrator\Desktop\CindyAnthony cellphoneVBackup... 8/4/2008
8/11/2019 Accident Investigation Checklist
15/33
Examination Report Page4 of 10
S M S TextMessages
S M S M D 5Hash: F 5 D 1 D 3 B 3 B A F 1 F 6 1 7 A 2 F 9 4 8 7 9 E E E 5 B F 3 A
Number Name Date& Time Status ]Folder Storage'rype rext
1 N/A N/A Sent Sent Outgoing CgUme
1
* A
Lee N/A Sent Sent Outgoing 4o74667847
3
-*Fox Holly
Bristow
02/08/08 12:22:33
(GMT-16)
Read Inbox- -
(
t
t
I
Incomii^
ieyCmdy!
jeorgeasked me
0textthis
lumbertobothof
1.Mr.Mann
i02.204.2600
Dubhcist
for
^ericas
Most
Wanted.Letme
mowIf
youneed
mything.
4 N/A02/08/0812:42:36
(GMT-16)
Read Inbox Incoming
Joycestoppedby
i*ublix
looking for
you
5 N/A02/08/08 17:21:18
(GMT-16)Read Inbox Incoming
Hicindy! It's
emilyftomnews
13.Just
wonderingifwe'd
able to talk to u
today.
6 !N/A 02/08/0823:31:25 Read Inbox Incoming
Iknow itslate
3utIneeded2
textu and tell u I
criedwhenIread
the"People"
article.,I
saw
Georgeon the
news& he said u
bothfeltthe same.
Ourteam is due 4
abreak.Pm
prayingevery daythatGodhears my
cries. Words can't
expressthe pain I
feel
4all.Seeu-
torn. Believing 4a
miracl!Love,
HollY
Douguys need
meatqiehouse
prioftotonight's
vigilat 830?Iwai
mi
file://C:\Documents andSettings\Admmistrator\Desktop\Cindy
Anthony cellphoneVBaekup...
8/4/2008
8/11/2019 Accident Investigation Checklist
16/33
xamination
ReportPage
5of
10
71
ALee03/08/0813:17:25
(GMT-16)
Read Inbox Incoming
planningon being
alittle early. Btw-
we
should not
speakofany
lettersfromcasey
8 |
* ALee03/08/08 13:45:39
(GMT-16)
Read Inbox Incoming
Josehas
individual
messagesto us
from Casey that
liewants togive
toustonightafter
thevigil..Would
u
guysbeupfor
goingto his
office?
9j r A Lee N/A Sent Sent OutgoingWhendoesjosewantto meet?
10
W
^
]
* ALee03/08/0815:26:17
(GMT-16)Read Inbox Incoming
Afterthe vigil
spm.etinietonight.
11
W
^
]
1*
Debbie
Akin
03/08/08 18:48:29
(GMT-16)Read Inbox Incoming
May not get to be
theretonightbut i
continueto pray
andloveyou
12
W
^
]* Debbie
AJdn
N/A Sent Sent Outgoing Loveu
13* Debbie
Akin
03/08/08 18:57:31
(GMT-16)
Read Inbox Incoming
Isthere anything
ican do foruthis
week ,
*
Phonebook name lookup used to retrieve names
IncomingCalls
CLGMD5Hash:9999193F33E7C603AAF0541D734E67A6
Kame Date& Time Duration*Kenneth N/A N/A
N/A N/A N/A
N/A N/A N/A
N/A N/A ' N/A
N/A N/A . N/A
N/A N/A N/A
N/A N/A N/A
N/A N/A N/A
N/A ; N/A
N/A N/A N/A
Type1 Incoming
2 Incoming
3 Incoming
4 Incoming
5 Incoming
6 Incoming
7 Incoming
8 Incoming
9 Incoming
10 Incoming
file://C:\Documents
andSettings\Administrator\Desktop\Cindy
Anthony cell phoneVBackup... 8/4/2008
8/11/2019 Accident Investigation Checklist
17/33
Examination Report Page6of 10
OutgoingCalls
CLOGMD5 Hash:9999193F33E7C603AAF0541D734E67A6
Type
1 Outgoiig
2 Outgoing
3 Outgoing
4 Outgoing
5 Outgoing
6 Outgoing
7 Outgoing
8 Outgoing
9 Outgoing
1.0
Outgoiiag.
Number Name Date& Time Duration
N/A N/A N/A
N/A N/A N/A
N/A N/A N/A
*JoseBaez N/A N/A
*Steue PeopleMag. . N/A N/A
*Kenneth N/A N/A
8 N/A N/A N/A
*A George N/A N/A
* ALee N/A N/A
N/A .N/A N/A.
MissedCalls
C L 0 G M D 5
Hash:9999193F33E7C603AAF0541D734E67A6
u
[Type Number Name Datei&Time, Duration
1 Missed im
*
Kemieth
N/A N/A
2 Missed N/A N/A N/A
3 Missed N/A N/A N/A4 Missed N/A N/A N/A5 Missed m N/A N/A N/A
6 Missed. .N/A N/A N/A
7 Missed N/A N/A N/A
8 Missed N/A N/A N/A
9 Missed N/A N/A N/A
* Phonebook name lookup usedto retrievenames
Images
# Information MetaData Image
Filename:hfiaeesNOS-18-07
1527
.iD
(i
Resolution:
file://C:\Documents
and Settings\Administrator\Desktop\Cindy
Anthony cellphoneVBackup...
8/4/2008
8/11/2019 Accident Investigation Checklist
18/33
ExaminationReport ..., Page7of10
1
FilePath:picture
FileSize:24826 bytes
FileDate/Time:18/08/07 15:27:20(GMT)MD5:
087150C83E292F85EEBD96B0AD4219B
72x72(unit:
inch)
PixelResolution:"
640x480
2
Filename:Imaees\12-08-06 2025.jpg
FilePath:picture
FileSize:19842 bytes
FileDate/Time;08/12/06 20:23:27(GMT)MD5:
B5C6CCE1FAAEFA052DB488B7CC215816
Resolution:
72x72(unit-
inch)
PixelResolution;
640x480
'ML.*'
3
Filename:Imaees\05-09-08 1350.ipg
FilePath:picture
FileSize:31106bytes
FileDate/Time:09/05/08 13:50:47(GMT)
MD5:
5F85F5AF2544E90919E81C37CB27BF64
Resolution:
72x72(unit:
inch)
Pixel
Resolution:
640x480
4
Filename;ImaEes\08-l8-07 1523.ipp
FilePath:picture
FileSize:20266 bytes
FileDate/Time:18/08/0715:23:50(GMT)
MD5:
4C1910AF4B54F554C39E729EF18EABB9
Resolution;
72x72(unit:
inch)
Pixel
Resolution;
640x480 !
5
Filename:Imaees\12-08-06 2021.iDe
FilePath:picture
FileSize:22186bytes
FileDate/Time:08/12/06 20:20:15(GMT)
MD5:
3CD177DD6650091991101C916EC93E53
Resolution;
72x72(unit:
inch)
Pixel
Resolution;
640x480
file://C:\DocumentsandSettingsVAdministrator\Desktop\Cindy
Anthony cell phoneVBackup... 8/4/2008
8/11/2019 Accident Investigation Checklist
19/33
8/11/2019 Accident Investigation Checklist
20/33
xanunationKeportPage
9of 10
11
Filename;Images\07-23-06 1827.jpgFilePath:picture
FileSize:22862 bytes
FileDate/Time:23/07/0618:27:36(GMT)MD5:
35D05051E05FF28CC1BFC997EG291C65
Resolution:
72x72(unit;,.,
inch)
Pixel
Resolution:
640x480
12
Filename; Images\12-Q8-Q6_2023.jpg
FilePath;picture
FileSize:18002 bytesFileDate/Tune:08/12/06 20:21:56(GMT)
MD5;
98A5CA6DAC6B0967EF2506441BD2FF09
Resolution;
72x72(unh:
inch)Pixel
Resolution:
640x480
13
Filename;Images\12-08-062019,jpg
FilePath:picture
FileSize;27106 bytes
FileDate/T3ie:08/12/0620:18:36(GMT)
MD5;
52A0DD2591B
A27DFBC107D7B C223F6C1
Resolution:
72x72(unit:
inch)
Pixel
Resolution:
640x480
14
Filename;Images\12-08-06 2022.ipg
FilePath:picture
FileSize:25498 bytes
FileDate/Tkne:08/12/0620:21:19(GMT)MD5:
C5CC21B34590A948750C406539BAECC2
Resolution:
72x72(unit:
inch)
Pixel
Resolution:
640x480
o
15
Filename:Images\12-08-06 2018.jpg
FilePath:picture
FileSize:17826 bytes
FileDate/Time:08/12/0620:18:12(GMT)
MD5:
9CE491856DC4DEAB934F332593B9B170
Resolution:
72x72(unit:
inch)
Pixel
Resolution;
640x480
file://C;\DocumentsandSettings\Adminishator\Deslctop\CindyAnthony cellphoneVBackup... 8/4/2008
8/11/2019 Accident Investigation Checklist
21/33
ORANGE COUNTY SHE R IFF' S OFFICE08-069208 COMPUTER FORENSICS REPORT
CASEAGENT:
Y u r i Melich
D e t e c t i v e
Orange County S h e r i f fs O f f i c eC r i m i n a l I n v e s t i g a t i o n s D i v i s i o n
C h i l d Abuse/Missing Persons Unit
2500 West C olo nia l Driv e
O r l a n d o , F l o r i d a 32804
COMPUTERFORENSICSEXAMINER:
SandraG. Cawn
D e t e c t i v e
Orange County S h e r i f f ' s O f f i c e
C r i m i n a l I n v e s t i g a t i o n s D i v i s i o n
Computer Crimes Squad2500West Co lo ni al Driv e
Orlando, F l o r i d a 32804
(407) 254-7000 e x t . 7-0593
SeizureandProcessing Notes
S e i z u r e Notes:
On J u l y16,2008a ta p p r o x i m a t e l y 2000 hours, De te ct iv e Ch ar it y Beasley o f the
Orange County S h e r i f f ' s O f f i c e Domestic Violence Squadonb e h a l fo fDet ectiv e
C o r p o r a l Y u r i Melich , submit teda CompaqP r e s a r i oC300 l a p t o p computer; s e r i a lnumberCND6430RKH ( w i t h t h epower cord) and aNokiaRH-87model2610 c e l l u l a r
t e l e p h o n e ; IMEI# 011191/00/075157/2
t o theComputer CrimesLabf o r examination.
D e t e c t i v e Beasley ad vi se d these items bel ong t o thesuspect o f t h i s
i n v e s t i g a t i o n andt h a t Det ect ive Corporal Mel ichwas seeking a search war ran t
t o examinethecontents o fthese twodevices. Nei the rof th edeviceswas
examinedorprocessed u n t i l thewarrantwas obtai ned. Lat er t h a t evening,
D e t e c t i v e Melich obtaineda search warrant f o r bo th it ems.The c e l l phonewas
p r o c e s s e d andexamined.A separate r e p o r twas s u b m i t t e d f o r t h i s item.
On J u l y17,2008a t 1330hours, I n v e s t i g a t i v e An aly st Awilda McBrideo f the
Orange County S h e r i f f ' s O f f i c e M i s s i n g Persons Squad,onb e h a l fo fDet ectiv eC o r p o r a l Y u r i Meli ch, sub mit ted a. Po la ro id t730 D i g i t a l Camera, s e r i a l number
GR700405730013579 ( i n c l u d i n g a 1 GB P o l a r o i dSDmemory card; s e r i a l number:
MM8GF016WMC-PATC0D300753)and a SanDisk U-3USBthumb d r i v e f o r examination.
A l s o s u b m i t t e dwas a Hewlett Packard P a v i l i o n , model# a520n, desktop computer;
s e r i a l niomber:MXM4100HYL. Mrs.McBride advised these items belong t oGeorge
and C i n d y Anthony, andt h a t wewere granted consent t os e i z eandsear ch the se
i t e m s f o ranyi n f o r m a t i o nt h a tmay a s s i s t w i t h t h i s i n v e s t i g a t i o n .
On Ju ly 21, 2008a t 1052hours, Mrs.McBride, onb e h a l fofDe te cti ve Corporal
Y u r i M e l i c h , s u b m i t t e daNikon C ool pix D i g i t a l Camera, s e r i a l number: 30258381
a l s o b e l o n g i n gt oGeorgeandCindy Anthony f o r e x a m i n a ti o n . Consentwas grantee
8/11/2019 Accident Investigation Checklist
22/33
O R A N G E COUNTY SHERIFF'S OFFICE08-069208 COMPUTER FORENSICS REPORT
f o r thes e i z u r e and search o f these items.
Summary:
1) The Compaq l a p t o p computer
P i c t u r e s and video take n of Caylee Anthony were bookmarked and copied t o th e
Evidence\Graphic f i l e s \ C a y l e e f o l d e r . The image e n t i t l e d DSCN1894.JPGwas taker
w i t h a Nikon C o o l p i x d i g i t a l camera. The date and tim e from th e metadata i n the
p i c t u r e i n d i c a t e t h a t thep i c t u r e was taken June 15, 2008 a t 12:03:27 pm.
D i g i t a l v i d e o f i l e s were a l s o taken w i t h a Nikon C o o l p i x d i g i t a l camera with
the metadatadate and time of June 15, 2008 between 11:26:20 am and 12:03:18
pm.
There are s e v e r a l g r a p h i c f i l e s of i n t e r e s t ; the f i r s t i se n t i t l e d " g i r l . j p g "and the second, 2 3 3 b c 8 d 7 9 3 5 7 f3 0 7 5 c 7 e d f 5 d d b0 8 3 f l l . j p g . Both were l o c a t e d on
the C:\Documents and Settings\bobby\Desktop\artwork\misc f o l d e r on th eCompaq
computer. Both g r a p h i c f i l e s were bookmarked and c o p i e d t o the Evidence\Graphic
f i l e s \ G r a p h i c s of I n t e r e s t f o l d e r .
Also i nt h a t f o l d e r i s an image f i l e e n t i t l e d
I_b55a353606038e56bed924d0a4dcl301.jpg . I was asked by D e t e c t i v e E r i c Edwards
t o i d e n t i f y on e i t h e r computer any males who may bemembers of th e United
States M i l i a r y f o r c e s . This photograph i s of a w h i l e male dressedi n
camouflage. Thenameon h i ss h i r t i s "Hawkins."Email between Casey Anthony and
MarkHawkins was bookmarked i n the Web m a i l i nu n a l l o c a t e d space p o r t i o n of
t h i s r e p o r t .
AnMSWord document e n t i t l e d " d i a r y ofdays.doc was bookmarked. The Metadata
A n a l y s i s o f th e document "Diary of Days" r e p o r t s theauthor asCMANTHONof the
GENTIVA C o r p o r a t i o n on J u l y 2, 2008 at 10:42:08 am. The document was bookmarked
and copied t o th e Evidence\Documents f o l d e r . The r e s u l t s of th e Metadata
A n a l y s i s were saved t o th esame f o l d e r . Also bookmarked were s e v e r a l web page
e n t r i e s f o rB i l l Pay f o r th eaccount "Casey Anthony,account number 04985420-
001-04" f o r payment o f a c e l l phone b i l l .
Nophotographs, v i d e o , e m a i l , i n s t a n t message chat or any o t h e r type of
communication w i t h a Zenaida Fernandez-Gonzalez was d i s c o v e r e d on e i t h e rcomputer.
The I n t e r n e t h i s t o r y and cookies f o r theuser "bobby" was e x t r a c t e dv i a
N e t a n a l y s i s . A l l were saved ascomma d e l i m i t e d f i l e s t o the E v i d e n c e \ l n t e r n e t
History\Casey l a p t o p f o l d e r f o rv i e w i n g w i t h Excel.
2) The HP P a v i l i o n Desktop computer
On J u l y 16, 2008, Awilda McBride showed me a p r i n t - o u t of aMySpace b l o g dated
"Thursday, J u l y 3, 2008". The page i s t i t l e d , "my caylee i sm i s s i n g " . The web
page was bookmarked and r e p o r t e d i n the "my caylee i sm i s s i n g " p o r t i o n of t h i sr e p o r t .
8/11/2019 Accident Investigation Checklist
23/33
ORANGE COUNTY S H E R I F F S OFF ICE08-069208 COMPUTER FORENSICS REPORT
The I n t e r n e t H i s t o r y f o rthep r o f i l e "Casey"on the HP computerwase x t r a c t e d
v i a NetA n a l y s i s .TheH i s t o r ywas then f i l t e r e d f o r b o t h "MySpace"andf or
"facebook." A l ltheI n t e r n e t H i s t o r y f i l e s were saved t o theEvidence \Interne tH i s t o r y \ C i n d y Desktop computer\Casey p r o f i l e f o l d e r s ascommad e l i m i t e d f i l e s
f o r vie wi ng using Exc el.
A keyword search fo r "Zenaida" r e v e a l e d Webpages i n d i c a t i n g t h a t a user
s e a r c h e d t h eI n t e r n e t f o r t h a tname onJ u l y 16,2008. Those e n t r i e s were
bookmarked underthe"Zenaida Fernandez Gonzalez" s e c t i o noft h i s r e p o r t .
D e t e c t i v e Melich requested a keyword search f o r "E ri c Baker."The name "Eric
James Baker" wasbookmarked undert h es e c t i o no f t h e same name w i t h i nth e
r e p o r t .
S e v e r a l i n s t a n t message conversations were bookmarked andsavedt o th e
Evidence\Chat fragments\Fragments o fconversatons i na l l o c a t e dspace f o l d e r for
viewing using html. The f i l e e n t i t l e d n y i t a l i a n o 3 . h t mlm e n t i o n s t h e name
" z a n i . " This i s theon ly refere nce foun d thus f a rt o anyv a r i a t o no f th e name
Zenaida. The chat doesnoti n d i c a t e t h ei d e n t i t y orl o c a t i o n o f"zan i."
S e v e r a l i n s t a n t message conversations were bookmarkedandsavedt o th e
Evidence\Chat fragments\Fragments ofconversations i nu n a l l o c a t e d space f o l d e r .
3) TheN i k o n Coolpix D i g i t a l Camerawasexamined. Graphicandvideo f i l e so f
Caylee and f a m i l y were bookmarkedandsavedt o th eEvidence\Graphi c f i l e s
f o l d e r .
4) G r a p h i c andvideo f i l e s were examined from theP o l a r o i d d i g i t a l camera's
memory card. Two g r a p h i c f i l e s dated May 23,2008were l o c a t e dasw e l las
o t h e r s t h a t were d e l e t e d , noneo fw h i c h appeart o be o fp a r t i c u l a r e v i d e n t i a r y
v a l u e . They are no ti n c l u d e di nt h i s r e p o r t . Also submitted witht h eP o l a r o i d
camerawas aSandiskU-3 1 GB t h i x m b d r i v e . Nothing o fe v i d e n t i a r y v a lu ewas
d i s c o v e r e d . Both items were r e t u r n e dt o thef a m i l ybyAwilda McBride.
5)On J u l y22,2008, D e t e c t i v e Edwards s u b m i t t e d a B l a c k b e r r y 8300 c e l l u l a r
phone b e l o n g i n g t oAnthony Lazarro t o theComputer CrimesLabf o rt hepurp ose
o f e x t r a c t i n g anydata a v a i l a b l e . A separate re po rtwas prepared and submittedt o Detective Melich.
6)On J u l y23,2008,Amy Huizenga o f f e r e dherNokia GSM c e l l u l a r phone, model
6126t o thecomputer crimes l a bf o rt h epurpose o fe x t r a c t i n g thephone book
and SMS messages.A separate r ep or twas prepared ands u b m i t t e d t oDetec tive
Melich.
7) On J u l y 24,2008, B r i t t a n y Scheiber of fe re dherT-MobileShadow GSM
c e l l u l a r phoneto th ecomputer crimes l a bf o rt hepurpose o fe x t r a c t i n gth e
phone bookand SMS messages.A separate r ep or twasprepared andsubmittedt o
D e t e c t i v e Melich.
8/11/2019 Accident Investigation Checklist
24/33
ORANGE COUNTY SHE R IFF' S OFFICE08-069208 COMPUTER FORENSICS REPORT
8) On J u l y25,2008, D e t e c t i v eEdwards s u b m i t t e dan LG KG800 c e l l u l a r phone
b e l o n g i n gt oRicardo Moralest o theComputer CrimesLabf o rthepurposeo f
e x t r a c t i n g thephone bookand SMS messages.A separate r e p o r twaspreparedand
submitted t oDete ctiv e Melich.
9) Also onJ u l y25,2008, D e t e c t i v eEdwards s u b m i t t e daSamsungSGH-A707 c e l l
phone belongingt oTroy Brownt o theComputer CrimesLabf o rthepurposeo f
e x t r a c t i n g thephone bookand SMSmessages.A separate r e p o r twaspreparedand
submitted t oDete ctiv e M elich.
10) A search war ran t autho red ando b t a i n e dby t h i s w r i t e r onJ u l y 2 9, 2008f o r
the purpose ofl i s t e n i n g t o anda r c h i v i n g v o i c e m a i lmessagesasw e l l as SMS
messages incoming t oCasey Anthony's Nokia c e l l phone.An attempt was made
l a t e r t h a t same day t oexecute thewarrant, howeverthephone s e r v i c ehadsin ce
been d i s c o n t i n u e dandaccesswas not p o s s i b l e .
11) During thecourse oft h i s i n v e s t i g a t i o n , Sgt.John A l l e n o f theOrange
County S h e r i f f ' s O f f i c e C h i l d Abuse Squad advised t h i s w r i t e r t h a t i t w ou ld be
i n thebest i n t e r e s t o ft h i s i n v e s t i g a t i o n t oo b t a i na search warra nt f o rthe
HPdesktop computer b e l o n g i n gt oGeorgeandCindy Anthony. This w r i t e r authored
and o b t a i n e dasearch warran t fo rthecomputeronAugust 6,2008.The search
f o r evidence con tin ues as of thedate oft h i s r e p o r t .
12) On August4,2008, Cindy Anthony o f f e r e d herMotorola V3 GSM c e l l u l a r
phonet o th ecomputer crimes l a bf o rthepurposeo fe x t r a c t i n g th e SMS
messages. N o th i ng r e l e v a n tt ot h i s i n v e s t i g a t i o nwas found. A separate r e p o r twas prepared ands u b m i t t e dt oDete ctiv e M elic h.
To date, t h i s w r i t e r hasa s s i s t e d o t h e r D e t e c t i v e s w i t h therecovery of s t i l l
p h o t o s andvideos fr om s to re s u r v e i l l a n c e cameras r e c e i v e dasCrimeLine Tip sas
w e l l asCrimeLine Ti ps f rom c i t i z e n s m o n i t o r i n gMySpace, Facebook,and
Photobucket. These t i p s ares t i l l b e i n g i n v e s t i g a t e d at th etimeo f t h i s
r e p o r t .
8/11/2019 Accident Investigation Checklist
25/33
08-069208
O R A N G E C O U N I Y S H E ^ ^
COMPUTERFORENSICS REPORT
Cavlee/ Family Photos
Name: DSCN1894.JPG
Description: File, ArchiveFileCreated: 06/17/08 03:28;50PMLastAccessed: 06/18/08 10:13:52AMLastWritten: 06/15/08 12:03:26PM
EntryModified:f^^^^^SZ,,^,,^,^,^^,,
andSeings\bobbv^Descp^photos^Ca.eMarie^une
2008\DSCN1894.JPG
Comment;
I m a g e D e s c r i p t i o n :
Make: NIKON
Model: COOLPIX L12
S o f t w a r e : COOLPIXL12V1.0
DateTime: 2008:06:15 12:03:27
D a t e T i m e O r i g i n a l : 2008:06:15 12:03:27
D a t e T i m e D i g i t i z e d : 2008:06:15 12:03.27
T h i s
photographwas taken w i t h aNikon ^^^^^tlt^^^^^^^t i m e s e t t i n gon t h ecameraa t th etxme t h r s p i c t u r e ^^^^^^ ^^^^^^^^
a t 12:03:26pm. - f - ^ ^ ; ; ^ , : ^ ' ^ ^ ^ ^ ^ ^ ( - t h i n 2minutes) on thedate andtime s e t t i n g s ont h e camerawer ^^^^ r e g a r d i n g t h i sdayt h ecamerawas examined ( J u l y 21, .^^ picture savedt o tpiLure
o fcaylee ont h e CoolPxxcam a i s t h e same^as the
Compaq computer, meaning t h a t ^^^^^ t h e c ^ ^ ^ ^ ^ l ^ thecamera
8/11/2019 Accident Investigation Checklist
26/33
ORANGE COUNTY SHE R IFF' S OFFICE08-069208 COMPUTERFORENSICS REPORT
my caylee is missing
Name:
Description:FullPath:
UnallocatedClusters
File, Unallocated Clusters08-069208\S013J10X237614\D\UnallocatedClusters
FileOffset: 8033745365
Thursday, July 03, 2008
IMG[http://x.myspace.com/images/spacer.gif]
mycaylee is missing
Currentmood: IMG[http;//x.myspace.com/images/blog/moods/iBrads/sad.gif]distraught
Shecame inmylife unexspectedly, just as she has left me. This precious little angel from above gave me strength and unconditional love,hsheis gone and I don't know why. All I am guilty of is loving her and providing her a safe home. Jealousy has taken her away.
Jealousyfrom the one person that should be thankfull for all of the love and support given to her. A mother's love is deep,howeverthere are limits when one is betrayed by the one she loved and trusted the most. A daughter comes to her mother forsupportwhen she is pregnant, the mother says without hesitation it will be ok. And it was. But then the lies and betrayal began,Firstit seemed harmless, ah, love is blind. A mother will look for the good in her child and give them a chance to change. Thismothergave chance after chance for her daughter to change, but instead more lies more betrayal. What does the mother getfigivingher daughter all of these chances? A broken heart. The daughter who stole money, lots of money, leaves without warniranddoes not let her mother now speak to the baby that her mother raised, fed, clothed, sheltered, paid her medical bills, etc.Insteadtells her friends that her mother is controlling her life and she needs her space. No money, no future. Where did she gcWhois now watching out for the little angel?
[http://blog.myspace.com/index.cfm?fuseaction=blog.view&frien...]
8/11/2019 Accident Investigation Checklist
27/33
08-069208
ORANGE COUNTY SHERIFF'S OFFICECOMPUTERFORENSICS REPORT
ImageFiles of Interest
Name: girl.jpg
Description: File, ArchiveFileCreated: 07/08/08 10:14:53PMLastAccessed: 07/10/08 09:41:03PMLastWritten: 07/08/0810:14;54PM , ^ m \ - r ^FullPath- 08-069208\WXE906472668\C\Documents andSettings\bobby\Desktop\artwork\misc\girl.jpg
Name: 233bc8d79357f3075c7edf5ddb083f11.jpg
Description: File, ArchiveFileCreated: 07/11/0802:21:30PMLastAccessed: 07/14/08 01:26:56PMLastWritten: 07/11/0802:21:30PMFullPath- 08-069208\WXE906472668\C\Documents andSettings\bobby\Desktop\artwork\misc\233bc8d79357f3075c7edf5ddb083f11.jpg
ou CANSPENDMIb4UTBS.HOURS,
DAYS.W
ORI V I N
MONTHS
O m - A N A I Y Z I N G
ASTTUATION;
TRYINGT OPUTTHEMECE
TOCSETHER.
JUSTIFYINGWHAT
COUliNt WOULD^VEHAPPINED
...ORYHJCANJOSTtEAVE
THEPIECEONTHEHXX)R AND
MOVETHE
FUCKON
8/11/2019 Accident Investigation Checklist
28/33
8/11/2019 Accident Investigation Checklist
29/33
ORANGE COUNTY SHE RI F F 'S OFFICE08-069208 COMPUTER FORENSICS REPORT
Zenaida Fernandez Gonzalez
Akeyword search f o r"Zenaida" was conducted on th e HP desktop computer.Thf o l l o w i n g f i l e s arerecords o f web pages i n d i c a t i n g t h a t someone was search
f o r t h a t nameon th e I n t e r n e t .
Name: [email protected][2].txtDescription: File, ArchiveFileCreated: 07/16/0806:21:17AMLastAccessed: 07/16/0806:21:27AMLastWritten: 07/16/0806:21:27AM , ,. , ^ i r9i tv+FullPath: 08-069208\S013J10X237614\D\DocumentsandSettings\casey\Cookies\[email protected][2J.txt
zenaida
Name: history.datDescription: File, ArchiveFileCreated: 10/22/07 01:13:21PMLastAccessed: 07/16/08 12:03:24PMLastWritten: 07/16/08 12:03;24PMFullPath: 08-069208\S013J10X237614\D\Documents andSettings\casey\ApplicationData\Mozilla\Firefox\Profiles\mfhaxjkl.default\history.dat
http://friends.myspace.com/index.cfm
?fuseaction=user.viewfriends\=203461948897ec12-9984-4944-b65e-6dcef3d5a590=zenaida
Name: index.datDescription: File, ArchiveFileCreated: 06/12/0811:15:29PMLastAccessed: 06/12/0811:15;29PM
Fuf/i^tl^ 08-069208\S013J10X237614\D\Documentsand Settings\casey\LocalSettings\TemporaryInternet
Files\Content.lE5\index.dat
http://clk.atdmt.com/RC/go/whtpgreu0210000164ruc/direct;at.rucreu00001670;ct.l/01?dispat^^^^
S e a r c h R e g i s t r a t i o n S a c t i o n = pe o p l e S e a r c h _ w p _ r e s u l t c o u n t S ci t y = S i t > n a m e = S p e o p l e S e a r c h F ro m = w p & a f f i l i a t e
id=131SsearchFirstName=zenaidaSsearchLastName=Gonzalez&searchAge-25
Name: index.datDescription: File, ArchiveFileCreated: 06/12/08 11:15:29PMLastAccessed: 06/12/08 11:15:29PM
F u f p a t h ^ 08-069208\S013J10X237614\D\Documents and Settings\casey\LocalSettings\TennporaryInternet
Files\ContentlE5\index.dat
h t t p : / / p r e v i e w . U 3 s e a r c h. c o m / p r e v i e w / a l a / n e H s e a r c h ? S s e a r c h L N a m e = F e r n a n d e z & s e a r c h S t a t e - F L S s ^
t y = j a c k s o n v i ll e S s e a r c h F N a m e =Z e n a i d a S a d I D = 3 03 0 1 4 F 9 3 6 & a d s o u rc e = 8 S T I D = 0 S c i d =p e o p l e S s e a r c h t ab = p e o p l e
6--newsearch [2]
8/11/2019 Accident Investigation Checklist
30/33
ORANGE COUNTY SHERIFF'S OFFICE-08-069208 COMPUTER FORENSICS REPORT
Name: UnallocatectsClustersDescription: File,UnalloeatedClustersFileCreated:
LastAccessed:LastWritten:
FullPath: 08-069208\S013J10X237614\D\UnallocatedClusters
h t t p ; / / s e a r c h s e r v i c e . m y
s p a c e . c o m / i n d e x .
c f m ? f u s e a c t i o n = s i t e s e a r c h . r e s u l t s S \
q r y = z a i m i e S ty p e = P e o p l e S s r ch B y = N a n i e S g = FS l o c = o r l a n d o %2 C f l 3 2829aminAge=22 maxAge=\
26sd=25
Name; Unallocated ClustersDescription: File, Unallocated ClustersFileCreated:LastAccessed:
LastWritten:FullPath: 08-069208\S013J10X237614\D\UnallocatedClusters
" h t t p : / / x . m y s p a c e c d H . c o m / m o d u l e s / s i t e s e a r c h / s t a t i c / j s / s i t e s e a r c h 0 0 3 . j s " > < / s c r i p t >
< ! Search - S t a r t ~ >
8/11/2019 Accident Investigation Checklist
31/33
08-069208COMPUTERFORENSICS REPORT
Webmall inUnallocated Space
Name: Unallocated ClustersDescription: File, Unallocated Clusters
f S P afh* '
J|?j6WXE906472668\C\UnallocatedClusters
[iavascript:Help('http;//help.yahoo.com/help/us/mail/context/...]
To- caseyanthony" &&&&&itii
on7/23/07,m a
h a w .n .wrots, ^ ^ 1 : 1
reXfan 'd'S:1e^:^Sln
l^rStSXfL'e
^5:1^
yaKnJ w . a . s , r ea .about . is.Ka.foronce,n,
happyand iknow whoi amand whatiwantout oflife
on7/23/07,caseyanthony ^ ^ ^
on7/23/07,n,a*bawwns
8/11/2019 Accident Investigation Checklist
32/33
08-069208
ORANGE COUNTY SHERIFF'S OFFICECOMPUTERFORENSICS REPORT
Name: Lb55a353606038e56becf924d0a4dc1301jpgDescription: File, ArchiveFileCreated: 07/15/0810:15:30AM
LastAccessed:07/15/08 10:16:37AMLastWritten: 07/15/0810:15:31AM
FullPath: 08-069208\WXE906472668\C\Documents andSettings\bobby\Desktop\photos\l_b55a353606038e56bed924d0a4dc1301.jpg
-5.
-Cj
-
8/11/2019 Accident Investigation Checklist
33/33
ORANGE COUNTY SHERIFF'S OFF ICE
08-069208 COMPUTER FORENSICS REPORT
MessageFragments inallocated space
Name: _h.cfsDescription: File, ArchiveFileCreated: 07/13/0801;02:09PMLastAccessed:07/13/08 03:19:09PMLastWritten: 07/13/0801:02:09PM
FullPath: 08-069208\WXE906472668\C\Documents and Settings\bobby\LocalSettings\ApplicationData\Apple
Computer\Safari\History\_h.cfs
InboxSent M e s s a g e s N o t i f i c a t i o n s O p d a t e s ComposeMessageA A BetweenYou andShawn J a r r e t t A Sh
awn J a r r e t t Todaya tl l : 2 0 a i noo i ca nd i g i tg n g e l how'ds a tgo a tf u s i a nA Casey Anthon
yTodaya t11:28amid i d n ' t end upgoing l a s t n i g h t , ihungouth e r e w i t h n a t e . i twasb e t t e rto
smoke, eat,andwatch h o r r o rmovies. :) idi dt a l ktoraythough,he wase x p e c t i n g agood turn
out.A Shawn J a r r e t t Todaya t11:48amoht h a t s watup h o r r o r movie f a n a t i c m y s e l f watsu
P
Name: _h.cfsDescription: File, ArchiveFileCreated: 07/13/08 01:02:09PMLastAccessed:07/13/08 03:19:09PMLastWritten; 07/13/08 01;02;09PM . ^ ^ ,FullPath; 08-069208\WXE906472668\C\Documents and Settings\bobby\Local SettingsVXpplicationData\Apple
Computer\Safari\History\_h.cfs
Date: J u l13,200812:30 PM F l a g asSpamorReport Abuse [?]Subject:Re: RE: Re: No S u b j e c tBod
y:I may bedowntohead o v e r f r i d a y a f t e r workandhead back Saturday afternoon...
O r i g i n a l
Message
From: [casey] Date: J u l13,20089:20 AM f r i d a y night i r e a l l y wantto go. i'mt h i n k i n g about i t . how'veyoubeen? O r i g i n a lMes
sage From: B r e t t Date: J u l 13,, 2008 12:05PM Ididn't ge t a h o t e l yet,I c an
' t p l a n f a rahead haha.What n i g h t i si t ? O r i g i n a l Message
From: [casey] Date: J u l13,20088:20 AM heyhun! a reyouheadingout toj a c k s o n v i l l e t h i s week
end?
Name; l7tone.htmlDescription; File, ArchiveFileCreated; 4/29/0812:53;21AMLastAccessed; 06/12/0809;09;34AMLastWritten; 06/12/0809:09;34AM
FullPath; 08-069208X8013J10X237614\DXDocumentsandSettingsXOwnerXMy DocumentsXAIMLoggerXcaseyomarieXir
LogsXI7tone.html
ODOCTYPE
html PUBLIC "-//W3C//DTD XHTML 1.0T r a n s i t i o n a l / / E N "
"http://www.w3.org/TR/xhtmll/DTD/
x h t m l l - t r a n s i t i o n a l . d t d " >
IM History with buddy L 7 T o n e < / t i t l e > < l i n k r e l = " s t y l e s h e e t " h r e f = " s t y l e s . e s s " t y p e = " t e x t / c
ss">
,