Marcus Lawson, the expert, had testified this morning that some of the pornography could have been accessed by the defendant's son via a Hotmail e-mail account.
But under cross-examination this afternoon, prosecutor George "Woody" Clarke hammered away at Lawson's conclusion that somone other than Westerfield was responsible for some of the pornography. Lawson even acknowledged other investigations in which computer users had created and used a variety of different e-mail accounts.
In addition, Clarke elicited testimony that showed someone used a similar e-mail moniker and the last four digits of the defendant's Social Security number to create an account on the free data storage Web site Free Drive.
Further, the expert admitted that he never possessed the original files under investigation in the case, examining instead the versions on data storage drives created by the defense in San Diego. Lawson said that he made it a practice never to possess the material in his office.
"I don't want to get anyone in my office in trouble for a technical violation of federal law," he said.
Under Clarke's questioning, it was revealed that someone used an account name of "DNWest1" to join Free Drive, and used a password 5203, which testimony revealed are the last four digits in Westerfield's Social Security number.
Clarke's cross-examination also revealed:
Earlier, Lawson had testified that some pornographic web sites had been accessed during a period of time during the afternoon of Monday, Feb. 4, when Westerfield was being questioned by an interrogation specialist. Clarke, however, produced a list of web sites copied from the office computer during a time frame that ranged from 3:50 p.m. to 8:29 p.m.
While numerous web sites were accessed during that time frame, according to Clarke's document -- including SignOnSanDiego.com, the web site for The San Diego Union-Tribune -- none of the sites were pornographic.
"I didn't create the document, so I don't know," Lawson said. But he never disputed its validity.
Cherokee Youngs described the trio as "partying and having a good time" that night at Dad's in Poway.
"When I first saw her she tried to grab my hands and dance with me," Youngs said of Easton. Later in the evening, she was approached by Brenda van Dam, Youngs said.
"Brenda approached me along with Barbara when I was with my friend, Ryan." Youngs said. "She asked Barbara who these two people were and Barbara didn't know our names. We were just kind of walking away and she said, 'Are you together?' I said 'Yes' and Brenda made a comment that 'I'd like to take these two people home. I wouldn't mind taking them home.' "
Brenda repeated the request at least once, she testified, and Youngs says she declined. Youngs testified she made quick friends with her male companion, Ryan, though she had just met him that night because of the repeated propositions. "I said you are now my official boyfriend for the evening to try and keep her from being attracted to me, I guess."
Under cross-examination from prosecutor Jeff Dusek, Youngs testified she had been drinking -- at least two cocktails at Dad's and half a bottle of wine at dinner -- though she was the designated driver for the evening.
She never saw the defendant, David Westerfield, at Dad's, Youngs testified. She also admitted following some of the trial coverage on television.
A detailed analysis of the files on Westerfield's computers showed that someone accessed images on explicit sex Web sites such as "Teen Dreamer" and "Lesbian Bordello" at about the same time someone was retrieving e-mail from David Neil Westerfield's Hotmail account.
Marcus Lawson, the private computer forensics expert hired by Westerfield's defense attorney, showed the jury print-outs of what he saw using the EnCase analysis program.
"A considerable number of these screen prints involve bondage scenarios with women in ropes or like that," Lawson said at one point.
In a cross-examination interrupted by the noon lunch break, prosecutor Woody Clarke questioned the thoroughness of Lawson's analysis and suggested David Westerfield could have given one of his computers to his son as a hand-me-down.
Westerfield is accused of sneaking into the van Dams' Sabre Springs house on Feb. 2 and abducting 7-year-old Danielle, then killing her and dumping her body off rural Dehesa Road near El Cajon.
Today was the 16th day of testimony in the case and the 18th overall day of court activity since the trial began on June 4.
A police expert testified last week that about 85 of an estimated 8,000 to 10,000 sexually explicit images found on computers and storage disks in Westerfield's possession appeared to depict underage girls.
Westerfield also is charged with possession of child pornography and prosecutors have suggested that his possession of "questionable" images of bondage and rape show his motivation for kidnapping Danielle.
Lawson said he used a computer forensics program called EnCase to sift through deleted files, temporary Internet files and other data. San Diego police had not used EnCase in their analysis.
The computer files showed that David Neil Westerfield, known as Neil Westerfield, had used a Hotmail account with the address of DNWest@hotmail.com as his return address in correspondence, Lawson said.
Neil Westerfield's age has not been disclosed at the trial.
So when someone was logging on to Hotmail.com to check or send e-mail through that account, it was most likely Neil Westerfield, Lawson said. And that suggests it was probably Neil Westerfield using the computer when Web sites were accessed at or near the time his e-mail account was accessed.
There were no signs that the computer's clock had been reset or changed to alter the reported times that files had been created or altered, Lawson said.
Neil Westerfield's e-mail account and some of the sexually explicit Web sites were accessed on one of the computers around 4:50 p.m. on Feb. 4 – two days after Danielle's disappearance – while David Westerfield was being interviewed by police interrogation specialist Paul Redden.
Neil Westerfield's e-mail also was checked around the time the computers were used to access Web sites offering "fresh teens," images of bestiality, "extreme Asian bondage," schoolgirls and similar material, Lawson said.
The images on three ZIP disks and two CD-ROMs found stashed behind some books in Westerfield's office appeared to have come from Neil Westerfield's computer because they shared the same last access date, Lawson said.
But under cross-examination by Clarke, Lawson said he couldn't be sure whether or when the files on the ZIP disks and CD-ROMs were downloaded from the Internet.
Lawson said he also had not noticed that file names for many of the porn images began with the letters IEA – just like many of David Westerfield's business files.
Clarke suggested that Westerfield could have been the original user of Neil Westerfield's computer, giving his son an older, slower computer after buying a new one for himself.
"Or the other way around," Lawson replied.
He was not allowed to access the original files at the place stored, has never been able to.
He will not take those original files to his office without a court order so he or anyone in his office can ever be charged w/violating Federal laws.
He told the prosecution that the CD's/zips needed to be downloaded on the harddrive w/the forensic software or times, dates and info could be altered....they did not......item #142 was the report from the witness...states is #158.....the states had incomplete info with which they tried to discredit the witness.
Witness testified that in his experience with computer child pornography, the vast majority of Teen websites are woman over 18 pretending to be teens.
Brief rundown of todays testimony....transcripts should be out in couple of days to crosscheck and verify.