Accident Investigation Checklist

8/11/2019 Accident Investigation Checklist

1/33

Appendix4AccidentInvestigationCheckList

Pre-field

investigation

[ ] Select investigationmethodology/protocols

[ ]DesignAItasks to takefulladvantage ofavailableresources.

[ ] Identify and define perceived self-interests of everyone affected by investigation[ ]

Negotiatewith others who might be investigating

[ ] Identify and control personalrisksto investigator

[ ] Define and order investigation tasks

Fieldinvestigation tasks

[ ] Dowalkaround/lookaroundtofamiliarizeselfwith scene

[ ]Identifyphysicalobjects likely to change

[ ]Identifypeopledata likely to change

[ ] Protect data sources againstprematurechange

[ ]Formulatequestions to generate needed data[ ] Document post-occurrencephysical states

[ ] Definepre-occurrencephysicalstates of involved objects

[ ] Define physical changes (damages) during incident

[ ] Document post-occurrence physiological states

_ ]Prepareinvestigation - photographs

[ ]Prepareinvestigation - sketches

r ]Prepareinvestigation - drawings

[ ]Prepareinvestigation - maps

[ ]Prepareinvestigation - charts or graphs

[ ] Defmepre-occurrencephysiological states

[ ] Define physiological changes (injuries)during incident[ ]Identify and define change makers that produced outcome

[ ] Define actionsrequiredto produce observed ending conditions

[ ]Acquiredata about interactionsfromwitnesses

[ ]Acquiredata about interactions from object sources

[ ]Transformobservations into form entries

[ ]Transformobservations into event descriptions

r ] Organize events sequentially

[ ] Focus energies onremainiagunknown events

[ ] Select events to break down or decompose

[ ] Define events pairs orsetsfor logic testing


2/33

[ ] Apply cause-effect logic toeventsparis andsets^

[ ] Demonstrate causal relationships among interactions

[ ] Defmegapsin understanding of what happened[ ] Hypothesize bounded scenarios tofillgaps

[ ] Acquire data to verify hypotheses

[ ] Develop plans for any testing/simulations

[ ] Apply necessary/sufficient logic toevents

[ ] Separate relevant from irrelevant events/data

[ ] Do QualityControl check offinaldescription

[ ] Useeventsdescription to define problem relationships

[ ] Useeventsdescription to evaluate problems orneeds

[ ] Assess gravity of each need ( fix/don'tfix)

[

] Select problems/needs to address with recommendations

[ ] Identify candidate actions to address problems orneeds^

[ ] Useeventssetsto evaluate each candidate recommendation

[ ] Develop rationale for selecting recommendations to be proposed

r

] Develop recommendations effectivenessassessment plans and procedures

_

] Do objective quality assurance procedures for final investigation outputs

Post-field investigation

[ ]Prepare narrativedescription and explanation of what happened

[ ] Complete analysis to determine cause, causes, causal factors, root cause

[ ] Prepare final report[ ] Defendfinalreport

[ ]

Respond to media inquiries

[ ] Do objective quality assurance procedures investigation process

[ ]Arrangefor disposition of wreckage/debris/test objects

__]Arrangefor archiving of data sources

Leadinvestigator

[ ] Set daily taskprioritiesfor each investigator or group

[ ]Manage work force performance

[ ] Assure needed mformation exchanges among workers

[ ]Conductpublic and private briefmgs

[ ] Manage quality assurance procedures for team tasks and outputs

[ ] Manage recommendation development process

[ ]

Manage report preparation

Multinational investigations

[ ] Implement multinational investigating protocols

[ ] Implement customs and conventions of hoststate


3/33

[ ] Managemulticulturalmultinationalinvestigation teams

[ ]Negotiateparticipationby non-government experts

[ ]Critiqueinvestigation process


4/33

AccidentInvestigation Preliminary InterviewList

Interviewee/Title ReasonFor Interview PhoneLocation/Shifl/Company

AffiliationNotes

:

:

;

:

i

\

i

1

1 i


5/33

DocumentaryEvidence Log

Item

No.

Item Description Source of Document RequestedBy Rec'd

Y/N


6/33

AccidentInvestigationWitnessStatementForm

jName:

UobTitle:

iTelephoneNo.

iLocationat Time of Accident:

iHomeAddress:

ILocationof Accident:

[OccidentTime and Date:

tleasefully describe the accidentsequencefrom start to finish (use additional paper as needed):

Pleasefully describe the work and conditions in progress leading up to the accident (use additional

paper as needed):

jNote

anythingunusual you observed beforeor during the accident (sights, sounds, odors, etc.):

iWhatwas your role in the accident sequence?


7/33

IWhatconditions influenced the accident (weather, time of day, equipment malfunctions, etc.)?

jWhatdo

you think caused the accident?

How could the accident havebeenprevented?

jPlease

list other possible witnesses:

lAdditional comments/observations:

Signature:


8/33

PhysicalEvidence Log

Item

No.

Item Description Received

Date

By COC

Y/N

COC - Chainof Custody formexecuted


9/33

EVIDENCETAGACCID ENT

ITEMDESCRIPTION_

INVESTIGATORAFFIXING TAG

DATE

ACCIDENT INVESTIGATION

EVIDENCE

WARNING THISITEMISEVIDENCEINANOFFICIAL

ACCIDENTINVESTIGATION.DONOT

DISTURBWTTHGUTPERMISSION

SampleEvidence Tag to IdentifyPiecesofPhysicalEvidence.

SamplePhotographic Log

PhotographicLog

Name:

Agency:

Address:

Date:

Time:

Accident Identification:

PhotoNo.(Roll/Exposure)

Subject ExposureInformation

FlashY/N


10/33

C A S E N U M B E R

C A S E NAME INCIDENT DATE

DATE/TIME EVE NT ID EVE NT DET AIL DESCRIP TION SOUR CE O F DATA COMMENTS


11/33

08-069208

ORANGE COUNTY SHERIFF'S OFF ICECOMPUTERFORENSICCELLPHONEREPORT

Pagel

CASE AGENT:YuriMelich

Detective

OrangeCountySheriffs

Office

Criminal Investigations Division

ChildAbuse/Missing Persons Squad

2500W.Colonial Drive

Orlando.FL.32804

COMPUTER FORENSIC EXAMINER:SandraG.Cawn

Detective

OrangeCountySheriffsOffice

CriminalInvestigations Division

ComputerCrimesSquad

2500W,Colonial Drive

S E A R C H andS E I Z U R E I J ^

August4,2008:

DetectiveMarkHussey, Orange CountySheriffsOffice HomicideUnitpresented this writer with thebelow

described cellulartelephoneand asked that all thetext messagesbe extracted. Thephonebelongsto Cynthia

Anthony, whogaveconsentfor the extraction.

P R O C E S S I N G andA C Q U I S I x f O N NOTES

TheCaseAgent provided this examiner thefoUov/ingfor processing:

CELLULAR TELEPHONE:

ITEM

Make: Motorola

Model Number: V3Razr

PossibleSerialNumber:23755930216

I M E I :

358921008652799

MSN:

SIM:890141042008900 40872

E X A M I N A T I O N SYNOPSIS

Thisexaminer received the listed cellulartelephonewhich was poweredon. An extraction of data via the use ofCellebrite

software andcabhngwas conducted. The contact list,calllogs,tejrtmssagesall dated either8/02/08

and8/03/08and image files were recoveredandreported on the attachedreportform.

DetectiveSandraG,Cawn Atigstt04-,2008-


12/33

ExaminationReport Page1of 10

ExaminationReport Properties

SelectedManufacture: Motorola GSM

SelectedModel: MotorolaV3RAZR

DetectedManufacture: "MotorolaCE ,Copyright2004"

DetectedModel:GSM900 , GSM1800 , GSM1900 , GSM850 , MODEL=V3

Revision: "R374 G 0E.41.C3R B"

IMEi: 358921008652799

MSISDN; 14078084731

IMSI:

310410089004087

Extractionstartdate/time: 04/08/0809:28:47

Extractionenddate/time: 04/08/0809:30:34

PhoneDate/Time: 08/08/04,10:20:44+00

ConnectionType: US BCable-

U F E DVersion: Software:1.0.9.0U P E D . F u l lI m a R e : 1.0.1.9,TinyImage:1.0,1.9

ExaminationReport Index

1. Contacts

2. SMS- TextMessages

3. IncomingCalls4. OutgoingCalls

5. MissedCalls

6, hiiages

7. Ringtones

8. Audio

9. Video

Contacts

Total Entries:28

PBBMD5Hash:05C03A0E29O88C3F02B4D8815EAF8456

#1 DebbieAkin (Phone memory)

General:

#2 JodyParker(Phone memory)

Home;

#3 Roder B (Phone memory)

file://C:\Docujnents andSettings\Administrator\Desktop\Cindy

Anthony cell phoneVBackup... 8/4/2008


13/33

nxammationReport Page2of10

Work: 17634798162

#4

Work:

DaveNltti(Phone memory)

#5

Work:

Nilsa(Phone memory)

#6 J Duckett (Phone memory)

Work:

#7Work:

Ryan(Phong memory)

#8 George@Work(Phone memory)

Work:

#9 ^ petectineMeUch(Phpne memory)

Work:

Work:

Carla

Dagkett(Phone memory)

#11 ChristinaChester (Phone memory)

Mobile:

#12 JasonFort(Phone memory)

Work:

#13 JoseBaez (Phone memory)

Mobile: ^ ^ ^ ^ I H B

Work: ^ I ^ M I

Work:i B l ^

#14 JohnAllen (Phone memory)

Mobile:

#15

General:

ALee (Phone memory)

file://C:\Documents andSettmgsNAdministrator\Desktop\CindyAnthony cellphoneVBackup... 8/4/2008


14/33

ExaminationReportPage

3of 10

#16 AHome (Phone memory)

General:

#17 AGeorge (Phone memory)

General:

#18 Casey(Phone memory)

General:

#19 JimN B C (Phone memory)

Work:

#20 Kenneth(Phone memory)

Work:

#21 Annie(Phone memory)

Work:f:

#22 FoxHollyBristow QPhonememory)

Work:

#23 Don SilverLeadAllen (Phone memory)

Home:

#24 ChristinaBaez (Phone memory)

Work:

#25 SonnieCell(Phone memory)

Work:

#26 Ke nGagne (Phone memory)

Mobile:

#27 JessicaNever Lose Hope (Phone memory)

Work:

#28 SteuePeopleMag (Phone memory):;

Work:

^ ^ ^ ^

file://C:\Doeuments and Settings\Admmistrator\Desktop\CindyAnthony cellphoneVBackup... 8/4/2008


15/33

Examination Report Page4 of 10

S M S TextMessages

S M S M D 5Hash: F 5 D 1 D 3 B 3 B A F 1 F 6 1 7 A 2 F 9 4 8 7 9 E E E 5 B F 3 A

Number Name Date& Time Status ]Folder Storage'rype rext

1 N/A N/A Sent Sent Outgoing CgUme

1

* A

Lee N/A Sent Sent Outgoing 4o74667847

3

-*Fox Holly

Bristow

02/08/08 12:22:33

(GMT-16)

Read Inbox- -

(

t

t

I

Incomii^

ieyCmdy!

jeorgeasked me

0textthis

lumbertobothof

1.Mr.Mann

i02.204.2600

Dubhcist

for

^ericas

Most

Wanted.Letme

mowIf

youneed

mything.

4 N/A02/08/0812:42:36

(GMT-16)

Read Inbox Incoming

Joycestoppedby

i*ublix

looking for

you

5 N/A02/08/08 17:21:18

(GMT-16)Read Inbox Incoming

Hicindy! It's

emilyftomnews

13.Just

wonderingifwe'd

able to talk to u

today.

6 !N/A 02/08/0823:31:25 Read Inbox Incoming

Iknow itslate

3utIneeded2

textu and tell u I

criedwhenIread

the"People"

article.,I

saw

Georgeon the

news& he said u

bothfeltthe same.

Ourteam is due 4

abreak.Pm

prayingevery daythatGodhears my

cries. Words can't

expressthe pain I

feel

4all.Seeu-

torn. Believing 4a

miracl!Love,

HollY

Douguys need

meatqiehouse

prioftotonight's

vigilat 830?Iwai

mi

file://C:\Documents andSettings\Admmistrator\Desktop\Cindy

Anthony cellphoneVBaekup...

8/4/2008


16/33

xamination

ReportPage

5of

10

71

ALee03/08/0813:17:25

(GMT-16)

Read Inbox Incoming

planningon being

alittle early. Btw-

we

should not

speakofany

lettersfromcasey

8 |

* ALee03/08/08 13:45:39

(GMT-16)

Read Inbox Incoming

Josehas

individual

messagesto us

from Casey that

liewants togive

toustonightafter

thevigil..Would

u

guysbeupfor

goingto his

office?

9j r A Lee N/A Sent Sent OutgoingWhendoesjosewantto meet?

10

W

^

]

* ALee03/08/0815:26:17


Afterthe vigil

spm.etinietonight.

11

W

^

]

1*

Debbie

Akin

03/08/08 18:48:29


May not get to be

theretonightbut i

continueto pray

andloveyou

12

W

^

]* Debbie

AJdn

N/A Sent Sent Outgoing Loveu

13* Debbie

Akin

03/08/08 18:57:31

(GMT-16)

Read Inbox Incoming

Isthere anything

ican do foruthis

week ,

*

Phonebook name lookup used to retrieve names

IncomingCalls

CLGMD5Hash:9999193F33E7C603AAF0541D734E67A6

Kame Date& Time Duration*Kenneth N/A N/A

N/A N/A N/A

N/A N/A N/A

N/A N/A ' N/A

N/A N/A . N/A

N/A N/A N/A

N/A N/A N/A

N/A N/A N/A

N/A ; N/A

N/A N/A N/A

Type1 Incoming

2 Incoming

3 Incoming

4 Incoming

5 Incoming

6 Incoming

7 Incoming

8 Incoming

9 Incoming

10 Incoming

file://C:\Documents

andSettings\Administrator\Desktop\Cindy



17/33

Examination Report Page6of 10

OutgoingCalls

CLOGMD5 Hash:9999193F33E7C603AAF0541D734E67A6

Type

1 Outgoiig

2 Outgoing

3 Outgoing

4 Outgoing

5 Outgoing

6 Outgoing

7 Outgoing

8 Outgoing

9 Outgoing

1.0

Outgoiiag.

Number Name Date& Time Duration

N/A N/A N/A

N/A N/A N/A

N/A N/A N/A

*JoseBaez N/A N/A

*Steue PeopleMag. . N/A N/A

*Kenneth N/A N/A

8 N/A N/A N/A

*A George N/A N/A

* ALee N/A N/A

N/A .N/A N/A.

MissedCalls

C L 0 G M D 5

Hash:9999193F33E7C603AAF0541D734E67A6

u

[Type Number Name Datei&Time, Duration

1 Missed im

*

Kemieth

N/A N/A

2 Missed N/A N/A N/A

3 Missed N/A N/A N/A4 Missed N/A N/A N/A5 Missed m N/A N/A N/A

6 Missed. .N/A N/A N/A




* Phonebook name lookup usedto retrievenames

Images

# Information MetaData Image

Filename:hfiaeesNOS-18-07

1527

.iD

(i

Resolution:

file://C:\Documents

and Settings\Administrator\Desktop\Cindy

Anthony cellphoneVBackup...

8/4/2008


18/33

ExaminationReport ..., Page7of10

1

FilePath:picture

FileSize:24826 bytes

FileDate/Time:18/08/07 15:27:20(GMT)MD5:

087150C83E292F85EEBD96B0AD4219B

72x72(unit:

inch)

PixelResolution:"

640x480

2

Filename:Imaees\12-08-06 2025.jpg

FilePath:picture


FileDate/Time;08/12/06 20:23:27(GMT)MD5:

B5C6CCE1FAAEFA052DB488B7CC215816

Resolution:

72x72(unit-

inch)

PixelResolution;

640x480

'ML.*'

3

Filename:Imaees\05-09-08 1350.ipg

FilePath:picture

FileSize:31106bytes

FileDate/Time:09/05/08 13:50:47(GMT)

MD5:

5F85F5AF2544E90919E81C37CB27BF64

Resolution:

72x72(unit:

inch)

Pixel

Resolution:

640x480

4

Filename;ImaEes\08-l8-07 1523.ipp

FilePath:picture


FileDate/Time:18/08/0715:23:50(GMT)

MD5:

4C1910AF4B54F554C39E729EF18EABB9

Resolution;

72x72(unit:

inch)

Pixel

Resolution;

640x480 !

5

Filename:Imaees\12-08-06 2021.iDe

FilePath:picture

FileSize:22186bytes

FileDate/Time:08/12/06 20:20:15(GMT)

MD5:

3CD177DD6650091991101C916EC93E53

Resolution;

72x72(unit:

inch)

Pixel

Resolution;

640x480

file://C:\DocumentsandSettingsVAdministrator\Desktop\Cindy



19/33


20/33

xanunationKeportPage

9of 10

11

Filename;Images\07-23-06 1827.jpgFilePath:picture


FileDate/Time:23/07/0618:27:36(GMT)MD5:

35D05051E05FF28CC1BFC997EG291C65

Resolution:

72x72(unit;,.,

inch)

Pixel

Resolution:

640x480

12

Filename; Images\12-Q8-Q6_2023.jpg

FilePath;picture

FileSize:18002 bytesFileDate/Tune:08/12/06 20:21:56(GMT)

MD5;

98A5CA6DAC6B0967EF2506441BD2FF09

Resolution;

72x72(unh:

inch)Pixel

Resolution:

640x480

13

Filename;Images\12-08-062019,jpg

FilePath:picture

FileSize;27106 bytes

FileDate/T3ie:08/12/0620:18:36(GMT)

MD5;

52A0DD2591B

A27DFBC107D7B C223F6C1

Resolution:

72x72(unit:

inch)

Pixel

Resolution:

640x480

14

Filename;Images\12-08-06 2022.ipg

FilePath:picture


FileDate/Tkne:08/12/0620:21:19(GMT)MD5:

C5CC21B34590A948750C406539BAECC2

Resolution:

72x72(unit:

inch)

Pixel

Resolution:

640x480

o

15

Filename:Images\12-08-06 2018.jpg

FilePath:picture


FileDate/Time:08/12/0620:18:12(GMT)

MD5:

9CE491856DC4DEAB934F332593B9B170

Resolution:

72x72(unit:

inch)

Pixel

Resolution;

640x480

file://C;\DocumentsandSettings\Adminishator\Deslctop\CindyAnthony cellphoneVBackup... 8/4/2008


21/33

ORANGE COUNTY SHE R IFF' S OFFICE08-069208 COMPUTER FORENSICS REPORT

CASEAGENT:

Y u r i Melich

D e t e c t i v e

Orange County S h e r i f fs O f f i c eC r i m i n a l I n v e s t i g a t i o n s D i v i s i o n

C h i l d Abuse/Missing Persons Unit

2500 West C olo nia l Driv e

O r l a n d o , F l o r i d a 32804

COMPUTERFORENSICSEXAMINER:

SandraG. Cawn

D e t e c t i v e

Orange County S h e r i f f ' s O f f i c e

C r i m i n a l I n v e s t i g a t i o n s D i v i s i o n

Computer Crimes Squad2500West Co lo ni al Driv e

Orlando, F l o r i d a 32804

(407) 254-7000 e x t . 7-0593

SeizureandProcessing Notes

S e i z u r e Notes:

On J u l y16,2008a ta p p r o x i m a t e l y 2000 hours, De te ct iv e Ch ar it y Beasley o f the

Orange County S h e r i f f ' s O f f i c e Domestic Violence Squadonb e h a l fo fDet ectiv e

C o r p o r a l Y u r i Melich , submit teda CompaqP r e s a r i oC300 l a p t o p computer; s e r i a lnumberCND6430RKH ( w i t h t h epower cord) and aNokiaRH-87model2610 c e l l u l a r

t e l e p h o n e ; IMEI# 011191/00/075157/2

t o theComputer CrimesLabf o r examination.

D e t e c t i v e Beasley ad vi se d these items bel ong t o thesuspect o f t h i s

i n v e s t i g a t i o n andt h a t Det ect ive Corporal Mel ichwas seeking a search war ran t

t o examinethecontents o fthese twodevices. Nei the rof th edeviceswas

examinedorprocessed u n t i l thewarrantwas obtai ned. Lat er t h a t evening,

D e t e c t i v e Melich obtaineda search warrant f o r bo th it ems.The c e l l phonewas

p r o c e s s e d andexamined.A separate r e p o r twas s u b m i t t e d f o r t h i s item.

On J u l y17,2008a t 1330hours, I n v e s t i g a t i v e An aly st Awilda McBrideo f the

Orange County S h e r i f f ' s O f f i c e M i s s i n g Persons Squad,onb e h a l fo fDet ectiv eC o r p o r a l Y u r i Meli ch, sub mit ted a. Po la ro id t730 D i g i t a l Camera, s e r i a l number

GR700405730013579 ( i n c l u d i n g a 1 GB P o l a r o i dSDmemory card; s e r i a l number:

MM8GF016WMC-PATC0D300753)and a SanDisk U-3USBthumb d r i v e f o r examination.

A l s o s u b m i t t e dwas a Hewlett Packard P a v i l i o n , model# a520n, desktop computer;

s e r i a l niomber:MXM4100HYL. Mrs.McBride advised these items belong t oGeorge

and C i n d y Anthony, andt h a t wewere granted consent t os e i z eandsear ch the se

i t e m s f o ranyi n f o r m a t i o nt h a tmay a s s i s t w i t h t h i s i n v e s t i g a t i o n .

On Ju ly 21, 2008a t 1052hours, Mrs.McBride, onb e h a l fofDe te cti ve Corporal

Y u r i M e l i c h , s u b m i t t e daNikon C ool pix D i g i t a l Camera, s e r i a l number: 30258381

a l s o b e l o n g i n gt oGeorgeandCindy Anthony f o r e x a m i n a ti o n . Consentwas grantee


22/33

O R A N G E COUNTY SHERIFF'S OFFICE08-069208 COMPUTER FORENSICS REPORT

f o r thes e i z u r e and search o f these items.

Summary:

1) The Compaq l a p t o p computer

P i c t u r e s and video take n of Caylee Anthony were bookmarked and copied t o th e

Evidence\Graphic f i l e s \ C a y l e e f o l d e r . The image e n t i t l e d DSCN1894.JPGwas taker

w i t h a Nikon C o o l p i x d i g i t a l camera. The date and tim e from th e metadata i n the

p i c t u r e i n d i c a t e t h a t thep i c t u r e was taken June 15, 2008 a t 12:03:27 pm.

D i g i t a l v i d e o f i l e s were a l s o taken w i t h a Nikon C o o l p i x d i g i t a l camera with

the metadatadate and time of June 15, 2008 between 11:26:20 am and 12:03:18

pm.

There are s e v e r a l g r a p h i c f i l e s of i n t e r e s t ; the f i r s t i se n t i t l e d " g i r l . j p g "and the second, 2 3 3 b c 8 d 7 9 3 5 7 f3 0 7 5 c 7 e d f 5 d d b0 8 3 f l l . j p g . Both were l o c a t e d on

the C:\Documents and Settings\bobby\Desktop\artwork\misc f o l d e r on th eCompaq

computer. Both g r a p h i c f i l e s were bookmarked and c o p i e d t o the Evidence\Graphic

f i l e s \ G r a p h i c s of I n t e r e s t f o l d e r .

Also i nt h a t f o l d e r i s an image f i l e e n t i t l e d

I_b55a353606038e56bed924d0a4dcl301.jpg . I was asked by D e t e c t i v e E r i c Edwards

t o i d e n t i f y on e i t h e r computer any males who may bemembers of th e United

States M i l i a r y f o r c e s . This photograph i s of a w h i l e male dressedi n

camouflage. Thenameon h i ss h i r t i s "Hawkins."Email between Casey Anthony and

MarkHawkins was bookmarked i n the Web m a i l i nu n a l l o c a t e d space p o r t i o n of

t h i s r e p o r t .

AnMSWord document e n t i t l e d " d i a r y ofdays.doc was bookmarked. The Metadata

A n a l y s i s o f th e document "Diary of Days" r e p o r t s theauthor asCMANTHONof the

GENTIVA C o r p o r a t i o n on J u l y 2, 2008 at 10:42:08 am. The document was bookmarked

and copied t o th e Evidence\Documents f o l d e r . The r e s u l t s of th e Metadata

A n a l y s i s were saved t o th esame f o l d e r . Also bookmarked were s e v e r a l web page

e n t r i e s f o rB i l l Pay f o r th eaccount "Casey Anthony,account number 04985420-

001-04" f o r payment o f a c e l l phone b i l l .

Nophotographs, v i d e o , e m a i l , i n s t a n t message chat or any o t h e r type of

communication w i t h a Zenaida Fernandez-Gonzalez was d i s c o v e r e d on e i t h e rcomputer.

The I n t e r n e t h i s t o r y and cookies f o r theuser "bobby" was e x t r a c t e dv i a

N e t a n a l y s i s . A l l were saved ascomma d e l i m i t e d f i l e s t o the E v i d e n c e \ l n t e r n e t

History\Casey l a p t o p f o l d e r f o rv i e w i n g w i t h Excel.

2) The HP P a v i l i o n Desktop computer

On J u l y 16, 2008, Awilda McBride showed me a p r i n t - o u t of aMySpace b l o g dated

"Thursday, J u l y 3, 2008". The page i s t i t l e d , "my caylee i sm i s s i n g " . The web

page was bookmarked and r e p o r t e d i n the "my caylee i sm i s s i n g " p o r t i o n of t h i sr e p o r t .


23/33

ORANGE COUNTY S H E R I F F S OFF ICE08-069208 COMPUTER FORENSICS REPORT

The I n t e r n e t H i s t o r y f o rthep r o f i l e "Casey"on the HP computerwase x t r a c t e d

v i a NetA n a l y s i s .TheH i s t o r ywas then f i l t e r e d f o r b o t h "MySpace"andf or

"facebook." A l ltheI n t e r n e t H i s t o r y f i l e s were saved t o theEvidence \Interne tH i s t o r y \ C i n d y Desktop computer\Casey p r o f i l e f o l d e r s ascommad e l i m i t e d f i l e s

f o r vie wi ng using Exc el.

A keyword search fo r "Zenaida" r e v e a l e d Webpages i n d i c a t i n g t h a t a user

s e a r c h e d t h eI n t e r n e t f o r t h a tname onJ u l y 16,2008. Those e n t r i e s were

bookmarked underthe"Zenaida Fernandez Gonzalez" s e c t i o noft h i s r e p o r t .

D e t e c t i v e Melich requested a keyword search f o r "E ri c Baker."The name "Eric

James Baker" wasbookmarked undert h es e c t i o no f t h e same name w i t h i nth e

r e p o r t .

S e v e r a l i n s t a n t message conversations were bookmarked andsavedt o th e

Evidence\Chat fragments\Fragments o fconversatons i na l l o c a t e dspace f o l d e r for

viewing using html. The f i l e e n t i t l e d n y i t a l i a n o 3 . h t mlm e n t i o n s t h e name

" z a n i . " This i s theon ly refere nce foun d thus f a rt o anyv a r i a t o no f th e name

Zenaida. The chat doesnoti n d i c a t e t h ei d e n t i t y orl o c a t i o n o f"zan i."

S e v e r a l i n s t a n t message conversations were bookmarkedandsavedt o th e

Evidence\Chat fragments\Fragments ofconversations i nu n a l l o c a t e d space f o l d e r .

3) TheN i k o n Coolpix D i g i t a l Camerawasexamined. Graphicandvideo f i l e so f

Caylee and f a m i l y were bookmarkedandsavedt o th eEvidence\Graphi c f i l e s

f o l d e r .

4) G r a p h i c andvideo f i l e s were examined from theP o l a r o i d d i g i t a l camera's

memory card. Two g r a p h i c f i l e s dated May 23,2008were l o c a t e dasw e l las

o t h e r s t h a t were d e l e t e d , noneo fw h i c h appeart o be o fp a r t i c u l a r e v i d e n t i a r y

v a l u e . They are no ti n c l u d e di nt h i s r e p o r t . Also submitted witht h eP o l a r o i d

camerawas aSandiskU-3 1 GB t h i x m b d r i v e . Nothing o fe v i d e n t i a r y v a lu ewas

d i s c o v e r e d . Both items were r e t u r n e dt o thef a m i l ybyAwilda McBride.

5)On J u l y22,2008, D e t e c t i v e Edwards s u b m i t t e d a B l a c k b e r r y 8300 c e l l u l a r

phone b e l o n g i n g t oAnthony Lazarro t o theComputer CrimesLabf o rt hepurp ose

o f e x t r a c t i n g anydata a v a i l a b l e . A separate re po rtwas prepared and submittedt o Detective Melich.

6)On J u l y23,2008,Amy Huizenga o f f e r e dherNokia GSM c e l l u l a r phone, model

6126t o thecomputer crimes l a bf o rt h epurpose o fe x t r a c t i n g thephone book

and SMS messages.A separate r ep or twas prepared ands u b m i t t e d t oDetec tive

Melich.

7) On J u l y 24,2008, B r i t t a n y Scheiber of fe re dherT-MobileShadow GSM

c e l l u l a r phoneto th ecomputer crimes l a bf o rt hepurpose o fe x t r a c t i n gth e

phone bookand SMS messages.A separate r ep or twasprepared andsubmittedt o

D e t e c t i v e Melich.


24/33

ORANGE COUNTY SHE R IFF' S OFFICE08-069208 COMPUTER FORENSICS REPORT

8) On J u l y25,2008, D e t e c t i v eEdwards s u b m i t t e dan LG KG800 c e l l u l a r phone

b e l o n g i n gt oRicardo Moralest o theComputer CrimesLabf o rthepurposeo f

e x t r a c t i n g thephone bookand SMS messages.A separate r e p o r twaspreparedand

submitted t oDete ctiv e Melich.

9) Also onJ u l y25,2008, D e t e c t i v eEdwards s u b m i t t e daSamsungSGH-A707 c e l l

phone belongingt oTroy Brownt o theComputer CrimesLabf o rthepurposeo f

e x t r a c t i n g thephone bookand SMSmessages.A separate r e p o r twaspreparedand

submitted t oDete ctiv e M elich.

10) A search war ran t autho red ando b t a i n e dby t h i s w r i t e r onJ u l y 2 9, 2008f o r

the purpose ofl i s t e n i n g t o anda r c h i v i n g v o i c e m a i lmessagesasw e l l as SMS

messages incoming t oCasey Anthony's Nokia c e l l phone.An attempt was made

l a t e r t h a t same day t oexecute thewarrant, howeverthephone s e r v i c ehadsin ce

been d i s c o n t i n u e dandaccesswas not p o s s i b l e .

11) During thecourse oft h i s i n v e s t i g a t i o n , Sgt.John A l l e n o f theOrange

County S h e r i f f ' s O f f i c e C h i l d Abuse Squad advised t h i s w r i t e r t h a t i t w ou ld be

i n thebest i n t e r e s t o ft h i s i n v e s t i g a t i o n t oo b t a i na search warra nt f o rthe

HPdesktop computer b e l o n g i n gt oGeorgeandCindy Anthony. This w r i t e r authored

and o b t a i n e dasearch warran t fo rthecomputeronAugust 6,2008.The search

f o r evidence con tin ues as of thedate oft h i s r e p o r t .

12) On August4,2008, Cindy Anthony o f f e r e d herMotorola V3 GSM c e l l u l a r

phonet o th ecomputer crimes l a bf o rthepurposeo fe x t r a c t i n g th e SMS

messages. N o th i ng r e l e v a n tt ot h i s i n v e s t i g a t i o nwas found. A separate r e p o r twas prepared ands u b m i t t e dt oDete ctiv e M elic h.

To date, t h i s w r i t e r hasa s s i s t e d o t h e r D e t e c t i v e s w i t h therecovery of s t i l l

p h o t o s andvideos fr om s to re s u r v e i l l a n c e cameras r e c e i v e dasCrimeLine Tip sas

w e l l asCrimeLine Ti ps f rom c i t i z e n s m o n i t o r i n gMySpace, Facebook,and

Photobucket. These t i p s ares t i l l b e i n g i n v e s t i g a t e d at th etimeo f t h i s

r e p o r t .


25/33

08-069208

O R A N G E C O U N I Y S H E ^ ^

COMPUTERFORENSICS REPORT

Cavlee/ Family Photos

Name: DSCN1894.JPG

Description: File, ArchiveFileCreated: 06/17/08 03:28;50PMLastAccessed: 06/18/08 10:13:52AMLastWritten: 06/15/08 12:03:26PM

EntryModified:f^^^^^SZ,,^,,^,^,^^,,

andSeings\bobbv^Descp^photos^Ca.eMarie^une

2008\DSCN1894.JPG

Comment;

I m a g e D e s c r i p t i o n :

Make: NIKON

Model: COOLPIX L12

S o f t w a r e : COOLPIXL12V1.0

DateTime: 2008:06:15 12:03:27

D a t e T i m e O r i g i n a l : 2008:06:15 12:03:27

D a t e T i m e D i g i t i z e d : 2008:06:15 12:03.27

T h i s

photographwas taken w i t h aNikon ^^^^^tlt^^^^^^^t i m e s e t t i n gon t h ecameraa t th etxme t h r s p i c t u r e ^^^^^^ ^^^^^^^^

a t 12:03:26pm. - f - ^ ^ ; ; ^ , : ^ ' ^ ^ ^ ^ ^ ^ ( - t h i n 2minutes) on thedate andtime s e t t i n g s ont h e camerawer ^^^^ r e g a r d i n g t h i sdayt h ecamerawas examined ( J u l y 21, .^^ picture savedt o tpiLure

o fcaylee ont h e CoolPxxcam a i s t h e same^as the

Compaq computer, meaning t h a t ^^^^^ t h e c ^ ^ ^ ^ ^ l ^ thecamera


26/33

ORANGE COUNTY SHE R IFF' S OFFICE08-069208 COMPUTERFORENSICS REPORT

my caylee is missing

Name:

Description:FullPath:

UnallocatedClusters

File, Unallocated Clusters08-069208\S013J10X237614\D\UnallocatedClusters

FileOffset: 8033745365

Thursday, July 03, 2008

IMG[http://x.myspace.com/images/spacer.gif]

mycaylee is missing

Currentmood: IMG[http;//x.myspace.com/images/blog/moods/iBrads/sad.gif]distraught

Shecame inmylife unexspectedly, just as she has left me. This precious little angel from above gave me strength and unconditional love,hsheis gone and I don't know why. All I am guilty of is loving her and providing her a safe home. Jealousy has taken her away.

Jealousyfrom the one person that should be thankfull for all of the love and support given to her. A mother's love is deep,howeverthere are limits when one is betrayed by the one she loved and trusted the most. A daughter comes to her mother forsupportwhen she is pregnant, the mother says without hesitation it will be ok. And it was. But then the lies and betrayal began,Firstit seemed harmless, ah, love is blind. A mother will look for the good in her child and give them a chance to change. Thismothergave chance after chance for her daughter to change, but instead more lies more betrayal. What does the mother getfigivingher daughter all of these chances? A broken heart. The daughter who stole money, lots of money, leaves without warniranddoes not let her mother now speak to the baby that her mother raised, fed, clothed, sheltered, paid her medical bills, etc.Insteadtells her friends that her mother is controlling her life and she needs her space. No money, no future. Where did she gcWhois now watching out for the little angel?

[http://blog.myspace.com/index.cfm?fuseaction=blog.view&frien...]


27/33

08-069208

ORANGE COUNTY SHERIFF'S OFFICECOMPUTERFORENSICS REPORT

ImageFiles of Interest

Name: girl.jpg

Description: File, ArchiveFileCreated: 07/08/08 10:14:53PMLastAccessed: 07/10/08 09:41:03PMLastWritten: 07/08/0810:14;54PM , ^ m \ - r ^FullPath- 08-069208\WXE906472668\C\Documents andSettings\bobby\Desktop\artwork\misc\girl.jpg

Name: 233bc8d79357f3075c7edf5ddb083f11.jpg

Description: File, ArchiveFileCreated: 07/11/0802:21:30PMLastAccessed: 07/14/08 01:26:56PMLastWritten: 07/11/0802:21:30PMFullPath- 08-069208\WXE906472668\C\Documents andSettings\bobby\Desktop\artwork\misc\233bc8d79357f3075c7edf5ddb083f11.jpg

ou CANSPENDMIb4UTBS.HOURS,

DAYS.W

ORI V I N

MONTHS

O m - A N A I Y Z I N G

ASTTUATION;

TRYINGT OPUTTHEMECE

TOCSETHER.

JUSTIFYINGWHAT

COUliNt WOULD^VEHAPPINED

...ORYHJCANJOSTtEAVE

THEPIECEONTHEHXX)R AND

MOVETHE

FUCKON


28/33


29/33

ORANGE COUNTY SHE RI F F 'S OFFICE08-069208 COMPUTER FORENSICS REPORT

Zenaida Fernandez Gonzalez

Akeyword search f o r"Zenaida" was conducted on th e HP desktop computer.Thf o l l o w i n g f i l e s arerecords o f web pages i n d i c a t i n g t h a t someone was search

f o r t h a t nameon th e I n t e r n e t .

Name: [email protected][2].txtDescription: File, ArchiveFileCreated: 07/16/0806:21:17AMLastAccessed: 07/16/0806:21:27AMLastWritten: 07/16/0806:21:27AM , ,. , ^ i r9i tv+FullPath: 08-069208\S013J10X237614\D\DocumentsandSettings\casey\Cookies\[email protected][2J.txt

zenaida

Name: history.datDescription: File, ArchiveFileCreated: 10/22/07 01:13:21PMLastAccessed: 07/16/08 12:03:24PMLastWritten: 07/16/08 12:03;24PMFullPath: 08-069208\S013J10X237614\D\Documents andSettings\casey\ApplicationData\Mozilla\Firefox\Profiles\mfhaxjkl.default\history.dat

http://friends.myspace.com/index.cfm

?fuseaction=user.viewfriends\=203461948897ec12-9984-4944-b65e-6dcef3d5a590=zenaida

Name: index.datDescription: File, ArchiveFileCreated: 06/12/0811:15:29PMLastAccessed: 06/12/0811:15;29PM

Fuf/i^tl^ 08-069208\S013J10X237614\D\Documentsand Settings\casey\LocalSettings\TemporaryInternet

Files\Content.lE5\index.dat

http://clk.atdmt.com/RC/go/whtpgreu0210000164ruc/direct;at.rucreu00001670;ct.l/01?dispat^^^^

S e a r c h R e g i s t r a t i o n S a c t i o n = pe o p l e S e a r c h _ w p _ r e s u l t c o u n t S ci t y = S i t > n a m e = S p e o p l e S e a r c h F ro m = w p & a f f i l i a t e

id=131SsearchFirstName=zenaidaSsearchLastName=Gonzalez&searchAge-25

Name: index.datDescription: File, ArchiveFileCreated: 06/12/08 11:15:29PMLastAccessed: 06/12/08 11:15:29PM

F u f p a t h ^ 08-069208\S013J10X237614\D\Documents and Settings\casey\LocalSettings\TennporaryInternet

Files\ContentlE5\index.dat

h t t p : / / p r e v i e w . U 3 s e a r c h. c o m / p r e v i e w / a l a / n e H s e a r c h ? S s e a r c h L N a m e = F e r n a n d e z & s e a r c h S t a t e - F L S s ^

t y = j a c k s o n v i ll e S s e a r c h F N a m e =Z e n a i d a S a d I D = 3 03 0 1 4 F 9 3 6 & a d s o u rc e = 8 S T I D = 0 S c i d =p e o p l e S s e a r c h t ab = p e o p l e

6--newsearch [2]


30/33

ORANGE COUNTY SHERIFF'S OFFICE-08-069208 COMPUTER FORENSICS REPORT

Name: UnallocatectsClustersDescription: File,UnalloeatedClustersFileCreated:

LastAccessed:LastWritten:

FullPath: 08-069208\S013J10X237614\D\UnallocatedClusters

h t t p ; / / s e a r c h s e r v i c e . m y

s p a c e . c o m / i n d e x .

c f m ? f u s e a c t i o n = s i t e s e a r c h . r e s u l t s S \

q r y = z a i m i e S ty p e = P e o p l e S s r ch B y = N a n i e S g = FS l o c = o r l a n d o %2 C f l 3 2829aminAge=22 maxAge=\

26sd=25

Name; Unallocated ClustersDescription: File, Unallocated ClustersFileCreated:LastAccessed:

LastWritten:FullPath: 08-069208\S013J10X237614\D\UnallocatedClusters

" h t t p : / / x . m y s p a c e c d H . c o m / m o d u l e s / s i t e s e a r c h / s t a t i c / j s / s i t e s e a r c h 0 0 3 . j s " > < / s c r i p t >

< ! Search - S t a r t ~ >


31/33

08-069208COMPUTERFORENSICS REPORT

Webmall inUnallocated Space

Name: Unallocated ClustersDescription: File, Unallocated Clusters

f S P afh* '

J|?j6WXE906472668\C\UnallocatedClusters

[iavascript:Help('http;//help.yahoo.com/help/us/mail/context/...]

To- caseyanthony" &&&&&itii

on7/23/07,m a

h a w .n .wrots, ^ ^ 1 : 1

reXfan 'd'S:1e^:^Sln

l^rStSXfL'e

^5:1^

yaKnJ w . a . s , r ea .about . is.Ka.foronce,n,

happyand iknow whoi amand whatiwantout oflife

on7/23/07,caseyanthony ^ ^ ^

on7/23/07,n,a*bawwns


32/33

08-069208

ORANGE COUNTY SHERIFF'S OFFICECOMPUTERFORENSICS REPORT

Name: Lb55a353606038e56becf924d0a4dc1301jpgDescription: File, ArchiveFileCreated: 07/15/0810:15:30AM

LastAccessed:07/15/08 10:16:37AMLastWritten: 07/15/0810:15:31AM

FullPath: 08-069208\WXE906472668\C\Documents andSettings\bobby\Desktop\photos\l_b55a353606038e56bed924d0a4dc1301.jpg

-5.

-Cj

-


33/33

ORANGE COUNTY SHERIFF'S OFF ICE

08-069208 COMPUTER FORENSICS REPORT

MessageFragments inallocated space

Name: _h.cfsDescription: File, ArchiveFileCreated: 07/13/0801;02:09PMLastAccessed:07/13/08 03:19:09PMLastWritten: 07/13/0801:02:09PM

FullPath: 08-069208\WXE906472668\C\Documents and Settings\bobby\LocalSettings\ApplicationData\Apple

Computer\Safari\History\_h.cfs

InboxSent M e s s a g e s N o t i f i c a t i o n s O p d a t e s ComposeMessageA A BetweenYou andShawn J a r r e t t A Sh

awn J a r r e t t Todaya tl l : 2 0 a i noo i ca nd i g i tg n g e l how'ds a tgo a tf u s i a nA Casey Anthon

yTodaya t11:28amid i d n ' t end upgoing l a s t n i g h t , ihungouth e r e w i t h n a t e . i twasb e t t e rto

smoke, eat,andwatch h o r r o rmovies. :) idi dt a l ktoraythough,he wase x p e c t i n g agood turn

out.A Shawn J a r r e t t Todaya t11:48amoht h a t s watup h o r r o r movie f a n a t i c m y s e l f watsu

P

Name: _h.cfsDescription: File, ArchiveFileCreated: 07/13/08 01:02:09PMLastAccessed:07/13/08 03:19:09PMLastWritten; 07/13/08 01;02;09PM . ^ ^ ,FullPath; 08-069208\WXE906472668\C\Documents and Settings\bobby\Local SettingsVXpplicationData\Apple

Computer\Safari\History\_h.cfs

Date: J u l13,200812:30 PM F l a g asSpamorReport Abuse [?]Subject:Re: RE: Re: No S u b j e c tBod

y:I may bedowntohead o v e r f r i d a y a f t e r workandhead back Saturday afternoon...

O r i g i n a l

Message

From: [casey] Date: J u l13,20089:20 AM f r i d a y night i r e a l l y wantto go. i'mt h i n k i n g about i t . how'veyoubeen? O r i g i n a lMes

sage From: B r e t t Date: J u l 13,, 2008 12:05PM Ididn't ge t a h o t e l yet,I c an

' t p l a n f a rahead haha.What n i g h t i si t ? O r i g i n a l Message

From: [casey] Date: J u l13,20088:20 AM heyhun! a reyouheadingout toj a c k s o n v i l l e t h i s week

end?

Name; l7tone.htmlDescription; File, ArchiveFileCreated; 4/29/0812:53;21AMLastAccessed; 06/12/0809;09;34AMLastWritten; 06/12/0809:09;34AM

FullPath; 08-069208X8013J10X237614\DXDocumentsandSettingsXOwnerXMy DocumentsXAIMLoggerXcaseyomarieXir

LogsXI7tone.html

ODOCTYPE

html PUBLIC "-//W3C//DTD XHTML 1.0T r a n s i t i o n a l / / E N "

"http://www.w3.org/TR/xhtmll/DTD/

x h t m l l - t r a n s i t i o n a l . d t d " >

IM History with buddy L 7 T o n e < / t i t l e > < l i n k r e l = " s t y l e s h e e t " h r e f = " s t y l e s . e s s " t y p e = " t e x t / c

ss">

,