The last time anyone saw Susan Powell alive, at least the last time that can be proven, was Dec. 6, 2009. Ten years have now passed since that date.
In that time, Susan’s story has spread across the globe. Network and cable news shows have aired hours-long specials about the investigation into her disappearance, as well as the criminal probe that focused on her husband, Josh Powell.
An Unwelcome Anniversary
For Susan’s friends and family members, the anniversary marks a milestone they’d hoped to never reach. Susan, who Josh is widely believed to have murdered, has never been found. The manner of her death has not been determined. Questions persist about the circumstances of that snowy night a decade past.
Susan’s parents, Chuck and Judy Cox, sat down for a special interview with Cold, marking 10 years since their daughter vanished.
“Nothing’s really changed from our point of view because our daughter’s still missing, our children are still dead, our grandchildren are still dead,” Chuck Cox said. “Evil has been exposed, but our response to it is the same. It’s beyond our control.”
The interview was also the first time Susan’s mother, Judy Cox, shared her perspective with Cold on the record.
“It took me a long time to be willing to get in front of cameras or answer questions, because it hurts,” Judy said.
“Every time there’s a body found, every time there’s a you know cadaver found somewhere, we wait here,” Chuck said. “You kind of start wondering, ‘Well is this the one? Is our wait going to be over? Will we be able to put whatever’s left to her to rest with her children?’”
The Coxes also reflected on the legacy of abuse in the Powell family, passed down by Josh’s father, Steve Powell.
“Steve taught [Josh] to be who he was. And Steve’s parents affected him,” Chuck said. “It’s just a sad waste of a life, a waste of time, and the tragedy that his time in life, Steve ruined his family. But is he a victim? And who’s going to judge that? I’m not going to judge that.”
Judy described visiting Steve’s home one time when Josh and Susan were vacationing in Washington. Susan had left their sons, Charlie and Braden, with Josh at Steve’s home while she went to spend time with her family. However, Susan had forgotten something and returned to the Powell house to retrieve it.
“We’re going up the stairs to the second floor,” Judy said. “As soon as I got to the top of the stairs, she looked at me, she goes, ‘Do you feel it?’ I go ‘What? I feel uncomfortable. I am not exactly happy to be here.’ She goes ‘You feel the evil?’”
When police served a search warrant at Steve Powell’s home on Aug. 25, 2011 in search of Susan’s childhood journals, one detective described the scene as a “house of horrors.” Investigators uncovered Steve’s collection of voyeur videos, many focused on Susan, as well as more than 2,000 pages of journal entries about his daughter-in-law. Most of them were explicit.
“I want people to know this story so it doesn’t happen to them.”
Susan had spent years during her marriage to Josh attempting to counter the negative influence of his father.
“The only reason she stuck around as long as she did is because she was trying to follow every everything that [The Church of Jesus Christ of Latter-day Saints] taught, and she was not giving up on him,” Chuck said. “She kept investing time and energy and love and stuff to try and bring him back and save him and all that when he was a lost case from the beginning.”
Josh lost custody of his sons as a result of Steve’s arrest, due to the fact they had all been living under the same roof since December of 2009. However, during a court-authorized visit with the boys on Feb. 5, 2012, Josh bludgeoned Charlie and Braden and set fire to a home he had rented. All three died in the fire.
In the mean time, the Coxes find comfort in their faith, as well as in the knowledge that sharing their daughter’s story can help highlight the dangers of domestic abuse.
“[Susan] wanted to help [Josh]. She wanted to be a mom and have children and have a happy life and all that. And I think everybody still wants that, and everybody still looking for that,” Chuck said. “By sharing those experiences, talking about this and doing this, we’re helping a lot of people who are in different situations that may be similar but are different.
It’s a daunting thing to stand alone on a stage in front of a crowd.
On May 16, 2019, I stepped out from the wings on the stage of the Eccles Theater on Main Street in Salt Lake City, Utah to face just such a situation. It was a packed house. Looking out through the glare of the stage lights, I could see Susan Powell’s parents and close friends sitting in the first few rows.
Don’t screw this up, Dave, I thought.
Many of the rest of the more than 2,000 people in attendance for the special event, Cold Live, had come to hear the behind-the-scenes story of how the podcast had come to be. They had come to ask questions of myself, retired West Valley City police detective Ellis Maxwell and Utah Domestic Violence Coalition Executive Director Jennifer Oxborrow.
In spite of those nerves, I aimed to do my best in Susan’s honor.
Question and Answer
Both the dress rehearsal and the main event included question and answer sessions. Audience members submitted their questions online and using printed cards during the pre-show and intermission periods.
Ellis, the former lead detective on the Powell case, discussed his frustration in dealing with Josh during the first two weeks of the investigation.
“If we went and took this in front of a judge or court or a jury and we had her last will and testament, we had blood on the tile and we had a theory… I guarantee you that a defense attorney could take this case a thousand different directions to sway the jury or the judge,” Ellis said. “There is absolutely no way that he would have been convicted.”
Ellis said that changed by the spring of 2012, after police eliminated many of the other possible explanations for Susan’s disappearance. However, Josh killed himself and his sons before detectives could secure criminal charges against him.
“I had spectacular investigators on this case that really, really poured everything they had into it.”
Many of the questions aimed at Jennifer Oxborrow dealt with how to help loved ones who find themselves trapped in situations similar to Susan’s.
“It’s a difficult conversation to have. It’s very embarrassing to people sometimes. People just usually want the abuse to stop,” Jennifer said. “Avoid that question ‘Why do you stay? Why did you get yourself into this?’”
Instead, Jennifer said society needs to shift the focus onto the abusers, asking why they choose to mistreat their partners. She added that the most important actions people can take when confronted with situations of domestic abuse are to express support for the victims and direct them to resources.
Jennifer pointed out the availability of help through the Utah 24-hour domestic violence hotline, 1-800-897-LINK, or www.thehotline.org for people in other parts of the country.
How Cold Live Came to Be
KSL, my employer and the company behind Cold, had partnered with MagicSpace Entertainment to craft a program focused on Susan and her sons, Charlie and Braden. Together, we hoped to provide an enlightening look at how Susan’s life and loss have impacted not only her immediate friends and family, but also an entire community.
The director of Cold Live, Jim Millan, and I had spent hours discussing the proper approach.
“Conversations and questions coming at this from the personal and journalism angle created all the ideas for the stage presentation,” Jim said later.
We did not want Cold Live to turn into a funeral in absentia, or to glorify the more ghastly aspects of what occurred in the Powell family. Keeping Susan central was our goal.
“Working with Dave to help him write the story of his journey with Cold was fascinating,” Jim said. “He was open and curious about how it might share something new for an audience and determined to make it worth people’s time.”
A conversation was then playing out among the Cold audience about how Susan had become a victim of domestic abuse. By shining a light on the mistreatment she’d endured, we hoped to help others recognize the warning signs.
Glimpse Behind the Scenes
For me, Cold Live also provided an opportunity to share the backstory to how a news story that I had covered off-and-on throughout the years morphed into an idea for a podcast, then blossomed into an outright obsession. The quest for answers extended beyond the KSL newsroom, filling the dark and quiet hours at home as I reviewed hours upon hours of Josh Powell’s audio journals.
No such undertaking can occur without the help of many talented people. So, during Cold Live, the voice actors who took on the difficult task of portraying Susan, Josh and Steve Powell in Cold told of their experiences filling those roles.
Far too many others went without credit, like composer Michael Bahnmiller. I had to cut part from the program in the interest of time.
Many in the audience had never met or even seen the people who are portrayed in the podcast. Through several video clips, they were introduced with Josh’s ex-girlfriend Catherine Everett, his sister Jennifer Graves and the Powell’s daycare provider Debbie Caldwell, among others.
Susan’s oldest sister, Mary Douglass, even shared her perspective, something that was not present in the podcast itself.
After Cold Live
I walked off stage at the conclusion of Cold Live feeling a little hoarse. A sense of uncertainty and self-doubt pervaded. What would Susan have thought, I asked myself, had she been in the audience?
Susan’s parents and several of her close friends were in the lobby afterward. We shook hands and stood together for pictures.
In a conversation the next day, Susan’s mom, Judy Cox, told me how it felt sitting in the audience and listening to Ellis Maxwell describe his part in the investigation.
“You always learn from your mistakes,” Judy said. “I knew they were working hard and doing their best. We also felt frustrated about things because [Chuck Cox, Susan’s dad] wanted to try to be more involved.”
Chuck, for his part, shared a pragmatic perspective.
“Police aren’t miracle workers, they’re just police. They’re people doing their job,” Chuck said. “I do know their heart was in the right place.”
And, as a parting note, he offered words of thanks for the role that Cold has had in drawing new attention to his daughter’s story.
“I’m so thankful that you took the time to go through it,” Chuck said. “You’re getting the story out and teaching people some stuff. So thank you for the effort.”
Cold has uncovered new clues regarding the likely contents of an encrypted hard drive seized from the West Valley City, Utah home of Josh and Susan Powell on Dec. 8, 2009, one day after Susan disappeared.
The Josh Powell hard drive was encrypted and has never been accessed, in spite of extensive efforts by law enforcement and ongoing work involving private digital forensics experts.
It is not clear whether or not the device might hold clues pointing to Susan’s whereabouts. However, breaking the encryption could reveal new information about Josh’s activities in the weeks prior to the disappearance.
The Josh Powell Hard Drive
Detectives seized the device in question while serving their first search warrant at the Powell family’s home on Sarah Circle in West Valley. They located it in the downstairs bedroom that Josh used as his home office. The Western Digital-brand MyBook World Edition was connected by way of an ethernet cable to Josh’s home network.
The MyBook World drive had been in that same position for at least a year and a half. Susan pointed it out while recording a video documenting the family’s assets in July of 2008.
“This is some type of backup device,” Susan said in the video. “It says WD on the side. I don’t know, it like shares the information somehow.”
West Valley police investigating Susan’s disappearance discovered the MyBook World drive was inaccessible after delivering it to the FBI’s Intermountain West Regional Computer Forensic Laboratory or RCFL in Salt Lake City. Based on the FBI’s analysis, it appeared the whole drive had been encrypted using a freeware tool known as True Crypt.
Not all of Josh Powell’s hard drives were similarly encrypted. While reviewing data from Josh’s other computers and digital storage devices, investigators flagged several files referencing encryption, hoping to discover possible passwords or other insights that might help them gain access to the MyBook World drive.
One of those files resided on an array of hard drives in Josh’s desktop computer tower. It had the file name vvdb1NetworkEncrypted.tdb.
The Cold podcast obtained a copy of that file and discovered it is a tracking database created by a file backup app called ViceVersa Pro. The database contained a log of files ViceVersa Pro had transferred to a disk named “mybookworld.” While the database did not hold copies of the files themselves, it did record their names and the locations to which they were saved on the MyBook World drive.
Based on this evidence, Cold believes the ViceVersa Pro database is likely an at least partial log of the files saved to the encrypted Josh Powell hard drive.
Josh made an effort to determine whether or not police had gained access to the MyBook World drive in the months immediately following Susan’s disappearance.
His defense attorney, Scott Williams, contacted police by email in March of 2010, requesting the return of his client’s digital devices. West Valley police Sgt. Robert Bobrowski refused, but offered to have detectives seek out any individual files Josh might need.
“If it is in the encrypted section then your client will need to provide the password to help the process move along,” Bobrowski wrote to Williams.
Josh had previously told police he could not remember the password to the encrypted MyBook World drive.
“If possible, pleas send all photos, audio, and video files you can find. There will be some hundreds of gigabytes in total.”
On April 5, 2010, Josh provided police with a list of files he wanted them to retrieve for him. At the top of the list were his photos and videos, which he described as “basically unreplaceable [sic].”
“Everything that can be released from the white Western Digital drive would be greatly appreciated,” Josh wrote.
West Valley police were unable to accommodate Josh’s request.
In truth, Josh already had copies of many of those files safely in Washington. This became clear after police served a search warrant at the home of Josh’s father, Steve Powell, in South Hill, Washington on Aug. 25, 2011. At that time, they once again seized Josh’s computers and digital devices.
An RCFL examination of those devices revealed some of them contained copies of Josh’s photo and video library, the very files he had claimed were not replaceable.
Decipher Forensics Attacks the Josh Powell Hard Drive
On Feb. 5, 2012, Josh Powell killed himself and his sons, Charlie and Braden. The murder-suicide forever deprived police of the possibility that Josh might voluntarily provide the password for the MyBook World drive. The subsequent release of West Valley’s redacted case files in May 2013 publicly revealed for the first time the existence of the still-encrypted Josh Powell hard drive.
Richard Hickman, who was then a partner in a Utah-based digital forensics firm called Decipher Forensics, saw media reports about the encrypted drive. He contacted Susan’s father, Chuck Cox, and offered to attempt to crack the encryption.
“I reached out and said ‘hey, we’d be willing to take a look at it at no charge,’” Hickman said.
Another partner at Decipher, Mike Johnson, had built a pair of powerful computers to mine cryptocurrency. Hickman told Cox those machines could also be used for password cracking. Cox convinced West Valley police to meet with Decipher.
Police case records showed Detective Ellis Maxwell, the now-retired lead investigator on the Powell case, provided Decipher with a copy of the MyBook World drive in December of 2013.
Box Within A Box
Trent Leavitt, a third partner at Decipher, said they put their computers to work on what’s known as a dictionary attack in an effort to guess the password. The dictionary was built off of lists of common passwords collected from past data breaches. Special software used that dictionary, along with variations, to attempt to unlock the encryption.
After a period of time, the software reported success. It had discovered that the encryption on the MyBook World drive accepted the password “ap1124.”
“It’s six characters,” Trent said. “It’s really simple.”
However, when Decipher attempted to access the drive, they discovered it was blank. This led them to believe that Josh had utilized a feature of True Crypt that allowed for the creation of invisible encrypted partitions nested within encrypted volumes. In essence, a box within a box.
“There might not even be a second layer,” Hickman said. “It could just be, we cracked that top code and it was an empty hard drive.”
The Decipher Forensics team put their machines back to work in an effort to crack the suspected second layer of encryption. The software ran through billions of possible passwords.
“That thing would run around the clock, 24/7, for months, if not, you know, close to two years before those things burned up,” Trent said. “And still didn’t break it.”
In October of 2017, word leaked that the Decipher team had succeeded in cracking a password for Josh’s MyBook World hard drive. However, West Valley police had Decipher under a non-disclosure agreement. They were legally prohibited from discussing their work.
“We didn’t talk about the fact that we were even doing it with anybody.”
A short time later, the firm Eide Bailly purchased Decipher Forensics. Richard Hickman and Mike Johnson left the company, but Trent Leavitt brought their copy of the MyBook World drive to Eide Bailly’s new state-of-the-art digital forensics lab in Lehi, Utah.
His work on the Powell case has continued there, when time and resources have permitted.
“Most of its done after hours,” Trent said. “We’ll get together as a group and meet and pull our computers out and start working on it. We’ll collaborate on whiteboards.”
Focusing Sunlight on the Josh Powell Hard Drive
The public revelation of Decipher’s work in late 2017 drew the attention of cybersecurity analyst Rob Burton. He worked for a large corporate employer in West Valley City as a digital forensics specialist and had a keen interest in the Susan Powell case.
“The Susan Powell case had a big impact on me personally,” Rob said. “I was aware of it 10 years ago when the news first broke of Susan’s disappearance and the involvement of Josh Powell.”
Rob decided to approach West Valley police. Like the team from Decipher Forensics and Eide Bailly, he offered to volunteer his time and expertise to the password cracking effort. Police accepted his offer and provided him with a copy of the MyBook World drive. They also required that he sign a non-disclosure agreement.
“I knew I just couldn’t just create a folder on my computer called ‘Susan Powell project’ because I was under NDA and kind of had to keep it hidden,” Rob said.
He decided to give that folder the codename “Project Sunlight.”
“There’s a lot of dark things related to this case. And especially after listening to the Cold podcast. Josh, Steven and some of their activities and efforts and a lot of dark subject material. But there’s hope and there’s light,” Rob said. “Sunlight is the best disinfectant, I think.”
Hear the surprising discovery we made in Josh Powell’s digital data in a bonus episode of Cold: Project Sunlight.
Josh and Susan Powell moved from their home state of Washington to Utah at the beginning of 2004. Neither had a job lined up, nor did they have a place to live planned.
Prior to the move, the Powells had worked as live-in managers at a pair of senior living communities. They’d run afoul of management at the first, Orchard Park in Yakima, Washington, due in part to excessive absenteeism related to medical treatment.
That treatment, comprising several months of chiropractic and massage therapy care, had followed a minor car crash on May 12, 2003 in the community of Union Gap, Wash.
Records now recovered exclusively by Cold raise questions about the necessity of the treatment and suggest fraudulent behavior in this and other Josh Powell car crashes.
Josh Powell Car Crashes
The Union Gap crash occurred as Josh and Susan Powell were driving northbound on an I-82 frontage road called Rudkin Road.
Another motorist who was behind the Powells had glanced away from the road for a brief moment. Bob Powers told Cold he recalled looking back to see the minivan stopped in front of him, for no apparent reason.
“There’s clear roadway ahead, no stop lights, no stop signs, no right or left turn opportunities,” Powers said. “There was no reason for him to be stopped dead center in the middle of the road.”
Powers’ Lexus ES240 sedan collided with the Powell’s minivan at a low speed. The crash caused minor damage to a headlight on the car.
Repair records from Greenway Auto Body in Yakima showed the crash also left a small dent in the rear bumper of the minivan. The shop billed $1275 to Powers’ insurance to repair the damage.
Photos taken by appraiser Kelly Lawson and included with the body shop paperwork showed the damage was mostly cosmetic.
A Union Gap police officer responded to Powers’ phone call reporting the crash. A report authored by the officer described Josh as having claimed he had slowed to make a left-hand turn. The officer’s report also noted that “no injuries were reported.”
Josh Powell Car Crashes and Whiplash
Following the crash, Josh had Susan drive him to Memorial Hospital in Yakima. Josh sought an evaluation in the emergency department for symptoms of whiplash.
Records retained by Josh Powell and recovered from his digital archive by the Cold podcast, with the assistance of digital forensic experts at the firm Eide Bailly, showed he received a prescription for Vicodin. Josh was also advised to avoid strenuous activity at work “for 3-4 days.”
Susan Powell did not complain of any pain the evening of the crash. She did not request an evaluation at the hospital. However, the morning after the crash, she went to a clinic with general body aches. Susan received a prescription for Celebrex, which she did not end up taking, and similar advice regarding light duty.
On the second day after the crash, Josh convinced Susan they both needed to see a chiropractor. Josh had found one he liked in the Yellow Pages. Josh and Susan spent the next two months seeing the chiropractor two or three times per week. They also made multiple visits to a massage therapist.
All of those visits were billed to auto insurance.
Evidence Against Josh Powell’s Injury Claim
In mid-July, 2003, Josh Powell decided that his recovery had plateaued. On July 16, 2003, he transferred his and Susan’s care to a different chiropractor.
However, only three days earlier, Josh and Susan had visited a trucking business in Kent, Wash. Josh at the time was considering obtaining a commercial driver license. In video recorded that day by Josh’s father, Steve Powell, Josh can be seen using his arms and upper body to steer a tractor-trailer.
By coincidence, that day was also when Steve Powell confessed his infatuation with Susan to her in a conversation he accidentally captured on tape.
Josh Powell’s personal notes indicate the second chiropractor advised the Powells they should hire a personal injury attorney in an attempt to extract a settlement from Bob Powers’ insurance company. Josh resisted this idea, opting to instead negotiate with the insurance company directly.
“I actually had no idea that this guy had made any claim whatsoever with my insurance company until you guys had come up with that information.”
By August, both insurance companies involved in the claim had become suspicious about the necessity of the ongoing chircopractic and massage therapy treatments. Josh’s insurance provider, Pemco, ordered the Powells to undergo independent medical evaluations.
Josh and Susan Powell’s IME
Records show both Josh and Susan Powell took part in those evaluations on Aug. 19, 2003.
The evaluator noted that Josh complained of “aching, stabbing, or burning pain” in his neck, as well as headaches. Josh also described having hit his head at the time of the crash and blacking out “for about two seconds following the accident.”
On an intake form, Josh checked boxes indicating he was experiencing severe or frequent headaches, shaking or twitching in limbs, loss of motion in joints, spine abnormality and excessive worry or anxiety.
Susan did not check any boxes indicating current symptoms.
The IME paperwork also revealed both Josh and Susan had each missed eight days of work following the crash.
Josh also told the evaluator that he had no “previous problems involving his neck or mid back prior to the motor vehicle accident of May 12, 2003.” In fact, this was the second in a series of three Josh Powell car crashes from which he’d claimed injury. Josh had received similar treatment for neck and back pain following the first crash in June of 2000.
In the end, Pemco agreed to cover the lion’s share of the medical costs. It refused to pay for specific treatments provided by the second chiropractor, finding them to be “not reasonable.” Pemco, in turn, received reimbursement from Bob Powers’ insurance provider, State Farm.
Josh Powell’s own negotiations with the other insurance provider proved lucrative. He ended up receiving a check for more than $6,000, above and beyond the covered medical expenses.
Josh Powell on Unemployment
A dispute over Josh and Susan’s missed work time as a result of the May 2003 car crash contributed to a worsening of their standing with their employer, Holiday Retirement. In a probationary move, they transferred to a different senior living center in Olympia, Washington toward the end of 2003.
However, that move brought Josh and Susan Powell physically closer to Steve Powell, who Susan had gone to great lengths to avoid in the months following her rejection of his love confession. So, in the waning months of the year, Josh and Susan decided to move to Utah.
The couple spent the first few months of 2004 living with Josh’s older sister, Jennifer Graves, and her family in West Jordan, Utah.
They obtained jobs with Fidelity through a temp agency. Josh lost his within a matter of days. By February, he was receiving unemployment insurance benefits from the Utah Department of Workforce Services.
Susan Powell Insurance
On Feb. 8, 2004, Josh filled out paperwork applying for private health insurance coverage from IHC Health Plans. On the form, he listed his occupation as “manager.” He did not disclose that he was unemployed.
Elsewhere on the form, Josh wrote that he and Susan were both in “great health.” On a section of the form dealing with past prescription medications, he omitted the pain medications both he and Susan had received after the May 12, 2003 car crash in Yakima.
Insurance application processing notes later recovered by West Valley City police through an investigative subpoena showed IHC Health Plans quoted Josh a 15% rate increase due to his and Susan’s recent neck and back pain.
Those processing notes included a history of contacts between the insurance agent, sales representative and underwriter. In one exchange, the agent described Josh as “quite difficult to work with” over a request for records related to the chiropractic treatment.
In the final exchange captured in the processing notes, the sales representative asked the agent what it was that Josh managed. The agent replied that she had learned Josh was actually “between jobs.”
Hear about the two other Josh Powell car crashes in a bonus episode of Cold: Car Crash Con.