Search log files and Scott Peterson

[orion]

Search logged files and privacy issues is the theme of this thread; however, I called it "Scott Peterson & log files". Why? Search log files appear to be relevant to the Scott Peterson trial.

According to this news http://abclocal.go.com/kfsn/news/083004_nw_peterson.html, logged search results are becoming relevant to the infamous Scott Peterson trial. According to this news, "Lydell Wall of the Stanislaus County Sheriff's Department returned to the stand Monday for cross-examination.... Wall testified that between 8:40 a.m. to 8:45 a.m. the morning of Dec. 24, someone used Peterson's home computer to search shopping Web sites"

At one point the article says

"Geragos has repeatedly shown jurors a Web site page about fishing with a Dec. 5 date on it. Wall has previously agreed the site may have been searched on that day, but it's also likely the Web site manager simply failed to change the date. Records also indicate that Peterson surfed Web sites on his warehouse computer for 26 minutes on the very morning police allege he disposed of his wife's body. Peterson stored his boat -- the one prosecutors allege he used to dump Laci Peterson's body into the bay -- at the warehouse.".

Thus, the logged search results are important to establish a time frame.

Feel free to comment or speculate as much as you wish on how logged search results may affect this trial or feel free to discuss the bigger picture, ie., how logged search results may affect user's privacy in general.


Orion

[Mikkel deMib Svendsen]

I remember a trial here in denmark that invlolved logs (allthough not search logs) but the prosecutor lost the case because they forget about the time zone! The server was in US and the person on trial was in Denmark, so when the defence pointed that out the case fell apart because the timing of events that the logs was used for suddenly did not match at all :)

[Elisabeth]

oooh... I love computer forensics. (and have been following the Scott Peterson case, too)

I think privacy issues tend to go out the window when you're accused of murdering one or more people.

in anycase, personal/work computer data and surfing has been used on an increasing level in legal arguments, and with good reason, since it's highly traceable and 'concrete' evidence in many cases. (of course, Child Porn cases seem to be the most applicable) I don't think that's something that going to go away.

that said, these parts:

but it's also likely the Web site manager simply failed to change the date.

Wall testified that between 8:40 a.m. to 8:45 a.m. the morning of Dec. 24, someone used Peterson's home computer to search shopping Web sites

which is really interesting, because it implies Laci was alive at that time, possibly searching for baby stuff (can we see some keywords please?) - howver it does not rule out Scott creating counter evidence to cover his tracks.

is hard to comment really though, not knowing all the details - it's all speculation and heresay -

/necessary legal jargon.

[orion]

Their expert may simply suggest state prosecutors to ask the visited search engines to supply log files. I don't have all the inside information, so the following is a mere speculation:

I wonder why the State not simply ask the search engines (through a court ruling) produce any log file? Not sure if they have done it already.

This topic reminds me of Daniel Brandt's excellent article on search logs, but from the search engine standpoint, not from the local hard drive side. [Warning: be aware that if you visit the following link, your visit will be logged.]

http://www.google-watch.org/cgi-bin/urldemo.htm

Orion

[orion]

This post in particular is not about if Scott Peterson is guilty or not but about the importance of web search logs and forensics in court trials.

Let's take a look at timeframes, forensics, and some dates. Info extracted from the link given in post #1 of this thread (http://abclocal.go.com/kfsn/news/083004_nw_peterson.html)


TIMEFRAME

Dec 24, 2002 - 8:40 a.m. to 8:45 a.m - This timeframe is important as someone used Peterson's home pc to search shopping Web sites. "Who was the person who logged on at 8:40 a.m.?" defense lawyer Mark Geragos asked to Lydell Wall (State expert). Wall could not answer.

Dec 24, 2002 - 10:08 a.m to 10:30 am - Within this timeframe, Peterson made a cell phone call from or near his home. Defense lawyers are trying to show Laci was still alive, leaving little time for Peterson to kill her, make a cell phone call at 10:08 a.m. from or near his home -- as prosecutors allege -- and browse Web sites at his office across town at 10:30 a.m., as Lydell Wall testified. Records also indicate that Peterson surfed Web sites on his warehouse computer for 26 minutes on the very morning police allege he disposed of his wife's body. Geragos is apparently trying to show it would be ridiculous for Peterson to spend any time searching Web sites in his office while, as prosecutors allege, he had his wife's body stuffed in a toolbox in the back of his truck


FORENSICS

This is interesting as it involves forenscs in the local machine to assess the use of searched terms.

Wall also testified that police asked him to scan Peterson's computers for specific words he may have used in searches such as "divorce," "shooting," and "silencer."

"However, in viewing them, no significant information was observed?" Geragos asked.
"I did not see any, no," Wall replied.

Geragos then noted Peterson made no attempt to cover his tracks, so to speak, if, as authorities allege, he was in the midst of a murder plot.

"Did you see any attempts to try to erase information, delete information?" Geragos asked.
"No, I did not," Wall said.

"Did you see any attempts ... that somebody had tried to tamper with them?" Geragos prodded.
"No. There would be obvious indications if that had occurred," Wall said


REVISITNG SOME DATES

Dec 5 - Web search activities this date may show that Peterson searched the Web before being confronted by Shawn Sibley. Geragos has repeatedly shown jurors a Web site page about fishing with a Dec. 5 date on it. Wall has previously agreed the site may have been searched on that day, but it's also likely the Web site manager simply failed to change the date.

Dec 6 - Shawn Sibley, the woman who introduced Peterson to Amber Frey, his mistress, testified that she confronted him on Dec. 6 after learning he was married.

Dec 7 - The Dec. 7 date is important because Shawn Sibley, the woman who introduced Peterson to Amber Frey, his mistress, testified that she confronted him on Dec. 6 after learning he was married. Prosecutors appear to be trying to show that Peterson hatched the murder plot the following day (Dec 7).

Dec 7-8 - Wall said Peterson searched sales ads for used boats on Dec. 7-8, 2002, weeks before Lacy vanished. Peterson also searched numerous Web sites for fishing information, currents in San Francisco Bay and details about boat ramps in the area.

It is clear someone was searching for information at Peterson's home pc and Peterson's warehouse pc within the specified timeframes and dates. Web search forensics may make a difference. In addition to local hard drive forensics, search logs from

a. search engines visited
b. visited sites
c. Peterson's ISP

make shed important info, assuming these Internet properties log web search and users' activities.


Orion

[Jennifer who Me]

How does anybody know that there is not someone else involved in the murder. Just because he was at work at the time does not mean that the person shopping or on the computer was lacy peterson. Maybe there are more people involved. Mayhaps Mr. Peterson had a jealous girlfriend on the side that killed her and he is trying to cover it up either way the whole thing is just a mess

[Opie1Canopie]

Ok I'll bite...sorry Orion, not exactly what you want to discuss but, how do they know it was Scott Peterson that was surfing on his work computer at that time? Could someone else have been using the machine? I assume they ran prints etc. on the machine, but are they sure?

[Elisabeth]

let's make sure this thread stays on the topic of how computer forensics can help or hurt court cases in general, in particular using the petersen case now. But let's NOT discuss his guilt/innocence or speculate on other suspects or motives - that has no place here.