http//
John Dennis Bradley, the CEO and founder of SiQuest Corporation
Bradley dropped the bombshell that these searches were visited frequently. “I believe that some of these items might have been actually bookmarked."
I'm trying to think of a situation where you have the hard drive or drives in your possession and you make a statement like these items might have been bookmarked.
What would you be going on to think that they might have been as opposed to currently bookmarked?
I'd love to hear that issue pressed.
The cross of him was weak at best.
The cross of him was weak at best.
Indeed. I thought the expert made some fairly speculative comments.
I can only assume the defence will have a rebuttal witness.
Armresl
Here is a link to a PDF Encase report from examiner Sandra Cawn. http//
I find it curious that she has to document bookmarking data from the drives in to specific folders. Who does that? (well I guess she does, but why bother?)
Then she makes a broad sweeping statement like this
No photographs, video, email, instant message chat or any other type of
communication with a Zenaida Fernandez-Gonzalez was discovered on either
computer.
without explaining how she knows that.
Eugh, native EnCase reports (
Eugh, native EnCase reports (
Heh, yeah it makes my screen crawl too.
The use of "this writer" makes my screen crawl.
Then she makes a broad sweeping statement like this
No photographs, video, email, instant message chat or any other type of
communication with a Zenaida Fernandez-Gonzalez was discovered on either
computer.without explaining how she knows that.
Well, thats essentially saying "I looked for these things and didnt find any".
Not that big a stretch.
I agree, not that big of a stretch.
What I was getting at is that 'this writer' documents that she bookmarked something, and where it was bookmarked in the report, but includes no information on the process of looking for communication with Zenaida. It is a curious choice of emphasis on detail.
I watched the testimony from Mr. Bradley and I thought he said he only had access to one file - the Firefox 2 history file - and not the entire drive?
How about mounting the image, or VM?