The Case & Investigation
K. 'Gus' Dimitrelos, CIS
Active Top Secret Clearance, SCI, (SI/G)
State of Florida vs Kevin Watkins
Case Background
I examined trial exhibits and testimony presented in the case of State of Florida vs. Kevin Watkins. Specifically, I examined the trial exhibit #1 titled, "(A) EMAIL FROM HOLLY TO KEVIN" which is a printed document presented as a valid electronic mail supposedly sent to and from Mr. Kevin Watkins' email account.
Based on my 16 years experience as a certified computer forensics specialist and special agent with the US Secret Service, I was requested by Attorney William Kent to examine all the evidence in this case and to conduct a complete and unrestricted examination of the computer system belonging to Mr. Kevin Watkins.
Specifically, I examined the computer system belonging to and used by Mr. Watkins to send and receive email and verified that in fact, this computer systems contained email communications to/from Mr. Watkins email account of and containing the email account belonging to Mr. Watkins at watkins68******. I imaged the original hard drive and have preserved the image duplicate. The HASH value of the evidence image is:
SHA1 9c3dd23ba2cebacab0294cf44cbdeb6599741a23.
Evidence Related to Possible Motive
The analysis of the Watkins computer system revealed a deleted document detailing anger towards Mr. Watkins. The document, which was created by the user account Holly and authored by Holly Watkins, was created on or about December 30, 2003, and deleted on or before December 5, 2007.
The verbiage in the document I discovered was similar to the verbiage in the printed document, which had been incorrectly presented into evidence as an electronic communication to Mr. Watkins. However, a distinct difference in the found document (below) is that at no time are there any cited allegations of inappropriate or illegal behavior by Mr. Watkins.
The found document was stored in two locations prior to deletion and the last time it was accessed was on December 5, 2007 in the following location //Backup 8-00/New Backup Job/F/Documents and Settings/Holly/My Documents/12-30-03.doc 12/5/2007 1:47:41 PM (2007-12-05 19:47:41 UTC).
The content I discovered which was authored by Holly Watkins on December 30, 2003, is pasted below exactly as written:
Case Background
I examined trial exhibits and testimony presented in the case of State of Florida vs. Kevin Watkins. Specifically, I examined the trial exhibit #1 titled, "(A) EMAIL FROM HOLLY TO KEVIN" which is a printed document presented as a valid electronic mail supposedly sent to and from Mr. Kevin Watkins' email account.
Based on my 16 years experience as a certified computer forensics specialist and special agent with the US Secret Service, I was requested by Attorney William Kent to examine all the evidence in this case and to conduct a complete and unrestricted examination of the computer system belonging to Mr. Kevin Watkins.
Specifically, I examined the computer system belonging to and used by Mr. Watkins to send and receive email and verified that in fact, this computer systems contained email communications to/from Mr. Watkins email account of and containing the email account belonging to Mr. Watkins at watkins68******. I imaged the original hard drive and have preserved the image duplicate. The HASH value of the evidence image is:
SHA1 9c3dd23ba2cebacab0294cf44cbdeb6599741a23.
Evidence Related to Possible Motive
The analysis of the Watkins computer system revealed a deleted document detailing anger towards Mr. Watkins. The document, which was created by the user account Holly and authored by Holly Watkins, was created on or about December 30, 2003, and deleted on or before December 5, 2007.
The verbiage in the document I discovered was similar to the verbiage in the printed document, which had been incorrectly presented into evidence as an electronic communication to Mr. Watkins. However, a distinct difference in the found document (below) is that at no time are there any cited allegations of inappropriate or illegal behavior by Mr. Watkins.
The found document was stored in two locations prior to deletion and the last time it was accessed was on December 5, 2007 in the following location //Backup 8-00/New Backup Job/F/Documents and Settings/Holly/My Documents/12-30-03.doc 12/5/2007 1:47:41 PM (2007-12-05 19:47:41 UTC).
The content I discovered which was authored by Holly Watkins on December 30, 2003, is pasted below exactly as written: