Mark Spencer

Mark Spencer testified for the defense as a digital-forensics witness, comparing computer histories and tracing files across devices associated with the Tsarnaev brothers. On Day 42, he identified firearm, electronics, fireworks, and pre-bombing Marathon searches on Tamerlan's Samsung that he did not find among the corresponding Sony records. These contrasts addressed the defense's account of the brothers' relative roles, but Spencer's analysis concerned devices and accounts, not proof of who operated them.

Spencer linked ordinary files on the Laurel Street hard drive to the Samsung's Umar account, while noting exceptions for system files without traditional ownership identifiers. He described records suggesting that Complete Inspire was copied from the Samsung to the Sony through the missing Patriot thumb drive on January 21, 2012. He treated that route as an inference, had no forensic image of the Patriot, and cautioned that creation dates could reflect copying or moving rather than original authorship.

Under cross-examination, Spencer confirmed Sony searches for the call of jihad and Jannah al Firdaus, material he understood as jihadi-related on both laptops, and Dzhokhar's use of the Samsung. He maintained that forensic records could not identify the person at the keyboard with specificity or establish that person's thoughts. On redirect, he explained why extracted search artifacts might lack dates or fail to establish a typed search; the court admitted 13 Samsung search-history pages over a scope objection. On recross, he confirmed relevant April 15 and April 16, 2013 dates but could not identify who made the searches.

Returning on Day 54, Spencer presented MacBook search records, Samsung browsing and Skype records, encrypted volumes, and desktop material. He identified Katherine Russell as the MacBook operating-system username and described searches about rewards for wives of a shahid or mujahidin. He said three Samsung encrypted volumes shared a password supplied by the government and also stored elsewhere on the computer. The court admitted Exhibit 3306 and allowed him to read a supplied sticky-note translation because it was already in evidence. Spencer qualified the recreated desktop's accuracy and distinguished its image folder from browser-cache storage. Fick displayed images and played excerpts from admitted files; the prosecution had no questions after the resumed direct examination, and Spencer was excused.