State v. Cooper

747 S.E.2d 398

STATE of North Carolina

v.Bradley Graham COOPER.

No. COA12–926.

Court of Appeals of North Carolina.

Sept. 3, 2013.

Appeal by Defendant from judgment entered 5 May 2011 by Judge Paul G. Gessner in Superior Court, Wake County. Heard in the Court of Appeals 9 April 2013.

Attorney General Roy Cooper, by Assistant Attorney General Daniel P. O'Brien and Assistant Attorney General LaToya B. Powell, for the State.

Glover & Petersen, P.A., Chapel Hill, by Ann B. Petersen, for Defendant–Appellant.

McGEE, Judge.

Bradley Graham Cooper (Defendant) and Nancy Lynn Rentz Cooper (Ms. Cooper) were married in October 2000, and they moved to Cary from Canada in January 2001. They had two daughters (the daughters). Defendant worked for Cisco Systems, Inc. (Cisco). By 2008, Defendant's marriage to Ms. Cooper was in difficulty and, by April 2008, Ms. Cooper had hired a family law attorney and planned to move out of the marital home. Defendant and Ms. Cooper were still living in the marital home in July 2008, though they were leading mostly separate lives and were sleeping in separate bedrooms.

Defendant and Ms. Cooper attended a party at a neighbor's house on the evening of 11 July 2008. There was testimony that Defendant and Ms. Cooper argued at the party. Defendant left the party that evening, around 8:00 p.m., to put the daughters to bed. Ms. Cooper left the party a little after midnight, on 12 July 2008.

Sometime during the morning of 12 July 2008, Ms. Cooper disappeared. Defendant subsequently gave the following account of events to investigators about the morning of 12 July 2008: one of the daughters awoke between 4:00 a.m. and 4:30 a.m., and had difficulty getting back to sleep. The daughter wanted milk, but there was none at the house. Defendant went to a Harris–Teeter at about 6:30 a.m. to buy milk, and then returned home. Ms. Cooper was doing laundry, but had run out of detergent. Defendant returned to the Harris–Teeter to buy detergent and, while on his way there, received a call from Ms. Cooper asking him to get some “green juice.” Receipts and surveillance video from the Harris–Teeter confirm that Defendant bought milk at 6:25 a.m., left the store, then returned and bought detergent and juice at 6:44 a.m. After Defendant bought the detergent and juice, he returned home. At about 7:00 a.m., Ms. Cooper called to Defendant, who was upstairs, and told him she was going running. Defendant remained at home with the daughters and, when Ms. Cooper did not return from her run when expected, Defendant called a friend and cancelled a tennis date he had planned. Defendant stated he did laundry and cleaned around the house and, in the early afternoon, drove around with his daughters, looking for Ms. Cooper.

Evidence at trial tended to show that police began questioning Defendant that same day, and asked if they could take photographs of the couple's house. Defendant consented, and police photographed every room. Defendant provided police with a pair of Ms. Cooper's running shoes in order to give a police tracking dog Ms. Cooper's scent. However, the dog could not pick up a trail.

Police returned to the house the next morning, 13 July 2008, and questioned Defendant further. Police questioned Defendant more that day and the following day, 14 July 2008. Cary Police Detective George Daniels (Detective Daniels) asked Defendant for permission to look through Defendant's car and Ms. Cooper's car, and Defendant consented.

At approximately 7:00 p.m. on 14 July 2008, a body was found just off Fielding Drive, which was a short drive from Defendant's and Ms. Cooper's house. Detective Daniels went to Defendant's house at approximately 10:00 p.m. on 14 July 2008, and informed Defendant that a woman's body had been found on Fielding Drive. At that time, identification of the body had not been determined. However, on 15 July 2008, the body was affirmatively identified from dental records as being that of Ms. Cooper. The cause of death was determined to be strangulation. The time of death could not be determined with specificity. However, it was determined that Ms. Cooper died some time in the twelve-hour period between shortly after midnight on 12 July—when she was last seen at the party—and approximately noon that same day.

Around 5:20 p.m. on 15 July, Defendant vacated his house in order to preserve the house as a possible crime scene. One of Defendant's laptops (the laptop) was left in Defendant's house and was connected to the internet for approximately twenty-seven hours on 15 and 16 July, after Defendant had vacated the house. Cary police, pursuant to a warrant, searched both Defendant's house and his car on 16 July 2008. Police also seized the laptop, along with another computer, and various other computer-related components.

Defendant was indicted for Ms. Cooper's murder on 27 October 2008. Trial began on 28 February 2011. There was testimony concerning the strained relationship between Defendant and Ms. Cooper, and suspicious behavior on the part of Defendant, both before and after Ms. Cooper's disappearance. However, the sole direct evidence linking Defendant to the murder was obtained from the laptop that had been left on and connected to the internet after Defendant vacated his house.

The State presented expert testimony from FBI Special Agent Greg Johnson (Special Agent Johnson) and Durham Police Detective Chris Chappell (Detective Chappell), both of whom testified as forensic computer analysts. Special Agent Johnson and Detective Chappell were forensic examiners of the Computer Analysis Response Team (CART). CART extracts “evidence off of seized digital media” such as computer hard drives. The first part of the forensic process involves taking inventory of the components. CART then checks for any portable media in or attached to the computer, opens up the case of the CPU and removes the hard drive(s). CART handles all seized material carefully so as not to compromise or contaminate the data. According to Special Agent Johnson's testimony, the integrity of the hard drive is protected by making a “forensic image” of the drive, which is “a copy that we make of the hard drive. It's a bit-per-bit copy, which gets every piece of ... information off of the hard drive and puts it into what we call forensic image.” Examination then occurs of a different hard drive containing the forensic image, not the original hard drive. The forensic image requires some type of specialized software to read and “interpret those files that it creates.”

Members of the CART team performed these forensic retrieval and information processing techniques on the hard drive from the laptop. The CART team used software called Forensic Tool Kit, or FTK, to process that hard drive. FTK and similar programs index files retrieved from the hard drive, allowing for specific searches for particular data to be performed. An FTK report was then created based upon the particular search parameters utilized. One of the sub-sets of files collected in the FTK report for Defendant's laptop was temporary internet history files for dates close in time to Ms. Cooper's murder.

Special Agent Johnson and Detective Chappell testified that the temporary internet files recovered from the laptop indicated someone conducted a Google Map search on the laptop at approximately 1:15 p.m. on 11 July, the day before Ms. Cooper was murdered. They concluded that this search was done by someone using the laptop while it was at the Cisco office where Defendant worked. The State's experts testified that the Google Map search was initiated by someone who entered the zip code associated with Defendant's house, and then moved the map and zoomed in on the exact spot on Fielding Drive where Ms. Cooper's body was found.

Defendant presented evidence at trial. Defendant called Jay Ward (Ward) to testify concerning the incriminating Google Map files recovered from the laptop. Ward had worked for more than fifteen years in the computer field, specializing in computer network security. When Defendant called Ward, the State objected, challenging Ward's credentials to testify as an expert concerning the relevant Google Map files.

The State focused on Ward's lack of training and experience as a forensic computer analyst. The trial court agreed with the State and, on 19 April 2011, ruled that Ward could not testify specifically about the Google Map files. Ward was allowed to give general testimony concerning the ease with which files could be altered or planted on a computer that, like Defendant's, had been left connected to the internet. Defendant argued, since the trial court did not find the methods by which Ward obtained his data to be reliable, that Ward be allowed to testify based upon the data produced by the State's forensic analysts. The trial court denied Defendant's request. Ward testified on voir dire that had he been allowed to, he would have offered his opinion that the incriminating Google Map files had been planted on Defendant's computer, and he would have further testified to the specific aspects of the files that had led him to this conclusion.

Following the trial court's ruling, Defendant immediately sought a forensic computer analyst that he could call to testify concerning the Google Map files. Defendant located a forensic computer analyst, Giovanni Masucci (Masucci), on 20 April 2011. As the court session began on 21 April 2011, Defendant gave notice of Masucci as Defendant's replacement expert. Masucci had examined the data produced by the State's forensic computer analysts, and produced a report. Masucci's report indicated that the data results obtained by Ward matched the results obtained by CART. Masucci's conclusion was the same as Ward's: that the Google Map files had “been placed on the hard drive [and] could not have been the result of normal internet activity.” Masucci's curriculum vitae was sent to the State on 22 April 2011, and Masucci's report...