Police comb digital files in pursuit of evidence

San Diego Union-Tribune via SignOnSanDiego.com ^ | March 18, 2002 | Kathryn Balint

[MizSterious]

Police comb digital files in pursuit of evidence

By Kathryn Balint
STAFF WRITER

March 18, 2002

As San Diego police began focusing on David Westerfield in connection with the kidnapping – and, as was later discovered, death – of Danielle van Dam, they looked in the places that so frequently hold clues to crimes: his computers.

The Digital Age has taken police forensics far beyond fingerprints.

Police now routinely seize computers in serious crimes. Increasingly, evidence from those computers becomes part of court proceedings, as it did last week when prosecutors presented evidence they said points to Westerfield as Danielle's kidnapper and killer. Westerfield has pleaded not guilty to charges of kidnapping, murder and possession of child pornography.

Last week's preliminary hearing shed light on how police go about examining a suspect's computer and what they look for.

On Feb. 4, two days after Danielle was found missing from her Sabre Springs home, San Diego police Detective James Watkins, a computer-forensics specialist, showed up at Westerfield's home with a search warrant to examine his computers.

In his job with the San Diego Police Department, Watkins needs to know as much about computers as about criminal investigations.

Retrieving evidence from a computer requires special care by someone with proper training. Digital files, Watkins testified last week, can be "altered or damaged or cease to exist if not handled correctly."

Computer forensics experts ferret out photos, Web sites, e-mail and digital files believed to have been deleted. Any of that information can help solve a crime, or explain a suspect's motives or state of mind.

In the wake of the Sept. 11 terrorist attacks, investigators followed the conspirators' electronic trail from libraries in Florida to major Internet service providers across the country.

The digital evidence revealed the terrorists had booked airline tickets online, used the Internet to learn about the aerial application of pesticides and exchanged e-mail.

Among the cases in San Diego County in which computer evidence has played a role:

l The prosecution of Michael Craig Dickman, the "Gap-Toothed Bandit" who was sentenced to nine years in prison last year for robbing six banks around the county. Computer-forensics investigators found copies of his demand notes on his laptop computer.

l The conviction of Arthur Gerardo and Valerie Beidler 1-1/2 years ago for the torture and murder of a roommate who helped them make fake identification cards and forge checks. A computer seized from their house contained pictures of checks and driver's licenses that had been scanned, then altered.

l The ongoing case against Charles "Andy" Williams, the teen-ager who is awaiting trial on charges of killing classmates Randy Gordon and Bryan Zuckor and wounding 13 others at Santana High School last year. Williams' computer was seized as part of the investigation.

Westerfield, 50, a self-employed engineer, had four computers – three desktops and a laptop – at his home in addition to a Palm handheld computer, Watkins testified.

On his visit to Westerfield's home, two houses from where Danielle lived, Watkins was accompanied by computer specialist Lee Youngflesh of the FBI's regional computer forensics laboratory.

The San Diego-based facility was the first of its kind in the nation, and has been used as a model for other such laboratories across the country.

Watkins and Youngflesh brought with them the tools of their trade, including a field imaging device that can make copies of computer hard drives.

One of their first tasks at Westerfield's house was to disassemble the computers and remove the hard drives, which is where all of a computer's files are stored. Then they copied the data on Westerfield's computers onto extra hard drives they brought with them.

Digital information can be copied perfectly, unlike, say, a photocopied letter or a tape of a prerecorded song. That way, the forensics exam can be done on the digital copy so that the original is left intact.

Watkins said he and Youngflesh reassembled Westerfield's computers and made sure they were left in working order. They also copied data from Westerfield's handheld computer.

Afterward, they searched the house for other computer-related items, such as a list of passwords or other media on which computer data can be stored. In this case, Youngflesh found three Zip disks and three CD-ROMs in an envelope on a bookcase, Watkins testified.

Copious review

Once back at the office, the real work began: poring through thousands of files. In an era in which a typical hard drive holds 20 gigabytes of information, that can be a daunting task.

Twelve gigabytes of text, for example, would stack 24 stories high if printed out.

Westerfield's computers contained about 64,000 photo files and 2,200 video clips, Watkins said.

Investigators had to sift through them to find the 100 or so files they deemed relevant to the case.

Just as police testified that Westerfield's house was in immaculate order, so were his computer files, Watkins said. Westerfield neatly organized his digital data – including pornographic photos – in computer folders, and folders within folders, the detective testified.

With so many files to sift through, what investigators look for first is dictated by the nature of a crime. In this case, they were looking for files containing child pornography, which a prosecutor said points to a motive for the crime: sexual assault.

Watkins said he found less than 100 "questionable images," including those he said that may have depicted minor females engaged in sex acts or posing nude in a sexual manner.

Two of the files he said he retrieved were cartoon animations of an act of rape. Eight more photos also entered into evidence were supposedly of a girlfriend of Westerfield's and her teen-age daughter in a bikini in suggestive poses.

Unlike handwritten notes, computer data contain embedded information noting when a file was created, when it was modified and when it was last accessed. That can give investigators valuable insight into timing.

Deleted, hidden files

Computer forensics goes beyond plowing through the obvious "active" files on a computer. Investigators also look at "deleted" files.

Many computer users do not realize that simply deleting a file does not make it disappear forever. In most cases, hitting the Delete button erases the file from the directory, but the underlying data remain on a disk until the computer writes over it.

Watkins was able to resurrect some files that had been deleted from the Zip disks, he said.

Another routine check he said he performed on Westerfield's computers was to see if any files were disguised with "bad signatures." That is when a file extension, such as .doc or .mp3 or .jpg, is changed to hide the true nature of the file. For instance, a .jpg file, which denotes an image, could be changed to .mp3 to make it appear to be a music file.

Watkins testified that he found no such attempts to disguise files in Westerfield's computers.

While the fact that a file was found on a specific computer or disk may be indisputable, who actually created it or viewed it is often not as concrete.

Westerfield's attorney raised questions about who downloaded or created the files on his client's computers. In court, he suggested that perhaps Westerfield's grown son or a house guest may have done it.

"You don't know who downloaded those photos onto the Zip drives or CD-ROMs, do you?" Watkins was asked.

"No, sir, I don't," he replied.

[MizSterious]

I didn't find this on any of my searches; if it's been posted before, my apologies.

[MizSterious]

FYI, interesting stats toward the bottom of the article.

[MizSterious]

One man's verdict: Jury selection won't be easy

March 14, 2002

To guarantee an untainted trial, maybe we should all be gagged.

Not only the players in the David Westerfield case, recently rendered mute by a court order.

All of us. All the fallout victims.

Think of it as a countywide holiday from gossip, speculation and sea lawyering.

But as a result, would Westerfield receive a better brand of local jury down the line?

I sort of doubt it.

In fact, the televised preliminary hearing, which could wind up today, already has made up a multitude of minds, I suspect.

At this point, no matter how little we say – or hear – the vast majority of San Diegans think pretty much the same thing:

He killed the girl.

So go ahead. Gag everyone.

The evidence, the sine qua non of justice, is out.

The damage to the presumption of innocence is done.

Try as I might to focus on other matters at hand – filling out my NCAA brackets, for example – I can't turn away from this infernally involving case.

Today, the prosecution appears headed for its coup de grace – a coherent theory of how Westerfield entered the van Dam house, kidnapped the little girl and later dumped her body.

Of course, much has been made of Judge H. Ronald Domnitz's gag order.

More interesting, it seems to me, is whether this case, assuming it goes to trial, will remain in San Diego County.

Given what we now know, can a jury of San Diegans be impartial?

Tuesday night, I had a little hallucination, the highlights of which I'll share.

As one of 5,358 jurors called for the Westerfield trial, I was apprehensive as we filed into the jury box.

Steven Feldman, Westerfield's lead attorney, looked me over and began his selection interview:

"What is your occupation?" Feldman asked.

"Journalist," I replied.

The wiry lawyer rolled his eyes. "Have you been exposed to media coverage of the Danielle van Dam case?"

"Inundated," I admitted. "Saturated. Soaked."

"How many hours have you spent absorbing information about the case?" he asked, unable to conceal his disdain for my classless profession.

"Just guessing, I'd say somewhere between 80 and 120 hours of conscious attention."

"Have you formed an opinion as to the guilt or innocence of the defendant, David Westerfield?" he asked.

"Well, I'm willing to admit the remote possibility that Mr. Westerfield is, in fact, innocent," I said, "but given the evidence presented at the preliminary hearing, I'd have to agree with defense attorney Milton Silverman, who, while impersonating Greta Van Susteren on a local TV broadcast, said: this is 'one of the most solid cases I've seen' in 32 years of trial experience. In my view, the real issue will be the one of life or death, not guilt or innocence."

Feldman scowled. "Do you believe you could hear evidence in this trial and come to an impartial conclusion, even if the facts refuted what you believed to be true?"

"Yes, I do," I replied. "If you were to pull a Perry Mason and find the 'real' murderer, I'd be happy for Westerfield, a victim of a diabolical conspiracy. If you could undermine the integrity of the prosecution's evidence against Westerfield, I would be unhappy for the justice system, but I might vote to acquit. The odds of that, however, seem about as long as the blood on Westerfield's jacket not being Danielle's. What were they? One in 25 quadrillion?"

Feldman stomped back to his table.

"Gag this juror," he said to the judge.

Look, the second day of the preliminary hearing was devastating. More so if you watched it on TV. (Even if you sit in the courtroom, you almost never see the defendant's face. How many times, after a damning piece of evidence was presented – disgusting photographs, blood, fingerprints – did the TV camera pan to Westerfield's face?)

Prosecutors, gagged outside the courtroom, are not only proving to the judge they have a legitimate case, they're boiling the jury pool.

Maybe the Westerfield trial should be moved out of San Diego County. Tough call.

Historically, high-profile trials have gone both ways.

You be the judge.
Source

[spectre]

Well, I guess this article just about covers the percentage of a possibility for DW's acquital...maybe ZERO...based on the "leaked" blood evidence that even an idiot would have to be impressed with.

So how do they get an "impartial" jury? They don't. Someone is going to Lie just to have the power to put this guy away.

That's the reason why Feldman has to be the best Defense lawyer on the face of this planet, he knows the prejudice is there against his client.

No one has to prove what the van Dams are, the facts speak for themselves. These two are a real piece of work.

The author is correct, Steven Feldman will have to pull a "Perry Mason". It's the only way this can end...beyond a resonable doubt.

~sw~

[DoughtyOne]

Watkins said he found less than 100 "questionable images," including those he said that may have depicted minor females engaged in sex acts or posing nude in a sexual manner.  Two of the files he said he retrieved were cartoon animations of an act of rape. Eight more photos also entered into evidence were supposedly of a girlfriend of Westerfield's and her teen-age daughter in a bikini in suggestive poses.

The Westerfield connection is something that has mystified me from the start.  How did that man become the leading suspect so rapidly?

To hear the Van Dams tell the story, they barely knew Westerfield.  Brenda mentions that she only met him briefly while canvasing the neighbors for girl scout cookies.  If I remember correctly, that was a full year before the Danielle disappeared.  Then she ran into him again "briefly" on the night her daughter disappeared.

It seems wierd to me that a guy could be out buying Brenda drinks at one moment, then secreting into the Van Dam home just minutes later.  I'd like to see an accurate timeline of the friday evening and night this all occurred.

When it comes to the computer files that are reported to incriminate Westerfield, I get a little squeemish.  I don't understand why any grown man would have child pornography on his computer.  But in the accounting of what Westerfield had on his computer, the descriptions go limp.  Watkins determinations are described for us.

Westerfield has been turned into a monster by the revelation that child pornography existed on his computer.  I expected to hear that thousands of photos existed on his computer.  I expected those to be of little girls.  I expected them to reveal a man obsessed with girls ranging from age 1 to 10.  Now it is revealed that Westerfield had less than 100 questionable photos on his computer.  It is further revealed that those images included photos of "possible" minor females.  Just how many actual photos of little girls exist on Westerfield's computer?  Were there any at all?  Were there ten or less?  How many?

When I think of child pornography, I think of children from the age of birth through ten or twelve.  When the police think of child pornography they think of any minor child.  I believe a revealing or suggestive photo of a girl that is seventeen years and 360 days old, would qualify technicly as child porn.  Any eighteen year old boy might have child porn, if for no other reason than that he might have a photo of his girlfriend in a bikini, or God forbid even less.

Is Westerfield the monster we've been led to believe.  Was this just too quick and easy?  How many people are aware that Danielle's blood was found on the stairs at the Van Dam home?  I'll be interested to hear the acutal case against Westerfield.  At this point it almost sounds like a setup to me.

I'm not saying it's impossible, but I have found the scenario that sees Westerfield secreting into the Van Dam home, locating Danielle's room without distrubing anyone else, then getting her out of the house without disturbing anyone, to be a very difficult sell.  I guess anything is possible, but it sure seems iffy to me.

All this being said, I still lean toward Westerfield.  But I sure do have a lot of questions at this point.  I am far from convinced.

[Jaded]

Change of venue is the only option.

[Jaded]

That DW was in a rage because he was spured by Brenda is IMO stretching it. The time frame prosecution gives is thin. There is too much resonable doubt. I wonder how much of the forensic evidence will come back inconclusive or there wasn't enough to test, then it will be emotion only. They will haul out all of the profilers that SD can buy. Like that's really a slam dunk.

[DoughtyOne]

I believe the Van Dams had more to do with Westerfield than has been previously revealed. I think more will come out in the trial. Brenda's contention that she didn't know what an "adult party" was, leads me to think she's not being honest. And when it comes to Westerfield, I have a hard time accepting that he just wasn't her cup of tea. It sounds to me like she cast her sexual net over a large area, that would almost certainly include Westerfield.

Wasn't it revealed during the questioning of Brenda, that Westerfield was interested in hosting adult parties? Does that sound like a guy obsessed with children?

Westerfield is either a guy who deserves to die, or a man that is going to go down as one of the most unfairly slandered in recent history.

[chaosagent]

I think the first thing that caught their attention was that he immediately left the area in his RV to head out into the desert. It turns out he was known to be in the area where the body was found.

The clincher was the fact that they fould her blood in his RV and apparently, some DNA evidence from him in her room

[FresnoDA]

Account set up for Danielle's search still has about $24,000

Van Dams undecided on how money will be used

By Kristen Green
UNION-TRIBUNE STAFF WRITER

March 24, 2002

After Danielle van Dam was abducted from her Sabre Springs home, neighbors, friends and even strangers volunteered to help out. Some put up fliers in storefronts around the county, and others joined the search party. But many also opened their checkbooks.

As of Friday, more than $33,000 had been donated by people from New Jersey to Oregon.

During the search for the 7-year-old, donations totaling more than $10,600 flowed into an account in Danielle's name. And since the discovery of her body in rural East County nearly a month after she was reported missing, an additional $22,800 has been deposited.

"We didn't go open an account and ask for money," said family friend Bill Libby, who handled donations for the van Dams. "I opened the account because people wanted to donate money."

Initially, the family expected to use the donations to pay for search expenses, like posters and fliers. After Danielle's body was found, the family Web site said additional donations would be used to pay memorial expenses.

But Libby said the family's expenses have been limited because of numerous donations, from fliers to cremation fees. So far, the van Dams have spent $4,200 of the donations to buy banners, posters and buttons. And they are writing a $5,000 check to the Laura Recovery Center, which coordinated the search for Danielle.

The family hasn't decided how to use the remaining $24,000.

"I'm sure in due time that they will turn their attention to the appropriate and productive use of those funds, but right now they're really still dealing with the loss of their daughter," said family spokeswoman Sara Muller Fraunces.

Close friends have suggested the van Dams take their time considering how the money will be used. Libby has said the funds could be used to pay for counseling for the family, and the van Dams are considering establishing a local foundation to conduct searches for missing San Diego children.

After Danielle's parents realized she wasn't in her bed the morning of Feb. 2, people began donating money to cover search expenses. Libby tried to open an account at Wells Fargo on behalf of the van Dams.

But the account had to be set up by a nonprofit organization, and a family friend who attends Community Bible Church in Scripps Ranch asked the pastor if the church would sponsor the account. Even though the van Dams aren't members of his congregation, the Rev. Barry Minkow agreed.

Minkow, who was convicted of securities and bank fraud in the late 1980s and served a 71/2-year prison sentence, doesn't have access to the van Dam account, church treasurer Bruce Brown said.

Brown said he is the only person who can withdraw money from the account, taking requests for checks directly from Libby, who acts on the van Dams' behalf.

[DoughtyOne]

Thanks for the comments. If as I believe, Westerfield was more of a friend than the Van Dams have admitted to, then the blood and DNA traces could have been made at a time other than the night or weekend in question.

I believe there was a handprint of Danielle's in the motor home too. Was it fresh? Did it get there that weekend? Time will tell.

Look, my comments may certainly pale when evidence surfaces at the trial. Perhaps my skepticism is unfounded, but from the get-go I've wondered how in the heck Westerfield was pegged almost from day one? This just sounds way too easy.

Was Westerfield a registered sex offender? Did the Van Dams finger him? Did someone observe something? How did this guy get fingered so early on? Cases like this linger for years. This one was solved in a matter of days, if not hours. I'm just curious how that took place.

[FresnoDA]

Van Dams thank volunteers who searched for Danielle

By John Berhman
UNION-TRIBUNE STAFF WRITER

March 24, 2002

It was a day to reward and thank the hundreds of volunteers who helped in the search for Danielle van Dam, the 7-year-old Sabre Springs girl whose body was found Feb. 27 almost four weeks from the night she disappeared from her bedroom.

Under cool and cloudy skies at Hospitality Point on Mission Bay, Danielle's parents and leaders in the search effort gathered yesterday to meet and thank the many county residents who volunteered their services.

"It's all about them today," Brenda van Dam said. "The whole event today is to thank the many volunteers who gave up their time away from their families to help in the search for Danielle. It's to give them a big thank-you."

About 2,500 people volunteered to scour the suburban hills around the girl's home and trek out into the county's backcountry. An estimated 1,000 were expected for the outdoor luncheon yesterday, but an early-morning rain and cool temperatures kept attendance to about 300, an event sponsor said.

Ken Foley, who owns San Diego Catering Concepts, donated the food and drinks for the "Appreciation Event."

"We had 1,500 hamburgers and 700 hot dogs ready to serve 1,000 people," Foley said. "But we had quite a downpour when we were setting up here at 5 a.m., and it stayed pretty cool during the day. But I still think it was a successful event to honor the volunteers."

And the volunteers, many of whom sat on lawn chairs or blankets, agreed. Several of those interviewed said they were glad they volunteered, and although many were saddened when Danielle's body was found by volunteers searching in rural East County, all said the discovery at least brought closure to the girl's disappearance.

A neighbor who lived two doors from the van Dams, David Westerfield, 50, has been charged with kidnapping and killing Danielle and will stand trial.

"I was sad when they found her, but also relieved because at least it gave closure for the parents and the rest of us who had been searching for her," said Scott Dell, 42, of San Diego, who spent seven days assisting in the effort.

"This is why I did it," added Dell, patting the head of his 9-year-old daughter, Hayley. "If it had been her, I would have hoped that people would have volunteered to look for her, just as they did for Danielle."

John Huey, 35, also of San Diego, said he doesn't have any children of his own, but still spent 16 days in the search effort. "I just looked at my brother's four girls – ages 12, 9, 7 and 4 – and I knew I had to help out," he said.

Diane Halfman, who headed the Danielle Search Center, and San Diego police Lt. Jim Collins spoke and thanked the gathering.

"In my 30 years on the San Diego Police Department, I have never seen a volunteer effort like this one," Collins said.

The van Dams did not address the gathering, but mingled among the volunteers, thanking them and hugging many.

[FresnoDA]

The family hasn't decided how to use the remaining $24,000.

"I'm sure in due time that they will turn their attention to the appropriate and productive use of those funds, but right now they're really still dealing with the loss of their daughter," said family spokeswoman Sara Muller Fraunces.

Trip to Sandals?

Lifetime membership to the CB Club......

Decisions, decisions......

[fnord]

I think the first thing that caught their attention was that he immediately left the area in his RV to head out into the desert. It turns out he was known to be in the area where the body was found.

Oddly enough, he did not leave immediately. He left home somewhere between 6 and 12 hours after she disappeared. He also returned to the neighborhood that afternoon, in his RV, while the neighborhood had a massive search going on. Then he left even later for the desert. Ballsy behavior for someone with a dead child or evidence thereof, dontcha think. Also, he was in the area where the body was found in the same sense as about 2 million other San Diegans. Not much to go on there.

The clincher was the fact that they fould her blood in his RV and apparently, some DNA evidence from him in her room

They also found more blood (maybe hers) in several places at the VDs. They found a pinspot on his. No evidence of when any of her blood was dropped. That rumor of 'DNA evidence' in her room has been debunked for quite awhile now.

The police and DA went to a lot of effort to leak certain pieces of evidence, and to leak flat-out lies about evidence. As per your comments, those leaks were effective. There's still a lot of real evidence to be seen. What has been seen doesn't add up to much, so the DA better have some rabbits in his hat.

[MizSterious]

"Was Westerfield a registered sex offender? "

We do know the answer to this one. No, he was not. However, there were 13 registered offenders in the area that were "immediately cleared." The SDPD seems to have done a lot of "immediate clearing," including the 13 registered child molesters, the 4 visitors to the VD "pizza party" that night, and the VDs themselves--and it should be noted that the one person with no verifiable alibi for several hours that night is Damon van Dam himself.

[MizSterious]

"Lifetime membership to the CB Club......"

ROFL! And maybe continued use of the P.R. firm? They might need them!

[spectre]

"How was Westerfield fingered from day on"..

According to various reports, DW seemed to be the ONLY person gone from the neighborhood when the search began...it's that simple. Someone had to give them reason to suspect DW, and it probably was the Van Dams with their fabricated story of DW focusing on Danielle when she sold him GS Cookies.

Course, the van Dams were acquainted with DW much more than they admitted, but as soon as they found out he was made the suspect, they immediately set out to distance themselves from him.

It seemed to spiral out of control, when BVD was caught in her web of deception. (Here's where the van Dams were stupid, and think other's are equally as dumb.) They HAD to realize the events of that evening and early morning would eventually be found out...OR maybe, they figured, by then, DW would be the prime suspect, and no one would give a dam what kind of a life they led....and that seems to be working.

sw

[spectre]

Everyone should read your post #16.

Bump!

~sw~

[E. Pluribus Unum]

Retrieving evidence from a computer requires special care by someone with proper training. Digital files, Watkins testified last week, can be "altered or damaged or cease to exist if not handled correctly."

Eraser 5.3 handles files very incorrectly. Detective Watkins would not approve.