Posted on 03/24/2002 8:41:01 AM PST by MizSterious
Police comb digital files in pursuit of evidence
By Kathryn Balint March 18, 2002 As San Diego police began focusing on David Westerfield in connection with the kidnapping – and, as was later discovered, death – of Danielle van Dam, they looked in the places that so frequently hold clues to crimes: his computers. The Digital Age has taken police forensics far beyond fingerprints. Police now routinely seize computers in serious crimes. Increasingly, evidence from those computers becomes part of court proceedings, as it did last week when prosecutors presented evidence they said points to Westerfield as Danielle's kidnapper and killer. Westerfield has pleaded not guilty to charges of kidnapping, murder and possession of child pornography. Last week's preliminary hearing shed light on how police go about examining a suspect's computer and what they look for. On Feb. 4, two days after Danielle was found missing from her Sabre Springs home, San Diego police Detective James Watkins, a computer-forensics specialist, showed up at Westerfield's home with a search warrant to examine his computers. In his job with the San Diego Police Department, Watkins needs to know as much about computers as about criminal investigations. Retrieving evidence from a computer requires special care by someone with proper training. Digital files, Watkins testified last week, can be "altered or damaged or cease to exist if not handled correctly." Computer forensics experts ferret out photos, Web sites, e-mail and digital files believed to have been deleted. Any of that information can help solve a crime, or explain a suspect's motives or state of mind. In the wake of the Sept. 11 terrorist attacks, investigators followed the conspirators' electronic trail from libraries in Florida to major Internet service providers across the country. The digital evidence revealed the terrorists had booked airline tickets online, used the Internet to learn about the aerial application of pesticides and exchanged e-mail. Among the cases in San Diego County in which computer evidence has played a role: l The prosecution of Michael Craig Dickman, the "Gap-Toothed Bandit" who was sentenced to nine years in prison last year for robbing six banks around the county. Computer-forensics investigators found copies of his demand notes on his laptop computer. l The conviction of Arthur Gerardo and Valerie Beidler 1-1/2 years ago for the torture and murder of a roommate who helped them make fake identification cards and forge checks. A computer seized from their house contained pictures of checks and driver's licenses that had been scanned, then altered. l The ongoing case against Charles "Andy" Williams, the teen-ager who is awaiting trial on charges of killing classmates Randy Gordon and Bryan Zuckor and wounding 13 others at Santana High School last year. Williams' computer was seized as part of the investigation. Westerfield, 50, a self-employed engineer, had four computers – three desktops and a laptop – at his home in addition to a Palm handheld computer, Watkins testified. On his visit to Westerfield's home, two houses from where Danielle lived, Watkins was accompanied by computer specialist Lee Youngflesh of the FBI's regional computer forensics laboratory. The San Diego-based facility was the first of its kind in the nation, and has been used as a model for other such laboratories across the country. Watkins and Youngflesh brought with them the tools of their trade, including a field imaging device that can make copies of computer hard drives. One of their first tasks at Westerfield's house was to disassemble the computers and remove the hard drives, which is where all of a computer's files are stored. Then they copied the data on Westerfield's computers onto extra hard drives they brought with them. Digital information can be copied perfectly, unlike, say, a photocopied letter or a tape of a prerecorded song. That way, the forensics exam can be done on the digital copy so that the original is left intact. Watkins said he and Youngflesh reassembled Westerfield's computers and made sure they were left in working order. They also copied data from Westerfield's handheld computer. Afterward, they searched the house for other computer-related items, such as a list of passwords or other media on which computer data can be stored. In this case, Youngflesh found three Zip disks and three CD-ROMs in an envelope on a bookcase, Watkins testified. Copious review Once back at the office, the real work began: poring through thousands of files. In an era in which a typical hard drive holds 20 gigabytes of information, that can be a daunting task. Twelve gigabytes of text, for example, would stack 24 stories high if printed out. Westerfield's computers contained about 64,000 photo files and 2,200 video clips, Watkins said. Investigators had to sift through them to find the 100 or so files they deemed relevant to the case. Just as police testified that Westerfield's house was in immaculate order, so were his computer files, Watkins said. Westerfield neatly organized his digital data – including pornographic photos – in computer folders, and folders within folders, the detective testified. With so many files to sift through, what investigators look for first is dictated by the nature of a crime. In this case, they were looking for files containing child pornography, which a prosecutor said points to a motive for the crime: sexual assault. Watkins said he found less than 100 "questionable images," including those he said that may have depicted minor females engaged in sex acts or posing nude in a sexual manner. Two of the files he said he retrieved were cartoon animations of an act of rape. Eight more photos also entered into evidence were supposedly of a girlfriend of Westerfield's and her teen-age daughter in a bikini in suggestive poses. Unlike handwritten notes, computer data contain embedded information noting when a file was created, when it was modified and when it was last accessed. That can give investigators valuable insight into timing. Deleted, hidden files Computer forensics goes beyond plowing through the obvious "active" files on a computer. Investigators also look at "deleted" files. Many computer users do not realize that simply deleting a file does not make it disappear forever. In most cases, hitting the Delete button erases the file from the directory, but the underlying data remain on a disk until the computer writes over it. Watkins was able to resurrect some files that had been deleted from the Zip disks, he said. Another routine check he said he performed on Westerfield's computers was to see if any files were disguised with "bad signatures." That is when a file extension, such as .doc or .mp3 or .jpg, is changed to hide the true nature of the file. For instance, a .jpg file, which denotes an image, could be changed to .mp3 to make it appear to be a music file. Watkins testified that he found no such attempts to disguise files in Westerfield's computers. While the fact that a file was found on a specific computer or disk may be indisputable, who actually created it or viewed it is often not as concrete. Westerfield's attorney raised questions about who downloaded or created the files on his client's computers. In court, he suggested that perhaps Westerfield's grown son or a house guest may have done it. "You don't know who downloaded those photos onto the Zip drives or CD-ROMs, do you?" Watkins was asked. "No, sir, I don't," he replied.
|
At 2:00 a.m., when closing time was announced, the three women got in Brenda’s truck (allegedly taking hits from the same joint they had smoked earlier) and the two men drove in another vehicle to the Van Dam home. Damon, who was allegedly asleep in his underwear in his own bed, was awakened by Barbara, who climbed on top of the bed. Damon admits to “kissing” Barbara, and “rubbing her back”. Brenda Van Dam came upstairs about 15 minutes later, and informed the couple that they were being “rude” and that they should join the rest of the ensemble downstairs. Yet, after pizza, the remaining guests allegedly left. The Van Dam’s assert that they went to bed at approximately 2:30 a.m.
Exited bar at 2am
Smoked a joint
Drove Home
Friend cozies up to hubby, Brenda goes up about 15 minutes later.
Hubby and girly come downstairs.
They all EAT PIZZA.
Brenda and Damon in bed by 2:30. RIGHT! On what planet !
An earlier article mentioned that Damon was home all evening, spending time with a female neighbor.
Or at least had a female friend there from around 10:30pm until ?Then later, after 2am, Brenda comes home with another girlfriend.
What happened to the first girlfriend ??????
These days, it takes courage to write an article like this. I'm sure NRO has been inundated with angry "how dare you" mail because of this column, just as, on Free Republic, others who have posted similar thoughts have faced flames for their efforts.
Perhaps at the trial, we'll know more, but so far, if they've examined the VD computers, there's been no mention of it.
I think the VDs realized the folly of that particular time line, which might explain why in subsequent interviews, it seems to have "morphed" considerably. The VD timelines require a certain amount of agility, as you jump from one to another. They've been changed many times, and none of us know for sure which one, if any, might be the right one.
No one really knows. Damon is sure a busy guy, isn't he?
Thanks for the ping.
I think the van Dams are despicable parents and may well have contributed to making the abduction possible. However, Westerfield is the guy with the penchant for child porn.
The defense is trying to obfuscate by questioning who else may have had access to the computers. The files according to the prosecution were extensive and very well organized. Unless there was another party who had unlimited, private access to Westerfield's computers, Westerfield is the person who loaded those files.
Until some other compelling evidence is presented, I have to believe that Westerfield is the murderer of that poor little girl.
I totally agree that this is a very perplexing case. However, current evidence points at Westerfield. Westerfield has a great defence team and if there is any exculpatory evidence they will find it.
Damon and 1st girlfriend are at the Damon's home in early evening. They get closer, and then around 10:30pm Damon puts Danielle to bed.
Damon and 1st Girlfriend head to the bedroom. They are in the midst of sexplay and (Daddy, I couldn't get to sleep) daughter walks in on them.
Daddy screams (maybe he was embarrassed) at Danielle, saying things he shouldn't have (I hate you , get out, you don't belong in here, go away, etc.) Who knows.
Danielle goes to her room and writes in her diary a note to Daddy begging him to love her.
At this point, I really have to stretch. Maybe girlfriend 1 came out of the bedroom, pissed, slammed open the door, and Danielle happened to just be in front of it (do their bedroom doors open out ?) or maybe in her rush out she ran into Danielle, knocking her down the stairs.
Danielle hits her head, causing a broken neck or severe concussion.
Damon and 1st girlfriend have to figure out what to do. They could have stashed the body in D.Westerfields Motorhome, in a panic.
Or maybe they just drove to the desert and dropped the body off, then drove back. (they had the time). Then they set off the alarm and leave doors open so it looks like a stranger broke in.
1st girl goes home, Damon jumps in bed in plenty of time before Brenda comes home.
When 2nd girl that was with Brenda comes up to his room, and snuggles up, he plays it cool, but is not aroused and doesn't 'jump to it'.
Fortunately, Brenda comes up and breaks it up.
Mom (Brenda) doesn't know what happened. Damon tries to control Brenda during interviews, Brenda thinks it is all because of swinging lifestyle and drugs, not knowing she is being controlled for an entirely different reason.
Daniel Westerfield is the unfortunate scapegoat that Damon told Brenda to mention to the police.
It may be that Damon had reasons to hate DW. Maybe Damon is a real weinie and Dan Westerfield didn't like him around. Maybe Damon called the neighborhood assoc. on DW for working on cars in his driveway. It doesn't take much when someone needs a scapegoat very badly.
As far as there DvD not being "in the mood" for Babs, I had read that there was traces of cocaine found in the home.
Usually that makes you want sex, but unable to keep an erection cause all the blood is pumped to your head, not your 'lap'.
Here is another possibility, maybe you were even suggesting this.
Damon and 1st girlfriend are going at it in bedroom or in the garage ? Danielle sees this and gets yelled at. She finds the stash of cocaine and eats it or maybe she saw them snort it, so she imitates them. Causes OD to the tiny body of Danielle.
What if one/some of the cops are part of the 'swingers' and supplied the cocaine. Might explain why they summarily dismissed the pizza party four, and the parents so quickly.
Well, the arrainment will be this Thursday, so we have to wait and see what shakes out. Do you see a quick trial or one about a year or so down the road? My original opinion was that it would be after the election, if the evidence isn't terribly strong, but that would depend on the Defense. Don't see that happening.
Disclaimer: Opinions posted on Free Republic are those of the individual posters and do not necessarily represent the opinion of Free Republic or its management. All materials posted herein are protected by copyright law and the exemption for fair use of copyrighted works.