Appendix 4: Accident Investigation Check List

Appendix 4
Accident Investigation Check List

Pre-field investigation
[ ] Select investigation methodology/protocols
[ ] Design AI tasks to take full advantage of available resources.
[ ] Identify and define perceived self-interests of everyone affected by investigation
[ ] Negotiate with others who might be investigating
[ ] Identify and control personal risks to investigator
[ ] Define and order investigation tasks
Field investigation tasks
[ ] Do walkaround/lookaround to familiarize self with scene
[ ] Identify physical objects likely to change
[ ] Identify people data likely to change
[ ] Protect data sources against premature change
[ ] Formulate questions to generate needed data
[ ] Document post-occurrence physical states
[ ] Define pre-occurrence physical states of involved objects
[ ] Define physical changes (damages) during incident
[ ] Document post-occurrence physiological states
[ _ ] Prepare investigation - photographs
[ ] Prepare investigation - sketches
r ] Prepare investigation - drawings
[ ] Prepare investigation - maps
[ ] Prepare investigation - charts or graphs
[ ] Defme pre-occurrence physiological states
[ ] Define physiological changes (injuries) during incident
[ ] Identify and define change makers that produced outcome
[ ] Define actions required to produce observed ending conditions
[ ] Acquire data about interactions from witnesses
[ ] Acquire data about interactions from object sources
[ ] Transform observations into form entries
[ ] Transform observations into event descriptions
r ] Organize events sequentially
[ ] Focus energies on remainiag unknown events
[ ] Select events to break down or decompose
[ ] Define events pairs or sets for logic testing
[ ] Apply cause-effect logic to events paris and sets ^
[ ] Demonstrate causal relationships among interactions
[ ] Defme gaps in understanding of what happened
[ ] Hypothesize bounded scenarios to fill gaps
[ ] Acquire data to verify hypotheses
[ ] Develop plans for any testing/simulations
[ ] Apply necessary/sufficient logic to events
[ ] Separate relevant from irrelevant events/data
[ ] Do Quality Control check of final description
[ ] Use events description to define problem relationships
[ ] Use events description to evaluate problems or needs
[ ] Assess gravity of each need ( fix/don't fix)
[ ] Select problems/needs to address with recommendations
[ ] Identify candidate actions to address problems or needs ^
[ ] Use events sets to evaluate each candidate recommendation
[ ] Develop rationale for selecting recommendations to be proposed
r ] Develop recommendations effectiveness assessment plans and procedures
[_ ] Do objective quality assurance procedures for final investigation outputs
Post-field investigation
[ ] Prepare narrative description and explanation of what happened
[ ] Complete analysis to determine cause, causes, causal factors, root cause
[ ] Prepare final report
[ ] Defend final report
[ ] Respond to media inquiries
[ ] Do objective quality assurance procedures investigation process
[ ] Arrange for disposition of wreckage/debris/test objects
[__ ] Arrange for archiving of data sources
Lead investigator
[ ] Set daily task priorities for each investigator or group
[ ] Manage work force performance
[ ] Assure needed mformation exchanges among workers
[ ] Conduct public and private briefmgs
[ ] Manage quality assurance procedures for team tasks and outputs
[ ] Manage recommendation development process
[ ] Manage report preparation
Multinational investigations
[ ] Implement multinational investigating protocols
[ ] Implement customs and conventions of host state
[ ] Manage multicultural multinational investigation teams
[ ] Negotiate participation by non-government experts
[ ] Critique investigation process
Accident Investigation Preliminary Interview List
Interviewee/Title
Reason For Interview Phone
Location/Shifl/Company i
Affiliation
Notes
i
:
:
;
:
i
\
i
1
i 1
i
Documentary Evidence Log
Item
No.
Item Description Source of Document Requested By Rec'd
Y/ N
Accident Investigation Witness Statement Form
jName:
Uob Title:
iTelephone No.
iLocation at Time of Accident:
iHome Address:
ILocation of Accident:
[Occident Time and Date:
tlease fully describe the accident sequence from start to finish (use additional paper as needed):
Please fully describe the work and conditions in progress leading up to the accident (use additional
paper as needed):
jNote anything unusual you observed before or during the accident (sights, sounds, odors, etc.):
iWhat was your role in the accident sequence?
IWhat conditions influenced the accident (weather, time of day, equipment malfunctions, etc.)?
jWhatdo you think caused the accident?
How could the accident have been prevented?
jPlease list other possible witnesses:
lAdditional comments/observations:
Signature:
Physical Evidence Log
Item
No.
Item Description Received
Date
By
COC
Y/ N
COC - Chain of Custody form executed
EVIDENCE TAG
ACCI DENT
ITEMDESCRIPTION_
INVESTIGATOR AFFIXING TAG
DATE
ACCI DENT I NVESTI GATI ON
EVI DENCE
WARNING THIS ITEM IS EVIDENCE IN AN OFFICIAL
ACCIDENT INVESTIGATION. DO NOT
DISTURB WTTHGUT PERMISSION
Sample Evidence Tag to Identify Pieces of Physical Evidence.
Sample Photographic Log
Photographic Log
Name:
Agency:
Address:
Date:
Time:
Accident Identification:
Photo No.
(Roll/Exposure)
Subject
Exposure
Information
Flash
Y/N
CASENUMBER CASE NAME INCIDENT DATE
DATE/ TI ME EVENT ID EVENT DETAI L DESCRIPTION SOURCE OF DATA COMMENTS
08- 069208
ORANGE COUNTY SHERI FF' S OF F I CE
COMPUTER FORENSIC CELL PHONE REPORT Pagel
CASE AGENT:
Yuri Melich
Detective
Orange County Sheriffs Office
Criminal Investigations Division
Child Abuse/Missing Persons Squad
2500 W. Colonial Drive
Orlando. FL. 32804
COMPUTER FORENSI C EXAMINER:
Sandra G. Cawn
Detective
Orange County Sheriffs Office
Criminal Investigations Division
Computer Crimes Squad
2500 W, Colonial Drive
S E ARCH and S EI ZURE I J ^
August 4,2008:
Detective Mark Hussey, Orange County Sheriffs Office Homicide Unit presented this writer with the below
described cellular telephone and asked that all the text messages be extracted. The phone belongs to Cynthia
Anthony, who gave consent for the extraction.
PROCES S I NG and ACQUI SI xf ON NOTES
The Case Agent provided this examiner the foUov/ing for processing:
CELLULAR TELEPHONE:
I TEM
Make: Motorola
Model Number: V3 Razr
Possible Serial Number: 23755 93021 6
I MEI : 358921008652799
MSN:
SIM: 890141042008900 40872
EXAMI NATI ON SYNOPSIS
This examiner received the listed cellular telephone which was powered on. An extraction of data via the use of
Cellebrite software and cabhng was conducted. The contact list, call logs, tejrt mssages all dated either 8/02/08
and 8/03/08 and image files were recovered and reported on the attached report form.
Detective Sandra G, Cawn
Atigstt04-, 2008- '
Examination Report Page 1 of 10
Examination Report Properties
Selected Manufacture: Motorola GSM
Selected Model: Motorola V3 RAZR
Detected Manufacture: "Motorola CE, Copyright 2004"
Detected Model: "GSM900","GSM1800","GSM1900","GSM850","MODEL=V3"
Revision: "R374 G 0E.41.C3R B"
IMEi: 358921008652799
MSISDN; 14078084731
IMSI: 310410089004087
Extraction start date/time: 04/08/08 09:28:47
Extraction end date/time: 04/08/08 09:30:34
Phone Date/Time: "08/08/04,10:20:44+00"
Connection Type: USB Cable-
UFED Version: Software: 1.0.9.0 UPED.FullImaRe: 1.0.1.9, Tiny Image: 1.0,1.9
Examination Report Index
1. Contacts
2. SMS - Text Messages
3. Incoming Calls
4. Outgoing Calls
5. Missed Calls
6, hiiages
7. Ringtones
8. Audio
9. Video
Contacts
Total Entries: 28
PBB MD5 Hash: 05C03A0E29O88C3F02B4D8815EAF8456
#1 Debbie Akin (Phone memory)
General:
#2 Jody Parker (Phone memory)
Home;
#3 Roder B (Phone memory)
file://C:\Docujnents and Settings\Administrator\Desktop\Cindy Anthony cell phoneVBackup... 8/4/2008
nxammation Report
Page 2 of 10
Work:
17634798162
#4
Work:
Dave Nltti (Phone memory)
#5
Work:
Nilsa (Phone memory)
#6
J Duckett (Phone memory)
Work:
#7
Work:
Ryan (Phong memory)
#8
George @ Work (Phone memory)
Work:
#9
^ petectine MeUch (Phpne memory)
Work:
Work:
Carla Dagkett (Phone memory)
#11
Christina Chester (Phone memory)
Mobile:
#12
Jason Fort (Phone memory)
Work:
#13
Jose Baez (Phone memory)
Mobile: ^ ^ ^ ^ I H B
Work: ^ I ^ M I
Work:
i B l ^
#14
John Allen (Phone memory)
Mobile:
#15
General:
A Lee (Phone memory)
file://C:\Documents and SettmgsNAdministrator\Desktop\Cindy Anthony cell phoneVBackup... 8/4/2008
Examination Report Page 3 of 10
#16 A Home (Phone memory)
General:
#17 A George (Phone memory)
General:
#18 Casey (Phone memory)
General:
#19 Jim N B C (Phone memory)
Work:
#20 Kenneth (Phone memory)
Work:
#21 Annie (Phone memory)
Work:
f:
#22 Fox Holly Bristow QPhone memory)
Work:
#23 Don Silver Lead Allen (Phone memory)
Home:
#24 Christina Baez (Phone memory)
Work:
#25 Sonnie Cell (Phone memory)
Work:
#26 Ken Gagne (Phone memory)
Mobile:
#27 Jessica Never Lose Hope (Phone memory)
Work:
#28 Steue People Mag (Phone memory): ;
Work:
^ ^ ^ ^
file://C:\Doeuments and Settings\Admmistrator\Desktop\Cindy Anthony cell phoneVBackup... 8/4/2008
Examination Report
Page 4 of 10
SMS" Text Messages
S MS MD 5 Hash: F5 D1 D3 B3 BAF1 F6 1 7 A2 F9 4 8 7 9 EEE5 BF3 A
Number Name Date & Time Status ] Folder i Storage' rype rext
1 N/ A N/ A Sent Sent Outgoing CgUme
n 1
* A Lee N/ A Sent Sent Outgoing 4 o7 4667847
3
-
* Fox Holly
Bristow
02/08/08 12:22:33
(GMT-16)
Read Inbox
- -
(
t
t
I
Incomii^
iey Cmdy!
jeorge asked me
0 text this
lumber to both of
1. Mr. Mann
i02.204.2600
Dubhcist for
êricas Most
Wanted. Let me
mow If you need
mything.
4 N/ A
02/08/08 12:42:36
(GMT-16)
Read Inbox Incoming
Joyce stopped by
i*ublix looking for
you
5 N/ A
02/08/08 17:21:18
(GMT-16)
Read Inbox Incoming
Hi cindy! It's
emily ftom news
13. Just
wondering if we'd
J able to talk to u
today.
6 ! N/ A 02/08/08 23:31:25 Read Inbox Incoming
I know its late
3ut I needed 2
text u and tell u I
cried when I read
the "People"
article.,I saw
George on the
news & he said u
both felt the same.
Our team is due 4
a break. Pm
praying every day
that God hears my
cries. Words can't
express the pain I
feel 4 all. Seeu-
torn. Believing 4 a
miracl! Love,
HollY
Do u guys need
me at qie house
priof to tonight's
vigil at 830? I wai
mi
file://C:\Documents and Settings\Admmistrator\Desktop\Cindy Anthony cell phoneVBaekup... 8/4/2008
xamination Report
Page 5 of 10
7 1" ALee
03/08/08 13:17:25
(GMT-16)
Read Inbox Incoming
planning on being
a little early. Btw-
we should not
speak of any
letters from casey
8| * ALee
03/08/08 13:45:39
(GMT-16)
Read Inbox Incoming
Jose has
individual
messages to us
from Casey that
lie wants to give
to us tonight after
the vigil.. Would u
guys be up for
going to his
office?
9j r A Lee N/A Sent Sent Outgoing
When doesjose
want to meet?
10
W
^ ]
* A Lee
03/08/08 15:26:17
(GMT-16)
Read Inbox Incoming
After the vigil
spm.etinie tonight.
11
W
^ ]
1* Debbie
Akin
03/08/08 18:48:29
(GMT-16)
Read Inbox Incoming
May not get to be
there tonight but i
continue to pray
and love you
12
W
^ ]
* Debbie
AJdn
N/A Sent Sent Outgoing Love u
13
* Debbie
Akin
03/08/08 18:57:31
(GMT-16)
Read Inbox Incoming
Is there anything
i can do for u this
week ,
* Phonebook name lookup used to retrieve names
Incoming Calls
CLGMD5 Hash: 9999193F33E7C603AAF0541D734E67A6
Kame Date & Time Duration
* Kenneth N/A N/A
N/A N/A N/A
N/A N/A N/A
N/A N/A ' N/A
N/A N/A . N/A
N/A N/A N/A
N/A N/A N/A
N/A N/A N/A
N/A ; N/A
N/A N/A N/A
U Type
1 Incoming
2 Incoming
3 Incoming
4 Incoming
5 Incoming
6 Incoming
7 Incoming
8 Incoming
9 Incoming
10 Incoming
file://C:\Documents and Settings\Administrator\Desktop\Cindy Anthony cell phoneVBackup...
8/4/2008
Examination Report
Page 6 of 10
Outgoing Calls
CLOG MD5 Hash: 9999193F33E7C603AAF0541D734E67A6
Type
1 Outgoiig
2 Outgoing
3 Outgoing
4
Outgoing
5 Outgoing
6 Outgoing
7 Outgoing
8 Outgoing
9 Outgoing
1.0
Outgoiiag.
Number Name Date & Time Duration
N/A
N/A N/A
N/A N/A N/A
N/A
N/A N/A
* Jose Baez N/A N/A
* Steue People Mag. . N/A N/A
* Kenneth N/A N/A
8 N/A
N/A N/A
* A George N/A N/A
* ALee N/A N/A
N/A .N/A
N/A.
Missed Calls
CL0GMD5 Hash: 9999193F33E7C603AAF0541D734E67A6
u [Type Number Name
Date i& Time,
Duration
1 Missed i
m
* Kemieth N/A N/A
2 Missed N/A
N/A N/A
3 Missed
N/A
N/A N/A
4
Missed
N/A
N/A N/A
5 Missed
m
N/A
N/A N/A
6 Missed
. .
N/A N/A
N/A
7 Missed
N/A N/A N/A
8 Missed N/A
N/A N/A
9 Missed
N/A N/A N/A
* Phonebook name lookup used to retrieve names
Images
# Information
MetaData Image
Filename: hfiaeesNOS-18-07 1527.iD(i
Resolution:
file://C:\Documents and Settings\Administrator\Desktop\Cindy Anthony cell phoneVBackup... 8/4/2008
Examination Report ..., Page 7 of 10
1
File Path: picture
File Size: 24826 bytes
File Date/Time: 18/08/07 15:27:20 (GMT)
MD5:
087150C83E292F85EEBD96B0AD4219B
72x72 (unit:
inch)
Pixel
Resolution: "
640x480
2
Filename: Imaees\12-08-06 2025.jpg
File Path: picture
File Date/Time; 08/12/06 20:23:27 (GMT)
MD5:
B5C6CCE1FAAEFA052DB488B7CC215816
Resolution:
72x72 (unit-
inch)
Pixel
Resolution;
640x480
'ML.* '
3
Filename: Imaees\05-09-08 1350.ipg
File Path: picture
MD5:
5F85F5AF2544E90919E81C37CB27BF64
Resolution:
72x72 (unit:
inch)
Pixel
Resolution:
640x480
4
Filename; ImaEes\08-l8-07 1523.ipp
File Path: picture
MD5:
4C1910AF4B54F554C39E729EF18EABB9
Resolution;
72x72 (unit:
inch)
Pixel
Resolution;
640x480
!
5
Filename: Imaees\12-08-06 2021.iDe
File Path: picture
MD5:
3CD177DD6650091991101C916EC93E53
Resolution;
72x72 (unit:
inch)
Pixel
Resolution;
640x480
file://C:\Documents and SettingsVAdministrator\Desktop\Cindy Anthony cell phoneVBackup... 8/4/2008
tixarmnation Keport Page 8 of 10
Filename: Images\Q7-2Q-07_l 903.jpg Resolution:
File Path: pichire 72x72 (unit:
File Size: 22242 bytes inch)
File Date/Time: 20/07/07 19:03:44 (GMT) Pixel
MD5: Resolution:
846A3BEF86F9FD8D80E8D5E093ABC9B4 640x480 *
Filename: Images\12-08-06_2024.ipg Resolution:
File Path: picture 72x72 (unit:
File Date/Time: 08/12/06 20:23:08 (GMT) Pixel
MD5: Resolution:
C908BE9D8092F00560091B77B3E884A3 640x480
Filename: Images\ 12-08-06_2017.ipg Resolution:
File Size: 43158 bytes mch)
File Date/Thne: 08/12/06 20:17:55 (GMT) Pixel
MD5: Resolution:
OC10FE8542FE87B7C60820714601772F 640x480
10
Filename: Images\08-18-07 1522.ipg Resolution:
File Datemme: 18/08/07 15:22:32 (GMT) Pixel
MD5: Resolution:
1693F3D81AFFBEBU270793328084F2D 640x480
Filename: Images\12-08-06 2020.ipg Resolution:
File Path: pichire 72x72 (unit:
File Size: 26562 bytes mch)
File Date/Thne: 08/12/06 20:18:57 (GMT) Pixel
MD5: Resolution:
D4F68D844513AE8CF88E2529EDB1AB6B 640x480
file://C:\Documents and Settings\Admmistrator\Desktop\Cindy Anthony cell phoneNBackup... 8/4/2008
xanunation Keport
Page 9 of 10
11
Filename; Images\07-23-06 1827.jpg
File Path: picture
MD5:
35D05051E05FF28CC1BFC997EG291C65
Resolution:
72x72 (unit;,.,
inch)
Pixel
Resolution:
640x480
12
Filename; Images\ 12-Q8-Q6_2023.jpg
File Path; picture
File Date/Tune: 08/12/06 20:21:56 (GMT)
MD5;
98A5CA6DAC6B0967EF2506441BD2FF09
Resolution;
72x72 (unh:
inch)
Pixel
Resolution:
640x480
13
r
Filename; Images\ 12-08-06 2019,jpg
File Path: picture
File Size; 27106 bytes
File Date/T3ie: 08/12/06 20:18:36 (GMT)
MD5;
52A0DD2591B A27DFBC107D7B C223F6C1
Resolution:
72x72 (unit:
inch)
Pixel
Resolution:
640x480
14
Filename; Images\ 12-08-06 2022. ipg
File Path: picture
File Date/Tkne: 08/12/06 20:21:19 (GMT)
MD5:
C5CC21B34590A948750C406539BAECC2
Resolution:
72x72 (unit:
inch)
Pixel
Resolution:
640x480
o
15
Filename: Images\12-08-06 2018.jpg
File Path: picture
MD5:
9CE491856DC4DEAB934F332593B9B170
Resolution:
72x72 (unit:
inch)
Pixel
Resolution;
640x480
file://C;\Documents and Settings\Adminishator\Deslctop\Cindy Anthony cell phoneVBackup... 8/4/2008
ORANGE COUNTY SHERI FF' S OFFI CE
08-069208 COMPUTER FORENSICS REPORT
CASE AGENT:
Y u r i M e l i c h
D e t e c t i v e
Orange County S h e r i f f s O f f i c e
C r i m i n a l I n v e s t i g a t i o n s D i v i s i o n
C h i l d Abuse/Missing Persons U n i t
2500 West C o l o n i a l D r i v e
Orlando, F l o r i d a 32804
COMPUTER FORENSICS EXAMINER:
Sandra G. Cawn
D e t e c t i v e
Orange County S h e r i f f ' s O f f i c e
C r i m i n a l I n v e s t i g a t i o n s D i v i s i o n
Computer Crimes Squad
2500 West C o l o n i a l D r i v e
Orlando, F l o r i d a 32804
(407) 254-7000 e x t . 7-0593
Seizure and Processing Notes
S e i z u r e Notes:
On J u l y 16, 2008 a t a p p r o x i m a t e l y 2000 hours, D e t e c t i v e C h a r i t y Beasley o f the
Orange County S h e r i f f ' s O f f i c e Domestic V i o l e n c e Squad on b e h a l f o f D e t e c t i v e
C o r p o r a l Y u r i M e l i c h , s u b m i t t e d a Compaq P r e s a r i o C300 l a p t o p computer; s e r i a l
number CND6430RKH ( w i t h t h e power cord) and a Nokia RH-87 model 2610 c e l l u l a r
t e l e p h o n e ; IMEI# 011191/00/075157/2 t o the Computer Crimes Lab f o r examination.
D e t e c t i v e Beasley a d v i s e d these items belong t o the suspect o f t h i s
i n v e s t i g a t i o n and t h a t D e t e c t i v e C o r p o r a l M e l i c h was seeking a search warrant
t o examine the c o n t e n t s o f these two d e v i c e s . N e i t h e r o f t h e devices was
examined or processed u n t i l the w a r r a n t was o b t a i n e d . L a t e r t h a t evening,
D e t e c t i v e M e l i c h o b t a i n e d a search warrant f o r b o t h i t e m s . The c e l l phone was
processed and examined. A separate r e p o r t was s u b m i t t e d f o r t h i s i t e m .
On J u l y 17, 2008 a t 1330 hours, I n v e s t i g a t i v e A n a l y s t A w i l d a McBride of the
Orange County S h e r i f f ' s O f f i c e M i s s i n g Persons Squad, on b e h a l f o f D e t e c t i v e
C o r p o r a l Y u r i M e l i c h , s u b m i t t e d a. P o l a r o i d t730 D i g i t a l Camera, s e r i a l number
GR700405730013579 ( i n c l u d i n g a 1 GB P o l a r o i d SD memory card; s e r i a l number:
MM8GF016WMC-PA TC0D300753) and a San Disk U-3 USB thumb d r i v e f o r examination.
A l s o s u b m i t t e d was a H e w l e t t Packard P a v i l i o n , model# a520n, desktop computer;
s e r i a l niomber: MXM4100HYL. Mrs. McBride advised these items belong t o George
and Cindy Anthony, and t h a t we were g r a n t e d consent t o s e i z e and search these
items f o r any i n f o r m a t i o n t h a t may a s s i s t w i t h t h i s i n v e s t i g a t i o n .
On J u l y 21, 2008 a t 1052 hours, Mrs. McBride, on b e h a l f of D e t e c t i v e Corporal
Y u r i M e l i c h , s u b m i t t e d a Nikon C o o l p i x D i g i t a l Camera, s e r i a l number: 30258381
a l s o b e l o n g i n g t o George and Cindy Anthony f o r e x a m i n a t i o n . Consent was grantee
f o r the s e i z u r e and search o f these items.
Summary:
1) The Compaq l a p t o p computer
P i c t u r e s and video taken o f Caylee Anthony were bookmarked and copied t o the
Evidence\Graphic f i l e s \ C a y l e e f o l d e r . The image e n t i t l e d DSCN1894.JPG was taker
w i t h a Nikon C o o l p i x d i g i t a l camera. The date and t i m e from the metadata i n the
p i c t u r e i n d i c a t e t h a t the p i c t u r e was taken June 15, 2008 a t 12:03:27 pm.
D i g i t a l v i d e o f i l e s were a l s o taken w i t h a Nikon C o o l p i x d i g i t a l camera w i t h
the metadata date and time o f June 15, 2008 between 11:26:20 am and 12:03:18
pm.
There are s e v e r a l g r a p h i c f i l e s of i n t e r e s t ; the f i r s t i s e n t i t l e d " g i r l . j p g "
and t h e second, "233bc8d79357f3075c7edf5ddb083fll.jpg". Both were located' on
the C:\Documents and Settings\bobby\Desktop\artwork\misc f o l d e r on the Compaq
computer. Both g r a p h i c f i l e s were bookmarked and c o p i e d t o t h e Evidence\Graphic
f i l e s \ G r a p h i c s o f I n t e r e s t f o l d e r .
Also i n t h a t f o l d e r i s an image f i l e e n t i t l e d
"I_b55a353606038e56bed924d0a4dcl301.jpg". I was asked by D e t e c t i v e E r i c Edwards
t o i d e n t i f y on e i t h e r computer any males who may be members o f t h e U n i t e d
States M i l i a r y f o r c e s . This photograph i s o f a w h i l e male dressed i n
camouflage. The name on h i s s h i r t i s "Hawkins." Email between Casey Anthony and
Mark Hawkins was bookmarked i n the Web m a i l i n u n a l l o c a t e d space p o r t i o n o f
t h i s r e p o r t .
An MSWord document e n t i t l e d " d i a r y o f days.doc" was bookmarked. The Metadata
A n a l y s i s o f the document " D i a r y of Days" r e p o r t s the a u t h o r as CMANTHON o f the
GENTIVA C o r p o r a t i o n on J u l y 2, 2008 a t 10:42:08 am. The document was bookmarked
and c o p i e d t o the Evidence\Documents f o l d e r . The r e s u l t s o f the Metadata
A n a l y s i s were saved t o the same f o l d e r . Also bookmarked were s e v e r a l web page
e n t r i e s f o r B i l l Pay f o r the account "Casey Anthony, account number 04985420-
001-04" f o r payment o f a c e l l phone b i l l .
No photographs, v i d e o , e m a i l , i n s t a n t message chat or any o t h e r t y p e o f
communication w i t h a Zenaida Fernandez-Gonzalez was d i s c o v e r e d on e i t h e r
computer.
The I n t e r n e t h i s t o r y and cookies f o r the user "bobby" was e x t r a c t e d v i a
N e t a n a l y s i s . A l l were saved as comma d e l i m i t e d f i l e s t o t h e E v i d e n c e \ l n t e r n e t
History\Casey l a p t o p f o l d e r f o r v i e w i n g w i t h Excel.
2) The HP P a v i l i o n Desktop computer
On J u l y 16, 2008, A w i l d a McBride showed me a p r i n t - o u t of a MySpace b l o g dated
"Thursday, J u l y 3, 2008". The page i s t i t l e d , "my caylee i s m i s s i n g " . The web
page was bookmarked and r e p o r t e d i n the "my caylee i s m i s s i n g " p o r t i o n of t h i s
r e p o r t .
ORANGE COUNTY S HE RI F F S OFFI CE
The I n t e r n e t H i s t o r y f o r the p r o f i l e "Casey" on t h e HP computer was e x t r a c t e d
v i a Net A n a l y s i s . The H i s t o r y was t h e n f i l t e r e d f o r b o t h "MySpace" and f o r
"facebook." A l l the I n t e r n e t H i s t o r y f i l e s were saved t o the E v i d e n c e \ I n t e r n e t
H i s t o r y \ C i n d y Desktop computer\Casey p r o f i l e f o l d e r s as comma d e l i m i t e d f i l e s
f o r v i e w i n g u s i n g E x c e l .
A keyword search f o r "Zenaida" r e v e a l e d Web pages i n d i c a t i n g t h a t a user
searched t h e I n t e r n e t f o r t h a t name on J u l y 16, 2008. Those e n t r i e s were
bookmarked under the "Zenaida Fernandez Gonzalez" s e c t i o n of t h i s r e p o r t .
D e t e c t i v e M e l i c h requested a keyword search f o r " E r i c Baker." The name " E r i c
James Baker" was bookmarked under t h e s e c t i o n o f t h e same name w i t h i n the
r e p o r t .
S e v e r a l i n s t a n t message c o n v e r s a t i o n s were bookmarked and saved t o the
Evidence\Chat fragments\Fragments o f conversatons i n a l l o c a t e d space f o l d e r f o r
v i e w i n g u s i n g h t m l . The f i l e e n t i t l e d n y i t a l i a n o 3 . h t m l mentions t h e name
" z a n i . " This i s the o n l y r e f e r e n c e found thus f a r t o any v a r i a t o n o f the name
Zenaida. The chat does not i n d i c a t e t h e i d e n t i t y or l o c a t i o n o f " z a n i . "
S e v e r a l i n s t a n t message c o n v e r s a t i o n s were bookmarked and saved t o the
; Evidence\Chat fragments\Fragments of c o n v e r s a t i o n s i n u n a l l o c a t e d space f o l d e r .
j
3) The Nikon Coolpix D i g i t a l Camera was examined. Graphic and video f i l e s o f
Caylee and f a m i l y were bookmarked and saved t o t h e Evidence\Graphic f i l e s
f o l d e r .
4) Graphic and video f i l e s were examined from the P o l a r o i d d i g i t a l camera's
memory c a r d . Two g r a p h i c f i l e s - dated May 23, 2008 were l o c a t e d as w e l l as
o t h e r s t h a t were d e l e t e d , none o f which appear t o be o f p a r t i c u l a r e v i d e n t i a r y
v a l u e . They are not i n c l u d e d i n t h i s r e p o r t . Also s u b m i t t e d w i t h t h e P o l a r o i d
camera was a Sandisk U-3 1 GB thixmbdrive. Nothing o f e v i d e n t i a r y value was
d i s c o v e r e d . Both items were r e t u r n e d t o t h e f a m i l y by A w i l d a McBride.
5) On J u l y 22, 2008, D e t e c t i v e Edwards s u b m i t t e d a B l a c k b e r r y 8300 c e l l u l a r
phone b e l o n g i n g t o Anthony Lazarro t o t h e Computer Crimes Lab f o r the purpose
o f e x t r a c t i n g any data a v a i l a b l e . A s e p a r a t e r e p o r t was prepared and submitted
t o D e t e c t i v e Melich.
6) On J u l y 23, 2008, Amy Huizenga o f f e r e d her Nokia GSM c e l l u l a r phone, model
612 6 t o t h e computer crimes l a b f o r t h e purpose o f e x t r a c t i n g the phone book
and SMS messages. A separate r e p o r t was prepared and s u b m i t t e d t o D e t e c t i v e
M e l i c h .
7) On J u l y 24, 2008, B r i t t a n y Scheiber o f f e r e d her T-Mobile Shadow GSM
c e l l u l a r phone t o t h e computer crimes l a b f o r the purpose o f e x t r a c t i n g the
phone book and SMS messages. A separate r e p o r t was p r e p a r e d and submitted t o
D e t e c t i v e M e l i c h .
8) On J u l y 25, 2008, D e t e c t i v e Edwards s u b m i t t e d an LG KG800 c e l l u l a r phone
b e l o n g i n g t o Ricardo Morales t o the Computer Crimes Lab f o r the purpose o f
e x t r a c t i n g the phone book and SMS messages. A separate r e p o r t was prepared and
s u b m i t t e d t o D e t e c t i v e M e l i c h .
9) Also on J u l y 25, 2008, D e t e c t i v e Edwards s u b m i t t e d a Samsung SGH-A707 c e l l
phone b e l o n g i n g t o Troy Brown t o the Computer Crimes Lab f o r t h e purpose o f
e x t r a c t i n g the phone book and SMS messages. A separate r e p o r t was prepared and
s u b m i t t e d t o D e t e c t i v e M e l i c h .
10) A search w a r r a n t authored and o b t a i n e d by t h i s w r i t e r on J u l y 2 9, 2008 f o r
the purpose of l i s t e n i n g t o and a r c h i v i n g v o i c e m a i l messages as w e l l as SMS
messages incoming t o Casey Anthony's Nokia c e l l phone. An attempt was made
l a t e r t h a t same day t o execute the w a r r a n t , however the phone s e r v i c e had since
been d i s c o n t i n u e d and access was not p o s s i b l e .
11) During the course o f t h i s i n v e s t i g a t i o n , Sgt. John A l l e n o f the Orange
County S h e r i f f ' s O f f i c e C h i l d Abuse Squad advised t h i s w r i t e r t h a t i t would be
i n t h e best i n t e r e s t o f t h i s i n v e s t i g a t i o n t o o b t a i n a search w a r r a n t f o r t h e
HP desktop computer b e l o n g i n g t o George and Cindy Anthony. This w r i t e r authored
and o b t a i n e d a search w a r r a n t f o r the computer on August 6, 2008. The search
f o r evidence c o n t i n u e s as o f the date o f t h i s r e p o r t .
12) On August 4, 2008, Cindy Anthony o f f e r e d her Motorola V3 GSM c e l l u l a r
phone t o t h e computer crimes l a b f o r the purpose o f e x t r a c t i n g t h e SMS
messages. Nothing r e l e v a n t t o t h i s i n v e s t i g a t i o n was found. A separate r e p o r t
was p r e p a r e d and s u b m i t t e d t o D e t e c t i v e M e l i c h .
To d a t e , t h i s w r i t e r has a s s i s t e d o t h e r D e t e c t i v e s w i t h t h e r e c o v e r y o f s t i l l
photos and videos f r o m s t o r e s u r v e i l l a n c e cameras r e c e i v e d as CrimeLine Tips as
w e l l as CrimeLine T i p s from c i t i z e n s m o n i t o r i n g MySpace, Facebook, and
Photobucket. These t i p s are s t i l l b e i n g i n v e s t i g a t e d a t t h e t i m e o f t h i s
r e p o r t .
08-069208
O R A N G E C O U N I Y S H E ^ ^
COMPUTER FORENSICS REPORT
Cavlee / Family Photos
Name: DSCN1894.JPG
Description: File, Archive
File Created: 06/17/08 03:28;50PM
Last Accessed: 06/18/08 10:13:52AM
Last Written: 06/15/08 12:03:26PM
Entry Modified: f^^^^^SZ,,^,,^,^,^^,, and Seings\bobbv^Descp^photos^Ca.e Marieûne
2008\DSCN1894.JPG
Comment;
I m a g e D e s c r i p t i o n :
Make: NIKON
Model: COOLPIX L12
Software: COOLPIX L12V1.0
DateTime: 2008:06:15 12:03:27
D a t e T i m e O r i g i n a l : 2008:06:15 12:03:27
D a t e T i m e D i g i t i z e d : 2008:06:15 12:03.27
T h i s photograph was taken w i t h a Nikon ^^^^^tlt^^^^^^^
t i m e s e t t i n g on t h e camera a t the txme t h r s p i c t u r e w ^^^^^^ ^^^^^^^^
a t 12:03:26 pm. - f - ^ ^ ; ; ^ , : ^ ' ^ ^ ^ ^ ^ ^ ^ ( - t h i n 2 minutes) on the
date and time s e t t i n g s on t h e camera wer ^^^^ r e g a r d i n g t h i s
day t h e camera was examined ( J u l y 21, .^^ picture saved t o t
piLure o f caylee on t h e CoolPxx cam a i s t h e sameâs the
Compaq computer, meaning t h a t ^^^^^ t h e c ,^ ^ . ^ ^ ^ l ^ the camera
my caylee is missing
Name:
Description:
Full Path:
Unallocated Clusters
File, Unallocated Clusters
08-069208\S013J10X237614\D\Unallocated Clusters
File Offset: 8033745365
Thursday, July 03, 2008
IMG
[http://x.myspace.com/images/spacer.gif]
my caylee is missing
Current mood: IMG
[http;//x.myspace.com/images/blog/moods/iBrads/sad.gif]distraught
She came in
my life unexspectedly, just as she has left me. This precious little angel from above gave me strength and unconditional love, h
she is gone and I don't know why. All I am guilty of is loving her and providing her a safe home. Jealousy has taken her away.
Jealousy from the one person that should be thankfull for all of the love and support given to her. A mother's love is deep,
however there are limits when one is betrayed by the one she loved and trusted the most. A daughter comes to her mother for
support when she is pregnant, the mother says without hesitation it will be ok. And it was. But then the lies and betrayal began,
First it seemed harmless, ah, love is blind. A mother will look for the good in her child and give them a chance to change. This
mother gave chance after chance for her daughter to change, but instead more lies more betrayal. What does the mother get fi
giving her daughter all of these chances? A broken heart. The daughter who stole money, lots of money, leaves without warnir
and does not let her mother now speak to the baby that her mother raised, fed, clothed, sheltered, paid her medical bills, etc.
Instead tells her friends that her mother is controlling her life and she needs her space. No money, no future. Where did she gc
Who is now watching out for the little angel?
[http://blog.myspace.com/index.cfm?fuseaction=blog.view&frien...]
08-069208
Image Files of Interest
Name: girl.jpg
File Created: 07/08/08 10:14:53PM
Last Accessed: 07/10/08 09:41:03PM
Last Written: 07/08/0810:14; 54PM , ^ m \ - r ^
Full Path- 08-069208\WXE906472668\C\Documents and Settings\bobby\Desktop\artwork\misc\girl.jpg
Name: 233bc8d79357f3075c7edf5ddb083f11 .jpg
File Created: 07/11/08 02:21:30PM
Last Written: 07/11/08 02:21:30PM
Full Path- 08-069208\WXE906472668\C\Documents and
Settings\bobby\Desktop\artwork\misc\233bc8d79357f3075c7edf5ddb083f11.jpg
You CAN SPEND MIb4UTBS. HOURS,
DAYS. W OR I VI N MONTHS
Om- ANAIYZING ASTTUATION;
TRYING TO PUT THE MECE
TOCSETHER. JUSTIFYING WHAT
COUliNt WOULD^VE HAPPINED
... OR YHJ CAN JOST tEAVE
THE PIECE ON THE HXX)R AND
MOVE THE FUCK ON
08-069208
ORANGE OUNTY SHERI FF' S OFFI CE
On August 12, 2008 a t approximately 0900 hours. D e t e c t i v e Y u r i M e l i c h requestec
the date and t i m e o f when t h e f o l l o w i n g photograph was posted t o the website
Cupid.com. The EXIF data f o r the image suggests t h a t t h e P o l a r o i d camera date
and time was s e t t o March 20, 2008 a t 07:06:48.
According t o Cupid.com i n Poughkeepsie, New York, Casey Anthony's Cupid.com
member p r o f i l e was c r e a t e d on May 20, 2008 a t 12:59 pm EDT. The l a s t l o g on
date was May 27, 2008.
Name: P1CT0105.JPG
File Created: 03/20/08 08:06:48AM
Last Written: 03/20/08 08:06:52AM
Full Path: 08-069208\WXE906472668\C\Documents and Settings\bobby\Desktop\photos\misc\PICT0105.JPG
y 0 y a * E x i f I I * A O
- ffi 1- { 1 - - - 2 p----
. .:^ n H ME-H i d X v D I G I T A L
CAMERA - - P o l a r o i d - - P o l a r o i d - -H H V I . 0 4 P - 2 0 0 8 : 03 : 20
0 7 : 0 6 : 4 8 - - - s , 4 - - "* ' " d 0 2 2 0 - < -
,1 /
d ' 1 '
t - - - - ' I - - - - ' P - - ' ' Y - - -
' - - I ' - i s - -CE 0 1 0 0
Y- - ,
- 2 0 0 8 : 0 3 : 2 0 0 7 : 0 6 : 4 8 - 2 0 0 8 : 0 3 : 2 0 07 : 0 6 : 4 8 - - - - d - - * - - - d
- - 6 1 0 - - - 6 7 - 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 '
Documents of Interest
diary of davs.doc
Name: diary of days.doc
File Created: 07/02/08 10:51:12AM
Last Written: 07/02/08 10:51:12AM
Full Path: 08-069208\WXE906472668\C\Documents and Settings\bobby\Desktop\diary of days.doc
Zenaida Fernandez Gonzalez
A keyword search f o r "Zenaida" was conducted on t h e HP desktop computer. Th
f o l l o w i n g f i l e s are records o f web pages i n d i c a t i n g t h a t someone was search
f o r t h a t name on the I n t e r n e t .
Name: casey@www.reunion[2].txt
File Created: 07/16/08 06:21:17AM
Last Written: 07/16/08 06:21:27AM , ^ ,. , ^ ir9i tv+
Full Path: 08-069208\S013J10X237614\D\Documents and Settings\casey\Cookies\casey@www.reunion[2J.txt
zenaida
Name: history.dat
FileCreated: 10/22/07 01:13:21PM
LastWritten: 07/16/08 12:03;24PM
Full Path: 08-069208\S013J10X237614\D\Documents and Settings\casey\Application
Data\Mozilla\Firefox\Profiles\mfhaxjkl.default\history.dat
http://friends.myspace.com/index.cfm ?fuseaction=user.viewfriends\=203461948897ec12-9984-4944-b65e-
6dcef3d5a590=zenaida
Name: index.dat
FileCreated: 06/12/0811:15:29PM
Last Accessed: 06/12/08 11:15;29PM
Fuf / i ^t l ^" 08-069208\S013J10X237614\D\Documents and Settings\casey\Local Settings\Temporary Internet
Files\Content.lE5\index.dat
http://clk.atdmt.com/RC/go/whtpgreu0210000164ruc/direct;at.rucreu00001670;ct.l/01?dispat^^^^
SearchRegistrationSaction=peopleSearch_wp_resultcountScity=Sit>name=SpeopleSearchFrom=wp&affiliate
id=131SsearchFirstName=zenaidaSsearchLastName=Gonzalez&searchAge-25
Name: index.dat
File Created: 06/12/08 11:15:29PM
Fuf pat h^" 08-069208\S013J10X237614\D\Documents and Settings\casey\Local Settings\Tennporary Internet
Files\ContentlE5\index.dat
http://preview. U3sear ch.com/preview/ala/neHsearch?SsearchLName=Fernandez&searchState-FLSs^
ty=jacksonvilleSsearchFName=ZenaidaSadID=303014F936&adsource=8STID=0Scid=peopleSsearchtab=people
6--newsearch[2]
- 08-069208 COMPUTER FORENSICS REPORT
Name: UnallocatectsClusters
Description: File, Unalloeated Clusters
File Created:
Last Accessed:
LastWritten:
Full Path: 08-069208\S013J10X237614\D\Unallocated Clusters
http;//searchservice.my space.com/index. c f m ? f u s e a c t i o n = s i t e s e a r c h . r e s u l t s S \
qry=zaimieStype=PeopleSsrchBy=NanieSg=FSloc=orlando%2Cfl32 82 9aminAge=22&maxAge=\
2 6sd=25
Name; Unallocated Clusters
Description: File, Unallocated Clusters
File Created:
Last Accessed:
Last Written:
" h t t p : / / x . m y s p a c e c d H . c o m / m o d u l e s / s i t e s e a r c h / s t a t i c / j s / s i t e s e a r c h 0 0 3 . j s " > < / s c r i p t >
< ! Search - S t a r t ~ >
<div id="searchContent'!>
<div i d = " s i t e S e a r c h " c l a 3 s = " g l o b a l " >
<input type="hidden" i d = " f u s e a c t i o n " queryID="fuseaction" v a l u e = " s i t e s e a r c h . r e s u l t s " / >
<div c l a s s = " s e a r c h F i e l d " >
<input type="text" c l a s s = " s e a r c h F i e l d I n p u t " maxlength="100" s i z e = " 3 5 " id="qry" name="qry" que
ryID="qry" t i t l e = " S e a r c h MySpace" value="zarmy" onkeypress="return keyPressHandler(event, ' s e a r c
hButton');" />
Name: Unallocated Clusters
File Created:
Last Accessed:
Last Written:
"http://searchservice.myspace.com/index. c f m ? f u s e a c t i o n = s i t e s e a r c h . r e s u l t s S q r y = z a n i e S t y p e = P e o p l e S
srchBy=NaineSg=FSloc=orlando%2Cfl32 82 95upic=onSnpic=onSminAge=22SmaxAge=26sd=25
08-069208
Web mall in Unallocated Space
Name: Unallocated Clusters
f S Pafh*' J|?j6WXE906472668\C\Unallocated Clusters
[iavascript:Help('http;//help.yahoo.com/help/us/mail/context/...]
To-"casey anthony" <caseyomarie@yahoo.com> &&&&&i tii
on 7/23/07, ma* haw.n. <^Ki "S. . *gn, al Uon, > wrots, ^ ^ 1 : 1 "
reXfan'd'S:1e^:^Sln l^rStSXfL'e" ^5:1^ ya Kn J w. a . s ,rea. about . is .Ka. for once ,n,
happy and i know who i am and what i want out of life
on 7/23/07, casey anthony <-syomarie@yahoo.om >^^^^^^
on 7/23/07, n,a*bawwns<baw.ns.d,.^^^^^^^^^^^^^
'Zl^'^fZl fhi: c l " K r * i S i ^ ^ y blTsTh^Jtcan be an amazing .a,e .o,e . ode, , your daughter
r f e T o : j H s r . " = T S ^ ^ ^ ^ ^
between now, and the time you FINALLY get your ass home.
08-069208
Name: Lb55a353606038e56becf924d0a4dc1301 jpg
FileCreated: 07/15/0810:15:30AM
LastWritten: 07/15/0810:15:31AM
Full Path: 08-069208\WXE906472668\C\Documents and
Settings\bobby\Desktop\photos\l_b55a353606038e56bed924d0a4dc1301.jpg
-5. -Cj -(^
Message Fragments in allocated space
Name: _h.cfs
File Created: 07/13/08 01 ;02:09PM
LastWritten: 07/13/08 01:02:09PM
Full Path: 08-069208\WXE906472668\C\Documents and Settings\bobby\Local Settings\Application Data\Apple
Computer\Safari\History\_h.cfs
InboxSent MessagesNotificationsOpdates Compose Message A A Between You and Shawn J a r r e t t A Sh
awn J a r r e t t Today a t l l : 2 0 a i n oo i can dig i t gngel how'd s a t go a t f u s i a n A Casey Anthon
y Today a t 11:28am i d i d n ' t end up going l a s t night, i hung out here with nate. i t was b e t t e r to
smoke, eat, and watch h o r r o r movies. :) i d i d t a l k to ray though, he was expecting a good t u r n
out. A Shawn J a r r e t t Today a t 11:48am oh t h a t s wat up horror movie f a n a t i c myself wats u
P
Name: _h.cfs
File Created: 07/13/08 01:02:09PM
LastWritten; 07/13/08 01;02;09PM . ^ ^ ,
Full Path; 08-069208\WXE906472668\C\Documents and Settings\bobby\Local SettingsVXpplication Data\Apple
Computer\Safari\History\_h.cfs
Date: J u l 13, 2008 12:30 PM F l a g as Spam or Report Abuse [ ? ] Subject: Re: RE: Re: No S u b j e c t Bod
y: I may be down to head over f r i d a y a f t e r work and head back Saturday afternoon...
O r i g i n a l Message From: [casey] Date: J u l 13, 2008 9:20 AM f r i d a y nigh
t i r e a l l y want to go. i'm t h i n k i n g about i t . how've you been? O r i g i n a l Mes
sage From: B r e t t Date: J u l 13,, 2008 12:05 PM I didn't get a h o t e l y e t , I can
' t p l a n f a r ahead haha. What n i g h t i s i t ? O r i g i n a l Message
From: [ c a s e y ] Date: J u l 13, 2008 8:20 AM hey hun! are you heading out to j a c k s o n v i l l e t h i s week
end?
Name; l7tone.html
Description; File, Archive
File Created; 4/29/08 12:53;21AM
Last Accessed; 06/12/08 09;09;34AM
LastWritten; 06/12/08 09:09; 34AM
Full Path; 08-069208X8013J10X237614\DXDocuments and SettingsXOwnerXMy DocumentsXAIMLoggerXcaseyomarieXir
LogsXI7tone.html
<?xml version="1.0" standalone="yes" encoding="OTF-8" ?>
ODOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 T r a n s i t i o n a l / / E N " "http://www.w3.org/TR/xhtmll/DTD/
x h t m l l - t r a n s i t i o n a l . d t d " >
<html>
<head>
<meta http-equiv="content-type" content="application/xhtml+xml;charset=utf-8"/>
< t i t l e > I M H i s t o r y with buddy L 7 T o n e < / t i t l e > < l i n k r e l = " s t y l e s h e e t " h r e f = " s t y l e s . e s s " t y p e = " t e x t / c
s s " >
</head> ,
<body><hl><irag src="http://api.oscar.aol.com/expressions/get?f=nativeStype=buddyIconSt-17tone h
eight="48" border="l" alt="icon"/>S#160;IM H i s t o r y w i t h buddy <a href="aim:goim?screenName=17ton
e StargetBuddyList=cas eyomarie">L7 Tone</a></hl>
<table width="100%%" c e l l p a d d i n g = " l " c e l l s p a c i n g = " 0 " >
<tr><td colspan="2" class="time">Tuesday, A p r i l 29, 2008</td></tr>
</<tr><td class="remote">L7Tone (12:53:20S#160;AM) :</td><td class="msg" width="100%"><font
f a c e = " H e l v e t i c a " absz="12" color="#000000">i t h i n k your laughable</font></td></tr>

Appendix 4: Accident Investigation Check List

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Appendix 4: Accident Investigation Check List

Uploaded by

Copyright:

Available Formats

Appendix 4

Accident Investigation Check List

You might also like