Professional Documents
Culture Documents
i,
(")
,.,
r- I"-.)
~
COUNTY DEPARTMENT, CRIMINAL DIVISION 0::00 c:::>
~""o ..."
nO :,::"
0""' ,-
fTl
O -'~.·
CO
"'<'I!.t~
:;:K xr T"l....,.
_.~
I
PEOPLE OF THE STATE OF ILLINOIS, ) \ ) .r"\ --
W
0 :"':
C h I:;
z " :x.
-I~C
-0
:x
'·n
Plaintiff,
:<-I:E
;::gz
W :J
N
c: N
::0
-I
v. No. 08 CR-10502
ANNABEL K. MELONGO
Defendant.
Comes now the defendant, ANNABEL K. MELONGO, Pro Se, and asks that this Honorable Court, pursuant
to Supreme Court Rule 411, et seq., compels the State to produce additional discovery information and
delivers it to the Accused , pursuant to the broad power and discretion granted to this Court by the
Illinois Supreme Court; and as grounds for said request alleges and states:
1. The indictment in this cause alleged that the defendant committed Computer Tampering, Count
I and II, on or about April 2008, and Count III, on or about May 1, 2006, in violation of 720 ILCS,
5/16D-3 of the Illinois Complied Statutes by remotely accessing Save-A-Life Foundation ( "SALF")
servers/computer.
2. Allegedly a Cook County Grand Jury was convened in Cook County, pursuant to 725 ILCS 215/1 et
seq.
3. Allegedly, the Judge supervising the aforesaid Statewide Grand Jury somehow determined that
4. The Defendant was presented with a transcript of the proceeding of said Cook County Grand
Jury.
5. Discovery tendered to the Defendant provided, among other documents, police reports from the
Schiller Park Police Department, Three CDs, correspondence from the Illinois Attorney General,
reports of Attorney General forensic expert, list of deleted files, printouts of logs and Email
6. The reports of the expert is misleading, open-ended and incomplete without any data with
7. That the People have individuals identified as witnesses, including lay witnesses (civilian) who
were in communication with each other and collaborated in rendering opinion s, including
8. On April 14th , 2009, Defendant filed a Motion For Additional Discovery. It's not until November
12 th, 2009, that the State re sponded to Defendant's motion. In the response however, the
evidence supporting the charges couldn't be provided stating liThe People's investigation is
ongoing ". The Defendant has documents in her possession testing to the contrary, attached
possess ion of witne sses for the People and she contends that she has th e rig ht to copy and
review sa id documents in order to determine whether they conta in evid ence material to he r
A. Any evidence relating to Count I. Including, but not limited to, forensic examination
data/evidence, log files of computer data server, confessions, witness statements, video, tapes
recordings, radio communications and handwritten or typed memoranda. The data provided
B. Any evidence relating to Count II. Including, but not limited to, forensic examination
data/evidence, log files of computer data server, confessions, witness statements, video,
tapes recordings, radio communications and handwritten or typed memoranda. The data
C. Any evidence relating to Count III . Including, but not limited to, forensic examination
data/evidence, log files of SAVE A LIFE Foundation founder's computer, confessions, witness
statements, video, tapes record ings, radio communications and handwritten or typed
memoranda. The data provided so far to the Defendant is lacking such evidence.
D. Provide All communications ( emails, memos, faxes, documents of any kind) between Don
Peters (computer consultant) and any individua l at SAlF regarding the incident/progress of
system recovery.
E. Provide All communications ( emails, memos, faxes, documents of any kind) between Don
Peters and Detective Martin regarding his report to Carol Spizzirri and his recovery findings .
Specifically as mentioned in the police report "other people prior to him having access to and
F. HAND-WRITTEN copy of complaints related to reports #06-3714 and #06-3219 with Carol
G. Page '7' of "Investigative Follow Up Report" of the Schiller Park Police Department is
missing.
H. Copy of report faxed by Sgt. leach from Kansas City Police to Detective Martin.
I. Contact Information of the "Experts" mentioned in the Grand Jury Transcript, page 8, lines
15 -24. Contact Information should be address, phone, fax( if available) and corporate email( if
available ). Also provide All communications ( emails, memos, faxes, documents of any kind)
between ANY SAlF's employee with the said experts if the communication documents are
J. Defendant has been provided with ONLY list of deleted files. Defendant needs to know
K.. Evidence of intrusion of SAlF servers and computer using GO-TO-MY-PC software. As stated
l. Creation date of All "Typed Uris" mentioned in the forensic report. Since the Defendant
used her laptop to accomplish her job as network administrator and programmer while
working at SAlF, the dates when those uris were typed are crucial.
M. Creation and Modification dates of ALL SALF related files listed in t he Forensic Report.
Defendant has reasons to believe that NONE of those files constitute viable evidence; since
the files were created either long before the Defendant was employed at SALF or during her
N. Date of creation of ALL the usernames and passwords found on the Defendant's laptop.
Since the Defendant used her laptop to accomplish her job as network administrator and
programmer while working at SALF, the dates those username and passwords were saved are
crucial.
O. Creation and Deletion dates of "Two links files found in the Recycle Bin for a network
connection to Save- A- Life Foundation" as mentioned in the forensic report. Since the
Defendant used her laptop to accomplish her job as network administrator and programme r
while working at SALF, the dates those files were created and deleted are crucial.
P. Copy of email Defendant sent to SALF employees as mentioned in the police report.
Q. Disclose the identity of the person with email dated May 4, 2006 at 9:41 pm from 'Technical
Support'. Including the name and address of the person sending the E-mail to Carol Spizzirri.
R. Copies of ALL papers documents( bills, SALF related documents, travel tickets, paycheck
stubs, currency exchange receipts or any other document) taken from Defendant's apartment
B. Whatever other relief this Honorable Court deems relevant, necessary, and just to ensure the
Accused her right to full discovery necessary and proper to a preparation of a bona fide defense.
In case the State is unable to provide ALL information as requested, the Defendant further asks this
Respectfu Iy submitted,
ANNABEL K. MELONGO
ANNABEL K. MELONGO
Addison , IL 60101
630/220-4132
IN THE CIRCUIT COURT OF COOK COUNTY, ILLINOIS
COUNTY DEPARTMENT, CRIMINAL DIVISION
NOTICE OF FILING
PLEASE TAKE NOTICE that on February 3th , 2010, I have filed with the Clerk of the
Circuit Court of Cook County, Illinois, a MOTION TO COMPEL DISCOVERY OR TO DISMISS, a copy of which
is herewith served upon you.
Annabel Melongo
630-220-4132
CERTIFICATE OF SERVICE
I served this Notice of Filing and documents referred to therein upon counsel as listed above
via personal service on February 3 th ,2010 prior to 5:00 p.m in 13 th Floor, 2650 S. California Ave., Chicago,
Illinois.
_~- '0-103/ /u
._. __ - -----
. - - - -
Lisa Madigan
AT TORNEY GENERAL
Dear Scott:
Per our telephone conversation, the following materials for the above-referenced matter
accompany this correspondence in anticipation of our meeting:
The following criminal statutory provisions contain felony charges that may apply to the matter:
720 ILCS 5116D-3 (Computer Tampering), 720 ILCS 5116D-4 (Computer Fraud),720 ILCS
5116G-15 (Identity Theft) and 720 ILCS 5/14 (Eavesdropping).
Detective Martin, Senior Computer Evidence Recovery Technician Monge and I are looking
forward to discussing the matter with you at your office located at 2121 Euclid Avenue, Rolling
Meadows, on Monday, October 30, 2006 at 9:30 A.M.
Sincerely,
~~
Assistant Attorney General
Office of the Illinois Attorney General
High Tech Crimes Bureau
Direct Voice: 312-814-1155
Email: kfrench@atg.statejI.us
Encls. EXh{bit 10
cc: Detective William Martin, via facsimile 847-671-9389 (w/o encls.)
SCERT Shahna Monge, via personal delivery (w/o encls.)
500 South Second Street, Springfield. lIIinois 62706 • (217) 782·1090 • TTY: (217) 785-2771 • Fax: (217) 782-7046
100 Wen Randolph Srreec, Chicago, Illinois 60601 • (312) 814-3000 • TTY: (312) 814-3374 • Fax: (312) 814-3806
1001 EaSt Main. Carbondale, Illinois 62901 • (618) 529-6400 • TTY: (6181529-6403 • Fax: tlillll .~ 2q-h41(' .-.
Office of the Attorney General
High Tech Crimes Bureau
Regional Computer Forensic Lab - Chicago
Forensic Report - 09/ 18/2006
The hard drive £i·om the computer system relating to tlils case was locked (write-protected) via
the use of the Encase Fast Bloc IDE to SCSI imaging device. The hard drive was then imaged to
a separate hard drive within the forensic computer. The ZIP media was imaged to the same hard
drive witllln the forensic computer, and a separate file was created for each ZIP disk. The ZIP
media was acquired though Encase's network acquisition and the ZIP drive was locked to
prevent writing to the media through Encase in DOS mode before the acquisition was beglm.
The CD media was imaged to the same hard drive within the forensic computer, and a separate
file was created for each CD. The forensic CD drive does not have writing capabilities. The
USB thumb drive was imaged to the same hard drive witlllll the forensic computer. The thumb
drive was write-blocked by the use of a Windows registry change that prohibits any writes being
made to any media connected via USB.
1
This imaging process entailed the creation of an evidence file (disk image) in which the hard
drive/ZIP/CDiUSB thumb drive were recreated sector by sector in a forensic environment
utilizing forensic software licensed and registered to Shahna G. Monge, Senior Computer
Evidence RecovelY Technician a11cl/or the Illinois Att011ley General.
This process allowed the forensic examination to proceed without alteling any of the original
files fi-om the suspect media, and also preserved File, Disk and Volume Slack. This also allowed
the unallocated sectors of the disk to be searched and examined. The process detailed above also
allowed for forensic examination of RAM Slack.
I reviewed the case files provided by Detective Mrutin, Schiller Park Police Deprut1l1ent. After
review of the search WruTrult, it was detenllined that I would attempt to recover any infonnation
that would constitute evidence of the offense Computer Tampering and also detelIDine
ownership/control ancl/or dominion over the data.
The forensic examination was completed and forensic repOlts ru'e listed under their respective
names and were provided as sepru'ate documents (files) to Detective Mmtin.
• Two link files were fOlmd in the Recycle Bin for a network connection to Save A Life
Foundatioll.
• Log files for the program Go To My PC were discovered. Go To My PC is a program that
allows remote access to another computer.
• A log file for the Jakalia service were discovered that contained entries for the specific date
and time of the intlUsioIl. Jakarta is a project to create rul open-somce java-based selver.
• Connection settings were found in the Microsoft network c01ll1ections phonebook resident on
the laptop computer.
• Within a restore point "snapshot" that was automatically created by the computer, there was
a text document discovered naIlled "domain.txt" that contains infonnation relating to a
computer on the domain savealifefou.
• A cookie file containing IF information for comcast server with IP 24.15.202.102 was
discovered. File last written 04/28/06 09:43 :13hrs.
• Several instrulces of the IP 24.15.202.102 were discovered on the evidence. Please see the
forensic repOli for f1.l1ther details.
• The URL ft ·p-:·/I7·0·.·1·4·2·.·2·5·1· .·2-4-2·;·· was found in the regishy in the folder
"TypedURLs" for Windows user Administrator. It also shows that an FTP session (or file
transfer protocol) session was initiated by the Windows user Administrator for the IP
70.142.251.242.
2
• The IP shown of24.15.202.102 was located in the regishy in the folder "TypedURLs". It is
shown as it was typed by the Windows user Administrator.
• The URL h·t-t·p·:·N 'w'w·w' .'g'o't'o·mYP·c·.'c·o·m'/'" was found in the registIy in the folder
"TypedURLs" by the Windows user Administrator.
• The URL h·t·t·p·:';';'m·a·i·I· .·s·a·l·f· .·oTg'/"· was found in the registly in the folder
"TypedURLs" for Windows user Adminish·ator.
• What appeaJ:s to be user name and password (carol@salf.org:hennan·) for the website
www.salf.org:2095/Webmail. was fotmd in the Protected Storage System Provider folder
for SID (System ill) that cOlTesponds to Windows user AdtninistI·ator.
• s'g'h'o'l·aT@· s'a·I·f-.·oTg" ·s'g·h·o'I'a'f'8·8·9·9"· appears to be infollnation typed in at URL
shown of http ://70.142 .251.2411
• The URL of H ·p·: ·;';·7·O' .·1·4·2·.·2·5·1· .·2·4·2·/-d'o·c·u·m·e·n·t·s·" was found in the regishy in
the folder "TypedURLs" for Windows user Adtninistrator. It also shows that an FTP
session (or file transfer protocol) session was initiated by the Windows user AdministI'ator
for the IP 70.142.251 .242 and the folder "documents"
• The executable file for the setup of the program Go To My PC, which allows remote access
to other computers, was discovered under the Adminish'ator account on the laptop
computer.
• The executable file for the program Go To My PC, which allows remote access to other
computers, was discovered under the Achninistrator account on the laptop computer.
• Several web pages (.htm) files were discovered that showed emails associated with
melongo_Annabel@yahoo.com and what appears to be Annabel Melongo's Roosevelt
University email account that contain references to different individuals with Save A Life
Foundation. Please see the forensic repOlt for more detailed infOlmation. These pages
can also be vie\ved separately and can be found in the folder named "Email".
• One Word document was discovered that contained the name "Saquan Gholar"
• Connection infolmation for "scantron" was discovered shown in a java script page contained
within a folder named "new version", located on a USB thumbdrive.
• A URL was discovered for http://70.236.105.150 that was titled Scantron System.
• A URL was discovered for http://70.142.251.241 that was titled SALF Scantmn System.
• Several different files that appear to relate to ID cards for various SALF employees were
discovered. This information was found in a folder on a USB thumbdt'ive named "TMP".
• Several images that appear to be parts of a website associated with Save A Live Foundation
were discovered. These images were found in a folder named "IMAGES", which was
located on a USB thumbch·ive.
• Several different files were discovered that appear to be database items from Save A Life
Foundation.
• Several images, documents and one web page were discovered that contain infOlmation
relating to ownership/control and/or dominion over the data.
• The Recycle Bin report is also included that shows files that were contained in the recycle
bin before it was emptied.
The Media Report can be fOlmd here and it contains infOlmation peliaining to the evidence that
was tumed over to our lab for analysis.
3
The Duplicate Digital Evidence (DDE), created on CD, will remain in the ESR until termination
of this investigation. The DDE created on the forensic computer hard drive will be erased in
preparation for future unrelated examinatiollS.
Appeudix A
Appeudix B
4
I -- s~!;i~;:!;·;;k-i~l·i~Jq;-~·;~·l~~ l ···~~;'·I;r)k;~;~~;l,;;; "c" If ()fl . ' ? I ' 1 :=J
. lid IeJeas.c:d titt: iLfJ.n s. 1Q.M.'L MougL.:,.sn. tbllLSlte.could. processllmiiellls tlu ilny evide nce felat.illg.Jn...
tllis incidenl . Rt f had..her sigilli IC SduHer PaJk J'mpcI1y.Jn YJ:utury.Conlrot Shed gliowillg the . .cllahl . .
of cwaody o f the. c.vitkuGt:.
28 Sep 06- R! Lwas . CDCltact,:d..by Ms M nge.,. WM .lld 'i ~led that .dH~.fru:e.osl<: lfnalysis on t.J.r.e..il.cms. ...._......
suhmit.ted..wascnrnpJetf.audtl!,; rej1ortafl(tlht! il.cJlts. wCfC.. ready.!jLhY. frJUf'ned In R/ I.. lUI..and..DeL ..
Knell ..w.elll loJ.he I~CFL in Chicllgo. and rCi.:tl\·crcd I:h(; itcrns nom MiL Ivlonge. Is./I's rlittlbmughulle
tlyitiel1ce baclcLO SPI'D where it.was n:.JJ.J1llcd !.l.u .he .t::vidence tDck.'lr tilu,llc..keeping.
R/ I then made ampy_of Ms. }..1C!flge's c,) '>!~r 1.eu.cE.;lJldti)[cusi,:"leport SlllllflUlL), trOl1l
lite CD s.he. providcLlRfL ] ] lC SUIlllflJHY s.how.ed t hat ~I'LLMcl Q ngo clul access tht SALI;_~e(yeL..
remotely, hMLa..cflrlJJ;;t.~L 11' .IlLldre...'ISJlf 2 .<L IS.202 10.2..Jl lt 2R Apr CJ6, haviHg acc.:s.s loJl'ls .. Spiu.irri's
emaiLltGcoOnLllnd passwurd, email" !HI her Ro.o.scvdLllni 'lClsily email account-with JJ:f.eIl:'lncl:s..tO .
· ru:liyi.UlIal;; .a(.s.~ I Ii, iJ won t dOCllJ11.e nt CUlllaiJlinilr the name SruluarLGllDlaJ'.,..JP arldrt:&'ic!I 11ssnciaLc,L
viLh .sALF Scaotcon.B..y 'lcm,jrnagesJI OJIl.lhc S.ALI-,-wcbsite, database i.tClUsJi:olfl the SALE scrVJ:L.....
lJ Oct.06 ,,- 1i.lL~pClke..wi thML l'Lcl)ch limnlhc minoJS AG's 01l'u:iL..Mc...Ercuch advised Ulllt he hlliL..
l:oo!Jjjnated ..aJneeting.hct.weeJLhiOls.elf...A,SA.Hi.estek , aud l{fl, so lhar. j\SA BiesJ.ek couJ.d..re'1ic..w aU _
oCrhc t:.'lidence alld In .der ermine jf Iher.eis..r:nough..evldellCe.lD. cbarge Ms. MeIOl1go wilh.lLfelo!l~dIL
tltis case. ....._ ____ _ .,....
Looking for the IP address of the IT person from the mail log on the server
--------------------------------------------------- (.
bash-2.05b# grep 24.15.202 . 102 /var/log/exim mainlog ~",,~tI )t(v'tf
)
2006-05-01 20:31:40 1Fajjo-0002WM-Eb <= cspizzirri@salf .o rg U=ftpsalf
P=local S=6270 id=4849.24.15.202.102.1146533500.squirrel@www.salf.org
2006-05-01 23;01:31 1Fam4o-0007NG-U3 <E cspizzirri@salf.org U=ftpsalf
P=local S=4221 id=2431.24.15.202.102.1146542490.squirrel@www.salf.org
t., ..... ,. ',¥
This is the actual record showing her sending the email FROM Carol's
email address to her own Yahoo based email address. Note the IP in the
log .. .
Again second message going fr om Carol's address to her Yahoo Email Address: