Jump to content

Type keyword(s) to search

Josh & Anna Smuggar: A Series of Unfortunate Events


  • Start Topic

Recommended Posts

Hilaria et all being there is so bizarre.  Is she that much of a famewhore?  Who knows maybe she had some sort of close relationship with Pest and Anna which never made it to social media.  The whole thing just reeks of "look at me" and trying to get as much screen time in the paps eyes as possible.  But to what end?

  • Love 20
Link to comment

I was wondering if the prosecutor planned this or was it a honest mistake.  When Anna was sitting in back of him he had the computer on showing the pictures on the screen and Anna saw them. After a few minutes he closed the computer did he plan to make sure that Anna saw them?

  • Useful 5
Link to comment
3 hours ago, ginger90 said:

Falling asleep last night, I thought about how Anna’s stunted growth, shall we say, has been mentioned. I believe someone said she’s like a 12 year old. I don’t recall the actual age used. Anyway, this made me think it was what Josh wanted, an adult stuck at a younger age. 
 

😔

 

Could you imagine if the Kellers gave Josh Priscilla Instead of Anna? I feel like she’d be Josh’s ideal absolutely stunted that girl is.

  • Love 2
Link to comment

If I were Anna's parents (or any relative) I wouldn't show my face in public, either.  I would be so ashamed that I let/forced her to marry  this pervert, and that I had anything to do with this family.  I would offer support, but privately.  But I'm not sure how much support, if any, her parents and family are providing.

 

  • Love 16
Link to comment
11 hours ago, Tuxcat said:
Quote

Rufus is an app on the Linux side which allows you to create a bootable USB drive

He might as well said "Microsoft Word is a program on the Windows side".  Rufus is a ubiquitous tool that works on many OS and that I use a few times a month. 

Quote

A bootable USB drive was plugged in on May 13

Fascinating.  I plug around 8 USB drives into a computer every day. 

Quote

Files were opened from the thumb drive on May 13

So files were opened, but they don't say what files, what type of files or if they were executables, apps, or documents. Or are they referring to the two word docs and another file? Great..and that shows what, exactly?

Quote

Don’t know where this thumb drive is - it was never seized or searched

I find and lose USB drives at least 2x a week.  My oldest one is from 2006.  I lost the new I got on Black Friday this Thursday. I found it in the pocket of my cargo pants in the dryer today. The defense is alledging there were items in the office that were purposely not examined, I guess.  Of course that doesn't mean the device existed in the first place.  I don't go into an investigation thinking about what's NOT there.  My job is to analyze what IS there.  I routinely see .LNK files to  "bad" files (aka movie and image files with names constant with CP terms).  .LNK files are Windows OS artifacts that indicate that a file, program or whatever has been accessed.  If you open a word doc, a .LNK file is generated.  So, yes, the defense can see .LNK files to external drives that weren't examined (because they weren't in the office at the time) but we regularly see activity on external drives (drives that aren't inside the computer but connected by USB) for a device we don't have.  You can't obsess about what's not there.  And if you are the defense, saying that a missing drive exonerates your client....who is the most likely person who has that device?  Right, the suspect himself. Smoke and mirrors.

Quote

The files that were opened on the thumb drive were never opened on MacBook and iPhone

Hard to open files from a USB drive on a phone.  Unless they are referring to the 2 documents on the thumb drive? And saying those docs weren't found on any machine? Well, that's the nature of external drives.  You put stuff on them and they are portal. It's not necessarily stuff from the main computer you copied over to the thumbdrive.  Did you know that most USB drives are either formatted for NTFS (Windows) or OSX (mac) and they don't work well when plugged into the wrong system (unless they are formatted EXfat).  So no, I wouldn't typically expect to see a USB drive file on the wrong file formatted system.  And the files wouldn't be "opened" on a thumb drive.  They would be opened on the HP desktop or Mac, FROM the USB Drive.  The .LNK file would reference whatever drive letter the system assigned it, and other artifacts might indicate what type of USB drive it was.  But it was executed and opened on the desktop or laptop. This may be bad recapping from a non computer person, so again, I need the transcript.

Quote

The files couldn’t have been created on the thumb drive - where were the files created?

What files?  You can always create files on a thumb drive.  Maybe more recapping?

Quote

“Is there anything in your reports about remote access?”

Massive mistake by the forensics people for the prosecution.  They should have gone back and looked at those settings. Sloppy.

Quote

"Remmina is an app for the computer for remote access - and if a router would help with remote access?" -- I believe they said this app was installed on the windows side

Remmina is a remote access program that allows a Linux user to remote in using SSH.  It also works with Windows.

Quote

He said that linux can be accessed remotely

Yup.  If the computer is set up for it.  But that's on the Linux OS side, not the router.

Quote

Thumb drive was plugged in before the Tor browser was installed - "so if you find out who put the thumb drive in - you know who downloaded the porn"

Spaghetti.  You know who had the time, motive, and opportunity to put a thumb drive in and then later install TOR? Josh Duggar.

Quote

Feds do not know from where the Linux OS or the  TOR browser came - they say probably App Store.

MEh.

Quote

Router was "open" and never "investigated"

If I remember correctly, they said they didn't interrogate the router because it was password protected.  Which is stupid because 80% of the people using routers NEVER change the default password and username.  I can look at a router brand and tell you the default password and username and it usually lets us in.  Again, routers are never a big part of our cases.  And if the router is open, they would have inspected it. If it's "Closed" then no one can remote in.  I assume.  I don't use open and closed, I use secured via a unique and non default password versus no password".  But the only way you can have no password is to change the settings, and we know stupid, home schooled Josh is WAYYYY too stupid to do that, right?

Quote

Lots of people knew his password for the partition since it was used for 5 years all over the place. 

Indicating that Josh probably set it up and used it.  Thanks for giving us his normal habits. 

Quote

Okay, where are we going? Is this an onion defense that will go somewhere after peeling all these layers?  Someone installed linux OS from the bootable drive onto the partition side and then installed TOR remotely and then "the porn." Or is this just throw spaghetti till something - anything - sticks.

I think this is where their expert comes in and says that since everyone knew the password, someone remoted in using Remmina over SSH, which the router clearly (DOESN'T) show,  and installed TOR and did the porn.  Of course that doesn't explain the USB drive or how Linux was installed in the first place.  Maybe someone came into the office, waited until Josh was on the "other" side of the room (a whole two feet away), surreptitiously put the USB drive into the back of the computer, and then went home and remoted in and installed the bad programs from the USB drive.   But WAIT, are they saying that the remote person remoted into a computer that was turned off? You can't install an OS on something that's not on and to use a bootable USB drive created by Rufus, you have to be in front of the computer, hitting keys. You can remotely install Ubuntu via SSH on a box that ALREADY HAS Linux on it.  But on Josh's computer, you would have to create a Linux partition and I don't know if that's even possible remotely. 

I'm hoping some of these questions are because of the limited tech ability of the reporters and recappers.  It will be interesting to see where this goes.

So yes, we are in for a wild ride with the defense.

  • Useful 7
  • Love 1
Link to comment
12 minutes ago, CandyCaneTree said:

Am I  losing my mind because I remember Anna saying that she takes care of the top of the babies and Smuggar takes care of the bottom half of the babies. 

No, I remember that, too.

 

  • Love 6
Link to comment
19 minutes ago, CalicoKitty said:

If I were Anna's parents (or any relative) I wouldn't show my face in public, either.  I would be so ashamed that I let/forced her to marry  this pervert, and that I had anything to do with this family.  I would offer support, but privately.  But I'm not sure how much support, if any, her parents and family are providing.

 

I hear you however as far as I’m concerned Anna’s Parents should be there especially her Dad so he can hear all the crap Josh has done. See all the pain marrying Josh has put his daughter through, JB & Mechelle should be there also because it seems like these two don’t want to hear the truth about their “precious son” but they need to hear it. 

  • Love 24
Link to comment
1 hour ago, GeeGolly said:

It makes sense now why Josh had so many "employees" hanging around. It seems his part-time job was working and the other 20 was fulfilling legal and illegal deviant fantasies.

Right? I keep thinking (god help me), “Did he just sit there at his desk and beat off?” Ugh. Idle mind = devil’s workshop here. 

  • Love 5
Link to comment
36 minutes ago, CandyCaneTree said:

Am I  losing my mind because I remember Anna saying that she takes care of the top of the babies and Smuggar takes care of the bottom half of the babies. 

I remember it too. I brought it up on R/duggarsnark yesterday when people were talking about Anna being ditched with umpteen kids. Some were saying, Well, Josh wouldn’t have been helping her anyway. The “bottom half” thing popped into my head and I just wanted to weep. 

  • Love 2
Link to comment
1 hour ago, madpsych78 said:

The only thing I got is that David Waller is the pastor of the Spiveys' church, which isn't really that much.

He was only there the day that is brother testified. I think that might also be the case for Justin and the Spiveys. It’s possible they were all just there to support Matthew Waller. Based on what was written about his testimony, he did come across as nervous so he might have needed the support.

  • Love 4
Link to comment
1 hour ago, hathorlive said:

I think this is where their expert comes in and says that since everyone knew the password, someone remoted in using Remmina over SSH, which the router clearly (DOESN'T) show,  and installed TOR and did the porn.  Of course that doesn't explain the USB drive or how Linux was installed in the first place.  Maybe someone came into the office, waited until Josh was on the "other" side of the room (a whole two feet away), surreptitiously put the USB drive into the back of the computer, and then went home and remoted in and installed the bad programs from the USB drive.   But WAIT, are they saying that the remote person remoted into a computer that was turned off? You can't install an OS on something that's not on and to use a bootable USB drive created by Rufus, you have to be in front of the computer, hitting keys. You can remotely install Ubuntu via SSH on a box that ALREADY HAS Linux on it.  But on Josh's computer, you would have to create a Linux partition and I don't know if that's even possible remotely. 

I'm hoping some of these questions are because of the limited tech ability of the reporters and recappers.  It will be interesting to see where this goes.

So yes, we are in for a wild ride with the defense.

The questions being asked by the defense show me that they don't know what they're talking about when it comes to IT stuff.

  • Useful 7
  • Love 10
Link to comment
1 hour ago, CalicoKitty said:

If I were Anna's parents (or any relative) I wouldn't show my face in public, either.  I would be so ashamed that I let/forced her to marry  this pervert, and that I had anything to do with this family.  I would offer support, but privately.  But I'm not sure how much support, if any, her parents and family are providing.

I fully agree Just a note or two to add on what you say:

Historically, women became part of the husband’s family after marriage. They were in their care, their responsibility. Her own parents had little or no say about her after marriage. Since these fundies uphold many old ‘values’ and rules, and we do know that in Duggar life men are in charge, I’m assuming they also uphold this tradition of Anna being a Duggar and a Duggar charge under their responsibility and care. Not mom and dad’s, however much they might like it.

Which brings me to the second bit: For all we know, Anna’s parents might actually be really upset and worried. While it makes sense for us common sense people with a (fairly) modern take on life, to take our daughter straight out of the clutches of that monster, it probably isn’t. I think within that religious cult everything (nice and not so nice) is done by people around them to keep Anna there and for her parents not to interfere. Being shunned (like the Amish do) is one such cruel way. And neither Anna, nor her mom probably have any say in this either. If her parents do anything, it’s probably done in private like you say.


Yes, Anna could pack up and leave but where would she go with no money, no education, no work experience and a large brood of young kids. I’m no Anna fan, but I can’t help feeling for her.

  • Love 12
Link to comment

I don't know, but I think Josh's crimes have already hurt plenty of folks - friends, family and most of all those young victims.  He's on trial here, for his crimes and not anyone else. Karma happens. I'll wait patiently to let it do its job for anyone else needing it. Right now, I just want to see Josh receive a harsh punishment for the pain his actions have caused.

  • Love 24
Link to comment
3 minutes ago, Tabbygirl521 said:

OK, someone on Reddit just said they think it was Ben and Jessa who said they take of different ends of the kids. I hope to God that’s true. 

It was. Jessa does in, and Ben does out.

 

Also, what does everyone think of the Amy Duggar King file that was found on Smug's computer? My thoughts are not good. 

  • Love 1
Link to comment
4 minutes ago, Tabbygirl521 said:

OK, someone on Reddit just said they think it was Ben and Jessa who said they take of different ends of the kids. I hope to God that’s true. 

It wasn't. It was Josh and Anna, during what turned out to be the last show of 19 Kids.

  • Useful 2
  • Love 12
Link to comment
6 minutes ago, Tabbygirl521 said:

OK, someone on Reddit just said they think it was Ben and Jessa who said they take of different ends of the kids. I hope to God that’s true. 

Nope. I even remember the wording that was used. Anna took care of the north end and sex pest took care of the south end.

  • Love 8
Link to comment
1 hour ago, greenturtle36 said:

The questions being asked by the defense show me that they don't know what they're talking about when it comes to IT stuff.

I had a state case that we won and was appealed to the state court of appeals.  Three judges watched the entire trial on tape, and decided that yes, thumbnail images constitute CP and that neither the prosecutor nor the defense knew enough about computers. I was redirected and crossed around 17 times.  the defense would ask something, the prosecutor would clarify, the defense would reclarify, and back and forth.  And they weren't really asking anything of value.  The jury was getting annoyed. I was on the stand for maybe 6 or 7 hours. I lost my voice because I talked so much.  So they all need help.  But then I went to family court (which we don't have to do) to help a guy out in a custody case (no, he wasn't looking at CP).  And they were even worse. I got questions like "you know when you go on the internet and you click on that thing and this other thing pops up?"  No. I have no idea what you are talking about. 

  • Useful 2
  • LOL 4
  • Love 9
Link to comment
3 hours ago, hathorlive said:

I'm hoping some of these questions are because of the limited tech ability of the reporters and recappers.  It will be interesting to see where this goes.

I'm thinking that "limited tech ability" applies to most of Josh's "employees" as well.

Anna does have at least one relative there.  Her Uncle Eric, who is the guy that apparently looks like Santa.  

  • Useful 4
  • Love 3
Link to comment

Well, everything's been said but not everybody has said it, re: south and north ends.

This is from Free Jinger, May 22, 2015 -- talking about the end of 19 Kids -- and quoting Anna as saying the "south end" and "north end" part. ..... Bin and Jessa were apparently in this same episode talking to Anna.....but contemporaneous evidence says it is Anna who talked about that, unfortunately. 

Quote from free jinger poster -- 'The part that bothers me the most was Anna saying that "mama takes care of the north end, and daddy takes care of the south end." SHE KNEW. And she still gave him, most likely, unsupervised diaper changing time with Mack. I am just at a loss.'

https://www.freejinger.org/topic/23398-josh-duggar-admits-to-molestation-rumors-part-2/page/30/

 

  • Useful 7
  • Love 2
Link to comment
3 hours ago, LilyD said:

I fully agree Just a note or two to add on what you say:

Historically, women became part of the husband’s family after marriage. They were in their care, their responsibility. Her own parents had little or no say about her after marriage. Since these fundies uphold many old ‘values’ and rules, and we do know that in Duggar life men are in charge, I’m assuming they also uphold this tradition of Anna being a Duggar and a Duggar charge under their responsibility and care. Not mom and dad’s, however much they might like it.

Which brings me to the second bit: For all we know, Anna’s parents might actually be really upset and worried. While it makes sense for us common sense people with a (fairly) modern take on life, to take our daughter straight out of the clutches of that monster, it probably isn’t. I think within that religious cult everything (nice and not so nice) is done by people around them to keep Anna there and for her parents not to interfere. Being shunned (like the Amish do) is one such cruel way. And neither Anna, nor her mom probably have any say in this either. If her parents do anything, it’s probably done in private like you say.


Yes, Anna could pack up and leave but where would she go with no money, no education, no work experience and a large brood of young kids. I’m no Anna fan, but I can’t help feeling for her.

But would the Duggars try and stop Anna’s mom or dad from trying to be there to support her in court (or in her home?) seems unlikely that they would 

  • Love 2
Link to comment
On 12/2/2021 at 9:54 AM, Tabbygirl521 said:

There has to be a reason this cult believes sexual abuse and molestation happens in most families. With their perverted and repressive ideas and fixation in sex, it wouldn’t be surprising to me that many cultists end up twisted. 

well, their leader Bill gothard  (IBLP)  told a woman   that was exually molested by her father as a child that she was to thank him because it made her spiritually stronger""  that's how twisted this cult is..

   and don't let the Bates family fool you, the dad  Gill bates is still high up in  IBLP  

  \

  • Useful 1
  • Love 3
Link to comment
2 hours ago, Tabbygirl521 said:

OK, someone on Reddit just said they think it was Ben and Jessa who said they take of different ends of the kids. I hope to God that’s true. 

Anna said JB told her during her first pregnancy, “Mom takes care of the north end, and dad takes care of the south end.” It gave me the creeps then and now is even creepier.

ETA: Sorry, someone already answered with correct quote.

Edited by SMama
  • Useful 1
  • Love 1
Link to comment
2 hours ago, BitterApple said:

You're right, I distinctly remember Anna saying that. 

I believe that was the same episode Jessa either teased her first pregnancy or announced it. Anna was pregnant with Meredith.

  • Useful 4
Link to comment

If this north end/south end is true, it’s just creeping me out in light of what has come out especially with the age of some of the kids, it terrifies me to think that monster was alone doing diaper changes. Every time I read more and more about this case I just want to vomit. 

  • Love 24
Link to comment
2 hours ago, hathorlive said:

But then I went to family court (which we don't have to do) to help a guy out in a custody case (no, he wasn't looking at CP).  And they were even worse. I got questions like "you know when you go on the internet and you click on that thing and this other thing pops up?"  No. I have no idea what you are talking about. 

GUILTY.   But yeah, family law we are about able to explain email.   that's it.   Sorry.

Maybe the Kellers can't afford to travel from Florida and stay for several days.   You  know the Head Creep and his Baby voiced wife won't pay for a non-Duggar to do anything.   From my understanding the Kellers are pretty broke.  

Or they are there but staying out of sight.   We know they aren't watching Anna's kids, those are hanging at the main Duggar house under whichever daughter is in charge now.   Because Anna ain't raising her own kids either.   

  • Useful 4
  • Love 4
Link to comment
2 hours ago, hathorlive said:

And they weren't really asking anything of value.  The jury was getting annoyed. I was on the stand for maybe 6 or 7 hours. I lost my voice because I talked so much.  So they all need help. 

Thank you for breaking down my long list of fragmented defense claims in my earlier post.

This is why I am worried. Supposedly Josh's lawyers are very good and certainly have enough money to find experts to support whatever theory or theories they are spinning. So I am concerned that their line of reasoning - which seems fragmented now - is building to something. If its not- great. Case closed. If it is, how well can the prosecutors (and jury for that matter) rebut.

The governments witnesses were incredibly strong, seemingly liked by the jury and there is so much evidence placing Josh at the scene of the crime. Still there were mistakes made that leave me with questions- and I'm not even there. Why won't the feds just say they checked for evidence of remote access and there was none. Instead they keep saying "not likely, didn't fit the pattern."  We know there was an app that at least allowed remote access present on the computer. (And they will say the router was not password protected). Plus "everyone knew the password to the partition so anyone could have set that up and installed." And "not everything was seized and searched."

 I also wish they would explain why Josh seemingly loaded the partition with linux on the 11th, the mysterious thumb drive on the 13th followed by the TOR browser, and then loaded all his "material" for three days. By testimony it seems he didn't access that partition "side" of the computer until June (understand that yes he could have been downloading stuff he wasn't charged for - but the witness said " Linux side not accessed again until June."). At this point he deletes files and uploads a bill of sale.  Then months later he's looking at adult pornagraphy on his other devices in October (even though covenant eyes is looking). Seems so strange. 

They are definitely going to argue that someone set Josh up -- why so few days? so little material by comparative standards. And what of Caleb? And how is the email from Caleb in March relevant? Ugh, this why my hyperfocus is a gift and a curse...! Next week is really going to irritate me! 

 

  • Love 2
Link to comment

I don't think the Sun is doing a good job of summarizing the arguments. If you read the longer articles by the local reporter--mccandless (not 100% sure of the spelling)--it does seem like the latest prosecution witness was much more direct in saying "I looked for remote access. There was none. If there had been, I'd have detected it." He also pushed back very strongly on the routers in a way the Sun never described. He actually told the defense attorney his characterization of how routers work is misleading.

It's a shame the Sun is the only real source we have for updates through the day because I don't think they are up to the job. 

  • Useful 17
  • Love 7
Link to comment
5 minutes ago, emmawoodhouse said:

I suppose the problem is that The Sun's reporter isn't well versed in computer guts. They can't properly describe something they don't understand.

Yes and I think they're also tabloid hacks who are just focusing on sound bites and sensational details. 

I can't say enough good things about the local KNWA digital reporter. I wasn't familiar with him before this case. He's a very good writer, and his reporting is not sensational and has a good eye for relevant quotes/moments that are easy to understand.

I've picked up on quite a bit of detail from his articles that I've not seen earlier from the Sun live updates. I also don't remember them covering the fact the prosecution had a detailed visual timeline of all the downloads and Josh's computer activity but he mentioned that too. 

Edited by Zella
  • Useful 2
  • Love 11
Link to comment
28 minutes ago, Zella said:

I don't think the Sun is doing a good job of summarizing the arguments. If you read the longer articles by the local reporter--mccandless (not 100% sure of the spelling)--it does seem like the latest prosecution witness was much more direct in saying "I looked for remote access. There was none. If there had been, I'd have detected it." He also pushed back very strongly on the routers in a way the Sun never described. He actually told the defense attorney his characterization of how routers work is misleading.

It's a shame the Sun is the only real source we have for updates through the day because I don't think they are up to the job. 

True. I've read the articles but his explanations of "why" the router was irrelevant and "how" he looked for remote access didn't seem sufficient in the reports. Even in those articles he didnt explain the remote settings.

Edited by Tuxcat
  • Love 6
Link to comment
1 hour ago, Tuxcat said:

Thank you for breaking down my long list of fragmented defense claims in my earlier post.

This is why I am worried. Supposedly Josh's lawyers are very good and certainly have enough money to find experts to support whatever theory or theories they are spinning. So I am concerned that their line of reasoning - which seems fragmented now - is building to something. If its not- great. Case closed. If it is, how well can the prosecutors (and jury for that matter) rebut.

The governments witnesses were incredibly strong, seemingly liked by the jury and there is so much evidence placing Josh at the scene of the crime. Still there were mistakes made that leave me with questions- and I'm not even there. Why won't the feds just say they checked for evidence of remote access and there was none. Instead they keep saying "not likely, didn't fit the pattern."  We know there was an app that at least allowed remote access present on the computer. (And they will say the router was not password protected). Plus "everyone knew the password to the partition so anyone could have set that up and installed." And "not everything was seized and searched."

 I also wish they would explain why Josh seemingly loaded the partition with linux on the 11th, the mysterious thumb drive on the 13th followed by the TOR browser, and then loaded all his "material" for three days. By testimony it seems he didn't access that partition "side" of the computer until June (understand that yes he could have been downloading stuff he wasn't charged for - but the witness said " Linux side not accessed again until June."). At this point he deletes files and uploads a bill of sale.  Then months later he's looking at adult pornagraphy on his other devices in October (even though covenant eyes is looking). Seems so strange. 

They are definitely going to argue that someone set Josh up -- why so few days? so little material by comparative standards. And what of Caleb? And how is the email from Caleb in March relevant? Ugh, this why my hyperfocus is a gift and a curse...! Next week is really going to irritate me! 

 

I know their experts.  And they are great at coming at with bullshit excuses and tangents. But at the end of the day, I don't think the they can over come the texts and the downloads. And once the molestation is introduced, I don't think the jury will care.  Viewing CP is bad.  But he's already hurt numerous children in his life, which is just as bad if not worse.  I don't think they will care about mysterious thumb drives and blah blah blah once they put the pieces together. 

It's not unusual for most forensic people in LE to not look at network access issues.  We tend to do "dead box" forensics, which means you are looking at one box, not on the network, powered off.  Most of our cases don't involve network access or hacking, which is where digital forensics incident response (DFIR) comes in.  But you better bet that once I heard their line of questioning, I'd have gone back to the forensic image, loaded it up and checked those settings. I've mentioned things in court that was not in my report.  I look at a lot of things as I'm bookmarking files for inclusion.  I can't put all 100,000 files in the report.  But I hope this is a wake up call to whoever did the forensics.  And to be honest, on the state level, we had local yocal sheriffs and police departments doing the "investigating".  Meaning that I had to tell them what I found, why it was important and put all the pieces together because they weren't going to be able to do that.  But on the federal level 1) nothing ever goes to trial and 2) We hand off our report to the investigator/ special agent and say "call us if you have questions".  They read the report, open the report files with all the things we've bookmarked, note what applies to their case and then we rarely hear about it again. 

So, there's the idea of meh, not going to court.  And that attitude is always when you go to court.  But they could have at least looked at the settings and said "yes, I saw that was not enabled in the Linus OS and therefore it's not of evidentiary value and was not in my report".  Or something like that.  And also, we don't tend to get Linux cases. I've had one in the last 4 years.  And I was a unix system admin at some point in my life, so I'm comfortable with the file structure and artifacts. Many examiners aren't.  And some of our tools say they support Linux, but the last case I did, the tools did not do a great job of auto generating the information. I had to got into the various folders and manually pull out the install date, the OS version, the user accounts. If you don't know Linux, it may be hard for them to do this.  But I would hope this agency is big enough that they have an expert.  I really don't know why or how or who. I'm speculating here and not dissing another agency.  

I think the local reporters are doing a good job.  It's not a field most people understand, so I'll wait for the transcripts to start freaking out.

Edited by hathorlive
  • Useful 12
  • Love 3
Link to comment
30 minutes ago, hathorlive said:

t's not unusual for most forensic people in LE to not look at network access issues.  We tend to do "dead box" forensics, which means you are looking at one box, not on the network, powered off.  Most of our cases don't involve network access or hacking, which is where digital forensics incident response (DFIR) comes in.  But you better bet that once I heard their line of questioning, I'd have gone back to the forensic image, loaded it up and checked those settings.

Thank you! I so appreciate your insight. This matches up with what it seemed like from their testimony (albeit fragmented by reports). It seemed like they had the idea for the box and so only covered that one box. And it's a great slam dunk box but without looking at the other boxes, it leaves openings.  Maybe the prosecution is working over the weekend to close the holes. I agree that the defense likely won't be able to overcome the evidence presented - but if their "whodunit" line or reasoning is presented well and supported by their experts, it just makes me uncomfortable. So far it does look like spaghetti and if that is the path they actually take - they can keep throwing. I just don't want them to find a whole and jump in with a plausible scenario.

  • Love 7
Link to comment
52 minutes ago, emmawoodhouse said:

I thought the Fed's witness was from the DOJ. I'd assume they had ALL the resources. As for the defense "experts?" Who knows what they'll present?

They do have a lot of resources, but each of us have our own specialty.  Some are great at working servers, others specialize in cell phones or Macs.  There's a lot of stuff to know! The weird thing about this guy is that he's a 19 year experienced MANAGER.  My managers don't do active forensics anymore. I don't know if they had the top guy do the work because of his experience testifying and working cases or what.  

  • Useful 5
  • Love 2
Link to comment
57 minutes ago, Quilt Fairy said:

@hathorlive, is there any reason why the forensics people can't go back over the devices now, like over the weekend, to fill in these gaps that have been identified? 

Well, once you've testified, it looks a bit desperate to say "but wait, there's MORE." I've never had an AUSA say "go check that out and I'll recall you".  I have been recalled to the stand to refute the defense expert's testimony. So, I don't know? 

But they had ample warning BEFORE the testimony based on the pre-trial comments that they were going for a remote bad guy did it. I would have been in the office that weekend, double checking. Again, I've testified about things not in my report.  Usually, we give out our cover letter report that says exhibit one had email, social security numbers, and fake credit apps, exhibit 2 had nothing, exhibit three was dead and couldn't be imaged, and so on. My working case notes are anywhere from 5 to 40 pages long, that detail what happens from the moment I take custody of the evidence.  Those are discoverable, but to be fair, no many attorneys get through them all.  If they have a defense expert, they will give them my notes for them to tear apart.  But I can talk about what I saw, not necessarily what I noted in my report.  It's always good to note the big stuff, but I have a running tally in my brain as I go of things that I note that may be important but may not.  Not everything goes in my report. 

Edited by hathorlive
  • Useful 5
  • Love 1
Link to comment
Guest
This topic is now closed to further replies.
×
×
  • Create New...