Casey Anthony Deposition Sandra Cawn 0413

8/6/2019 Casey Anthony Deposition Sandra Cawn 0413

1/18


2/18

2

A. I don't think so. Everything I found was on the

1 with the laptop? You ran the Caylee and Zenaida.A. I ran Caylee and Zenaida. I believe I found some

3 e-mails later on regarding some photographs. I'm sorry,4 you're asking some pretty general questions and I did a5 whole lot of work in this case.6 Q. That's okay.7 A. From my recollection of that laptoPr I believe itB was initially, other than doing the timeline search and9 to look and see if there were matches with certain

10 things we found on the HP desktop, to look and see if we11 also found the same matches on the laptop computer just12 to compare and see trying to figure out who --13 Q. Was there anything that you found that was14 significant?15 A. Some of the pictures were the same. Other than16 that there was really not a whole lot that was the same.17 Q. Okay. Did you ever run any searches for18 chloroform on the laptop computer?19 A. I believe I did.20 Q. Did you find any?21

22 HP.

23 Q. Okay. So as it pertains to the laptop the only24 thing that you think was uncovered as it relates to this25 investigation are the searches -- the negative searches

Sc la fa n i W i lliams Cou rt R e po rte rs , In c.1-800-272-0404

23


3/18

19 I believe they all were.

241 for Zenaida Gonzales or Zanny --2 A. Yes.3 Q. -- and those relating to the babysitter.4 A. Yes.5 Q. Okay. Anything else that I may have missed?6 A. (Witness shakes head.)7 Q. You're shaking your head no.8 A. No.

9 Q. Okay. We'll move on to the desktop. Actually on10 the laptop, how do you check the time to see if it's11 correct?12 A. You pull the hard drive out and boot it up and13 hit certain function keys and it will bring up the14 system, the BIOS, and it will tell you the system clock.15 Q. SO did you do that with the laptop?16 A. Yes.17 Q. Okay. So the laptop was completely In line with18 the correct time.

I believe so..20 Q. Both computers?21 A. I think so.22 Q. Okay. Did you put that anywhere in your report?23 A. Yes, normally I do.24 Q. I wasn't sure I saw that.25 A. You know what, I did notice that that wasn't on

S cla fa ni W i lliam s Co u rt R e po rte rs , In c.1-800-272-0404


4/18

10

I

1 A. Yes.2 Q. Okay. What else?3 A. Like I said, that's a fishing expedition. When4 the detective brings you a huge amount of information5 and says search it for whatever you can find related to6 a missing Caylee, where do you begin?7 You start looking for blogs. You start looking for8 e-mails. You start looking for photos to kind of get a9 sense of you know you're going to find pictures.

You know you're probably going to find Cindy was11 obviously doting over Caylee and you're just going to12 look for family photos, you're going to look for13 anything and everything you can find regarding Caylee.14 Q. Okay.15 A. So you try to look for e-mails, blogs, pictures,16 dates, times, when did you last see her, when did you17 last communicate to her or about her to anyone. You let18 it take you where it takes you.19 Q. You mentioned Cindy was obviously doting over20 Caylee. What do you mean by that?21 She was obviously concerned about the welfare..22 was told by the time we got the HP computer that there23 were -- there was a lot of activity, a lot of buzz going24 on about this case.25 So it was very apparent that everyone was concerned

Sc la fa n i W i lliams Cou rt R e por te rs , In c .1-800-272-0404

27


5/18

1 with where she is and that Cindy was active daily in the2 care of Caylee. So I guess that was an assumption on my3 part that she was a doting grandmother. It appeared to4 me from everything I had seen that there probably would5 have been a lot of pictures.6 I had already examined Casey's laptop, so the7 information I gleaned from that laptop led me into8 assuming what I would find on the desktop.9 Q. Okay. What led you to believe that Casey was the

10 owner of the laptop and not anyone else?11 A. I was told by Detective Beasley and then when I12 got the search warrant from Yuri Melich that that one13 was seized from Casey.14 Q. Okay. You know that the laptop was Casey's.by15 what Detective Melich told you. There was.nothing that16 you found on the computer that made you believe it was17 specifically and only Casey's computer.18 A. I'd have to look and see if there was a user19 profile for Casey on the laptop. I don't remember.20 Q. Okay. So your initial searching of the desktop21 was for Caylee. You were given a broad I guess22 assignment. Is that correct?23 A. Yes.24 Q. Okay. And how did you begin to start looking at25 e-rnails and things like that? Did you look at things


28


6/18

1 that were deleted, current e-mails or both?2 A. Both. The EnCase software that we use shows3 both.4 Q. Okay. And how long did you search that -- how5 long did you work on that specifically?6 A. On the desktop?7 Q. Yes.8 A. Months. Probably four or five months.9 Q. Okay.

10 A. Not full time, but I basically left that case11 open and running just because when the detectives come12 in and say hey we just heard or whatever, did you find13 anything like that. Okay, let me check and see.14 Q. Did you ever find things and consult with15 detectives as you're finding them prior to issuing your16 report?17 A. Yes.18 Q. How often did you meet with detectives?19 A. Informally?20 Q. Yes.21 A. Every day.22 Q. Okay. For months.23 A. Yes.24 Q. Okay. And what would you say are the most25 significant findings that you found on the desktop?

Sc la fa n i W i lliams Cou rt R e po rte rs , In c.1-800-272-0404

29


7/18

130

A. I don't know what the detectives would have found2 significant or not. That's not for me to say.3 Q. Okay. Everything that you included in your4 report, obviously, you needed to -- after months of5 searching you had to summarize what you did and what you6 found on your report. Is that correct?7 A. Correct.8 Q. Is what you put in your report what you and the9 detectives found significant?

10 A. Yes.11 Q. And that was based on the meetings that you had12 with them?13 A. Yes.14 Q. Okay.15 A. Significant or at least interesting.16 Q. Okay. Let's go over a couple of them. The My17 Space entrie s, I think they've been -- we have two of18 them. I guess there are two communications, one which19 is allegedly from Cindy Anthony. Is that correct?20 A. I'm not alleging that they came from anyone. All21 I know is this My Space page has the Cindy name on the22 user icon and it's entitled My Caylee Is Missing.23 Q. And was that done on the desktop?24 A. Yes.25 Q. Okay. And the, I guess, response to this

S cla fa ni W illiam s Co urt R e po rte rs , In c.1-800-272-0404


8/18

23

Q. I'd like to confirm that if we can.

1 specific posting, what computer was that done on?2 A. I don't understand the question. I found -- I3 believe this page was brought to me on the same day that4 this initial case started on the 16th of July, 2008.5 This was brought to me by someone, one of the Missing6 Persons ladies I believe. This was brought to me at the7 time.8 So I knew that this possibly could be in there9 somewhere. So, obviously, I was searching for My Space

10 entries and blogs.11 Q. And I guess the response to this conversation12 A. I believe I found this on the HP desktop.13 Q. Okay. Are you certain?14 A. Yes.15 Q. Okay. What about the response to this posting,16 the one that's labeled Diary of Days?17 A. I didn't know that was a response. I found a18 document.Diary of Days, but I didn't realize it was a19 response to this.20 Q. Okay. And that document that you found that is a21 My Space posting labeled Diary of Days, what computer22 was that done on?

A. It's in my report that Mr. Mason is looking at.24 I believe it was also the desktop.25

S cla fa ni W i lliam s Co urt R e po rte rs , In c.1-800-272-0404

31


9/18

1

It looks like it was created July

A. Okay. I tried to make some quick notes. Let's2 see. Page 12 of my initial report indicates the Diary3 of Days was found on the Compaq laptop.4 Q. Okay. And do you know when that was posted or5 worked on?6 A. Which one? Posted or worked on?7 Q. The Diary of Days.B A. Posted or worked on?9 Q. Posted on -- when the file was created I should10 say.11 A. The file created date on this computer says July12 2nd. When it was actually posted to wherever it was13 posted I'm not sure.14 2nd of 2008.15 Q. Okay. What other files did you find that you16 included in your report that you found were significant17 enough to put in your report I should say?18 A. On either the desktop or the laptop?19 Q. Yes.20 A. On the Compaq laptop there was the photo of21 Caylee sitting on her great grandfather's lap at the22 nursing home. That was one of the first things I found23 on the laptop.24 Q. That was on the laptop?25 A. That was on the laptop.

Scla fa ni W illiams Cou rt R ep orte rs , In c.1-800-272-0404

32


10/18

2

A.

1 Q. And not on the desktop at all?A. I may have found that on the desktop also. I

3 believe I found that one just about everywhere. That's4 where I found it first though.5 Q. Okay.6 A. Lots of pictures on the Compaq laptop. Videos.7 Q. When you say pictures, what kind of --8 A. Pictures of Caylee. Found other pictures of9 interest. Found the blog from My Caylee Is Missing on

10 the desktop.11 Q. Okay.12 A. Image files of interest that were created, not13 only were they of interest because of the content of the14 pictures, but the file created date that they were put15 on these computers. That's the reason mostly that those16 were of interest, just that they were around the same17 time frame.18 Q. Okay. Let me stop you there. You have a photo19 of an anti-death penalty cartoon I guess. Is that20 correct?21 I don't know what kind of cartoon it is. It's22 just a cartoon with two figures in it.23 Q. What date was that created?24 A. July 8, 2008.25 Q. Okay. And on what computer?

S cla fa ni W illiam s C ou rt R ep orte rs , In c.1-800-272-0404

33


11/18

8

I can't

341 A. The laptop.2 Q. Okay. And you found that significant why?3 A. Mainly because of the content. Obviously, what4 the picture depicted and the date and time it was5 created on the laptop.6 Q. Okay. What about the picture makes it so7 interesting other than being a political message?

A. I don't know that it's a political message. It9 does not appear to me to be a political message.

10 Q. What does it say?11 A. The caricature of the picture says why do people12 kill people who kill people to show people that to kill13 people is bad. Then it's signed by someone.14 make out what the letters are. Lora maybe, L-o-r-a.15 And it depicts a young child approximately two years16 old looking up at stuffed doll with a noose around its17 neck.18 Q. Where was that picture downloaded from?19 A. No clue.20 Q. It was just on the hard drive.21 A. Just on the hard drive.22 Q. How do you know whether it was downloaded on the23 8th as opposed to just accessed on that date?24 A. The file was created on this computer -- it was25 saved to the computer on July 8th of 2008. Not only was



12/18

1 it placed on the computer from whatever source it came2 from, but it was saved In a folder on the desktop. So3 it wasn't just in arbitrary space, say some Internet4 page that you were looking at and didn't do anything5 with. It was actually saved to a folder and given a6 name.7 Q. And is there any way for you to determine where8 that photograph came from?9 A. No.

10 Q. No?11 A. No.12 Q. You couldn't have researched the Internet13 activity on July 8th to determine if that was from a14 anti-death penalty website?15 A. I could have, but that's not my job. I was asked16 to find anything of significance that might be related17 to Caylee.18 In my opinion, this is a graphic caricature picture19 of something that may be related to Caylee on Casey20 Anthony's reported laptop during the date and time of21 interest when she was missing and we were looking for22 her. ,Imerely found it interesting. That's all.23 MR. MASON: Just a minute ago you said the24 desktop.25 THE WITNESS: I'm sorry. The laptop.


35


13/18

23 A. I do not know.

571 much on what I initially did and what my report2 specifically says.3 Q. Was there anything -- did you do any searches for4 anything illegal on the computer like child pornography5 or anything like that?6 A. No.

7 Q. What about pornography? Did you run any searches8 for that?9 A. No.

10 Q. What about -- there's been I guess something11 released in reference to neck breaking. Were you the12 one that found that out?13 A.. Yes.14 Q. Okay. And what was the context of that search?15 A. There were Google Internet searches -- and you're16 going to ask me what computer -- the desktop, the tower17 at home.18 There was deleted Internet history that was found19 that made reference to Google searches specifically for20 the words neck breaking.21 Q. And what were the pages visited in relation to22 neck breaking?

24 Q. Okay. Did you visit them to see what they were25 about?

S cla fa ni W illiam s Co urt R e po rte rs , In c.1-800-272-0404


14/18

8

Q. So you didn't have any dealings with the Internet

1 A. No. We typically don't go onto the Internet to2 search because Internet pages change all the time and3 they're really not relevant to what we found on the4 computer. The Internet changes every day and the page5 could change and I don't have a reference to -- if I6 find something today and I go back to it tomorrow, it's7 not going to be the same.

Q. Is it possible to reconstruct Internet pages that9 were visited?10 A. l'1ostlikely.11 Q. Okay. Was that done in this case as it relates12 to the neck breaking search?13 A. The deleted Internet history search that was done14 was conducted by Sergeant Stenger with a very specific15 tool called Cash Back of which he has much more16 knowledge than I.17 I believe Mr. Bradley was involved with that, the18 creator of Cash Back. That would be Sergeant Stenger's19 area of expertise.2021 history.22 A. Other than extracting it and specifically looking23 for the keywords that Detective Melich asked us about, I24 didn't.25 Q. Okay. What about chloroform? Were you the


58


15/18

5

A. Unless you reconstruct the page, which I've

1 person that discovered the chloroform searches?2 A. Yes.3 Q. And when you searched for chloroform you found4 searches on how many days?

A. I don't remember. Again, I didn't really do that6 analysis. Sergeant Stenger did that.7 Q. Okay. So you just found it, turned it over to8 him and he analyzed it.9 I was asked to search for them. I was. Yes.10 asked to find out if there were any references and11 that's what I report. Yes, I did.12 Q. Is there a way of determining when a person is13 actively on the computer versus or are there times that14 the computer is kind of -- let me rephrase that15 question. I'm sorry.16 When you're looking at someone's history, Internet17 history specifically, how do you account for pop ups?18 How do they reflect when you do a printout for an19 Internet history?20

21 actually not done, the Cash Back program is the one that22 I know of that actually reconstructs web pages, which23 other than in a class I've never done.24 So I don't know that pop ups would even reappear on a25 reconstructed web page. That would be again a better


59


16/18

2

So there were times that law enforcement

601 question for Sergeant Stenger.

Q. Is all of the work that you did in this case3 reflected in your report other than the informal4 meetings with law enforcement?5 A. Thank you. Yes.6 Q. So is there anything you did other than the7 informal meetings with law enforcement that are not8 reflected in your report?9 A. There's nothing of interest or significance that

10 I did related to these cases that is not related in my11 report.12 Q. And when you say of interest or significance, are13 you relating to searches that may have been run and came14 back with negative results?15 A. Correct. Those would have been reported as16 didn't find it, would you like a report and it was17 either a yes or no.18 Okay..19 asked you to run searches for keywords and negative20 results were found and you asked did you want it on a21 report and they said no?22 A. Sometimes.23 Q. What were some of those words?24 A. I don't know.25 Q. Do you recollect any of them?

S cla fa ni W illiam s Co urt R ep orte rs , In c.1 -8 00 - 2 7 2 -0 40 4


17/18

7 Q. Did you include in your report all of the keyword

611 A. Usually those weren't keywords. Those were did2 you find reference to this person or that name or3 something to that effect. And if it was a quick no I4 didn't find it and it was just a matter of passing5 glance by the detective, they would say no report. But6 I can't recall what they might have been.

8 searches that you ran in EnCase software?9 A. Probably not.

10 Q. And you don't recall the others?11 A. No.

12 Q. Do you have any notes that may include some of13 these searches that you were given?14 A. No.

15 Q. Okay. Did you communicate Vla e-mail at times16 with the detectives in this case in reference to17 possible keyword searches?18 A. I don't remember.19 Q. Okay. Do you have e-mail communications between20 yourself and any of the detectives in the case?21 A. Yes.22 Q. And what are those e-mails in reference to?23 A. Specific to this case?24 Q. Yes.25 A. You just asked me that and I donlt remember.

Sc la fa n i W i lliams Cou rt R e po rte rs , In c .1-800-272-0404


18/18

12

NOTE: The original and one copy of the

621 Q. Okay.2 A. They were right there on the same floor with me,3 so anytime they needed anything they would usually just4 pop in. I could say yes. I guess Detective Melich5 moved to a different division in the middle of this6 case. I would say yes probably with him.7 Q. What was the -- have you been asked to do8 anything since you've written your report?9 A. No, because if it was anything that needed to be

10 reported it would have been and you would have gotten11 it.

Q. Okay. I kind of got two answers there and I just13 want to make sure we're clear. I'm asking you14 specifically if you were given any assignments to do on15 this case after you wrote your report.16 A. No.17 MR. BAEZ: All right. I have no further18 questions.19 MS. DRANE-BURDICK: Read or waive?20 THE WITNESS: I'd like to read this one.21 THEREUPON, the deposition of SANDRA CAWN was22 concluded at 10:32 a.m.23

24 foregoing deposition will be held by Mr. Baez;25 copy to Ms. Drane-Burdick.

Sc la fan i Wi lli ams C ourt R eporters, In c.

Date post:	07-Apr-2018
Category:	Documents
Upload:	myra-mains
View:	223 times
Download:	0 times

Casey Anthony Deposition Sandra Cawn 0413

Documents