Kevin Swindon

Kevin Swindon authenticated selected digital evidence for the prosecution on Day 36 and Day 37. An FBI supervisory special agent for Boston's Cyber Squad, he was accepted as a computer-forensics expert without objection. He explained forensic imaging, write protection, and MD5 comparisons used to verify copies and matching files. His task was to check selected material against processed device images, not to examine the entire collection or choose the evidence for trial.

His direct testimony connected exhibits to computers, removable drives, phone backups, and other devices. He described Inspire magazine material and files bearing al-Awlaki's name while distinguishing file presence from demonstrable access. He verified an exchange identified as involving Dias Kadyrbayev and Jahar on Kadyrbayev's phone; the court required redaction before admitting Exhibit 1153. He also attributed exported messages to iPhone backups and explained an MD5 chart showing common files across four devices. The court admitted digital exhibits over defense objections, including objections to derivative material.

Swindon distinguished recovered data from trial presentation versions. Translations had been added rather than recovered, DjVu files had been converted to PDFs, and carved files recovered from unused storage could be incomplete or impossible to open. He acknowledged changed carved-file titles and an intact presentation version despite the recovered file's non-intact condition. The court agreed to defense requests to correct the exhibits.

On cross-examination, William W. Fick questioned the selection of 151 Sony VAIO sub-exhibits from roughly half a million files and tested Swindon's knowledge of conflicting timestamps. Swindon could not explain a file-system-record-date column or resolve differing creation dates without more analysis. He acknowledged shared access to the Norfolk Street desktop, could not determine deletion dates for recovered Kingston-drive files, and did not confirm proposed links between Tamerlan's Samsung and the Watertown hard drive. He confirmed that TrueCrypt was not on the Sony. The court excluded further Samsung questioning that Fick argued concerned Tamerlan's motive, preparation, and role in the conspiracy.

On redirect by Aloke Chakravarty, Swindon explained MD5 and visual verification and reiterated that the checked exhibits were a subset of seized files. He confirmed a recorded login to Jahar's email account but did not identify the desktop user. His confirmation of device origins retained exceptions for translations, derivative products, changed titles, and converted files. On recross, he still could not identify the Windows artifact underlying the disputed date column and said consultation with AD Labs and the software was needed. He was then excused.