casey anthony docs joy wray files 0921

8/6/2019 Casey Anthony Docs Joy Wray Files 0921

1/22

Orange County Sheriffs Office8-074777/Orange County Sheriffs Office\Seizure and Processing Notes Page 1

Orange County Sheriffs Office

Forensic Examiner

Kevin Stengerergeant

Orange County Sheriffs OfficeCriminal Investigations DivisionComputer Crimes Squad

500 West Colonial DriveOrlando Florida 32804

eizure and Processing Notes

eizure and Processing Notes

eizure Notes

On 11/23/09 Sgt. John Allen with the Orange County Sheriffs Office turned overNikon Coolpix 5600 digital camera, serial number 31702281 to the Computer

Crimes Squad for examination. Sgt. Allen requested that the camera be examinedor any images relating to the case which may be in the camera.

On 11/23/09 Cpl. Yuri Melich with the Orange County Sheriffs Office turned overToshiba laptop, serial number 29522032Q, to the Computer Crimes Squad forxamination. Cpl. Melich requested that the computer be examined for images,ideos and any other information relating to the case.

gt. Allen provided a CD with images that had been scanned from prints. Sgt.Allen stated that the images were provided by Mrs. Wray.

Processing Notes

The Nikon Coolpix camera was examined.

No batteries or flash media was in the camera. The battery cover was

malfunctioning and would not close completely. The date and time on the cameraad reset to 1/1/05 at 00:00 hours.

The camera was attached to a computer with a registry write blocker on andmaged with FTK imager.

The Toshiba laptop was imaged and contained the following.

Hard drive


2/22


The hard drive is a 320GB Toshiba, model number MK3252GSX, serial numberZ835CMIVT.

The date and time on the BIOS is as follows.

Date TimeActual 11/24/09 08:33:00Computer 11/24/09 07:32:59

The date and time may be off by one hour due to the change in Daylight timeccurring in November.

ummary

No images of apparent evidentiary value were located on the internal memory of

he Nikon camera.

Eight images were located that appeared to match those on the CD provided bygt. Allen. Two movies files appear to be of the area around the memorial for

Caylee Anthony.

The images and video were copied to the Evidence folder.

Graphics from Desktop Folder

Name DSCN1800.JPGDescription File, Archive

ile Created 04/18/09 11:24:14Last Accessed 04/18/09 11:24:14Last Written 12/31/04 22:00:00Entry Modified 04/18/09 11:24:15

ull Path 08-074777 Wray\Z835CMIVT\D\Users\owner\Desktop\04192009\DSCN1800.JPG

mageDescription:Make: NIKONModel: E5600Orientation: 1XResolution: 300/1 = 300 (IFD 0)YResolution: 300/1 = 300 (IFD 0)ResolutionUnit: 2

oftware: E5600v1.0DateTime: 0000:00:00 00:00:00YCbCrPositioning: 2ExifOffset: 284Compression: 6XResolution: 300/1 = 300 (IFD 1)YResolution: 300/1 = 300 (IFD 1)ResolutionUnit: 2


3/22


pegIFOffset: 4596pegIFByteCount: 6552

ExposureTime: 10/4139 = 0.002416042522348394Number: 49/10 = 4.9000000000000004

ExposureProgram: 2SOSpeedRating: 50

ExifVersion: 0220DateTimeOriginal: 0000:00:00 00:00:00DateTimeDigitized: 0000:00:00 00:00:00ComponentsConfiguration: 01 02 03 00CompressedBitsPerPixel: 2/1 = 2ExposureBias: 0/10 = 0MaxAperture: 30/10 = 3MeteringMode: 5LightSource: 0

lash: 24ocalLength: 57/10 = 5.7000000000000002

MakerNote: undefinedUserComment: undefined

lashPixVersion: 0100ColorSpace: 1ExifImageWidth: 2592ExifImageHeight: 1944ExifInterOffset: 1026

ileSource: 03ceneType: undefined

CustomRendered: 0ExposureMode: 0WhiteBalance: 0DigitalZoomRatio: 0/100 = 0

ocalLenIn35mmFilm: 34ceneCaptureType: 0

GainControl: 0

Contrast: 0aturation: 0harpness: 0ubjectDistanceRange: 0


4/22






oftware: E5600v1.0DateTime: 0000:00:00 00:00:00YCbCrPositioning: 2ExifOffset: 284Compression: 6XResolution: 300/1 = 300 (IFD 1)YResolution: 300/1 = 300 (IFD 1)ResolutionUnit: 2pegIFOffset: 4596pegIFByteCount: 7393



ExifVersion: 0220DateTimeOriginal: 0000:00:00 00:00:00

DateTimeDigitized: 0000:00:00 00:00:00ComponentsConfiguration: 01 02 03 00CompressedBitsPerPixel: 2/1 = 2ExposureBias: 0/10 = 0MaxAperture: 30/10 = 3MeteringMode: 5LightSource: 0

lash: 24ocalLength: 57/10 = 5.7000000000000002


lashPixVersion: 0100ColorSpace: 1

ExifImageWidth: 2592ExifImageHeight: 1944ExifInterOffset: 1026




GainControl: 0Contrast: 0


5/22


aturation: 0harpness: 0ubjectDistanceRange: 0








ExifVersion: 0220DateTimeOriginal: 0000:00:00 00:00:00DateTimeDigitized: 0000:00:00 00:00:00ComponentsConfiguration: 01 02 03 00


6/22


CompressedBitsPerPixel: 2/1 = 2ExposureBias: 0/10 = 0MaxAperture: 30/10 = 3MeteringMode: 5LightSource: 0

lash: 24ocalLength: 57/10 = 5.7000000000000002









7/22











lash: 25ocalLength: 57/10 = 5.7000000000000002









8/22












9/22



lash: 24ocalLength: 57/10 = 5.7000000000000002









10/22











lash: 24ocalLength: 57/10 = 5.7000000000000002









11/22












12/22



lash: 24ocalLength: 57/10 = 5.7000000000000002









13/22











lash: 24ocalLength: 57/10 = 5.7000000000000002









14/22



Video

Name caylee memorial 002.MODDescription File, Archive

ile Created 05/04/08 18:58:42Last Accessed 05/04/08 18:58:42

Last Written 05/01/09 13:19:18Entry Modified 05/07/09 19:43:45

ull Path 08-074777 Wray\Z835CMIVT\D\Users\owner\Pictures\2009-05-01 caylee memorial\caylee memorial 002.MOD

Name misc vids 001.MODDescription File, Archive


ull Path 08-074777 Wray\Z835CMIVT\D\Users\owner\Pictures\2009-06-03 misc vids\misc vids 001.MOD


15/22


Registry, Physical and Logical Structure

Nikon Coolpix

Serial Number 0000-0000

Heads 4Sectors Per Track 16Unused Sectors 4,137Number of FATs 2Sectors Per FAT 3Boot Sectors 1

VolumeFile System FAT12Sectors per cluster 32Bytes per sector 512Total Sectors 27,863

Total Capacity 14,254,080 Bytes (13.6MB)Total Clusters 870Unallocated 13,189,120 Bytes (12.6MB)Free Clusters 805Allocated 1,064,960 Bytes (1MB)Volume Name NO NAMEVolume Offset 0Drive Type Fixed


16/22


17/22


Z835CMIVT

Name Z835CMIVTActual Date 11/24/09 08:30:47Target Date 11/24/09 08:30:47

File Path I:\08-074777\Z835CMIVT.E01Case Number 08-074777 WrayEvidence Number Z835CMIVTExaminer Name Sgt. Kevin Stenger Model MK3252GSXSerial Number Z835CMIVTDrive Type FixedFile Integrity UnverifiedAcquisition MD5 ac191ab44363ac191f9178cb6e02a6e5Verification MD5 ac191ab44363ac191f9178cb6e02a6e5GUID f1ae2c0e95f5d2469f97aba6a6776eeeEnCase Version 6.14.3System Version Windows XPWrite Blocked TableauNeutrino NoIs Physical YesRaid RHS NoRaid Stripe Size 0Error Granularity 64Process ID 0Index File I:\08-074777\Index\Z835CMIVT-

f1ae2c0e95f5d2469f97aba6a6776eee.IndexAcquisition Info NoSources NoSubjects NoRead Errors 1Missing Sectors 0Disk Elements NoCRC Errors 0Compression BestTotal Size 320,072,933,376 Bytes (298.1GB)Total Sectors 625,142,448Disk Signature 19D12ADDPartitions Valid

Read ErrorsStart Sector Sectors

11,431,680 64

artitionsName Id Type Start Sector Total Sectors Size

27 Unknown 2,048 3,072,000 1.5GB07 NTFS 3,074,048 607,188,992 289.5GB17 Hidden IFS 610,263,040 14,878,720 7.1GB


18/22


C

Serial Number E228-A506Full Serial Number 90E228B8E228A506Driver Information NTFS 3.1

VolumeFile System NTFSSectors per cluster 8Bytes per sector 512Total Sectors 3,072,000Total Capacity 1,572,859,904 Bytes (1.5GB)Total Clusters 383,999Unallocated 1,421,893,632 Bytes (1.3GB)Free Clusters 347,142Allocated 150,966,272 Bytes (144MB)Volume Name TOSHIBA SYSTEM VOLUME

Volume Offset 2,048Drive Type Fixed

PartitionId 27Type UnknownStart Sector 2,048Total Sectors 3,072,000Size 1.5GB

Unable to open registry on volume C

D

Serial Number F858-2B45Full Serial Number C2F85836F8582B45Driver Information NTFS 3.1

VolumeFile System NTFSSectors per cluster 8Bytes per sector 512Total Sectors 607,188,992Total Capacity 310,880,759,808 Bytes (289.5GB)Total Clusters 75,898,623Unallocated 149,984,817,152 Bytes (139.7GB)Free Clusters 36,617,387Allocated 160,895,942,656 Bytes (149.8GB)Volume Name SQ004829V03Volume Offset 3,074,048Id S-1-5-21-737594619-1414829202-

3786626943Drive Type Fixed


19/22


PartitionId 07Type NTFSStart Sector 3,074,048Total Sectors 607,188,992Size 289.5GB

Account Info

User name: Administrator

Full Name:Type of User: Local UserAccount Description: Built-in account for administering the computer/domainPrimary Group Number: 513Security Identifier: S-1-5-21-737594619-1414829202-3786626943-500

User belongs to group: AdministratorsLogon Script:Profile Path:Last Logon: 01/18/09 02:47:03Last Password Change: 01/20/08 21:57:58Last Incorrect Password Logon: 01/01/70 00:00:00

User name: Guest

Full Name:Type of User: Local UserAccount Description: Built-in account for guest access to thecomputer/domainPrimary Group Number: 513Security Identifier: S-1-0-0-0-0-0-0User belongs to group: GuestsLogon Script:Profile Path:Last Logon: 10/30/09 15:33:12Last Password Change: 01/01/70 00:00:00Last Incorrect Password Logon: 01/01/70 00:00:00


20/22


User name: owner

Full Name: joy and familyType of User: Local UserAccount Description:Primary Group Number: 513Security Identifier: S-1-5-21-737594619-1414829202-3786626943-1000User belongs to group: AdministratorsLogon Script:Profile Path: C:\Users\ownerLast Logon: 11/16/09 14:35:20Last Password Change: 03/11/09 17:16:32Last Incorrect Password Logon: 01/01/70 00:00:00

User name: systemprofile

Full Name:Type of User: Domain UserAccount Description:Primary Group Number: 0Security Identifier: S-1-5-18Logon Script:Profile Path: %systemroot%\system32\config\systemprofileLast Logon: 01/01/70 00:00:00Last Password Change: 01/01/70 00:00:00Last Incorrect Password Logon: 01/01/70 00:00:00

User name: LocalService

Full Name:Type of User: Domain UserAccount Description:Primary Group Number: 0Security Identifier: S-1-5-19Logon Script:Profile Path: %SystemRoot%\ServiceProfiles\LocalServiceLast Logon: 01/01/70 00:00:00

Last Password Change: 01/01/70 00:00:00Last Incorrect Password Logon: 01/01/70 00:00:00


21/22


User name: NetworkService

Full Name:Type of User: Domain UserAccount Description:Primary Group Number: 0Security Identifier: S-1-5-20Logon Script:Profile Path: %SystemRoot%\ServiceProfiles\NetworkServiceLast Logon: 01/01/70 00:00:00Last Password Change: 01/01/70 00:00:00Last Incorrect Password Logon: 01/01/70 00:00:00

User name: Guest

Full Name:Type of User: Domain UserAccount Description:Primary Group Number: 0Security Identifier: S-1-5-21-737594619-1414829202-3786626943-501User belongs to group: GuestsLogon Script:Profile Path: C:\Users\GuestLast Logon: 01/01/70 00:00:00Last Password Change: 01/01/70 00:00:00Last Incorrect Password Logon: 01/01/70 00:00:00

OS Info

roduct Name: Windows Vista (TM) Home PremiumCurrent Version: 6.0Registered Owner: ownerRegistered Organization: Toshiba

ystem Root: C:\WindowsCurrent Build Number: 6001

ath Name: C:\Windowsroduct ID: 89578-OEM-7332157-00237ast Service Pack: Service Pack 1roduct Key:

VersionNumber:ource Path:nstall Date: 01/18/09 02:44:55ast Shutdown Time: 11/07/09 18:54:29


22/22


TimeZone Info

Current control set is 001Default control set is 001

ailed control set is 000astKnownGood control set is 003tandard time bias is -5:00 hours offset from GMTtandardName: Eastern Standard Timetandard time is set to change the Standard bias by 0 minutestandard time is set to change on Sunday of the 1st week of November, at 02:00 hours.

DaylightName: Eastern Daylight TimeDaylight savings is set to change the Standard bias by 60 minutes.Daylight savings time is set to change on Sunday of the 2nd week of March, at 02:00 hours.Active time bias is -5:00 hours offset from GMT.

imeZoneKeyName: Eastern Standard Timehe current time setting is 0:00 hours offset from GMT.he offset must be either added or subtracted from GMT depending on the time zone location

Display: (GMT-05:00) Eastern Time (US & Canada)

E

Serial Number 8C7E-37ABFull Serial Number 7E8C7E858C7E37ABDriver Information NTFS 3.1

VolumeFile System NTFSSectors per cluster 8Bytes per sector 512

Total Sectors 14,878,720Total Capacity 7,617,900,544 Bytes (7.1GB)Total Clusters 1,859,839Unallocated 630,296,576 Bytes (601.1MB)Free Clusters 153,881Allocated 6,987,603,968 Bytes (6.5GB)Volume Name HDDRECOVERYVolume Offset 610,263,040Drive Type Fixed

PartitionId 17

Type Hidden IFSStart Sector 610,263,040Total Sectors 14,878,720Size 7.1GB

Unable to open registry on volume E

casey anthony docs joy wray files 0921

Documents