This article is written specially for Belkasoft by Kevin Stenger, a digital forensic examiner who investigated the case of Casey Anthony
The Casey Anthony case occurred back in 2008 when her 2-year-old daughter Caylee was first reported missing and, half a year later, found dead. The mother's behavior was suspicious from the beginning, and she was arrested the day after her child was reported missing.
You can familiarize yourself with the story in our previous articles "The case of Casey Anthony" and "Basic but significant legal issues in the Casey Anthony Case".
In this article, Kevin Stenger, a digital forensic examiner who investigated the Casey Anthony case, discusses other digital data sources that were investigated during this case.
* * *
The courtroom presentation of the digital evidence in the Casey Anthony case centered around the family's home computer. A very large number of computers, cell phones and other digital evidence was processed in this case which never made it into court as the Prosecution, Defense, Detectives and examiners deemed it extraneous.
Beyond the suspect and her family there were a number of other sources of digital evidence which were processed. Extended family, acquaintances, known individuals who claimed to have evidence as well as "anonymous" Internet sources posting information on websites and providing tips. All had devices or digital evidence logs which had to be obtained and or examined.
Logs from Internet Service Providers, Cellphone tower logs, cell service providers, all had to be subpoenaed and examined. Anonymous reports on Internet sites required that the site be subpoenaed for connection logs which then required additional subpoenas to track down the source of the post to individuals through their ISPs.
A few individuals became obsessed with the case and claimed to have knowledge of the events. In one case a computer had to be obtained from a local computer repair shop where it had been turned in to be wiped. Digital photos which were purported to document the location where the victim was abandoned were examined for their metadata. In one instance the examiners used the metadata from the pictures to go into the field and locate where the picture was taken to refute the report.
From the time of the initial report of the case to the trial the image of the family computer had to be reexamined sometimes on a weekly basis as tips and theories were presented from all sorts of sources on when and how the victim disappeared.
When the event was first reported it was alleged that the victim was left with her nanny however no such person existed and the apartment where the nanny lived was and had been vacant. The computers and phones all had to be searched for information relating to the existence or contact with the "nanny". No evidence was located which indicated that the nanny existed.
Other theories and rumors resulted in other searches such as where the victim might be located and who her father might be, the significance or lack thereof of tattoos. Where the suspect might be employed. How the victim might have died. In addition, allegations on family dynamics led to re-examination of the data. In short as the case evolved over months the evidence was reexamined in light of new information which either had to be confirmed or refuted if possible.
The actual amount of digital evidence processed and examined in this case was far larger than what was actually presented in court. This evidence resulted in a backlog for other cases which were pending examination of the digital evidence.