Mork keeps on giving: When the database worms eat into your murder trial

You may recall that back in 2004, I tried to extract the recently-visited URLs from Mozilla's history database, re-discovered some major, major insanity, and did some colorful swearing. See "When the database worms eat into your brain", the halfassed perl script I eventually came up with, RESOLVED WONTFIX bug 241438, and where it all started, "Netscape Mail Summary Files", 1998.

(For some reason, one of the wikitards thought that this bug report was of such significance to the Global Repository of All Human Knowledge that there's an entire sub-section on my Wikipedia page about it. I spent perhaps a grand total of 24 hours of my life thinking about this -- ok maybe 25 by now -- and this is what gets memorialized? WTF. Seriously. W the F.)

Anyway, you may be interested to know that seven years after that bug report, and thirteen years after it should have happened:

@chrisblizzard 5 Jul 2011
I'm told that the last of mork has been excised from the Mozilla tree. (this is kind of for @shaver, but really for @jwz)

But what brings us here today is a gentle reminder that when you write code this bad, you can actually kill people.

I'm leaving the DB-dump images in the following quote as a reminder of just how insane this code was. Think of these as skulls on sticks at the edge of the wasteland, saying "Never pass this way again".

Digital Evidence Discrepancies -- Casey Anthony Trial

The digital forensic evidence in this case is of particular interest to me as it involved the recovery and analysis of a Mozilla Firefox history database. The Internet history records within this database turned out to be extremely important to the prosecution case as the existence of Google searches relating to "chloroform" and other possibly relevant records prior to the child's disappearance could have indicated premeditation. This, of course, could have meant the difference between a conviction for murder in the first degree and manslaughter if found guilty. The State of Florida also has the death penalty as a punishment option for capital crimes.

During a keyword search of Anthony's computer, a hit was found for the word "chloroform". The hit was identified in what appeared to be a Mork database belonging to Mozilla Firefox. The file was identified as residing in unallocated clusters, and rather surprisingly, is reported to have been intact. Furthermore, all of the blocks belonging to the file were said to be contiguous. [...]

He pointed out the discrepancy between the first analysis the sheriff’s office did that showed one visit to a website about chloroform and an analysis done later with a second program that appeared to show 84 visits. However, according to Baez, the first report showed a progression that made it clear that the 84 visits were actually to MySpace. This was a major discrepancy with critical digital evidence presented in an extremely serious trial. [...]

The Mork record containing "" is identified as record 174EF. The Index record from the original file is highlighted and shown in Figure 10 below.

Figure 10

The entire record is contained within square brackets. The highlighted line above shows the full record. The first field 82 ("URL") is stored in cell 27F4B, as shown in Figure 11.

Figure 11

The second field 84 ("LastVisitDate") is stored in cell 27F4C, as shown in Figure 12 (2008-03-21 19:16:34 UTC / 2008-03-21 15:16:34 Local Time). Once again, this integer represents the number of micro-seconds from the 1st January 1970, 00:00:00 UTC.

Figure 12

The third field 85 ("FirstVisitDate") is stored in cell 27F4C. This is the same cell value as for ("LastVisitDate") and indicates this is the first visit to this web site during the scope of the current recorded history. The First and Last visit times are the same.

The fourth field 83 (“Referrer”) is stored in cell 27F49, as shown in Figure 13.

Figure 13

There are two critical points to make with this record. Firstly, there is no field 86 ("VisitCount") therefore this URL has only been visited once (not 84 times). This is further corroborated by the fact that field 85 ("FirstVisitDate") shows the exact same date/time as the "LastVisitDate". The second point is that the visit was recorded at 15:16:34 hours (local time) and NOT at 15:16:13 hours as was stated during the trial (from the report produced by the second forensic tool).

(Let me emphasize that those images above are not hex dumps or something: that's the actual, literal text of this file format!)

Previously, previously.

Tags: , , , , ,

21 Responses:

  1. I note that your wikipedia page also has a section devoted to wikipedia editors using words without knowing what they mean.

    • LafinJack says:

      When calling out others for not knowing what words mean it helps to know what words mean.

      con·vic·tion [kuhn-vik-shuhn]
      1. a fixed or firm belief.

      conviction (kənˈvɪkʃən)
      — n
      2. a fixed or firmly held belief, opinion, etc

      Now if you'd called them out for using an easily misinterpreted word that is similar to titles used in the wiki articles of criminals, that would be different. But you didn't.

      • You're correct that "convictions" wasn't actually incorrect, and I was aware of the word's multiple meanings. I was more referring to "undiscerning views regarding C++" and "continued to propagate against C++" (since changed to 'proselytize').

  2. pavel_lishin says:

    Wow, the "convictions" section is totally not what I expected it to be. I'll admit, I'm disappointed.

  3. James Broadhead says:

    At least it wasn't a bug in your script that made the Sherriff's office try to convict the guy ...

    • pavel_lishin says:

      If you release a script that could be of use to police investigators, would bugs in that script potentially open you up to being charged with interfering with a police investigation?

      Assuming that the bugs are egregious enough that a cop actually gets personally pissed off, a la "Code For The Maintainer"?

      • nandhp says:

        I would hope that this would cover that situation pretty thoroughly:

        No representations are made about the suitability of this software for any purpose. It is provided "as is" without express or implied warranty.


  4. Nick Lamb says:

    My guess would be that the 21 second discrepancy is because the real forensic investigators found the PC in question was running 21 seconds off real time and adjusted the reported timestamps appropriately. This very simple explanation doesn't seem to have occurred to the blog writer, which is disappointing.

  5. Nathan Mahon says:

    Lets get back to this database format... wtf. Is looks like it's basically just an obscured CSV with line numbers and references to line numbers? Is there any point in it?

    • I've never seen any rational justification for the format itself. I can only assume McCusker was assigned the task without adult supervision and by the time he came back with a working implementation it was too late to worry about whether it was sane.

    • mentallill says:

      Wait, the hex numbers are in there as ASCII characters? That is...well, I'd say it's nearly as bad as its replacement, which at one point (I hope this is no longer true) made sure any database changes were synced to disk before, you know, updating the UI. Because users totally expect low-priority UI data (visited URLs) to be written back to disk synchronously, because how horrible would it be if your system crashed and you lost 30 seconds' worth of browsing history?

      Wait, LE UTF-16 encoded as ASCII hex escapes? Mork wins.

      Please tell me the end-of-line backslashes aren't real, at least?

  6. chuckw says:

    What was Casey looking at before that search, or after? Did she search for "chloroform," read a resulting page, and then search for "chlorophyll"?

    I wonder if anyone has done a search of what was on TV during that time. Was she watching a show that made a mention of chloroform?

    • chuckw says:

      I found the TV schedule for 2008 before I found this thread on WebSleuths about how Casey was hooked on General Hospital, which had a plot involving chloroform around that time.

      My work here is done.

      • bobsaget67 says:

        I've heard some people actually get off to chloroform. Helps with the whole surreal environment ideation phase of masturbation or something. They wake up feeling like they just had great sex apparently. Might try it out, but am not too sure...

  7. pohl says:

    The General Hospital story is contradicted by her own excuse for the search:

  8. When that idiot was first creating Mork, and trying to rouse up support for it, he tried to get the security group to switch to it from Berkeley DB. I remember the meeting where he tried to explain it to me .. I came away strongly recommending that nobody should have anything to do with it, or with him for that matter.

    I'm glad it has finally been expunged.

  9. whyrequired says:

    So in that old 2004 blog post where you wrote 'I asked on IRC #mozilla, and all I got was some random guy writing a term paper on the computer industry who wanted to interview me about the "good old days."' - did that guy ever get his interview?

  10. Alexandre Rostovtsev says:

    FWIW, here is David/Rys McCusker's own explanation of the Mork trainwreck and his role in it. Basically, according to McCusker:

    * He created Mork because it was the only way to satisfy moronic and inherently conflicting requirements stipulated by Netscape management.

    * Mork replaced some (thankfully unreleased) monstrosity that was even more horrid.

    * He could not publicly document the format due to silly Netscape corporate policy.

    * He knows that jwz called him a complete barking lunatic comment, took it in stride, but asserts that jwz's anger was directed at the wrong person.

    * He was only doing what the management asked. It's surely not his fault that the management asked him to torture thousands of innocent kittens create the world's worst database format.

    • jwz says:

      Yeah yeah, I've heard it before.

      People say all kinds of things.

    • Ben Brockert says:

      I only know him from these resume pages, and he seems like... what's the word... a shithead.

      "I accept little responsibility" what the fuck is that? He wrote the code. If he was just maintaining it, that'd be a different thing, but he's the author. I do more mechanical engineering now than programming, and occasionally have to design something to meet requirements that I think are dumb, but still the shit works and I'll accept responsibility if it doesn't.