Orange County Sheriffs Office

08-074777/Orange County Sheriffs Office\Seizure and Processing Notes Page 1

Orange County Sheriffs Office

Forensic Examiner Kevin Stenger Sergeant Orange County Sheriffs Office Criminal Investigations Division Computer Crimes Squad 2500 West Colonial Drive Orlando Florida 32804
Seizure and Processing Notes

Seizure and Processing Notes Seizure Notes On 11/23/09 Sgt. John Allen with the Orange County Sheriffs Office turned over a Nikon Coolpix 5600 digital camera, serial number 31702281 to the Computer Crimes Squad for examination. Sgt. Allen requested that the camera be examined for any images relating to the case which may be in the camera. On 11/23/09 Cpl. Yuri Melich with the Orange County Sheriffs Office turned over a Toshiba laptop, serial number 29522032Q, to the Computer Crimes Squad for examination. Cpl. Melich requested that the computer be examined for images, videos and any other information relating to the case. Sgt. Allen provided a CD with images that had been scanned from prints. Allen stated that the images were provided by Mrs. Wray. Processing Notes The Nikon Coolpix camera was examined. No batteries or flash media was in the camera. malfunctioning and would not close completely. had reset to 1/1/05 at 00:00 hours. The battery cover was The date and time on the camera Sgt.

The camera was attached to a computer with a registry write blocker on and imaged with FTK imager. The Toshiba laptop was imaged and contained the following. 1 Hard drive

Orange County Sheriffs Office

08-074777/Orange County Sheriffs Office\Seizure and Processing Notes Page 2

The hard drive is a 320GB Toshiba, model number MK3252GSX, serial number Z835CMIVT. The date and time on the BIOS is as follows. Actual Computer Date 11/24/09 11/24/09 Time 08:33:00 07:32:59

The date and time may be off by one hour due to the change in Daylight time occurring in November.

Summary No images of apparent evidentiary value were located on the internal memory of the Nikon camera. Eight images were located that appeared to match those on the CD provided by Sgt. Allen. Two movies files appear to be of the area around the memorial for Caylee Anthony. The images and video were copied to the Evidence folder.

Graphics from Desktop Folder

Name DSCN1800.JPG Description File, Archive File Created 04/18/09 11:24:14 Last Accessed 04/18/09 11:24:14 Last Written 12/31/04 22:00:00 Entry Modified 04/18/09 11:24:15 Full Path 08-074777 Wray\Z835CMIVT\D\Users\owner\Desktop\04192009\DSCN1800.JPG ImageDescription: Make: NIKON Model: E5600 Orientation: 1 XResolution: 300/1 = 300 (IFD 0) YResolution: 300/1 = 300 (IFD 0) ResolutionUnit: 2 Software: E5600v1.0 DateTime: 0000:00:00 00:00:00 YCbCrPositioning: 2 ExifOffset: 284 Compression: 6 XResolution: 300/1 = 300 (IFD 1) YResolution: 300/1 = 300 (IFD 1) ResolutionUnit: 2

Orange County Sheriffs Office

08-074777/Orange County Sheriffs Office\Seizure and Processing Notes JpegIFOffset: 4596 JpegIFByteCount: 6552 ExposureTime: 10/4139 = 0.002416042522348394 FNumber: 49/10 = 4.9000000000000004 ExposureProgram: 2 ISOSpeedRating: 50 ExifVersion: 0220 DateTimeOriginal: 0000:00:00 00:00:00 DateTimeDigitized: 0000:00:00 00:00:00 ComponentsConfiguration: 01 02 03 00 CompressedBitsPerPixel: 2/1 = 2 ExposureBias: 0/10 = 0 MaxAperture: 30/10 = 3 MeteringMode: 5 LightSource: 0 Flash: 24 FocalLength: 57/10 = 5.7000000000000002 MakerNote: undefined UserComment: undefined FlashPixVersion: 0100 ColorSpace: 1 ExifImageWidth: 2592 ExifImageHeight: 1944 ExifInterOffset: 1026 FileSource: 03 SceneType: undefined CustomRendered: 0 ExposureMode: 0 WhiteBalance: 0 DigitalZoomRatio: 0/100 = 0 FocalLenIn35mmFilm: 34 SceneCaptureType: 0 GainControl: 0 Contrast: 0 Saturation: 0 Sharpness: 0 SubjectDistanceRange: 0 Page 3

Orange County Sheriffs Office

08-074777/Orange County Sheriffs Office\Seizure and Processing Notes Page 4 Name DSCN1803.JPG Description File, Archive File Created 04/18/09 11:24:15 Last Accessed 04/18/09 11:24:15 Last Written 12/31/04 22:00:00 Entry Modified 05/18/09 17:24:46 Full Path 08-074777 Wray\Z835CMIVT\D\Users\owner\Desktop\04192009\DSCN1803.JPG ImageDescription: Make: NIKON Model: E5600 Orientation: 1 XResolution: 300/1 = 300 (IFD 0) YResolution: 300/1 = 300 (IFD 0) ResolutionUnit: 2 Software: E5600v1.0 DateTime: 0000:00:00 00:00:00 YCbCrPositioning: 2 ExifOffset: 284 Compression: 6 XResolution: 300/1 = 300 (IFD 1) YResolution: 300/1 = 300 (IFD 1) ResolutionUnit: 2 JpegIFOffset: 4596 JpegIFByteCount: 7393 ExposureTime: 10/3148 = 0.003176620076238882 FNumber: 49/10 = 4.9000000000000004 ExposureProgram: 2 ISOSpeedRating: 50 ExifVersion: 0220 DateTimeOriginal: 0000:00:00 00:00:00 DateTimeDigitized: 0000:00:00 00:00:00 ComponentsConfiguration: 01 02 03 00 CompressedBitsPerPixel: 2/1 = 2 ExposureBias: 0/10 = 0 MaxAperture: 30/10 = 3 MeteringMode: 5 LightSource: 0 Flash: 24 FocalLength: 57/10 = 5.7000000000000002 MakerNote: undefined UserComment: undefined FlashPixVersion: 0100 ColorSpace: 1 ExifImageWidth: 2592 ExifImageHeight: 1944 ExifInterOffset: 1026 FileSource: 03 SceneType: undefined CustomRendered: 0 ExposureMode: 0 WhiteBalance: 0 DigitalZoomRatio: 0/100 = 0 FocalLenIn35mmFilm: 34 SceneCaptureType: 0 GainControl: 0 Contrast: 0

Orange County Sheriffs Office

08-074777/Orange County Sheriffs Office\Seizure and Processing Notes Saturation: 0 Sharpness: 0 SubjectDistanceRange: 0 Page 5

Name DSCN1804.JPG Description File, Archive File Created 04/18/09 11:24:15 Last Accessed 04/18/09 11:24:15 Last Written 12/31/04 22:00:00 Entry Modified 04/18/09 11:24:15 Full Path 08-074777 Wray\Z835CMIVT\D\Users\owner\Desktop\04192009\DSCN1804.JPG ImageDescription: Make: NIKON Model: E5600 Orientation: 1 XResolution: 300/1 = 300 (IFD 0) YResolution: 300/1 = 300 (IFD 0) ResolutionUnit: 2 Software: E5600v1.0 DateTime: 0000:00:00 00:00:00 YCbCrPositioning: 2 ExifOffset: 284 Compression: 6 XResolution: 300/1 = 300 (IFD 1) YResolution: 300/1 = 300 (IFD 1) ResolutionUnit: 2 JpegIFOffset: 4596 JpegIFByteCount: 7945 ExposureTime: 10/763 = 0.01310615989515072 FNumber: 49/10 = 4.9000000000000004 ExposureProgram: 2 ISOSpeedRating: 50 ExifVersion: 0220 DateTimeOriginal: 0000:00:00 00:00:00 DateTimeDigitized: 0000:00:00 00:00:00 ComponentsConfiguration: 01 02 03 00

Orange County Sheriffs Office

08-074777/Orange County Sheriffs Office\Seizure and Processing Notes CompressedBitsPerPixel: 2/1 = 2 ExposureBias: 0/10 = 0 MaxAperture: 30/10 = 3 MeteringMode: 5 LightSource: 0 Flash: 24 FocalLength: 57/10 = 5.7000000000000002 MakerNote: undefined UserComment: undefined FlashPixVersion: 0100 ColorSpace: 1 ExifImageWidth: 2592 ExifImageHeight: 1944 ExifInterOffset: 1026 FileSource: 03 SceneType: undefined CustomRendered: 0 ExposureMode: 0 WhiteBalance: 0 DigitalZoomRatio: 0/100 = 0 FocalLenIn35mmFilm: 34 SceneCaptureType: 0 GainControl: 0 Contrast: 0 Saturation: 0 Sharpness: 0 SubjectDistanceRange: 0 Page 6

Orange County Sheriffs Office

08-074777/Orange County Sheriffs Office\Seizure and Processing Notes Page 7 Name DSCN1805.JPG Description File, Archive File Created 04/18/09 11:24:15 Last Accessed 04/18/09 11:24:15 Last Written 12/31/04 22:00:00 Entry Modified 04/18/09 11:24:16 Full Path 08-074777 Wray\Z835CMIVT\D\Users\owner\Desktop\04192009\DSCN1805.JPG ImageDescription: Make: NIKON Model: E5600 Orientation: 1 XResolution: 300/1 = 300 (IFD 0) YResolution: 300/1 = 300 (IFD 0) ResolutionUnit: 2 Software: E5600v1.0 DateTime: 0000:00:00 00:00:00 YCbCrPositioning: 2 ExifOffset: 284 Compression: 6 XResolution: 300/1 = 300 (IFD 1) YResolution: 300/1 = 300 (IFD 1) ResolutionUnit: 2 JpegIFOffset: 4596 JpegIFByteCount: 7618 ExposureTime: 10/300 = 0.033333333333333333 FNumber: 29/10 = 2.8999999999999999 ExposureProgram: 2 ISOSpeedRating: 50 ExifVersion: 0220 DateTimeOriginal: 0000:00:00 00:00:00 DateTimeDigitized: 0000:00:00 00:00:00 ComponentsConfiguration: 01 02 03 00 CompressedBitsPerPixel: 2/1 = 2 ExposureBias: 0/10 = 0 MaxAperture: 30/10 = 3 MeteringMode: 5 LightSource: 0 Flash: 25 FocalLength: 57/10 = 5.7000000000000002 MakerNote: undefined UserComment: undefined FlashPixVersion: 0100 ColorSpace: 1 ExifImageWidth: 2592 ExifImageHeight: 1944 ExifInterOffset: 1026 FileSource: 03 SceneType: undefined CustomRendered: 0 ExposureMode: 0 WhiteBalance: 0 DigitalZoomRatio: 0/100 = 0 FocalLenIn35mmFilm: 34 SceneCaptureType: 0 GainControl: 0 Contrast: 0

Orange County Sheriffs Office

08-074777/Orange County Sheriffs Office\Seizure and Processing Notes Saturation: 0 Sharpness: 0 SubjectDistanceRange: 0 Page 8

Name DSCN1806.JPG Description File, Archive File Created 04/18/09 11:24:16 Last Accessed 04/18/09 11:24:16 Last Written 12/31/04 22:00:00 Entry Modified 04/18/09 11:24:16 Full Path 08-074777 Wray\Z835CMIVT\D\Users\owner\Desktop\04192009\DSCN1806.JPG ImageDescription: Make: NIKON Model: E5600 Orientation: 1 XResolution: 300/1 = 300 (IFD 0) YResolution: 300/1 = 300 (IFD 0) ResolutionUnit: 2 Software: E5600v1.0 DateTime: 0000:00:00 00:00:00 YCbCrPositioning: 2 ExifOffset: 284 Compression: 6 XResolution: 300/1 = 300 (IFD 1) YResolution: 300/1 = 300 (IFD 1) ResolutionUnit: 2 JpegIFOffset: 4596 JpegIFByteCount: 8090 ExposureTime: 10/1700 = 0.005882352941176471 FNumber: 49/10 = 4.9000000000000004 ExposureProgram: 2 ISOSpeedRating: 50 ExifVersion: 0220 DateTimeOriginal: 0000:00:00 00:00:00 DateTimeDigitized: 0000:00:00 00:00:00 ComponentsConfiguration: 01 02 03 00

Orange County Sheriffs Office

08-074777/Orange County Sheriffs Office\Seizure and Processing Notes CompressedBitsPerPixel: 2/1 = 2 ExposureBias: 0/10 = 0 MaxAperture: 30/10 = 3 MeteringMode: 5 LightSource: 0 Flash: 24 FocalLength: 57/10 = 5.7000000000000002 MakerNote: undefined UserComment: undefined FlashPixVersion: 0100 ColorSpace: 1 ExifImageWidth: 2592 ExifImageHeight: 1944 ExifInterOffset: 1026 FileSource: 03 SceneType: undefined CustomRendered: 0 ExposureMode: 0 WhiteBalance: 0 DigitalZoomRatio: 0/100 = 0 FocalLenIn35mmFilm: 34 SceneCaptureType: 0 GainControl: 0 Contrast: 0 Saturation: 0 Sharpness: 0 SubjectDistanceRange: 0 Page 9

Orange County Sheriffs Office

08-074777/Orange County Sheriffs Office\Seizure and Processing Notes Page 10 Name DSCN1810.JPG Description File, Archive File Created 04/18/09 11:24:16 Last Accessed 04/18/09 11:24:16 Last Written 12/31/04 22:00:00 Entry Modified 04/18/09 11:24:17 Full Path 08-074777 Wray\Z835CMIVT\D\Users\owner\Desktop\04192009\DSCN1810.JPG ImageDescription: Make: NIKON Model: E5600 Orientation: 1 XResolution: 300/1 = 300 (IFD 0) YResolution: 300/1 = 300 (IFD 0) ResolutionUnit: 2 Software: E5600v1.0 DateTime: 0000:00:00 00:00:00 YCbCrPositioning: 2 ExifOffset: 284 Compression: 6 XResolution: 300/1 = 300 (IFD 1) YResolution: 300/1 = 300 (IFD 1) ResolutionUnit: 2 JpegIFOffset: 4596 JpegIFByteCount: 7811 ExposureTime: 10/1200 = 0.008333333333333333 FNumber: 49/10 = 4.9000000000000004 ExposureProgram: 2 ISOSpeedRating: 50 ExifVersion: 0220 DateTimeOriginal: 0000:00:00 00:00:00 DateTimeDigitized: 0000:00:00 00:00:00 ComponentsConfiguration: 01 02 03 00 CompressedBitsPerPixel: 2/1 = 2 ExposureBias: 0/10 = 0 MaxAperture: 30/10 = 3 MeteringMode: 5 LightSource: 0 Flash: 24 FocalLength: 57/10 = 5.7000000000000002 MakerNote: undefined UserComment: undefined FlashPixVersion: 0100 ColorSpace: 1 ExifImageWidth: 2592 ExifImageHeight: 1944 ExifInterOffset: 1026 FileSource: 03 SceneType: undefined CustomRendered: 0 ExposureMode: 0 WhiteBalance: 0 DigitalZoomRatio: 0/100 = 0 FocalLenIn35mmFilm: 34 SceneCaptureType: 0 GainControl: 0 Contrast: 0

Orange County Sheriffs Office

08-074777/Orange County Sheriffs Office\Seizure and Processing Notes Saturation: 0 Sharpness: 0 SubjectDistanceRange: 0 Page 11

Name DSCN1811.JPG Description File, Archive File Created 04/18/09 11:24:17 Last Accessed 04/18/09 11:24:17 Last Written 12/31/04 22:00:00 Entry Modified 04/18/09 11:24:17 Full Path 08-074777 Wray\Z835CMIVT\D\Users\owner\Desktop\04192009\DSCN1811.JPG ImageDescription: Make: NIKON Model: E5600 Orientation: 1 XResolution: 300/1 = 300 (IFD 0) YResolution: 300/1 = 300 (IFD 0) ResolutionUnit: 2 Software: E5600v1.0 DateTime: 0000:00:00 00:00:00 YCbCrPositioning: 2 ExifOffset: 284 Compression: 6 XResolution: 300/1 = 300 (IFD 1) YResolution: 300/1 = 300 (IFD 1) ResolutionUnit: 2 JpegIFOffset: 4596 JpegIFByteCount: 6938 ExposureTime: 10/2371 = 0.004217629692113032 FNumber: 49/10 = 4.9000000000000004 ExposureProgram: 2 ISOSpeedRating: 50 ExifVersion: 0220 DateTimeOriginal: 0000:00:00 00:00:00 DateTimeDigitized: 0000:00:00 00:00:00 ComponentsConfiguration: 01 02 03 00

Orange County Sheriffs Office

08-074777/Orange County Sheriffs Office\Seizure and Processing Notes CompressedBitsPerPixel: 2/1 = 2 ExposureBias: 0/10 = 0 MaxAperture: 30/10 = 3 MeteringMode: 5 LightSource: 0 Flash: 24 FocalLength: 57/10 = 5.7000000000000002 MakerNote: undefined UserComment: undefined FlashPixVersion: 0100 ColorSpace: 1 ExifImageWidth: 2592 ExifImageHeight: 1944 ExifInterOffset: 1026 FileSource: 03 SceneType: undefined CustomRendered: 0 ExposureMode: 0 WhiteBalance: 0 DigitalZoomRatio: 0/100 = 0 FocalLenIn35mmFilm: 34 SceneCaptureType: 0 GainControl: 0 Contrast: 0 Saturation: 0 Sharpness: 0 SubjectDistanceRange: 0 Page 12

Orange County Sheriffs Office

08-074777/Orange County Sheriffs Office\Seizure and Processing Notes Page 13 Name DSCN1814.JPG Description File, Archive File Created 04/18/09 11:24:17 Last Accessed 04/18/09 11:24:17 Last Written 12/31/04 22:00:00 Entry Modified 04/18/09 11:24:18 Full Path 08-074777 Wray\Z835CMIVT\D\Users\owner\Desktop\04192009\DSCN1814.JPG ImageDescription: Make: NIKON Model: E5600 Orientation: 1 XResolution: 300/1 = 300 (IFD 0) YResolution: 300/1 = 300 (IFD 0) ResolutionUnit: 2 Software: E5600v1.0 DateTime: 0000:00:00 00:00:00 YCbCrPositioning: 2 ExifOffset: 284 Compression: 6 XResolution: 300/1 = 300 (IFD 1) YResolution: 300/1 = 300 (IFD 1) ResolutionUnit: 2 JpegIFOffset: 4596 JpegIFByteCount: 7718 ExposureTime: 10/1460 = 0.00684931506849315 FNumber: 49/10 = 4.9000000000000004 ExposureProgram: 2 ISOSpeedRating: 50 ExifVersion: 0220 DateTimeOriginal: 0000:00:00 00:00:00 DateTimeDigitized: 0000:00:00 00:00:00 ComponentsConfiguration: 01 02 03 00 CompressedBitsPerPixel: 2/1 = 2 ExposureBias: 0/10 = 0 MaxAperture: 30/10 = 3 MeteringMode: 5 LightSource: 0 Flash: 24 FocalLength: 57/10 = 5.7000000000000002 MakerNote: undefined UserComment: undefined FlashPixVersion: 0100 ColorSpace: 1 ExifImageWidth: 2592 ExifImageHeight: 1944 ExifInterOffset: 1026 FileSource: 03 SceneType: undefined CustomRendered: 0 ExposureMode: 0 WhiteBalance: 0 DigitalZoomRatio: 0/100 = 0 FocalLenIn35mmFilm: 34 SceneCaptureType: 0 GainControl: 0 Contrast: 0

Orange County Sheriffs Office

08-074777/Orange County Sheriffs Office\Seizure and Processing Notes Saturation: 0 Sharpness: 0 SubjectDistanceRange: 0 Page 14

Video
Name caylee memorial 002.MOD Description File, Archive File Created 05/04/08 18:58:42 Last Accessed 05/04/08 18:58:42 Last Written 05/01/09 13:19:18 Entry Modified 05/07/09 19:43:45 Full Path 08-074777 Wray\Z835CMIVT\D\Users\owner\Pictures\2009-05-01 caylee memorial\caylee memorial 002.MOD Name misc vids 001.MOD Description File, Archive File Created 06/06/08 19:44:28 Last Accessed 06/06/08 19:44:28 Last Written 06/03/09 15:32:46 Entry Modified 06/03/09 15:47:58 Full Path 08-074777 Wray\Z835CMIVT\D\Users\owner\Pictures\2009-06-03 misc vids\misc vids 001.MOD

Orange County Sheriffs Office

08-074777/Orange County Sheriffs Office\Seizure and Processing Notes Page 15

Registry, Physical and Logical Structure Nikon Coolpix

Serial Number Heads Sectors Per Track Unused Sectors Number of FATs Sectors Per FAT Boot Sectors 0000-0000 4 16 4,137 2 3 1 FAT12 32 512 27,863 14,254,080 Bytes (13.6MB) 870 13,189,120 Bytes (12.6MB) 805 1,064,960 Bytes (1MB) NO NAME 0 Fixed

Volume File System Sectors per cluster Bytes per sector Total Sectors Total Capacity Total Clusters Unallocated Free Clusters Allocated Volume Name Volume Offset Drive Type

Orange County Sheriffs Office

08-074777/Orange County Sheriffs Office\Seizure and Processing Notes Page 16 Name Actual Date Target Date File Path Case Number Evidence Number Examiner Name Notes Drive Type File Integrity Acquisition MD5 Verification MD5 EnCase Version System Version Neutrino Is Physical Raid RHS Raid Stripe Size Error Granularity Process ID Index File Acquisition Info Sources Subjects Read Errors Missing Sectors Disk Elements CRC Errors Compression Total Size Total Sectors Disk Signature Partitions Nikon Coolpix 11/24/09 12:50:35 11/24/09 12:50:35 I:\08-074777\Nikon Coolpix Wray.E01 08-074777 Sgt Kevin Stenger Fixed Unverified 206df4ff947bacd6cbedb15d01ebe513 206df4ff947bacd6cbedb15d01ebe513 FTKI2.4 Windows XP No No No 0 0 0 I:\08-074777\Index\Nikon Coolpix.Index No No No 0 0 No 0 None 14,265,856 Bytes (13.6MB) 27,863 00000000 Valid

Orange County Sheriffs Office

08-074777/Orange County Sheriffs Office\Seizure and Processing Notes Page 17

Z835CMIVT
Name Actual Date Target Date File Path Case Number Evidence Number Examiner Name Model Serial Number Drive Type File Integrity Acquisition MD5 Verification MD5 GUID EnCase Version System Version Write Blocked Neutrino Is Physical Raid RHS Raid Stripe Size Error Granularity Process ID Index File Acquisition Info Sources Subjects Read Errors Missing Sectors Disk Elements CRC Errors Compression Total Size Total Sectors Disk Signature Partitions Read Errors Start Sector 11,431,680 Z835CMIVT 11/24/09 08:30:47 11/24/09 08:30:47 I:\08-074777\Z835CMIVT.E01 08-074777 Wray Z835CMIVT Sgt. Kevin Stenger MK3252GSX Z835CMIVT Fixed Unverified ac191ab44363ac191f9178cb6e02a6e5 ac191ab44363ac191f9178cb6e02a6e5 f1ae2c0e95f5d2469f97aba6a6776eee 6.14.3 Windows XP Tableau No Yes No 0 64 0 I:\08-074777\Index\Z835CMIVTf1ae2c0e95f5d2469f97aba6a6776eee.Index No No No 1 0 No 0 Best 320,072,933,376 Bytes (298.1GB) 625,142,448 19D12ADD Valid

Sectors 64

Partitions Name Id Type 27 Unknown 07 NTFS 17 Hidden IFS

Start Sector Total Sectors 2,048 3,072,000 3,074,048 607,188,992 610,263,040 14,878,720

Size 1.5GB 289.5GB 7.1GB

Orange County Sheriffs Office

08-074777/Orange County Sheriffs Office\Seizure and Processing Notes Page 18

C
Serial Number Full Serial Number Driver Information E228-A506 90E228B8E228A506 NTFS 3.1 NTFS 8 512 3,072,000 1,572,859,904 Bytes (1.5GB) 383,999 1,421,893,632 Bytes (1.3GB) 347,142 150,966,272 Bytes (144MB) TOSHIBA SYSTEM VOLUME 2,048 Fixed

Volume File System Sectors per cluster Bytes per sector Total Sectors Total Capacity Total Clusters Unallocated Free Clusters Allocated Volume Name Volume Offset Drive Type Partition Id Type Start Sector Total Sectors Size

27 Unknown 2,048 3,072,000 1.5GB

Unable to open registry on volume C

D
Serial Number Full Serial Number Driver Information F858-2B45 C2F85836F8582B45 NTFS 3.1 NTFS 8 512 607,188,992 310,880,759,808 Bytes (289.5GB) 75,898,623 149,984,817,152 Bytes (139.7GB) 36,617,387 160,895,942,656 Bytes (149.8GB) SQ004829V03 3,074,048 S-1-5-21-737594619-14148292023786626943 Fixed

Volume File System Sectors per cluster Bytes per sector Total Sectors Total Capacity Total Clusters Unallocated Free Clusters Allocated Volume Name Volume Offset Id Drive Type

Orange County Sheriffs Office

08-074777/Orange County Sheriffs Office\Seizure and Processing Notes Partition Id Type Start Sector Total Sectors Size Page 19 07 NTFS 3,074,048 607,188,992 289.5GB

Account Info
User name: Administrator Full Name: Type of User: Account Description: Primary Group Number: Security Identifier: User belongs to group: Logon Script: Profile Path: Last Logon: Last Password Change: Last Incorrect Password Logon:

Local User Built-in account for administering the computer/domain 513 S-1-5-21-737594619-1414829202-3786626943-500 Administrators 01/18/09 02:47:03 01/20/08 21:57:58 01/01/70 00:00:00

User name: Guest Full Name: Type of User: Account Description: computer/domain Primary Group Number: Security Identifier: User belongs to group: Logon Script: Profile Path: Last Logon: Last Password Change: Last Incorrect Password Logon:

Local User Built-in account for guest access to the 513 S-1-0-0-0-0-0-0 Guests 10/30/09 15:33:12 01/01/70 00:00:00 01/01/70 00:00:00

Orange County Sheriffs Office

08-074777/Orange County Sheriffs Office\Seizure and Processing Notes Page 20 User name: owner Full Name: Type of User: Account Description: Primary Group Number: Security Identifier: User belongs to group: Logon Script: Profile Path: Last Logon: Last Password Change: Last Incorrect Password Logon: joy and family Local User 513 S-1-5-21-737594619-1414829202-3786626943-1000 Administrators C:\Users\owner 11/16/09 14:35:20 03/11/09 17:16:32 01/01/70 00:00:00

User name: systemprofile Full Name: Type of User: Account Description: Primary Group Number: Security Identifier: Logon Script: Profile Path: Last Logon: Last Password Change: Last Incorrect Password Logon:

Domain User 0 S-1-5-18 %systemroot%\system32\config\systemprofile 01/01/70 00:00:00 01/01/70 00:00:00 01/01/70 00:00:00

User name: LocalService Full Name: Type of User: Account Description: Primary Group Number: Security Identifier: Logon Script: Profile Path: Last Logon: Last Password Change: Last Incorrect Password Logon:

Domain User 0 S-1-5-19 %SystemRoot%\ServiceProfiles\LocalService 01/01/70 00:00:00 01/01/70 00:00:00 01/01/70 00:00:00

Orange County Sheriffs Office

08-074777/Orange County Sheriffs Office\Seizure and Processing Notes Page 21 User name: NetworkService Full Name: Type of User: Account Description: Primary Group Number: Security Identifier: Logon Script: Profile Path: Last Logon: Last Password Change: Last Incorrect Password Logon:

Domain User 0 S-1-5-20 %SystemRoot%\ServiceProfiles\NetworkService 01/01/70 00:00:00 01/01/70 00:00:00 01/01/70 00:00:00

User name: Guest Full Name: Type of User: Account Description: Primary Group Number: Security Identifier: User belongs to group: Logon Script: Profile Path: Last Logon: Last Password Change: Last Incorrect Password Logon:

Domain User 0 S-1-5-21-737594619-1414829202-3786626943-501 Guests C:\Users\Guest 01/01/70 00:00:00 01/01/70 00:00:00 01/01/70 00:00:00

OS Info
Product Name: Current Version: Registered Owner: Registered Organization: System Root: Current Build Number: Path Name: Product ID: Last Service Pack: Product Key: VersionNumber: Source Path: Install Date: Last Shutdown Time: Windows Vista (TM) Home Premium 6.0 owner Toshiba C:\Windows 6001 C:\Windows 89578-OEM-7332157-00237 Service Pack 1

01/18/09 02:44:55 11/07/09 18:54:29

Orange County Sheriffs Office

08-074777/Orange County Sheriffs Office\Seizure and Processing Notes Page 22

TimeZone Info
Current control set is 001 Default control set is 001 Failed control set is 000 LastKnownGood control set is 003 Standard time bias is -5:00 hours offset from GMT StandardName: Eastern Standard Time Standard time is set to change the Standard bias by 0 minutes Standard time is set to change on Sunday of the 1st week of November, at 02:00 hours. DaylightName: Eastern Daylight Time Daylight savings is set to change the Standard bias by 60 minutes. Daylight savings time is set to change on Sunday of the 2nd week of March, at 02:00 hours. Active time bias is -5:00 hours offset from GMT. TimeZoneKeyName: Eastern Standard Time The current time setting is 0:00 hours offset from GMT. The offset must be either added or subtracted from GMT depending on the time zone location Display: (GMT-05:00) Eastern Time (US & Canada)

E
Serial Number Full Serial Number Driver Information 8C7E-37AB 7E8C7E858C7E37AB NTFS 3.1 NTFS 8 512 14,878,720 7,617,900,544 Bytes (7.1GB) 1,859,839 630,296,576 Bytes (601.1MB) 153,881 6,987,603,968 Bytes (6.5GB) HDDRECOVERY 610,263,040 Fixed

Volume File System Sectors per cluster Bytes per sector Total Sectors Total Capacity Total Clusters Unallocated Free Clusters Allocated Volume Name Volume Offset Drive Type Partition Id Type Start Sector Total Sectors Size

17 Hidden IFS 610,263,040 14,878,720 7.1GB

Unable to open registry on volume E