Quote :

"you were told wrong. it was bogus evidence. and zip codes rarely change."

3 points there

1) I was told that by someone who was actually in the courtroom during the trial, so i'm inclined to believe them over you.
2) as my earlier posts on this subject attest, i'm fully aware that the evidence might not be valid evidence against BC.
3) Who cares. That point carries little to no significance (as does the zip code being centered on fielding), as I earlier explained.

6/1/2011 12:41:02 PM

since no one reads the last post:

webslueths timestamp explanation:
http://www.websleuths.com/forums/showpost.php?p=6505258&postcount=55

says last access time is always equal to create time in vista. i didn't think that was what they were talking about though.

6/1/2011 1:17:27 PM

If this was his work issued thinkpad they had, which is what I remember... it would have been XP. Cisco skipped vista entirely.

[Edited on June 1, 2011 at 2:42 PM. Reason : of course i'm not sure if that particular attribute is different between XP and Vista... ]

6/1/2011 2:42:34 PM

^^^ooo they were there... I watched the whole friggen testimony, only thing they saw that i didn't was the jurors faces. You have hear say, I have direct watching. Even gessner wouldn't allow that

Perhaps i'm mistaken, if so, somebody else chime in.

6/1/2011 2:47:43 PM

It was a work issued Cisco laptop running vista, according to testimony. He was a tester, so that's why he had Vista. I don't think the OS mattered for what the defense was saying though, if you watch the Masucci testimony.

^And you are mistaken. The map zoomed right up to the cul-de-sac. It was a zip code search originally, but it was a beeline directly to that spot. 41 seconds from the time browser opened, until closed (listen to the closing statement) with a few seconds at Fielding Drive specifically. I don't think there's any other explanation besides, Brad did it or the map was planted. If you listen to Kurtz's follow up interview, he states the map is planted. If it was an answer like "it wasn't even zoomed in to the spot" or "there are a million explanations" I think he would have given one, instead of stating his client was framed. That's a little harder to pull over on people if it's not true.

[Edited on June 1, 2011 at 2:52 PM. Reason : ]

6/1/2011 2:48:56 PM

Bobby, he had a vista image on his laptop

^fair enough, I retract my previous comments

[Edited on June 1, 2011 at 2:51 PM. Reason : .]

6/1/2011 2:50:56 PM

it had to be planted.

why would he hide every bit of physical evidence, set up fake phone calls, etc just to then do a google search of where to dump the body. he knows that someone would be able to find that google map if it came down to it.

6/1/2011 3:06:29 PM

bitch is dead...bitch is dead....lock this thread

6/1/2011 3:07:16 PM

Quote :

"bitch is dead...bitch is dead....lock this thread"

There will be an appeal, so no.

Quote :

"You have hear say, I have direct watching"

Well in this case, my hearsay > your direct watching

6/1/2011 3:25:08 PM

Quote :

"why would he hide every bit of physical evidence, set up fake phone calls, etc just to then do a google search of where to dump the body. he knows that someone would be able to find that google map if it came down to it."

nobody's perfect?
he used the wrong browser to run the search?
he thought he cleaned out the cache, didn't do so successfully?
he was in a different state of mind when he ran that search vs when he wacked her/cleaned up

but as far as my knowledge of the case goes, it could have been any of those....or it could be planted, or it could be cary,pd misusing the computer after it was their custody...i have no idea, and i'm pretty sure most of us don't either. BUT LETS ALL TALK LIKE WE DO!!!

6/1/2011 3:31:18 PM

^^YOUR MOM, OK.

THAT MEANS I WIN.

6/1/2011 3:43:23 PM

^^you summed it up pretty well, and considering that is the strongest evidence presented in the case it seems to me to be the epitome of reasonable doubt (actually, more than reasonable doubt)...which was supposed to be the standard of proof adhered to.

6/1/2011 3:47:50 PM

Quote :

"Sounds like that "tech guy" knows how to program his DVR and that's about it."

Not really. If what he said was "timestamps don't mean shit, in general," then he would be right. They can be easily changed, as we all know. And, given that he didn't get the whole scoop when he said that, I can't really hold it against him too much.

as for the Vista timestamp issue... let's read this:
http://www.jonesdykstra.com/index.php/blog-mainmenu-46/13-blog/131-last-accessed-timestamp-disabled-in-vista

Quote :

"One such change, which was included to increase Vista's performance, is a change in the NtfsDisableLastAccessUpdate registry key value. This value is now set to a 1 (true) instead of a 0 (false) by default, which means that the "last accessed" timestamps of files and folders will no longer be updated in Windows Vista. While some might see this as a major evidentiary sacrifice for a minor boost in performance, it's really not; computer forensics experts already know that MAC times, and more specifically, access times, should never be taken at face value. Aside from the ability to be changed intentionally by the user (by readily-available programs like Metasploit's Timestomp), MAC times can be inadvertently changed when files are accessed by automated programs like backup software, thumbnail creators, and virus scanners, and mass-altered when files are copied or moved. Access times are also only guaranteed by Microsoft to be accurate to within one hour of the time of access, and in cases where chronological precision is key, a timestamp of this granularity might lead an investigator to adopt a false conclusion. And lastly, disabling the last access time is not a new concept; the ability to stop Windows from updating this timestamp is available whenever one uses NTFS (NT/2000/XP/2003/Vista), and has been long-reported by the "OS tweaking" web sites out there as a performance booster. Running into computers with this tweak enabled is nothing new, as users looking for performance gains have been using it for years on multiple operating systems. While MAC times are useful when corroborated with other evidence (registry entries, .lnk files, MRU lists, file metadata, etc.), many computer forensics experts already know to be extremely wary of file system timestamp information. Let's have Microsoft's decision to turn off the "A" in "MAC times" serve as a reminder that these timestamps should be used only as a starting point in investigations; they are not the only piece of evidence we rely on for temporal analysis, and they should not be treated as such."

DOH!

6/2/2011 5:56:14 PM

so since they are so easy to manipulate anyone could have made those files look like they were from the year 2300?

6/2/2011 6:18:27 PM

Brad Cooper juror speaks out about murder trial
Jun 2, 2011 7:20 p.m.


Nearly a month after a Cary man was found guilty of killing his wife and dumping her body in an undeveloped subdivision, one of the 12 people who decided his fate is speaking out about the jury's decision.

"It is my personal belief that we (the jurors) came into this process verdict-neutral. Brad Cooper was innocent until proven guilty," jury foreman Andy Gilbert said in an email this week to WRAL News and other media outlets. "I came into this situation neutral, and I left it that way. The evidence was the only factor in determining our verdict. "

Specifically, Gilbert said, was testimony from two FBI agents who testified about Internet searches on Brad Cooper's laptop computer, including maps of the location where his wife's body was found.

"The evidence presented by Special Agents (Gregory) Johnson and (Chris) Chappell drove the outcome on this case," he said. "It caused a lot of the other circumstantial evidence to become relevant and credible."

Brad Cooper, 37, was arrested in October 2008, more than three months after his wife, Nancy Cooper, was found dead three miles from their Cary home.

He was sentenced to life in prison without parole on May 5 after the longest non-capital murder trial in Wake County.

Nearly 100 witnesses testified over a course of 36 days as prosecutors sought to prove that an angry Brad Cooper, tired and fed up with his wife, planned her murder and carried it out in the early morning hours of July 12, 2008.

Defense attorneys argued detectives never looked beyond their client as a suspect, because they were concerned that a random murder would tarnish Cary's reputation as a safe community. They characterized police work as being "dishonest" and "inept."

It took the jury of 10 women and two men about 10 hours over the course of three days to reach their verdict.

"With a lengthy trial, such as this one, the transition from the presentation of evidence into the deliberation phase felt like being shot from a cannon," Gilbert said. "The emotional intensity of the last few days of the trial (deliberation) was an important and necessary component of the jury process in this case."

"Most of us (the jurors) were undecided when we started deliberations," Gilbert added. "The transition happened quickly, and we needed time as a group to focus on the process and the laws we were instructed to follow. Then with our notes, the evidence presented became clear."

Defense attorneys believe their chance to appeal the conviction is good, saying jurors were never allowed to see evidence that proved Brad Cooper's laptop was tampered with.

Brad Cooper, meanwhile, is still at Central Prison in Raleigh, where he's awaiting a permanent assignment into the state prison system.

6/2/2011 9:04:37 PM

Quote :

"so since they are so easy to manipulate anyone could have made those files look like they were from the year 2300?"

Probably. I don't know about future dates, but some years ago I remember a program that let you set the create, etc., etc., etc. date on a file. I think it was this, but I can't remember.

http://www.nirsoft.net/utils/filedatech.html

The Cary PD could probably let you know about setting future dates.

6/2/2011 9:51:57 PM

I guess I'm still trying to figure out when they thought she was killed, and how they rectify that with what was found in her stomach... she was killed after the party, where she was buzzed and ate food, so there should have been alcohol either in her stomach, or in her system, yet it was found in neither, as well as no food in her stomach... She had coffee in her stomach, even though no one saw her drink coffee at the party. So, maybe she vomited up the alcohol and food while her neck was being constricted, magically replacing it with coffee? Oh, and not getting any of that vomit on the floor in the house...

really, jurors?

6/3/2011 6:52:09 PM

the "it was planted" excuse is pretty lame

6/3/2011 7:12:53 PM

Unless it's true, and they can prove it. Which is what it sounds like from the interview and the testimony of the computer experts (that the jurors weren't allowed to hear).

6/3/2011 7:14:44 PM

but, again, even if the google map search was legit, how in the fuck did the jurors explain away the autopsy results of what was and wasn't in her stomach and blood? The entire case hinges on the idea that he killed her after the party, but the autopsy clearly shows that she was alive in the morning

6/4/2011 10:37:41 PM

So, according to this juror, the testimony we couldn't here was key in deciding he was guilty?

It must have been gold... based on the shit show we saw... I'd like to know what was said.

6/4/2011 10:43:25 PM

It was just as much of a shit show as the rest of the trial. A Durham cop, Chris Chappell, got up there are said "we found a map on his computer that is a zoomed in shot of the spot where Nancy was found from the day before she went missing. We don't know why the timestamps are invalid, but they are. We didn't check any other tool to verify the timestamps. Yes there are signs of tampering, but that's not important. No, there was no google cookie for the search. No we didn't verify with google that there was a search done on that day at that time. No we didn't check Cisco's servers for the search. No we didn't check the home routers for intrusion detection. No we didn't check event logs. Yes, a cursor file is supposed to update when you use it. Oh? This one didn't, well, that's not a sign of tampering. Yes there were over 700 files changed after it was in police custody. We ruled them all out as being tampering. No, I can't tell you how I ruled out that sys file or that SAM user file password change, or all the internet history being modified after it's in police custody. Just trust us, it's a legit search."

6/5/2011 12:01:44 AM

^5 this. You guys are getting a little too carried away. He either googled the exact spot of where her body was dumped, or that evidence was planted on his computer by the Cary PD (lol).

Obv ok to assume that you can eliminate the latter beyond a reasonable doubt, esp. when there is testimony that we didn't hear.

6/5/2011 12:27:26 AM

Quote :

"He either googled the exact spot of where her body was dumped, or that evidence was planted on his computer by the Cary PD (lol)."

He didn't search the exact spot. He searched the ZIP of the area and panned across while zoomed out for less than a minute. Much different...

6/5/2011 12:30:51 AM

I don't think that's correct. Why would the defense say that evidence was planted if that's all there was? It's been debated ITT whether there was a zoomed in pic or just a zip code search. Which one is it?

6/5/2011 12:46:47 AM

Either way, homeboy deserves a new trial, based on the shit we did see. His guilt or innocence is immaterial to this.

6/5/2011 12:53:22 AM

Quote :

"He didn't search the exact spot. He searched the ZIP of the area and panned across while zoomed out for less than a minute. Much different..."

Incorrect. Don't speak like you're an authority on some shit when you have no idea what happened. It's on this freaking page.

Quote :

"The map zoomed right up to the cul-de-sac. It was a zip code search originally, but it was a beeline directly to that spot. 41 seconds from the time browser opened, until closed (listen to the closing statement) with a few seconds at Fielding Drive specifically."

6/5/2011 1:05:40 AM

Nobody said it had to be CPD that planted the files. He was surrounded by neighbors with computer expertise in wireless range that were out to "frame a guilty man." I mean--why not help CPD on their way a little bit.

6/5/2011 9:41:15 AM

Quote :

"computer expertise"

Was his network protected? It would probably take some hacking experience to do what you're suggesting...

6/5/2011 10:51:15 AM

WEP protected. Sharing enabled. Crackable in less than 5 minutes, according to Jay Ward's demonstrations.

[Edited on June 5, 2011 at 11:30 AM. Reason : ]

6/5/2011 11:29:38 AM

Quote :

"Crackable in less than 5 minutes, according to Jay Ward's demonstrations."

1 - Sure if you know what you're doing
2 - Was the entire hard drive shared? I doubt it..


My point is something like this would take some experience that most people don't have. Just because people were in wireless range doesn't make it plausible. Show me some router logs or something...

6/5/2011 11:45:02 AM

That's the problem, they werent permitted to show log files they wanted to.

6/5/2011 11:51:27 AM

^^

back in the day that was true, but a simple, free download of AirCrack makes it trivial for anyone with a modicum of computer literacy.

I'm not claiming anything beyond that specific point, however.

6/5/2011 11:54:54 AM

still though, you have to know to download that particular program...and the bigger point for me is gaining access to the computer. i'm sure like the WEP crack it's trivial if you know how to do it, but I don't so that's why i'm curious ntm it was his work computer so i'm pretty sure it wasn't wide open with holes...my work laptop is locked down pretty tight

6/5/2011 12:05:43 PM

Quote :

"The map zoomed right up to the cul-de-sac. It was a zip code search originally, but it was a beeline directly to that spot. 41 seconds from the time browser opened, until closed (listen to the closing statement) with a few seconds at Fielding Drive specifically."

And the standard of evidence for a closing argument is much lower. The fucking prosecutor mentions a canoe bumping into the mythical router, for fuck's sake. It's even funnier that you request router logs when the prosecution failed to do even that to show that a call was made. Even moreso, the "41 second google map search," itself, is fucking suspicious in its own right. I mean, he google map searches the exact spot, and it only takes him 41 seconds? Really? That's fucking insanely fast for someone SEARCHING for a spot to dump a body.

And then let's comment on the fact that there was no session cookie for the google map search. and the prosecution never subpoenaed google for evidence of the search, which is pretty fucking sketchy in its own right. If I was gonna try and prove my case, I'd get the damn records on both sides of the transaction. Eerily enough, the prosecution didn't do that. And then they magically waited until two weeks after google would dump the records to provide the defense with the hard drive, thereby preventing the defense from being able to subpoena the records from google. Kind of convenient, don't you think? Oh, and they did the EXACT SAME THING with the cell phone that the police "accidentally" erased. And, of course, the defense didn't know it had been erased at that point, either, thereby, AGAIN, denying the defense the ability to discover exonerating evidence.

Even then, a bee-line to the exact spot? That's damned good, and almost impossible if you aren't trying to do it. Hell, it's pretty fucking hard to do in the satellite view of google maps, even when you know where you are going. I just tried to GMS my parents place, and I know EXACTLY where it is, and I STILL had to pan to get there, not to mention it took me a second to find the damn place

[Edited on June 6, 2011 at 3:35 AM. Reason : ]

6/6/2011 3:29:09 AM

^I agree with every word you just wrote.

6/6/2011 8:31:53 AM

Quote :

"^5 this. You guys are getting a little too carried away. He either googled the exact spot of where her body was dumped, or that evidence was planted on his computer by the Cary PD (lol) SBI."

fixed it for ya. the computer went to the SBI for forensic analysis. later the SBI was indicted for evidence tampering on other cases. it's totally plausible to assume the SBI also tampered with the computer evidence on Brad's computer.

6/6/2011 9:51:22 AM

Computer went to the FBI. Not the SBI.

6/6/2011 9:51:51 AM

It was my understanding that the google map search supposedly took place on his work computer while Brad was at work. Moreover, the time stamps matched a time when Brad was known to be out to lunch, ie he couldn't have been sitting at the computer at the time of the search.

Either the person planting evidence screwed up their timeline or... Brad remoted into his work computer and searched google maps while he was at lunch - instead of just searching google maps with whatever he used to remote into his work computer and then tossing it in the garbage along side the stolen Cisco router. I guess he wanted to be sure to plant some evidence on his work computer.

I could be way off on the out to lunch thing, but it's something I remember hearing at one point.

6/6/2011 11:16:46 AM

honestly, on appeal the defense would do well to conduct some research on the cognition levels required to read a map, and specifically the cognition levels required to find something on google maps accurately and correlate that to time.


I'm positive that the average person can't find any given location, even if they know it for sure and have been there many times, without error when given an arbitrary starting point

6/6/2011 11:41:15 AM

Quote :

"Moreover, the time stamps matched a time when Brad was known to be out to lunch, ie he couldn't have been sitting at the computer at the time of the search."

So wait, did some of his coworkers testify that they were with him at lunch or something?
Do they have cisco swipe records or cisco security camera footage that shows leaving to/arriving from being at lunch?
Are there any credit card swipes/restaurant camera footage that prove he was at lunch?

I can't imagine this notion of him being 'known to be out to lunch' is based solely on his word...

Quote :

"Even then, a bee-line to the exact spot? That's damned good, and almost impossible if you aren't trying to do it. Hell, it's pretty fucking hard to do in the satellite view of google maps, even when you know where you are going. I just tried to GMS my parents place, and I know EXACTLY where it is, and I STILL had to pan to get there, not to mention it took me a second to find the damn place"

I don't know about you all, but if I'm familiar with a location (my house, friends house, parents house etc), I can type in the zip code it resides in and get to a max zoom of what im looking for in a good deal less than 41 seconds. Not saying there isn't anything fishy about that evidence, but lets now make that particular point out to be impossible or something...

6/6/2011 12:51:10 PM

^Coworker testified (for the prosecution) they went to lunch about 15 minutes before the search was done and that no one brought their laptops to work that day.

[Edited on June 6, 2011 at 12:58 PM. Reason : ]

6/6/2011 12:57:52 PM

Quote :

"Computer went to the FBI. Not the SBI."

you sure about that?

6/6/2011 1:00:55 PM

100% certain. Hence why Agent Gregory Johnson of the FBI testified and Task Force Agent Chris Chappell (Durham PD, assigned to FBI) were the ones who testified.

[Edited on June 6, 2011 at 2:12 PM. Reason : ]

6/6/2011 2:12:09 PM

gotcha....for some reason when I was listening to the trial i though they said SBI. I retract my former comments!

6/6/2011 2:18:34 PM

SBI did testify during the trial. Just not for computer stuff. They did fiber analysis, DNA analysis, blood analysis, etc. I don't think your statements are any less applicable to FBI than they are for the SBI. There's still the possibility of corruption before, during, or after it leaves their office. We certainly know the Durham PD aren't infallible.

6/6/2011 2:20:07 PM

Quote :

"Coworker testified (for the prosecution) they went to lunch about 15 minutes before the search was done and that no one brought their laptops to work that day."

Seems like they could have got some more evidence than that, since this piece of evidence was so crucial (some data along the lines of what I posted).

Do they have any other evidence that his computer was even used that day (if he supposedly didn't even bring it to the office with him there should be no use data). It should be childs play to establish whether someone was or wasn't using that computer that day...and probably not that hard to establish where it was being used from too.

6/6/2011 2:43:00 PM

You're wife just doesn't show up dead one day especially in cary.

6/6/2011 3:07:43 PM

YOU

ARE

WIFE

6/6/2011 3:11:35 PM

^^ You are wife never dies

6/6/2011 3:14:51 PM