Digital Media Recovered and Digital Forensics Implications in the Case

A fair number of digital devices were taken as evidence in this case both at the Niederbrock home in Farmville VA and at the McCroskey residence in Castro Valley California.

I created a separate place for general discussion of digital forensics here: [You must be registered and logged in to see this link.]

I'd like to reserve that location for more general discussion of digital forensics tools and so forth. Here let's talk about the media that was seized by the police and issues related to the various online presences the principles in the case created.

Digital items taken:

Kodak digital camera
Patriot thumb drive
4 GB SD memory card
X-box Live Card (provides information in relation to an online account)
HP Pavillion PC
LG Verizon Photo Cell Phone
Sandisk 80GB Storage device
256 MB thumb drive with Longwood Logo

More here: [You must be registered and logged in to see this link.]

I am not sure if this list includes Sam's computer from California.

Do you have any idea about the 4 hard drives? Did the police remove them from the computers, or where there four external or removed hard drives?

DoctorZ wrote:Do you have any idea about the 4 hard drives? Did the police remove them from the computers, or where there four external or removed hard drives?

It would be standard practice to remove and secure the hard drives under most circumstances in order to ensure that the contents are not modified. Analysis would be done on an image or copy. This ensures the contents of the original drives aren't changed simply by normal operation of the computer or by accident.

There are some exceptions where you instead want to examine the machine "live", but I don't think that applies here.

dangrsmind wrote:

DoctorZ wrote:Do you have any idea about the 4 hard drives? Did the police remove them from the computers, or where there four external or removed hard drives?

It would be standard practice to remove and secure the hard drives under most circumstances in order to ensure that the contents are not modified. Analysis would be done on an image or copy. This ensures the contents of the original drives aren't changed simply by normal operation of the computer or by accident.

There are some exceptions where you instead want to examine the machine "live", but I don't think that applies here.

My guess would be that one drive was from the laptop, one from the Compaq and two from the "custom tower." That leads me to wonder if Sam did bring his computer. It is possible that the custom built PC belonged to Emma, but to me seems likely to be Sam's for photo and video editing. Who knows though, since we don't know more about the components inside. If it were found to have a nice video card that would further my thinking that it may have been Sam's.

At least one computer was taken from the home in Castro Valley. I'll have to look for the article that stated this...

Here's the article: [You must be registered and logged in to see this link.]

Thanks for starting this thread, we needed a seperate area to discuss this part of the case.

Although the horrorcore element is more sensational, the real case likely will hinge on forensics, both in relation to DNA and blood evidence from the bodies and collected from Sam as well as from all the digital media collected.

At the very least there is the question of the deletions from Sam's MySpace page. Those can likely be tied to one of the computers here.

Any emails, text messages, images, prints, etc. that were circulated can very likely be traced to the originator even if they succeeded in fully deleting the original images themselves.

dangrsmind wrote:Although the horrorcore element is more sensational, the real case likely will hinge on forensics, both in relation to DNA and blood evidence from the bodies and collected from Sam as well as from all the digital media collected.

At the very least there is the question of the deletions from Sam's MySpace page. Those can likely be tied to one of the computers here.

Any emails, text messages, images, prints, etc. that were circulated can very likely be traced to the originator even if they succeeded in fully deleting the original images themselves.

Absolutely agree, the actual case itself will be about a lot of shit we havent even discussed such as the stuff listed in this thread and other forensic evidence. The horrorcore element may not even be menitioned unless used as backstory in an opening statment.

What if you have potential jurors who don't even have email? Seriously I talk to people over 50 every day that still don't email. Won't all the computer forensics really confuse them? Would the defense try to get those people or would it be really impossible to seat someone that out of touch with the internet for a case like this?

Retirees without computers need not worry about jury duty

I seriously doubt this is going to be a difficult case from the computer forensics perspective. Sam doesn't strike me as the super hacker type, and if he deleted anything he likely just did it the naive way which will be easily uncovered in a forensic evaluation of the computers.

All the prosecution's expert is going to have to say is that they found evidence of some image/file/message on a specific computer and what the contents of that object are if they know. They may also explain the chain of custody of the digital evidence or in the case of phone records how they were obtained. I don't think it is any harder to understand than blood/DNA evidence once you get beyond the issue that deleting a file on a computer isn't really erasing the data from the hard disk.

ziggy wrote:What if you have potential jurors who don't even have email? Seriously I talk to people over 50 every day that still don't email. Won't all the computer forensics really confuse them? Would the defense try to get those people or would it be really impossible to seat someone that out of touch with the internet for a case like this?

Retirees without computers need not worry about jury duty

Being that it is a university town I seriously doubt the juror pool would consist of enough people not internet-connected to make it a concern. I could be wrong, it IS small town southern USA after all, but I would think a good percentage of the juror pool for any case in that city will be made up of at least 50% of people connected to the university in one way or another. Isnt Longwood that big a part of Farmville?

dangrsmind wrote:I seriously doubt this is going to be a difficult case from the computer forensics perspective. Sam doesn't strike me as the super hacker type, and if he deleted anything he likely just did it the naive way which will be easily uncovered in a forensic evaluation of the computers.

All the prosecution's expert is going to have to say is that they found evidence of some image/file/message on a specific computer and what the contents of that object are if they know. They may also explain the chain of custody of the digital evidence or in the case of phone records how they were obtained. I don't think it is any harder to understand than blood/DNA evidence once you get beyond the issue that deleting a file on a computer isn't really erasing the data from the hard disk.

I would concur. The myspace stuff could get a little confusing to an older crowd, I dont even have myspace myself, even those connected could get confused about all that myspace stuff but that should only be a small part of the case.

I think the MySpace stuff is going to be limited to simple ideas like these people were friends on MySpace or sent each other messages on MySpace.

Private messages sent on Myspace are similar to email and not hard to understand. Perhaps the idea of posting a message publicly on someone else's MySpace page could be a bit confusing.

dangrsmind wrote:I think the MySpace stuff is going to be limited to simple ideas like these people were friends on MySpace or sent each other messages on MySpace.

Private messages sent on Myspace are similar to email and not hard to understand. Perhaps the idea of posting a message publicly on someone else's MySpace page could be a bit confusing.

\


There isnt anything much more confusing than DNA and other scientific/forensic evidence so a good lawyer should be able to explain all of this in a way that anyone can understand, they did a very good job of this with the Simpson case IMO, that was really a case of DNA for dummies, the lawyers and experts did a good job of allowing Joe 6 pack to understand some pretty complex stuff. Its more about the lawyers than the jurors I would say.

Yes I suppose so. The messaging and MySpace stuff is so totally confusing to those who have never seen it or done it. I suppose in deliberation other jurors could clue them in.

DNA is difficult to understand. What mucked it up was understanding contamination imo.

Anywhooo, no doubt they will be able to narrow down a better time line using this evidence AND find out if Sam contacted anyone and what his state of mind was after the killing.

It was my assumption and piXy can correct me if I'm wrong, but he may have gone in and listened to his own songs via a computer he had access to either right before or after the murders?

Why searching of all the myspace pages? I know mine was one of them and my world wasnt turned upside down like the media said it would......
any ideas about what theyw ere looking for or if they read IMs or msgs?