/

16
1 2 3
4

December

8th Of

to Thursday, '09? yes. All right.

December

10th.

10:21 10:21 10:21

Q.

A.
Q. approaches A.

2009, Okay.

So the

first was

day Mr. that

Stinger

10:21 10:21 10:21 10:21 10:21 10:21 10:21 10:21 10:21 10:22 10:22 10:22

5
6

you with The question

a question. was

What

question?

-- well,

actually

it was more he had from it or today, a

7 8 9 10 11 12 13

of a statement Firefox case. two

first.

He explained history that

to me that he recovered to decode available tool called

Internet had

He had

difficulty any software

trying tools

interpret that

it with

included

CacheBack

and another if the

Analysis.

He was going

curious

version the

of software course could of a to a

that we were do that, challenge decode business decoding why I say and

to be using

during

14
15 16 17 18 19 20 21 22
23

if it wasn't, if we were

he presented interested

it more in trying

to see

that

or whether

it would to put time

be of interest and effort

from

10:22 10:22 10:22 10:22

perspective this that

into The reason

particular is Firefox

Firefox at the had

history. time was

being they format were called

deprecated. now switching SQL8.
Q.

Version over

three

come

out

and

10:22 10:22 10:22

to a scaleable

database

You

mentioned by that? not

from

a business

perspective,

what

10:22 10:22

24 25

do you mean

A.

It's

uncommon

to expect

a software

company

10:22

SCLAFANI WILLIAMS COURT REPORTERS, INC 1-800-272-0404

17
1

to take complaints

about things that aren't working and One of the

10:22 10:22 10:22 10:22 10:22 10:22 10:22 10:23 10:23 10:23 10:23 10:23 10:23 10:23 10:23

2
3

hope that they get fixed sooner than later.

things I strive to do in running Sitequest is to be responsive situations Q. question to, particularly arise like this. And what was your response to that law enforcement needs when

4

5
6

Okay.

7 8

or that statement? My response, I can't remember exactly what I

A.

9
10 11 12 13 14 15 16

said, but it was something to the lines of, well, we'll see what it is, if I can see the data and if we can't decode it. I will do everything in my power while I'm

here to try and decode it. Q. Okay. And I presume the next day he brought

you the contents of the hard drive or a mirror copy of it?

A.

I don't know if it was the following day or the 10:23 10:23 10:23 10:23

17

same day, but he did present to me the history and the formula file, I believe it was on a thumb drive. Q. Okay. And what did you do with it?

18
19 20 21 22

A.

I transferred

the contents to a forensic laptop 10:23 10:23 10:23 10:23 10:23 10:23

that I brought with me. Q. Okay. And what did you -- what was the next

23
24

thing you did? A. Well, I resumed teaching the course and on breaks and back at the hotel room late

25

periodically

SCLAFANI WILLIAMS COURT REPORTERS, INC 1-800-272-0404

18
1

at night I'd work on trying to decode the file and analyze it. Q. I'm sorry, go ahead. I spent a lot of time actually analyzing the

10:23 10:24 10:24 10:24 10:24 10:24 10:24 10:24 10:24 10:24 10:24 10:24 10:24 10:24

2
3 4

A.

5 6
7 8
9

file to try to understand what the differences were between what he was presenting coded to decode Firefox two. Q. Did he tell you which case this Internet and how our software was

history was from?

10
11

A.
Q.

Yes. Which case did he tell you? I believe he told me it was the Casey Anthony At the time I had no idea what the name meant. about just simply

12 13 14
15 16 17 18

A.
case.

He had to refresh my memory actually

news coverage of the event, but I didn't know the actual 10:24 name. Q. And how did he do that? He just in a brief sentence or two explained 10:24 10:24 10:24

A.

19

that it was a case that's been in the news for some time 10:24 about a young lady and a daughter that had gone missing. I can't speak any more to that 'cause honestly I don't 10:24 10:25

20 21 22 23 24
25

remember the nature of what his response was except that 10:25 he explained Q. it was regarding a homicide. 10:25 10:25 10:25

Okay.

And did he ask you to look for anything

in particular?

SCLAFANI WILLIAMS COURT REPORTERS, INC 1-800-272-0404

19
1

A.
to him. Q. A.

No.

He explained

to me why it was of interest

10:25 10:25

2 3
4 5 6

And how did he do that? Well, he explained that he had
--

10:25 he was able 10:25 10:25 10:25 10:25 10:25 10:25

to in his own software tools, I can't remember if he mentioned End Case or not, but In his own ability to of the file, he was able to visually keyword, which was

7

review the contents

8
9 10
11

identify at least one particular relevant to his investigation chloroform. what appeared

and that was the word

And so he explained

to me that he could see 10:25 keywords amidst 10:25 10:26

to be searches for certain of information,

12 13 14 15 16 17

this collection

but he had no way of or parsing it.

properly decoding or interpreting

That's 10:26 10:26 10:26 10:26 10:26

been -- that's the nutshell really. Q. Okay. So you stated that you worked at night

after the course and how many hours did you put into this? A. I'd say from 5:00 p.m. to 2:00 a.m. for three Thursday.

18 19
20 21 22 23

10:26 10:26 10:26 10:26 10:26 10:26 10:26 10:26

nights, Tuesday, Wednesday, Q. A. Q. Were you --

That's approximately. Were you under some kind of contract or were

you doing that A. Q. No. -- pro bono?

24 25

SCLAFANI WILLIAMS COURT REPORTERS, INC 1-800-272-0404

20
1

A.
couldn't had

This fix

was

more

what that two

helps

me because

my software do. We

10:26 10:26 10: 2 6 10: 26 10: 26 10: 26 10:27

2
3

something that

we claimed

it could

claimed

Firefox two

is supported, that fix law was not

and being able to be here, with the

4 5
6 7

presented parsed,

the this

Firefox was more

data

of a let's to help

the problem enforcement

at the same case. Q. stay here you went A. around had

time

trying

8
9

Okay. or did back?

And

were

you

able

to fix

it during

your

10: 27 10:27 10:27

you have

to continue

working

on it when

10
11

I actually 2:30 or 3:00

fixed a.m.

the problem on the Friday out

I think morning

somewhere before I

10:27 10:27 10:27

12 13 14 15 16 17 18 19 20 21 22 23 24 25

to get up to

catch And

a flight were

of Orlando. to actually do

Q.
that Mr. A. it from being parse

Okay. Stinger I was start

what

you

able

10:27 10:27

couldn't? able to take and that block of data and parse

10:27 10:27 10:27 10:27 10:27 10:27

to or

finish keyword

extract

records

of websites and that

visited

searches for

being each the

conducted record,

the relative the time
lS

information it was

includes the URL, locator

visited,

number

of visits,

which or web

an acronym

for universal will

resource refer to it

address

a lot of people out of the you

10:28 10:28 10:28 10:28

as and created

a database And

information. turned

Q.
that over

Okay. to Mr.

I presume

immediately

Stinger?

SCLAFANI WILLIAMS COURT REPORTERS, INC 1-800-272-0404

21
1

A.

Yes.

I provided

a secure FTP upload server and 10:28 to download it from his end. 10:28

2
3 4 5
6

gave him the information Q. Okay.

The issue with chloroform, what were you 10:28 and find as to the keyword of 10:28 10:28 appeared in at least one 10:28 10:28

able to determine chloroform?

A.

The word chloroform

7 8 9 10 11 12 13 14 15 16
17

record entry, which appeared to be a Google search for that term.

And I believe the full -- I believe the full 10:28 10:28 10:28 10:29 10:29 to the database is I 10:29 10:29 10:29

query for that was how to make chloroform.
Q.

Okay.

And how many times was that query made?

A.
Q.

If I could digress for a moment. Sure. No problem.

A.

For the record, I'm referring

parsed as a means of reference. chloroform

My recollection

came up once as an individual

keyword and

then another time as how to make chloroform. spending a great deal of time researching

So without 10:29 10:29 10:29 10:29 10:29 10:29 10:29 10:29 10:29

through this is two

18 19 20 21 22 23 24 25

or looking through the data, my recollection entries so far.

One was just for chloroform and the

other one was how to make chloroform. Q. A. now? you. Q. Yeah. According to your data that you were And these pages were visited how many times? You want me to answer these questions right

I can look up the data and find the answer for

10:29

SCLAFANI WILLIAMS COURT REPORTERS, INC 1-800-272-0404

22
1 2

able that.

to recover,

if you want

to take

a moment

to do

10:29 10:29

3
4

A.
Q. A. I found

Bear Sure. Based two

with

me

for a minute.

10:29 10:29

5 6 7
8

on a quick One and

search was that And for was

for

the

keyword

chloro,

10:30 10:30 10:31 10:31 10:31 10:31 10:31 10:31 10:31 10:31 10:31

results.

chloroform dated was March

spelled, 17, 2008 And the and

c-h-l-o-r-o-f-o-r-m, at 14:43 the same p.m.

41 seconds. is for how 21st

there

one visit. and

9 10
11

second

entry

to make

chloroform 2008 at 3:16

spelling --

on the

of March

p.m.

30 seconds Q.

12 13 14 15 16 17 18 19 20 21 22 23 24 25

Okay. -- one visit. I'm One One to sorry? visit. visit. focus Now, were you given any other

A.
Q.

A.
Q. keywords A. chloroform Q. Mr.

10:31 10:31

in on? -- no. I don't believe so. I believe

I don't was Okay. the

10:31 10:31

the primary What did

keyword. you -- so after what else did you gave you do on this

10:32 10:32 10:32

Stinger

FTP upload,

case? A. will which I think that in the inclusive I prepared form of the upload was a quick I had done,

10:32 10:32 10:32

state was

to describe

what

of a Word

document.

SCLAFANI WILLIAMS COURT REPORTERS, INC 1-800-272-0404

23
1

Q. A. Q. A. attached sure. Q. testify

Are Yes.

you

referring

to,

like,

a report?

10:32 10:32

2 3
4

Okay. It was

And part

you

gave

that upload.

to whom I may

exactly? have actually I'm not

10:32 10:32 10:32 10:32

of the

5

it separately I can't Have recall. you been case? this aware kind

to the e-mail

for Kevin.

6
7 8 9 10
11

advised

that

you were

going

to

10:32 10:32

in this Well, made

A.
was truly

week

was

kind

of the

first Any

that prior

I

10:32 10:32 10:32 10:33

of that

possibility.

conversation Q. What

was

of a suggestion. a suggestion? I finished to Kevin, that I just uploading I don't I may know and if it

12 13 14 15 16 17 18 19 20 21 22 23 24 25

do you mean I think

A.
providing was

Well, this but

when

10:33 10:33 10:33 10:33 10:33

information it was

a joke,

suggested And

be called

because dismissed Q. Stinger,

of my

involvement.

basically

it at the time. Okay. you So after heard that conversation until phone kind with Kevin

10:33 10:33 10:33 10:33 10:33

hadn't

anything the

recently? call was

A.
Monday surprise

That's or Tuesday to me. Now,

right. this

I think week.

It was

of a big

Q.
this

have

you been --

contracted

in any way

on

10:33 10:33

case? A.

Have

you been

I don't

understand.

No.

10:33

SCLAFANI WILLIAMS COURT REPORTERS, INC 1-800-272-0404

24
1
2

Q. A.

No? Why would I be contracted? What I mean is, have you been paid in any way

10:33 10:33 10:33 10:33 Not at all. 10:33 10:33 10:33

3 4 5
6 7 8 9

Q.

for this case?

A.
Q. your --

No.

Have you been told you're going to be paid for

A.
Q.

No. So the extent of your involvement was your certain

10:33 10:34 10:34 10:34 10:34 10:34 10:34 10:34 10:34 10:34 10:34 10:34 10:34 10:34

10 11 12 13

software company had a problem deconstructing pages or reconstructing

them I should say and you fixed is that correct?

it and gave the data to Mr. Stinger; A. Sort of.

I should clarify or correct you on because it's a history, there's This is strictly history. I basically

14
15 16 17 18 19 20 21 22

the point of rebuilding

nothing to rebuild web pages.

So to that point, I just clarify that. successfully Q. parsed the history.

Wasn't it -- wasn't there an issue where you earlier that Mr. Stinger was able to get

had mentioned

certain bits of the history, but not the complete string? A. Yes. Okay. That's correct. So I guess that's where I got that. rebuilding a web

10:34 10:34 10:34 10:34

23
24 25

Q. A.

There's a difference between

page and a history.

One involves an actual file, the

SCLAFANI WILLIAMS COURT REPORTERS, INC
1-800-272-0404

2S
1

other one just involves sort of a record entry as to where someone has been. Q. that. Understood. Now, I'm sorry, let me rephrase

10:35 10:35 10:35 10:35

2 3 4 5

I don't want to -- have you had any further

contact after giving the information

to Mr. Stinger with 10:35 10:35 10:35 10:35 10:35 10:35 10:35 10:35 10:35

6
7 8 9

Mr. Stinger or anyone else from the Orange County Sheriff's Office? A. I've had contact with Kevin two, maybe three over the last nine months regarding We carne out

times sporadically

10
11

the use of the software and an upgrade. with a version three back in July. Q. upgrade? I presume

12

that bug fix was included in the

13
14 15 16 17 18 19
20

A.
believe. Q. A. Q. A.

Yes.

Actually

it was released early January, I 10:35 10:35 10:36 10:36

It's a free update. Early January of this year? Yes. Okay. And now your program is completely

fine? 10:36 10:36 10:36 10:36

Well, I would never attest to any software fine.

being completely Q. A. Q. A. Q.

21 22
23

As it relates to It's functioning as best as it can right now.

10:36 10:36 10:36 10:36

As it relates to the Firefox two history? Yes. Okay. That's correct. Well, I just have one final question.

24 25

SCLAFANI WILLIAMS COURT REPORTERS, INC 1-800-272-0404

Sign up to vote on this title
UsefulNot useful