Computer Forensic Testimony in the Casey Anthony Trial Regarding Differences Between the Findings of the Net Analysis

& CacheBack Software

No one ever testified that there were 84 searches for "chloroform." What was testified to at trial was that a website, SCI-SPOT.com was visited by someone looking for information about chloroform; CacheBack reported 84 while Net Analysis reported 1. There is a page on that website related to chloroform, and that is the page that was visited on that website. The testimony about the searches conducted on the Anthony home computer was given on the following dates by the following experts and can be found at: http://www.scribd.com/doc/61471988/Casey-AnthonyTrial-COMPUTER-EXPERT-Testimony-Unofficial-Transcript-Osborne-Stenger-Bradley . Links to video of the testimony referred to can be found in the text. Time stamps for the testimony referred to are included in the text. June 8th & 9th. Day 24. Mr. John Bradly, CEO of SiQUEST. page 3-22 http://www.wftv.com/videos/news/raw-video-day-24-in-casey-anthony-murder-trial-pt/vCZhg/ 25:55 John BRADLEY: "This appears to be a result of a search for chloroform, through GOOGLE, and then, or just a search for the word chloroform, and this is a result that was then generated by selecting one of the results." Bradley is talking about ONE search for "chloroform," not 84 searches. ========================================================================= page 3-35 http://www.wftv.com/videos/news/raw-video-day-24-in-casey-anthony-murder-trial-pt/vCZSR/ 26:03 John BRADLEY: "There's a chloroform search at 3:16 and 13 seconds at SCI-SPOT.COM." And two entries afterwards is a GOOGLE.COM search for chloroform." Bradley is talking about ONE search at SCI-SPOT.com and ONE Google search for chloroform, not 84 searches. ======================================================================= page 3-52 http://www.wftv.com/videos/news/raw-video-day-25-in-casey-anthony-murder-trial-pt/vCZRJ/ 16:34 Jose BAEZ: "And, as far as what you saw, in this internet history, all that you have testified to, all that you can testify to, are the actual URL links that you have viewed as a result of the work you did.?" 16:51 John BRADLEY: "That's correct. 17:00 Jose BAEZ: "Which do include 84 URL visits to the SCI-SPOT.COM." 17:04 John BRADLEY: "I should explain that a history keeps track of how many times you visit in the form of a counter. You would not expect to find 84 separate instances of a URL or a web record. Each record maintains its own counter. Um, does that answer the question."

17:31 John BRADLEY: "It only maintains the last visit time stamp, so, there could be a number of times a particular web site was visited, and it only maintains the last time it was visited, and increments the counter for each time it's visited." 17:44 Jose BAEZ: "And each time the page refreshes?" 17:46 John BRADLEY: "That is correct." 17:47 Jose BAEZ: "It would bring up, it would hit again, right?" 17:48 John BRADLEY: "Yes, that's correct." 17:49 Jose BAEZ: "And you don't know how often this page refreshes itself, do you sir?" 17:53 John BRADLEY: "I could speculate. 17:57 Jose BAEZ: "We don't want you to speculate. You can't testify to that, can you sir?" 18:00 John BRADLEY: "That's correct." 18:02 Jose BAEZ: "And, that would, of course, depend on the page itself and what is set up by the web site, correct?" 18:09 John BRADLEY: "That is correct." Here, clearly, Bradley tells Baez in this exchange that the registered 84 visits to SCI-SPOT.com could be the result of the webpage refreshing itself, which is a parameter that is set by the website construction. ======================================================================= June 23rd. Day 37. OCSO Sgt. Kevin Stenger. page 5-7 to 5-8 http://www.wftv.com/videos/news/raw-video-day-37-in-casey-anthony-murder-trialpt/vCcTn/ 00:30 Jose BAEZ: "Sir, I'd like to ask you to, I'd like to direct your attention to March 21st, 2008, at 14:16 hours and 34 seconds. Let me know when you find that." 00:50 Kevin STENGER: "I found that, sir." 00:51 Jose BAEZ: "Ok. And that is, what is the web site that is addressed with 34 seconds, there?" 00:59 Kevin STENGER: "The web site is WWW.SCI-SPOT.COM/chemistries/chloroform.htm." 01:10 Jose BAEZ: "And how many times does it show that that web site was visited?" 01:14 Kevin STENGER: "1, sir. 01:15 Jose BAEZ: "Now, I'd like to show you State's Evidence 166."

01:32 Jose BAEZ: "I'd like to direct your attention to the same web site at 15:16 hours and 13 seconds." 01:41 Kevin STENGER: "Yes, sir." 01:42 Jose BAEZ: "How many times does it show on the, well actually, what is this here?" 01:46 Kevin STENGER: "This item is the report for CACHEBACK." 01:51 Jose BAEZ: "And the report from CACHEBACK shows that it was visited how many times?" 01:54 Kevin STENGER: "84." 01:56 Jose BAEZ: "So there's a difference between the two softwares, is there not?" 02:00 Kevin STENGER: "That is correct." It is ABUNDANTLY clear here that Stenger tells the jury about the difference in the number of visits to SCI-SPOT.com found by the Net Analysis and Cache Back programs. Stenger testifies that the Net Analysis program found one visit to SCI-SPOT.com while the CacheBack program found 84. ============================================================================ pages 5-9 05:20 Jose BAEZ: "So, Sergeant Stenger, what you just testified to was that the chemistry, the SCI-SPOT was visited once, for chloroform, according to the NET ANALYSIS report, correct?" 05:34 Kevin STENGER: "That is correct." This exchange is pretty unambiguous. Stenger said that he testified that the Net Analysis software showed ONE visit to SCI-SPOT. com, not 84 visits. ========================================================================= It is also pointed out in the testimony that the Net Analysis software found 84 visits to MySpace while finding only one to SCI-SPOT.com, which is more believable than the other way around. It is clear that the Cache Back software had problems in parsing the information correctly while the Net Analysis software did not. Regardless, the prosecution did not try to hide any evidence about the internet searches for chloroform. They presented the jury with the evidence gleaned from BOTH programs and did not hide anything from them. As finders of fact, it was the jury's job to decide which one was the most accurate.

Some have said that the prosecution should have informed the jury about the errors in Bradleys CacheBack software. The first problem with this is that no one knows what the prosecution knew about this and when they knew it. Bradley testified in court regarding the results his CacheBack program because the OCSO detectives were confused by the results of his software, and they recruited the author of the software to testify to those results. Another problem is that when Bradley testified to the 84 visits to SCI-SPOT.com in the prosecutions case in chief, all those who defend Casey Anthony said that he was not credible because he was trying to make money off his software by testifying in this case, and that came directly from Baezs cross examination of Bradley; now, when he says something they agree with, they quickly dropped their old criticism of Bradleys bias. Furthermore, Bradley has publicly stated that he was not implying that the prosecution told him to lie as a previous statement on his part some

had taken to mean. But one fact of law renders these criticisms irrelevant. By law, the jury has the ability to reject, either in part or in total, any testimony or evidence they do not believe to be true, and this is explicitly stated in the jury instructions, pages 16 & 19, that were given to this jury:
WEIGHING THE EVIDENCE It is up to you to decide what evidence is reliable. You should use your common sense in deciding which is the best evidence, and which evidence should not be relied upon in considering your verdict. You may find some of the evidence not reliable, or less reliable than other evidence. You should consider how the witnesses acted, as well as what they said. Some things you should consider are: 1. Did the witness seem to have an opportunity to see and know the things about which the witness testified? Did the witness seem to have an accurate memory? Was the witness honest and straightforward in answering the attorneys' questions? Did the witness have some interest in how the case should be decided? Does the witness' testimony agree with the other testimony and other evidence in the case? Has the witness been offered or received any money, preferred treatment or other benefit in order to get the witness to testify? Had any pressure or threat been used against the witness that affected the truth of the witness' testimony? Did the witness at some other time make a statement that is inconsistent with the testimony he or she gave in court? EXPERT WITNESSES Expert witnesses are like other witnesses, with one exception - the law permits an expert witness to give her opinion. However, an expert's opinion is only reliable when given on a subject about which you believe her to be an expert. Like other witnesses, you may believe or disbelieve all or any part of an expert's testimony. http://www.scribd.com/doc/59297005/Jury-Instructions-Casey-Anthony

The jury was given the results of both programs Net Analysis showed one visit to SCI-SPOT.com while CachBack showed 84. It was obvious that one was wrong, and it was up to the jury to decide which was correct, which was not, and accept the one they believed to be correct. They could have disregarded the CacheBack results altogether if they chose to, and if they had done that, they were still left with enough evidence of at least one visit to SCI-SPOT.com to conclude that a visit to this website and the page about chloroform was, in fact, accomplished.