WEBVTT - The Trial: A seized computer and a keyword search

0:00:03.040 --> 0:00:07.360
<v Speaker 1>On August fifteen, twenty twenty three, a Victoria Police digital

0:00:07.400 --> 0:00:11.559
<v Speaker 1>forensic officer named Sharman fox Henry was given a job.

0:00:12.520 --> 0:00:16.800
<v Speaker 1>His job was to uncover traces of digital information information

0:00:17.000 --> 0:00:20.160
<v Speaker 1>that had been found on a computer seized by police

0:00:20.200 --> 0:00:26.280
<v Speaker 1>from the home of Aaron Patterson. After extracting the data,

0:00:26.560 --> 0:00:30.720
<v Speaker 1>mister fox Henry ran a keyword search typing in terms

0:00:30.760 --> 0:00:33.159
<v Speaker 1>to see if there were any matches.

0:00:34.640 --> 0:00:46.400
<v Speaker 2>Deaf cap, deaf cab, mushroom, deaf cap, mushrooms, mushroom poison.

0:00:48.440 --> 0:00:51.680
<v Speaker 1>Today in court, mister fox Henry was asked questions about

0:00:51.680 --> 0:00:56.960
<v Speaker 1>what he found. I'm Brooke Reebert Craig and this is

0:00:57.760 --> 0:01:03.240
<v Speaker 1>the Mushroom cook. Day sixteen of Aaron Patterson's murder trial

0:01:03.280 --> 0:01:05.679
<v Speaker 1>has wrapped up, and once again I'm joined by a

0:01:05.680 --> 0:01:07.080
<v Speaker 1>court reporter, Laura Plasseller.

0:01:07.680 --> 0:01:09.639
<v Speaker 3>Good to be here with you. As always, It's.

0:01:09.520 --> 0:01:12.200
<v Speaker 1>Been quite a day to day, hasn't it. Yes, it

0:01:12.280 --> 0:01:15.440
<v Speaker 1>has so. The jury has been given many lessons throughout

0:01:15.440 --> 0:01:18.880
<v Speaker 1>the trial, including lessons on mushrooms, but today it was

0:01:19.000 --> 0:01:20.600
<v Speaker 1>all about computers.

0:01:21.360 --> 0:01:23.800
<v Speaker 3>That's right. At the top of the episode, our listeners

0:01:23.800 --> 0:01:27.560
<v Speaker 3>were introduced to Sharman fox Henry. He is part of

0:01:27.600 --> 0:01:31.600
<v Speaker 3>the Victoria Police Cybercrime Squad. And he took to the

0:01:31.640 --> 0:01:34.399
<v Speaker 3>stand today, like you said, Brooke, to give the jury

0:01:34.480 --> 0:01:37.160
<v Speaker 3>yet another lesson. It's fair to say that will be

0:01:37.200 --> 0:01:39.560
<v Speaker 3>pretty well versed I think in a number of topics

0:01:39.600 --> 0:01:42.720
<v Speaker 3>by the end of this trial. His evidence began with

0:01:42.880 --> 0:01:46.560
<v Speaker 3>a slide show and the first slide read what is

0:01:46.600 --> 0:01:49.880
<v Speaker 3>a computer? So we started very much with the basics,

0:01:50.200 --> 0:01:58.800
<v Speaker 3>and he slowly walked the jury through evidence around computers, files, folders, thumbnails,

0:01:59.160 --> 0:02:02.400
<v Speaker 3>and even some more technical things known as artifacts. And

0:02:02.440 --> 0:02:05.760
<v Speaker 3>he explained that artifacts can range from a Microsoft word

0:02:05.800 --> 0:02:09.280
<v Speaker 3>file to a web browser cookie.

0:02:09.560 --> 0:02:12.760
<v Speaker 1>Now, a number of devices were seized from Aaron Patterson's

0:02:12.800 --> 0:02:15.799
<v Speaker 1>home and mister fox Henry was one of the officers

0:02:15.880 --> 0:02:17.280
<v Speaker 1>who examined them.

0:02:17.919 --> 0:02:21.800
<v Speaker 3>Yes, so the jury previously heard that several devices were

0:02:22.320 --> 0:02:27.520
<v Speaker 3>seized by police from Aaron's home when warrants were executed

0:02:27.600 --> 0:02:32.360
<v Speaker 3>on August five and November two, twenty twenty three, August

0:02:32.400 --> 0:02:36.520
<v Speaker 3>five being about one week after the lunch and in particular, today,

0:02:36.840 --> 0:02:41.200
<v Speaker 3>mister fox Henry was questioned about a Cooler Master computer

0:02:41.520 --> 0:02:45.080
<v Speaker 3>that was found, Cooler Master being the brand of computer.

0:02:45.680 --> 0:02:48.800
<v Speaker 3>He walked the jury through his job as a digital

0:02:48.800 --> 0:02:54.080
<v Speaker 3>forensics officer and how he extracts data from devices. He

0:02:54.160 --> 0:02:57.880
<v Speaker 3>explained that the beginning of that process involves creating a

0:02:57.919 --> 0:03:01.919
<v Speaker 3>copy of the data which is the case, and from

0:03:01.960 --> 0:03:07.040
<v Speaker 3>that case he can run analysis for the investigators. He

0:03:07.080 --> 0:03:09.400
<v Speaker 3>told the court that he was asked to run a

0:03:09.480 --> 0:03:13.360
<v Speaker 3>keyword search for five terms. Those terms were the ones

0:03:13.400 --> 0:03:16.440
<v Speaker 3>you heard at the top of the episode, death cap,

0:03:16.919 --> 0:03:21.800
<v Speaker 3>death cap, mushroom, death cap, mushrooms, mushrooms, and poison.

0:03:22.760 --> 0:03:25.720
<v Speaker 1>So what was actually found on the caller master computer then?

0:03:26.480 --> 0:03:29.680
<v Speaker 3>So it was at this point today where a forensic

0:03:29.800 --> 0:03:33.120
<v Speaker 3>examination report was brought up on the screens in the

0:03:33.160 --> 0:03:36.400
<v Speaker 3>court for the jury to see, and this contained all

0:03:36.440 --> 0:03:40.000
<v Speaker 3>the records that were pulled from this device. The court

0:03:40.040 --> 0:03:43.240
<v Speaker 3>heard there were records in this report that related to

0:03:43.520 --> 0:03:46.160
<v Speaker 3>a search term. So you think about a search term

0:03:46.280 --> 0:03:49.040
<v Speaker 3>as something you would type into a browser, just like Google.

0:03:49.880 --> 0:03:53.360
<v Speaker 3>This search term was for a naturalists and the record

0:03:53.480 --> 0:03:56.520
<v Speaker 3>showed that this search was made on May twenty eight,

0:03:56.960 --> 0:04:01.000
<v Speaker 3>twenty twenty two, at around seven to twenty p so

0:04:01.040 --> 0:04:04.080
<v Speaker 3>that's about fourteen months before the lunch at the center

0:04:04.160 --> 0:04:07.560
<v Speaker 3>of this trial. To remind our listeners again, I Naturalist

0:04:07.800 --> 0:04:11.240
<v Speaker 3>is that citizen science website we've been referring to that

0:04:11.320 --> 0:04:14.760
<v Speaker 3>allows members of the public to post sightings of plants,

0:04:15.160 --> 0:04:18.600
<v Speaker 3>animals and fungi, which includes deathcap mushrooms.

0:04:19.040 --> 0:04:22.560
<v Speaker 1>Yes, and doctor Tom May and Christine McKenzie both gave

0:04:22.640 --> 0:04:25.080
<v Speaker 1>evidence about this website previously.

0:04:25.560 --> 0:04:29.360
<v Speaker 3>That's right. So mister fox Henry was asked what these

0:04:29.440 --> 0:04:32.920
<v Speaker 3>records meant and he told the court that it confirmed

0:04:33.040 --> 0:04:36.599
<v Speaker 3>a being search was done for iiurnaturalist on this day.

0:04:37.000 --> 0:04:40.599
<v Speaker 3>I mentioned Google before, Bing is another search engine. But

0:04:40.640 --> 0:04:43.080
<v Speaker 3>it is really important to note at this stage that

0:04:43.120 --> 0:04:46.800
<v Speaker 3>the court didn't hear today who made these searches. It

0:04:46.839 --> 0:04:49.839
<v Speaker 3>was simply evidence about the fact a search was made

0:04:50.080 --> 0:04:50.880
<v Speaker 3>on that device.

0:04:51.400 --> 0:04:53.799
<v Speaker 1>And were there any other records relating to the Cooler

0:04:53.880 --> 0:04:54.640
<v Speaker 1>Master computer?

0:04:55.160 --> 0:04:58.680
<v Speaker 3>Yes, there were. After mister fox Henry spoke about the

0:04:58.920 --> 0:05:02.839
<v Speaker 3>search term record, we moved on to some web history

0:05:02.920 --> 0:05:06.360
<v Speaker 3>records and the court heard that after the search term

0:05:06.440 --> 0:05:10.400
<v Speaker 3>I naturalist was made by seven twenty one pms. This

0:05:10.520 --> 0:05:16.120
<v Speaker 3>is about one minute later, the urliinaturalist dot org was

0:05:16.240 --> 0:05:20.120
<v Speaker 3>visited by a browser on this computer. Another record showed

0:05:20.279 --> 0:05:24.480
<v Speaker 3>that two minutes later, at seven twenty three pm, another

0:05:24.560 --> 0:05:29.600
<v Speaker 3>I naturalist url was accessed by the computer. So we've

0:05:29.640 --> 0:05:33.960
<v Speaker 3>spoken about URLs, but the court heard today that every

0:05:33.960 --> 0:05:38.560
<v Speaker 3>web page has a title as well, and the title

0:05:38.720 --> 0:05:41.640
<v Speaker 3>of the URL that was visited at seven twenty three

0:05:42.320 --> 0:05:44.760
<v Speaker 3>and I'll read this out here from my notes was

0:05:45.279 --> 0:05:52.320
<v Speaker 3>deathcap from Melbourne, Vic, Australia on May eighteenth, twenty twenty two,

0:05:53.279 --> 0:05:58.800
<v Speaker 3>at two thirty six pm by Ivan Margitter Bricker Reserve

0:05:59.120 --> 0:06:03.280
<v Speaker 3>Moravin iNaturalist. The court wasn't told too much more at

0:06:03.279 --> 0:06:06.200
<v Speaker 3>all about this web page and what all of those

0:06:06.240 --> 0:06:10.320
<v Speaker 3>words meant. But the jury have previously heard evidence from

0:06:10.560 --> 0:06:14.000
<v Speaker 3>doctor May and miss McKenzie who you mentioned earlier Brooke,

0:06:14.600 --> 0:06:18.279
<v Speaker 3>who have made posts on I Naturalists before when they've

0:06:18.279 --> 0:06:19.760
<v Speaker 3>observed fungi in the wild.

0:06:20.800 --> 0:06:23.240
<v Speaker 1>And did the jury find out how many times these

0:06:23.279 --> 0:06:24.880
<v Speaker 1>web pages were actually visited?

0:06:26.080 --> 0:06:29.640
<v Speaker 3>They did so. Mister Fox Henry explained that there was

0:06:29.760 --> 0:06:33.640
<v Speaker 3>data extracted that related to the visit count and he

0:06:33.720 --> 0:06:36.640
<v Speaker 3>told the court that for this particular web page, the

0:06:36.720 --> 0:06:39.880
<v Speaker 3>visit count was two, which indicated the web page had

0:06:39.880 --> 0:06:41.000
<v Speaker 3>been visited twice.

0:06:41.360 --> 0:06:43.400
<v Speaker 1>And there was another search term that we heard more

0:06:43.440 --> 0:06:45.320
<v Speaker 1>about today, wasn't there there was?

0:06:45.480 --> 0:06:49.840
<v Speaker 3>After the court heard about the naturalist search terms, they

0:06:49.839 --> 0:06:52.599
<v Speaker 3>were also brought to a search term made at seven

0:06:52.720 --> 0:06:56.159
<v Speaker 3>twenty three pm so on this same day, on May

0:06:56.240 --> 0:06:59.880
<v Speaker 3>twenty eighth, twenty twenty two, for the current Borough Middle Pub.

0:07:00.680 --> 0:07:03.440
<v Speaker 3>According to the records, this search was made on the

0:07:03.480 --> 0:07:06.800
<v Speaker 3>computer about two minutes after the search for OI Naturalist.

0:07:07.360 --> 0:07:09.840
<v Speaker 1>That was a lot of detail, Laura, Can you summarize

0:07:09.840 --> 0:07:10.760
<v Speaker 1>it for our listeners.

0:07:11.200 --> 0:07:14.840
<v Speaker 3>I'll definitely try. As I mentioned earlier, everything we heard

0:07:14.840 --> 0:07:18.360
<v Speaker 3>about today was a record that related to a computer

0:07:18.720 --> 0:07:22.520
<v Speaker 3>seized from Erin's home. While the court didn't hear who

0:07:22.680 --> 0:07:26.840
<v Speaker 3>made searches or who visited websites on this device, what

0:07:27.160 --> 0:07:30.200
<v Speaker 3>was made clear was that there were searches made for

0:07:30.280 --> 0:07:34.239
<v Speaker 3>Iron Naturalist, and after those searches were made, web pages

0:07:34.280 --> 0:07:38.640
<v Speaker 3>relating to I Naturalist were also accessed, in particular that

0:07:38.720 --> 0:07:42.560
<v Speaker 3>web page relating to a siding of Deathcap Mushrooms in Morabin,

0:07:43.000 --> 0:07:44.400
<v Speaker 3>which is a suburb in Melbourne.

0:07:44.560 --> 0:07:49.360
<v Speaker 1>Great summary, Laura, Mister Fox Henry also examined another device.

0:07:50.000 --> 0:07:52.320
<v Speaker 3>That's right. We didn't hear a lot about this today

0:07:52.400 --> 0:07:54.800
<v Speaker 3>because by the time it was mentioned it was close

0:07:54.880 --> 0:07:57.240
<v Speaker 3>to the end of the day. But he told the

0:07:57.280 --> 0:08:01.800
<v Speaker 3>court the cybercrime team analyzed the of Gail Patterson and

0:08:01.840 --> 0:08:04.680
<v Speaker 3>we're expected to hear more of what was found tomorrow.

0:08:04.840 --> 0:08:08.000
<v Speaker 1>That's right, and to end the day, Justice Christopher Bill

0:08:08.200 --> 0:08:10.280
<v Speaker 1>gave a bit of a warning to the jury, didn't

0:08:10.280 --> 0:08:11.200
<v Speaker 1>he He did.

0:08:11.400 --> 0:08:14.800
<v Speaker 3>After there were those references made to the URLs which

0:08:14.840 --> 0:08:18.080
<v Speaker 3>were shown on the screen in the courtroom, he turned

0:08:18.080 --> 0:08:20.400
<v Speaker 3>to the jurors and gave them a gentle reminder that

0:08:20.440 --> 0:08:23.600
<v Speaker 3>they should not be going home and googling these URLs

0:08:23.760 --> 0:08:26.200
<v Speaker 3>to figure out where they went to, and they should

0:08:26.200 --> 0:08:28.800
<v Speaker 3>only be relying on the evidence they're hearing in court.

0:08:29.080 --> 0:08:31.880
<v Speaker 1>Thanks Laura, and to stay updated on all our coverage

0:08:31.880 --> 0:08:34.720
<v Speaker 1>of this case, go to the mushroomcook dot com dot

0:08:34.760 --> 0:08:35.480
<v Speaker 1>au for more