From the genetic traces of the teaspoon to the copies of the hard disks with different codes, the RIS documents rekindle questions about the investigations into the murder of Chiara Poggi
The analyzes on the famous teaspoon, where Chiara Poggi’s DNA was supposed to be, provided, between 17 and 19 November 2007, a flat trace (therefore without proof of the presence of DNA) and an illegible trace. The raw data and the fluorescence graphs (electropherograms), again, would not have been transmitted to the parties.
The teaspoon (exhibit 29), found in the TV room, was used by Ris as a comparison, to show how much DNA leaves direct salivary contact. Downsizing his profile would weaken the comparative scale with which the prosecution supported the blood nature of the victim’s DNA on the bicycle pedals and on the soap dispenser.
But was that comparison really necessary? Chiara’s blood was already there: taken directly from the body during the autopsy and indicated by the RIS, in the report of 4 September 2007, as a “biological comparison sample” for genetic tests.
Yet the scientific police obtained from the spoon a genetic profile attributed to the victim: why look for it there? This was anticipated by Ignoto X, on La7.
Anomalies in computer analysis
It is not the only opaque step: even on the IT front the picture is far from linear. When, in March 2008, the Carabinieri analyzed the PCs seized from Marco Panzarasa, a friend of Alberto Stasi, they even took care to avoid accidental switching on.
Only a few months earlier, however, Stasi’s IT media had been subjected to a more eventful treatment. The Compaq, seized but not sealed and used by investigators for 15 days after the acquisition, had arrived at the technical investigations with part of the information already altered.
In the subsequent activities of the Ris carabinieri, there was no shortage of other documentary anomalies: an identification code «MD5» (the alphanumeric string that acts as a unique digital fingerprint of files and hard disks and guarantees in IT forensics that a copy is identical to the original) referring to a hard disk different from the one mounted on the laptop, and three copies of the Compass external disk with different computer fingerprints.
Stasi’s alibi and the degree thesis files
But a question remains: how could we guarantee the integrity of computer evidence (linked to the alibi provided by Alberto, who reported that he was working on his thesis while someone was murdering his girlfriend) already compromised by previous operations?
What brings attention to these anomalies today is the material from the files recovered by the Pavia Prosecutor’s Office in the Parma Ris offices. The judicial police report of August 29 indicates five accesses; the court experts, engineer Roberto Porta and doctor Daniele Occhetti, reconstruct seven of them.
On the degree thesis, the prosecution had read the absence of temporary Word files in the unallocated clusters as evidence against Stasi. The defense countered that those files could be located in areas without a system date and time. On August 14, the police found the laptop on standby, with Word and theses open. Closing and saving the document would have caused the automatic deletion of the temporary files, confirmed by the office experts.
At 9.35 the previous day the computer is reactivated and unlocked; between 9.37 and 10.07 multimedia contents are displayed; from 10.17 to 12.20 Stasi works on his thesis.
The close rescues, suspected of simulating the work, are traced back to the revision: Stasi erased already written parts and rewrote them, without significantly increasing the characters. At 12.20 he puts the computer on standby, leaving the document and program open, compatible with the intention of resuming in the afternoon.
The hard drives, the child pornography material and the different codes
On child pornography material, only the installer appears on hard disk copies, not an active file sharing program such as eMule or Morpheus. There are no files cited in the invitation to appear with the prosecution’s nomenclatures, nor searches with relevant keywords.
In the Parma RIS report dated 11 December 2007, the MD5 hash of a 3.5-inch Western Digital hard disk appears instead of that of the 2.5-inch Hitachi inside the laptop. Cerati reports the discrepancy, which the RIS attributes to a transcription error and corrected with a correction.
On the Compass drive, the three compliant copies have different MD5 codes, explained by six bad sectors that would give different results in hardware clones.
Each access can make it more difficult to distinguish the original activity from that following the seizure. If a computer is to be useful for verifying an alibi, storing it correctly is not a detail: it is part of the evidence.
