“Decoding” the Anthony Family Computer

I haven’t been involved in the computer industry for several years, so I may not be apprised of the all the current buzz words, but yesterday a computer forensics expert (John Bradley) testified in the Casey Anthony trial about “decoding” a portion of the Firefox 2 search cache on the Anthony family’s computer in December 2009: “decoding” isn’t something I had ever heard a computer scientist or programmer (a.k.a. coder) talk about. So I did a Google search of my own to try to “decode” the man’s testimony. What I learned has—once again—troubled me about the way computer-search information is used in American courtrooms.

An April 13, 2011, story by Adam Long of CFNews13.com explains that two Orlando police officers attempted in the summer of 2008 to extract search information from the Anthony family computer using a product called CacheBack (designed by Bradley) and failed. When Sgt. Kevin Stegner met Bradley at a 2009 conference in Orlando, he asked for Bradley’s help. (It sounds to me—this is just a hunch—that Stegner didn’t understand that he could have demanded Bradley’s help in 2008, since Bradley’s product was not performing as advertised. I understand there’s at least one computer-industry professional on the jury who is likely to realize this, too.)

In any case, as Bradley stated in a 2010 deposition, he gladly worked late into the night for three nights on the problem. He resolved the issue and now calls that effort “decoding” the search database. IMHO as a former computer programmer of sorts, what he did was debug CacheBack’s inability to extract search strings from the Firefox 2 data written to the cache on the Anthony hard drive.

Jose Baez yesterday attempted to impeach Bradley by implying to the jury that the bug was in the reported data, rather than the program. He also pointed out Bradley had a strong financial interest in being able to satisfy the Orlando police department about the quality of the product he had sold them. This first implication is misleading. Nothing I read in the deposition suggested that the report contained errors, but the second implication does resonate with me.

Why? Because the police told Bradley what results they were seeking from his efforts and why. That’s right. You read that correctly. The police told Bradley they wanted to find search strings involving “chloroform” because they were investigating the Casey Anthony case.

Surely I don’t have to tell anyone that it isn’t “scientific” to specify the results of an experiment before you conduct the experiment.

No wonder Jose Baez asked at least one prospective juror if he understood why you can’t prove a negative. The Casey Anthony jury is being presented with a situation where Casey Anthony has to prove that 1) she did not run a search on “chloroform” on her family’s computer and 2) even if she did she was not searching for “how to make chloroform” because she wanted to make and use chloroform on her child.

That’s having to prove a negative.

Bradley didn’t “decode” all the search engine data on the computer, by his own admission. He did not look at data from several other browsers that were present on the computer. He did not work on the issue of whether the computer had several “users” with separate passwords. He did not look for any string of characters other than “chloroform,” so he did not turn up any search results that might have supported Casey Anthony’s contentions about how Caylee died.

Very, very bad use of computer forensics. I’m disgusted.

 
Trackbacks
  • Trackbacks are closed for this post.
Comments
  • No comments exist for this post.
Leave a comment

Comments are closed.