Records of files and directories with the name ‘Amanda Todd’ were found on a hard drive seized from the cabin of the man accused of harassing and extorting her before her death, a court has heard.
Aydin Coban, a 44-year-old man from The Netherlands, has pleaded not guilty to five charges in the high-profile case, including possession of child pornography, communication with a young person to commit a sexual offence, and criminal harassment.
Jurors heard Tuesday from Detective Frank van der Molen, a digital forensic investigator with the Dutch National Police’s child exploitation team.
Van der Molen was involved in the search of the Oisterwijk bungalow where Coban was arrested, and tasked with making forensic copies and analyzing several hard drives seized by police. Among them was a 320-Gigabyte Hitachi hard drive, which had been repaired and copied by forensic experts.
On the drive, Van der Molen told the court he found a log file, or “playlist,” from video-playing software called KM Player with a list of 1,383 files it had played as of Feb. 1, 2011.
The list referred to a video file, about four-and-a-half minutes long, named “AmandaTodd.wmv,” he testified.
It also referred to an apparently zero-second video file called LOL.mp4, Van der Molen testified. That file appeared to be either a capture of a Facebook profile page or a very short video taken from a Facebook page that included the name “Amanda Todd,” based on the way it had been stored on the computer.
The court heard about four other five-second video files referenced in the list with identical alphanumeric names, some of which were stored in folders titled, “Amanda Todd.”
Under cross-examination, van der Molen agreed he only found references to the videos, not the videos themselves.
“There were no videos of Amanda Todd found on any of the videos you analyzed?” asked defence counsel Joseph Saulnier.
“That is correct,” van der Molen said.
He further testified he wasn’t sure if he actually found an installed version of KM Player on the hard drive, and agreed he did not find the software installed on any other drives he examined.
Van der Molen also walked the jury through several pieces of software he found installed or referenced on the Hitachi and several other drives seized from the cabin which are designed to wipe data or disguise the activities of a user.
One piece of software called ManyCam could be used during live video chats to deceive someone on the other side of the conversation, he explained.
“It allows you to pretend you have an actual webcam so you can play a video file with that application, and the other side — for example if you are in a chat with the other party — they will think it is a real webcam although you are playing a video file,” he told the court.
Van der Molen also described finding software used to create private connections to the Internet, to permanently scrub data from a computer, or to disguise the identity of a user.
“It allows you to change your voice for example, from male to female or vice versa, and vanity figures like an alien from outer space,” he said of one program called MorphVOX Pro.
The detective further detailed how he had discovered a password that allowed him to access an encrypted hard drive found in the bungalow, and how he suspected but couldn’t be certain the drive had an an additional, hidden, encrypted portion.
Under cross examination, he agreed that nothing in the names or directories of the files listed in the video “playlist” suggested they were associated with an encrypted drive.
Defence questions officer who spearheaded arrest
On Monday, Dutch National Police Chief Inspector Joerie van Schijndel described the Jan. 13, 2014 operation to arrest Coban at his bungalow in Oisterwijk, and the weeks leading up to it.
Defence counsel Joseph Saulnier, pressed van Schijndel Tuesday on police procedure during the raid and a separate, covert operation at the cabin in December 2013.
Referencing photos taken during that operation, in which police secretly entered the cabin when Coban was not home, Saulnier pressed van Schijndel on whether or not officers were actually wearing gloves.
“The police covert operators were not wearing gloves on the 20th, were they?” Saulnier asked.
Van Schijndel responded that officers wore gloves for certain activities, but not throughout the entire investigation.
“You see in the picture where I was wearing my phone, if you ever try to use your phone with a plastic glove, it doesn’t work,” he testified. “Only when you do the activities like installing equipment we wear the gloves, and then we take them off.”
Van Schijndel agreed that officers may have touched items in the home without gloves, and then cleaned them afterward. He agreed doing so could have removed existing fingerprints or DNA.
On Tuesday, van Schijndel told the court he had seen Coban coming and going from the cabin several times, and identified him in the prisoner’s box.
Under cross-examination, Saulnier also pressed him on that identification — suggesting the distance van Schijndel observed the suspect from may have been as far as 200 metres. He asked the officer to clarify how many times he had seen him.
Van Schijndel maintained he was between 75 and 100 metres away, but couldn’t recall if he had seen Coban two or three times.
- Toronto Pearson gold heist: Ontario man arrested at airport after arriving from India
- Man charged in surfer deaths told girlfriend he killed ‘3 gringos,’ court hears
- ‘I believe they’re looking for me’: Man arrested after triple stabbing in Mississauga, Ont.
- Drone used to smuggle $250,000 worth of contraband into N.B. prison, police say
The court also heard new details of Coban’s arrest itself, with van Schijndel testifying the accused had grabbed a metal pipe when he saw police in the reflection of his bathroom mirror.
On Monday, van Schijndel had also described December 2013’s covert operation, telling the court that officers had entered the bungalow several times to install cameras, microphones, and computer keyloggers and to copy hard drives.
On the evening of Coban’s arrest the following month, he said two plainclothes officers made “silent entry” to the bungalow as van Schijndel monitored them through body cameras.
Coban suffered an injury to his right eye as he was subdued, and officers put a blindfold and headphones on him before removing the surveillance devices from his home, he added.
At the end of his testimony, van Schijndel pointed to Coban and identified him as the man he arrested eight years ago.
The Crown aims to prove Coban executed a “persistent campaign of online sextortion” against Todd between 2009 and 2012.
Prosecutors allege he obtained explicit video of the teen, then used 22 online accounts to try and sexually blackmail her into performing webcam shows for him. The Crown alleges he sent the video to family, friends and Todd’s school community.
The case hinges on the identity of the online extortionist, who has no connection to Coban, according to his lawyer.
Information can be manipulated on the Internet, the defence has argued, and there must be proof beyond a reasonable doubt about who sent the offending messages to Todd.
Todd took her own life in 2012 shortly after posting an online video that eventually went viral, in which she silently holds up flashcards describing incidents of harassment and bullying. She was 15.
Comments