4.Kevin Swindon — Direct (Part 2)
870 lines(SIDEBAR CONFERENCE AS FOLLOWS:
MR. FICK: So this is the contents, at least as of yesterday, of this exhibit, the disk exhibit here. These four directories contain the various files from inside the computer, as far as I can tell. These are the various derivative spreadsheets that somebody at the FBI, the U.S. Attorney's Office, I don't know who, created. And without a foundation, I don't see any basis to admit those things into evidence.
MR. CHAKRAVARTY: He's verified each of those spreadsheets. He didn't personally create them, but he knows what they are, and he knows how they were created. And he has verified that that content is on that computer.
MR. FICK: As I heard his testimony, he verified the files that were on the computer. He didn't say he verified the images.
THE COURT: Can I --
MR. FICK: Absolutely.
Whether or not he verified it, there's a question, a foundational question, of who made it, what procedures they used to make it. If he doesn't know, I would suggest a huge confrontation clause, Melendez-Diaz and its progeny, problem about this kind of evidence.
MR. CHAKRAVARTY: First, he's an expert. He's allowed to provide hearsay for Melendez-Diaz purposes. But, more importantly, if he's confirmed that this is data that's on the computer in a variety of the different metadata exports that forensic software allows them, then that's his competence. That's what he is allowed to say.
MS. CONRAD: May I just --
THE COURT: How do I get back to the list?
THE COURT: Maybe just do that?
MR. FICK: Even if an expert can rely on hearsay, to put in the actual documents into evidence is another question entirely. You know, these are not -- the contents of the spreadsheets are not -- the spreadsheets themselves were not on the computer. What some human being has done is collected the information, put it in the spreadsheet, and presented it. It's like a summary chart except the person who makes the summary chart ought to testify about how it was made and to verify that it's accurate.
THE COURT: Maybe. But I don't think necessarily if it's someone with knowledge of what it is and can say that's what it is.
MR. FICK: I think our ultimate position would be that all he's testified about now is verifying the files. There's no foundation there about the spreadsheets.
THE COURT: I agree with that. I think we need additional information about how those spreadsheets were prepared. I think it's likely that they will be submitted.
MR. FICK: We would maintain a confrontational Melendez-Diaz objection on top of the basic foundation issue.
That's actually a good suggestion Miss Conrad makes. The spreadsheets really ought to be a separate exhibit so that the jury doesn't get confused about what's from the computer and what's derivative. Right now, the way the government has done it is the disk has an exhibit number; the spreadsheets have a subnumber.
THE COURT: I think it can be made clear. It might be a better idea to have them separate. I don't think it's confusing for them to have --
. . . END OF SIDEBAR CONFERENCE.)
THE COURT: That's 1142, I guess, right? 1142, is that it?
MR. CHAKRAVARTY: Yes, your Honor.
THE COURT: All right. That's admitted.
(Exhibit No. 1142 received into evidence.)
MR. CHAKRAVARTY: So, Mr. Bruemmer, if I could ask you to open the display copy of 1142.
THE COURT: Is this all for everyone, right?
MR. CHAKRAVARTY: I think so. If it's admitted, then 1142 can be, your Honor.
MR. CHAKRAVARTY: This first folder structure has identified just what device this was from?
KEVIN SWINDON: Yes. That corresponds to the spreadsheet, yes.
MR. CHAKRAVARTY: And so what is this?
KEVIN SWINDON: This is the main root directory structure within that CD. The several files that are identified as where possible files were found on that computer in addition to there's a number of files there that were, as we talked about before, those derivative files that were created.
MR. CHAKRAVARTY: The first four folders, is that what you meant that they correspond to the structure?
KEVIN SWINDON: Actually, just Anzor files and public correspond.
MR. CHAKRAVARTY: I'm sorry. What was Anzor?
KEVIN SWINDON: I'm sorry. Anzor and public correspond files, and derivative derived Mobilsync do not.
THE COURT: I'm not following.
MR. CHAKRAVARTY: I'm not following either.
MR. CHAKRAVARTY: Can you explain what the first four folders are?
KEVIN SWINDON: There are four folders on that drive: one called Anzor; one called derived Mobilsync data; one called files; and one called public. Both Anzor and public existed on the drive in that way or in that -- the way that it looks on the screen there. Mobilsync data and the files were added for organizational purposes on the CD.
MR. CHAKRAVARTY: Okay. So were the contents of these folders actually on the 1R6 Sony Vaio computer?
KEVIN SWINDON: The Anzor and the public, yes; the derived Mobilsync data has information in there that was derived from the Mobilsync backup on the computer. And then the files do have files that were derived from that -- from 1R6, yes.
MR. CHAKRAVARTY: So can you explain whether you're talking about all of the contents of these folders was from the computer?
KEVIN SWINDON: No. As we discussed earlier, the sum of everything is voluminous. This was strictly just selected files that were provided to me to verify and validate whether they existed on 1R6.
MR. CHAKRAVARTY: Who provided you with the files that were of interest?
KEVIN SWINDON: The investigative team did.
MR. CHAKRAVARTY: So you said that there were, I think, derived files in the derived Mobilsync data folder and the files folder. What did you mean by that?
KEVIN SWINDON: On 1R6, there existed Mobilsync backup files. Mobilsync backup files are associated with typically an Apple product. If you had an iPhone and you plugged your iPhone into your computer and wanted to do a backup of it, it creates a backup file on that computer which would store a number of pieces of information including potentially contacts, information about the phone, your address list, your previous texts, your previous calls and your call log and images also from the phone.
MR. CHAKRAVARTY: And the Anzor and the public folders, do those correspond to two different user accounts on the computer?
KEVIN SWINDON: They do. I recognize those as being two different user accounts from the 1R6.
MR. CHAKRAVARTY: And the files folder, what's in that?
KEVIN SWINDON: The files folder was created for organizational purposes. Inside that files folder are other files from the drive.
MR. CHAKRAVARTY: Okay. Then outside of each of those folders, there's a number -- there are a number of PDF files, with the exception of one text file, numbered 142-1 through 13 and 142-151. Can you explain what each of those are in turn?
KEVIN SWINDON: Would you be able to bring those up one by one?
MR. CHAKRAVARTY: Sure.
KEVIN SWINDON: Thank you.
MR. CHAKRAVARTY: This is 1142-01. What is this?
KEVIN SWINDON: A little difficult to read on the screen. What this is this was an export of the internet activity that was identified on 1R6.
MR. CHAKRAVARTY: And how is internet activity exported?
KEVIN SWINDON: There are internet history files that exist on your computer. And a product -- a third-party product application was used for analysis called Internet Evidence Finder. It takes the internet history files and then puts them in a usable format. This here is a selection of the internet activity.
MR. CHAKRAVARTY: And so is this a subset of all of the internet history that was exported using that software?
KEVIN SWINDON: Yeah. I believe so, yes. I was given this file to determine whether or not these -- this internet history existed on the drive.
MR. CHAKRAVARTY: And did you, in fact, confirm that?
KEVIN SWINDON: We did.
MR. CHAKRAVARTY: Is that through AD Labs, that software tool that you said earlier?
KEVIN SWINDON: We used Internet Evidence Finder to parse out or to look into the internet history files.
MR. CHAKRAVARTY: I'm sorry. Internet Evidence Finder, is that another commercially available tool?
KEVIN SWINDON: Commercially available product, yes.
MR. CHAKRAVARTY: Let's go to 1142-2. What is this?
KEVIN SWINDON: This spreadsheet here is going to take a little bit of an explanation. This spreadsheet here is a snapshot of -- in Windows 7 and above, there are files on that computer called jump files or a jump list. A jump list is similar to what we would think of as a shortcut. When you create a shortcut on your desktop or you create a shortcut for a file, Windows creates these things called jump lists. What jump lists track is a number of different things that happen when you open up a file. You need a third-party application like Internet Evidence Finder to be able to look into that jump-list file. But in there are several different artifacts, what you see here.
MR. CHAKRAVARTY: So can you explain what these columns are and what information they tell you?
KEVIN SWINDON: In the jump list, utilizing the parser software, we're able to see this -- typically, this report was provided as removable media or drives or anything associated -- it was associated with a D drive, which is typically an external drive or other than your C drive, which would be your hard drive on your computer. What happened -- this would be a designation of what information existed in the jump list for these dates and times for these files.
MR. CHAKRAVARTY: Okay. When you say "external drive" and you talk about a "D" drive, what is -- explain how the computer assigns it the letter D.
KEVIN SWINDON: What happens in Windows is it's your first -- typically, your hard drive on your computer is a C drive. That becomes your initial -- or your drive where your operating system is stored. If you don't have a CD-ROM or a DVD or those are not designated, what will happen is Windows then goes to the next letter to designate the next drive that you put in that computer. So if you only had your C drive on your computer and you took a thumb drive or some external hard drive and plugged it into your computer, in order for Windows to access it, it needs to give it a drive letter. It would give the next drive letter available, and in this case, it was -- it would have been the D.
MR. CHAKRAVARTY: And so does this spreadsheet indicate when devices were plugged into this computer?
THE COURT: Overruled.
KEVIN SWINDON: The jump-start file, the jump-start information, has a bunch of information within it -- encapsulated within that jump list. In there could be when the creation date or when that first device or when that date and time of when that first file was created on that computer or viewed on that computer.
MR. CHAKRAVARTY: When you say "could be," why do you say "could"?
KEVIN SWINDON: There's a lot of variables based on time -- your date and time on your computer may not be completely in sync with the date and time that we're looking at right now here in the courtroom or maybe there's some other reason why it didn't collect the date and time when it was inserted into the computer.
MR. CHAKRAVARTY: The volume label and the volume serial number, what are those?
KEVIN SWINDON: The volume label is typically associated with the device itself. It may designate the device. The volume serial number is the unique ID that Windows would give it in order to access the -- make the drive accessible within Windows.
MR. CHAKRAVARTY: And some of these, they don't have a name. Is there a reason for that?
KEVIN SWINDON: Yeah. Other than I recognize those directory structures as being associated with a camera, I don't know why there's a volume -- not a volume label there.
MR. CHAKRAVARTY: And the word "Patriot" -- the words "Patriot" and "Kingston," what do those means?
KEVIN SWINDON: In this investigation or in this spreadsheet here?
MR. CHAKRAVARTY: In the spreadsheet.
KEVIN SWINDON: In the spreadsheet, they would be associated with the name of a thumb drive.
MR. CHAKRAVARTY: Can you --
KEVIN SWINDON: Or the manufacturer of a thumb drive.
MR. CHAKRAVARTY: Can you explain local path, what this content is in that column?
KEVIN SWINDON: Typically, in the local path -- what this would show is that this volume label or this Patriot, this device that was named Patriot, was plugged into this -- you scrolled up on me there.
MR. CHAKRAVARTY: Sorry.
KEVIN SWINDON: This YouTube video, this word, Rasool Allah, Inspiring Words of Truth, video was accessed on this computer, and then Windows created this jump list which then collected this information.
MR. CHAKRAVARTY: Looking at the last two entries, can you interpret what this -- the last -- the second -- the penultimate entry indicates based on this spreadsheet?
KEVIN SWINDON: The last two entries appear to be link files, exclusively link files, which show that the D drive -- or if we're looking at the second one from the bottom, again, then the Patriot volume label had a file on there called completeinspire.pdf with that volume and was accessed at that date and time.
MR. CHAKRAVARTY: For the Complete Inspire, it says January 21, 2012?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: And what's the next file?
KEVIN SWINDON: It says, "jointhecaravan.pdf."
MR. CHAKRAVARTY: Does that say it was created on January 28, 2013?
KEVIN SWINDON: Yes, it does.
MR. CHAKRAVARTY: And last accessed March 15, 2013?
KEVIN SWINDON: If you can scroll up to the top column? Yes. That typically would be the last time that that file potentially could have been accessed.
MR. CHAKRAVARTY: Now, in the course of your --
KEVIN SWINDON: I'm sorry. Accessed on that computer.
MR. CHAKRAVARTY: On this computer. On the --
KEVIN SWINDON: Thumb drive -- if that thumb drive went to another computer, that last access time of that file is not going to match that last access time on that computer.
MR. CHAKRAVARTY: So this spreadsheet only reflects data on the defendant's computer?
THE COURT: Overruled.
KEVIN SWINDON: This information was taken from 1R6, yes.
MR. CHAKRAVARTY: And not from that thumb drive?
KEVIN SWINDON: It was not taken from the thumb drive, no.
MR. CHAKRAVARTY: Go to the next one, 1142-03. What are these?
KEVIN SWINDON: If this were two images that were exported from 1R6, probably the most important part to figure out where it came from is if you look at the path. It's a long string of a naming convention. But most importantly, from the root, if we take it four in from the root and start with users, that was the user's folder on the drive. Anzor was the user. And the documents and web cam, web cam media, capture, and it was an image.2.jpeg.
MR. CHAKRAVARTY: Mr. Swindon, I think you just discovered it on your own, but if you want to annotate something on the screen, please just touch the screen.
KEVIN SWINDON: I did that. Sorry about that.
MR. CHAKRAVARTY: Were these all of the photos that were on the computer?
KEVIN SWINDON: Those were not all of the photos on the computer.
MR. CHAKRAVARTY: Like the other items, were they selected by the investigative team?
KEVIN SWINDON: Selected by the investigative team.
MR. CHAKRAVARTY: 1142-06, what is this?
KEVIN SWINDON: As we talked about for 01, this is an internet activity report derived from Internet Evidence Finder on -- from the Sony 1R6.
MR. CHAKRAVARTY: And so is this all of the internet history in the computer?
KEVIN SWINDON: That is not all of the internet history. I believe there were over 30,000 entries across a number of different browsers on 1R6, and this was a subset of that information.
MR. CHAKRAVARTY: And some of these entries have a date, and then some of them do not. What explains that?
KEVIN SWINDON: That -- typically, what may happen is in some cases the internet history would grab a date and timestamp along with it depending on the product or depending on the browser itself, you know, whether it be -- again, Mozilla, Chrome or internet are the three sort of major ones. They all handle that internet history potentially differently. So there may not be a date and time associated with an internet history entry that you see here.
MR. CHAKRAVARTY: And all of this data on this spreadsheet, like the others, is this exported using the tools that you were describing earlier?
KEVIN SWINDON: Exported using Internet Evidence Finder, yes.
MR. CHAKRAVARTY: The dates and times on this spreadsheet and on the other spreadsheets related to internet history, how do you know whether those are accurate with regards to Eastern Standard Time?
KEVIN SWINDON: Those are collected by the browser, and those would correspond to the date and time on the computer.
MR. CHAKRAVARTY: So whatever the computer time was affects that?
KEVIN SWINDON: Typically, yes.
MR. CHAKRAVARTY: What is this next file, 1142-08?
KEVIN SWINDON: As we had discussed earlier, a log is made when the imaging process is done for that piece of evidence. So this was -- this is the log entry for a device that we would call a TD3. That's an external standalone device that we would use to image the drive. It tells you the start/stop time and then what examiner created that image. And then down the bottom, as we mentioned, you'll see the MD5 hash value as we talked about earlier.
MR. CHAKRAVARTY: So this reflects also the type of computer hard drive?
KEVIN SWINDON: It does. It collects the hardware information about the actual hard drive that's in the computer.
MR. CHAKRAVARTY: How big was the hard drive on the defendant's computer?
KEVIN SWINDON: That drive, it's -- according to the TD report, is 500 gigabytes.
MR. CHAKRAVARTY: What's the next file, 1142-09?
KEVIN SWINDON: This file here is representative of the installed software that existed on the computer at the time it was imaged. This information is derived from the registry file. Windows has a registry file, which is typically the index for the computer. It stores information such as your user names, passwords, last accesses, different drives that had been connected to the computer. And it also includes a list of the installed computer.
MR. CHAKRAVARTY: Does the registry file also serve as sort of a table of contents for the computer?
KEVIN SWINDON: Not for the files on the computer within the directory structure, but what it does is it keeps all of the user information stored for the computer.
MR. CHAKRAVARTY: Okay. Thank you. Is there a way that a computer keeps a table of contents?
KEVIN SWINDON: I'm not sure I understand.
MR. CHAKRAVARTY: Are you familiar with a master file table?
KEVIN SWINDON: Yeah. Master file table is -- so the directory listing for the computer is basically your table of contents for human interaction. But the computer needs to be able to figure out where all those files are and translate that into the computer world of where it needs to access that on the disk. And the master file table would be where that information is stored. If you go to the directory structure to select a file, it would then point it to the master file table where it would find it on the hard drive.
MR. CHAKRAVARTY: If a file is deleted, what does that mean for the master file table?
KEVIN SWINDON: When a file is deleted, there's a character that's changed, and it is no longer seen or visible to the user, but the entry may still be available in the master file table, and the data may still exist on the drive.
MR. CHAKRAVARTY: If something has been deleted and then that space has been reclaimed by the computer, what happens to that data?
KEVIN SWINDON: The data would be overwritten, and it would not be able to be recovered.
MR. CHAKRAVARTY: I'm going to 1142-10. What is this?
KEVIN SWINDON: This file is also out of the registry. It's the -- or the SAM file, which is the Security Accounts Manager. And this is going to list all of the users on the computer. As you can see, it shows administrator, guest account. And if you scroll down, these are all the users that were on that computer.
MR. CHAKRAVARTY: So here it says, on the second page, user name, Anzor; full name, Jahar?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: What does that mean?
KEVIN SWINDON: That Anzor would have been a user on the laptop, on 1R6.
MR. CHAKRAVARTY: Is that one of the folders that was -- one of the user folders that was exported in contents from that user profile?
KEVIN SWINDON: Anzor was, yes.
MR. CHAKRAVARTY: The -- does this show the last login date under the user name, Anzor; full name, Jahar?
KEVIN SWINDON: It does.
MR. CHAKRAVARTY: When was that?
KEVIN SWINDON: The last login was Thursday, April 18th at 025.
MR. CHAKRAVARTY: That's 2013?
KEVIN SWINDON: 2013. But the designated Z is Zulu time. I believe, with daylight savings, minus 4, I believe is what it is.
MR. CHAKRAVARTY: So it was last accessed, according to this data, sometime on Wednesday evening, April 17th?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: 1142-11, what is this?
KEVIN SWINDON: Again, out of the registry, this is the -- this shows that there's a valid Windows license on the computer; who the owner of the computer was based on the user; and then the product ID; and the product key for Windows.
MR. CHAKRAVARTY: 1142-12, what is this?
KEVIN SWINDON: This was a derivative report of selected link files, are those -- as we talked about before, the shortcut files from the computer.
MR. CHAKRAVARTY: So explain a little bit more about what a link file is.
KEVIN SWINDON: Link file is a shortcut or the Windows creates a shortcut. If you were -- for example, one way a link file would be created is if you were -- created a shortcut on your desktop, it would create a link file. Sometimes when you open files, it creates -- automatically creates link files. So this would be a Windows-generated file that would be created.
MR. CHAKRAVARTY: Does a link file get created every time somebody opens a file on their computer?
KEVIN SWINDON: I haven't tested every piece of software that's out there, so I'm not sure how that would operate in the Windows 7 environment. I can't be for certain that every single software application that exists creates a link file.
MR. CHAKRAVARTY: What are some circumstances in which a link file might not be maintained by the computer when you export the file activity?
KEVIN SWINDON: Well, there could be several reasons. One of the reasons may be a user could go in and actually delete a link file. If they were technically savvy enough to know where to find them, they could go in and delete the link file. Also, some programs create or keep a last-access list or a most-recently-used list. And it typically would hold maybe the ten last accesses or ten last access -- files accessed. And those are going to be sort of first in, first out, last -- yeah, first in, first out.
MR. CHAKRAVARTY: And so the list here as -12, what can this tell you, as a computer forensics analyst, with regards to what usage was made of this computer?
KEVIN SWINDON: Well, evaluating the report, I was asked to make sure that these link files existed on the computer. We validated or verified that they did exist on the computer, existed on 1R6. If you're asking me to assess what this report is, I can look and say, from the information that's on here, at some point in time, these files were opened or accessed on this computer.
MR. CHAKRAVARTY: This is 1142-13. What is this?
KEVIN SWINDON: This is a spreadsheet that is a direct -- or a listing of the files and directories that existed in the user Anzor, a selected group of files -- folders that were in the user Anzor.
MR. CHAKRAVARTY: When you say "the user Anzor," what does that mean?
KEVIN SWINDON: If we go back -- reference back to the registry file that we had, it shows that Anzor was a user of the computer. So when they -- whoever established -- originally established the computer, which it says Anzor and Jahar, whoever established that user name decided to call that user name Anzor. And then Windows will create a folder called Anzor to store the documents, the photos, the videos that were associated with that user.
MR. CHAKRAVARTY: So that's a user-defined field? It's not automatic?
KEVIN SWINDON: It is a user-defined field although the operating system creates it.
MR. CHAKRAVARTY: So there are more files here than appeared on the file-access spreadsheet with the link files. Does that mean that these files weren't accessed?
KEVIN SWINDON: This list here is a list of the files that existed -- or selective list of the files that existed within that user Anzor.
MR. CHAKRAVARTY: What can you say about whether these files were accessed?
KEVIN SWINDON: I would have to look. If you can scroll to the right a little, there's actually -- in this particular spreadsheet here, access time is not -- the last access is not -- I'm sorry. The last time the file was modified is not listed in there. This is a directory listing of the files that existed in the user Anzor.
MR. CHAKRAVARTY: In computer forensics, how do your determine whether and when certain files were accessed?
KEVIN SWINDON: We would have to look -- we could look in the link or the shortcuts. We could look in the registry. There's a number of different places we could determine whether or not a file was opened.
MR. CHAKRAVARTY: Are those exhaustive?
KEVIN SWINDON: Yeah. The searches are exhaustive, yeah.
MR. CHAKRAVARTY: The searches are exhaustive. Can you tell definitely whether a file was accessed?
KEVIN SWINDON: In some cases, you may not be able to. You could see when it was created on the computer, but you may or may not have record of the last time that that file was accessed.
MR. CHAKRAVARTY: You can only testify to what you have a record of; is that fair to say?
KEVIN SWINDON: I can testify, yes, what the data that we collected on the computer.
MR. CHAKRAVARTY: What's 1142-51?
KEVIN SWINDON: 1142-51 is the file listing for the entire computer.
MR. CHAKRAVARTY: Okay. So this is, like, 4,670 pages long, right?
KEVIN SWINDON: Yes, it is.
MR. CHAKRAVARTY: Why is this on here?
KEVIN SWINDON: Because this includes all of -- a directory listing of all of the files on the computer. So a majority of the spreadsheets that we just introduced or that we talked about are derivative from the file listing.
MR. CHAKRAVARTY: Let's open the first folder. Again, this is for the user Anzor?
THE COURT: Mr. Chakravarty, if you're going to start a new topic, I think we're close enough to 1:00. We'll take a lunch recess at this point.
COURT CLERK: All rise for the Court and the jury. The Court will take the lunch recess.
(Luncheon recess taken at 1:00 p.m.)
(The Court and jury entered the courtroom at 2:08 p.m.)
THE COURT: Go ahead.
MR. CHAKRAVARTY: Good afternoon, Agent Swindon. When we left, we were just getting to dive -- getting ready to dive into the folders of the files that are on this -- this first CD, the 1142. Now, did you personally verify each of the files on these CDs that they came from, the computers -- for each of the computers that you were talking about?
KEVIN SWINDON: Yes. The CDs were provided to me by the team. We then went in and verified each file existed on the computer.
MR. CHAKRAVARTY: Did you personally verify that each of these spreadsheets that describe some of the data about what was on the computer, that that data itself was, in fact, on the computer?
KEVIN SWINDON: We verified -- based on the data sets that were available, yes, we verified that the data was there on the spreadsheets from the computer.
MR. CHAKRAVARTY: You were personally verifying that, right?
KEVIN SWINDON: Yes, I did.
MR. CHAKRAVARTY: So in the 1142-10, the registry SAM file, we had talked about the user with the full name Jahar, is that right?
KEVIN SWINDON: Yes, sir.
MR. CHAKRAVARTY: And that person created an account name called Anzor; is that fair to say?
KEVIN SWINDON: Yes, sir.
MR. CHAKRAVARTY: And can a user of a Windows Operating System designate any word as their account name?
KEVIN SWINDON: The user name can be -- it's a user-defined field that they could name it anything that they would like.
MR. CHAKRAVARTY: So you can name it after your kids?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: You can name it after your parents?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: And so one of the account names was Anzor on this computer?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: On the defendant's computer. So let's go to the Anzor folder.
MR. CHAKRAVARTY: Mr. Bruemmer, if you could.
MR. CHAKRAVARTY: Now, what is this?
KEVIN SWINDON: These are four folders that look similar to the folders that were on the -- in the user folder on the 1R6.
MR. CHAKRAVARTY: And so these are basically Windows folders? Any Windows Operating System has folders like this; most of them do?
KEVIN SWINDON: Yes. They are similar to folders that would be in a user directory structure of Windows.
MR. CHAKRAVARTY: Did the disks that includes 1142 that you brought with you today -- do they, as much as reasonable, try to marry that same structure?
KEVIN SWINDON: Again, the volume of data was such that we needed to make it easily understandable and -- for today or for court purposes or trial purposes. So we tried to keep it to the best structure we could to make it look like it was in the computer where it came from or the folder that it came from.
MR. CHAKRAVARTY: So if I click on the desktop folder, does that mean that any contents of that were on the desktop of the defendant's computer?
KEVIN SWINDON: Could you click on it, please?
MR. CHAKRAVARTY: Sure.
KEVIN SWINDON: Yes. Those folders were on the desktop of the laptop.
MR. CHAKRAVARTY: So on this laptop, on the desktop of the computer, these five folders existed?
KEVIN SWINDON: Yes. So if you're sitting at your computer with your screen up in Windows, these would be folders that would be displayed or on your desktop.
MR. CHAKRAVARTY: And there's a PDF as well on this, 1142-15, Effects of Intention. Was that also on the desktop?
KEVIN SWINDON: Yes, it was.
MR. CHAKRAVARTY: And you know this because you personally checked the image of the computer?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: And that tells you the file path; it tells you where on the computer these files were?
KEVIN SWINDON: Yes. We used AD Labs as the processing software, as we spoke about this morning, to go in and see the path of where the files were.
MR. CHAKRAVARTY: Clicking on Effects of Intention, is this the contents of that file Effects of Intention?
KEVIN SWINDON: It looks similar to the file that was verified, yes, or it is the file that was verified.
MR. CHAKRAVARTY: Click on the first folder, al Makdissi. Are these three files -- were these three files within that folder?
KEVIN SWINDON: Yes, they were.
MR. CHAKRAVARTY: It's 1142-16 through 18. Now, there was a documents folder. Is like the My Documents folder of a Windows Operating System?
KEVIN SWINDON: Windows would call it "documents," yes.
MR. CHAKRAVARTY: And in this folder, was there a subfolder called "web cam media"?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: And in that, was there another folder called "capture"?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: And then there are these images?
KEVIN SWINDON: Yes, those images.
MR. CHAKRAVARTY: Were these the images that were also referenced in that spreadsheet that you earlier spoke about?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: Then there was a folder called "downloads," is that right?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: And were all of these -- this folder and these files in the downloads folder?
KEVIN SWINDON: Yes. Those files were in the downloads folder.
MR. CHAKRAVARTY: So clicking on an image, this was one of the images in the downloads folder?
KEVIN SWINDON: It was. The only difference on this -- on the next three or this one here was that the file extension was changed to have it display as a picture.
MR. CHAKRAVARTY: The .jpeg file extension?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: This was 1142-98 for the record.
MR. CHAKRAVARTY: Then there were two other photos in that folder?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: In the music folder, was there a subfolder called "nasheed"?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: Have you heard that term before?
KEVIN SWINDON: I'm familiar with nasheed.
MR. CHAKRAVARTY: What is a nasheed in your understanding?
KEVIN SWINDON: My understanding of nasheed is --
THE COURT: Overruled.
KEVIN SWINDON: My understanding is that a nasheed is a sort of chant and typically popular in Islamic culture. A lot of them are in Arabic. I don't speak Arabic, so I'm not sure I would be able to recognize what they're saying, but I am familiar that they do exist.
MR. CHAKRAVARTY: Clicking on that folder, the nasheed folder, are there a number of files number 1142-100 through 136 on that folder?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: And these are all audio files?
KEVIN SWINDON: Those are -- if you could expand it? The title, please? Yes, those are MP3 files, or audio files, yes.
MR. CHAKRAVARTY: And there's one that's on this disk in the parent folder "music"?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: Now, is this all of the music that was on this computer hard drive?
MR. CHAKRAVARTY: Then there was another folder that was specifically called "music," is that right?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: And there was a folder called "playlists"?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: What's a playlist?
KEVIN SWINDON: A playlist is a file that is sort of like a table of contents that a Windows Media Player or a similar program would create to keep a sort of file list of songs or, say, a table of contents of songs that you would create.
MR. CHAKRAVARTY: So I clicked on the playlists subfolder. And are there two playlists here?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: And the WPL extension means it's a playlist?
KEVIN SWINDON: It's a Windows Playlist.
MR. CHAKRAVARTY: Windows Playlist, excuse me. Can you view that using a text editor?
KEVIN SWINDON: Yes. You could use that text editor or Notepad.
MR. CHAKRAVARTY: Does this list in the computer code the various files that were on the playlist?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: Now, there was another user folder called "public" on this computer, is that right?
KEVIN SWINDON: Yes. That's a Windows-created folder typically used for -- when you have sharing set up amongst computers, that the public folder would be the file or the folder where you would be able to share documents with other users.
MR. CHAKRAVARTY: So this is the user profile that anybody who's using the computer can see?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: And were there several files in this folder that were not exported onto the CDs?
KEVIN SWINDON: These two files here were in the public folder.
MR. CHAKRAVARTY: And opening 1142-147, is that a Microsoft Word file?
KEVIN SWINDON: The extension of .docx, yes, that's a Microsoft Word file.
MR. CHAKRAVARTY: Is this the contents of that Microsoft Word file?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: Is the -- at the top left-hand corner of this file, is it written, "Jahar Tsarnaev, Modern World History, Miss Auty"?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: And then the title of the document is called, The Predator War?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: Opening 1142-148, is this a 578-page PDF file that's in Cyrillic?
KEVIN SWINDON: It is a PDF file. In the top left-hand corner, it is recognized it is 578 pages. And I don't -- can't speak the language, but I do recognize that as Cyrillic language.
MR. CHAKRAVARTY: For foreign-language documents that you encountered when you were -- you and the rest of the investigative team were analyzing the various devices, what happened with those in the FBI?
KEVIN SWINDON: What would happen is, if the team encountered something that they needed translated, we have a full staff of linguists who are proficient in numerous different languages that would be able to translate that.
MR. CHAKRAVARTY: With regards to the content on these CDs, for some of the foreign-language documents, are, in fact, there translations that linguists at the FBI did and put on there?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: Now, the files folder, I'm clicking on an exhibit marked 1142-150, "work resume." Was this in the files folder?
KEVIN SWINDON: Yes, it was. No. Files folder is what we created, so this came off of the hard drive.
MR. CHAKRAVARTY: So you called this folder "files"?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: For files that were not in one of those other folders?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: And so is this the resume of a person named Jahar Tsarnaev from 410 Norfolk Street, No. 3?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: Does he list his email address as j.tsarnaev@yahoo.com and his phone number as 857-247-5112?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: Is it a one-page of content?
KEVIN SWINDON: It appears to be two pages, but one page has the content.
MR. CHAKRAVARTY: He lists himself as a student at University of Massachusetts at Dartmouth, is that correct?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: The other image in this folder is called 1142-149-carved, and then there's a number. What does that mean?
KEVIN SWINDON: So the forensic software that we use to process digital evidence, as we mentioned earlier this morning, has the ability to carve files out of space that is no longer being used by the computer. It's a fairly simple process. Each file has a specific header associated with it so the computer will be able to identify what kind of file that is. There's a specific header associated with a JPEG or a document or a spreadsheet. So the program will go out into unallocated or free space on the computer that's no longer being used, and it will look in that area of the computer to try and identify any of the files that can potentially be recovered out of a space. Once it identifies a file that it recognizes, it then continues to try and rebuild what may have been in that space before. And this would be an example of something that was carved out of free space on the computer that is now depicted as a JPEG.
MR. CHAKRAVARTY: Go back to the Anzor account name, and I open the folder called "YE." The first document in that folder, 1142-71, has a number of blank underlines. What does that mean?
KEVIN SWINDON: Sometimes the forensic software has a hard time with non-English alphabet characters. So if it was Cyrillic characters, sometimes through the processing with the forensic application, it doesn't know how to translate it. If it doesn't know how to translate it into an English equal or does not have the ability to depict the Cyrillic language, it will replace it with typically an underscore, which is what you're seeing here.
MR. CHAKRAVARTY: And so that particular document, is that a foreign-language document?
KEVIN SWINDON: It appears to be, yes.
MR. CHAKRAVARTY: Again, like the other documents that were in foreign language, were those given to the translators to translate?
KEVIN SWINDON: I'm not sure if this particular document was, but, yes, they were given to the translators to translate.
MR. CHAKRAVARTY: On this one, there's no translation on the CD of that document, is that correct?
KEVIN SWINDON: Correct.
MR. CHAKRAVARTY: I'm going to go down to the file 1142-91, completeinspire.pdf. Have you seen that name throughout your analysis of these CDs?
KEVIN SWINDON: Yeah. The name of that file was apparent on numerous of the different CDs that we had or that we looked at or the different pieces of media that we looked at.
MR. CHAKRAVARTY: In fact, on the spreadsheets that we looked at before the lunch break, did we see that in both the external drive access as well as amongst the link files?
THE COURT: I didn't hear you.
THE COURT: Try it again.
MR. CHAKRAVARTY: I'll try again.
MR. CHAKRAVARTY: Did the name of that file, Complete Inspire -- did that name appear in both the external access spreadsheets that we went through earlier as well as the file access or link history spreadsheet?
KEVIN SWINDON: Yes, it was on that spreadsheet.
MR. CHAKRAVARTY: Is this the first page of 1142-91, completeinspire.pdf? Is this the first page?
KEVIN SWINDON: Yes, it is.
MR. CHAKRAVARTY: Do you recognize it?
KEVIN SWINDON: Only from seeing it -- from viewing it on the disks and the different pieces of media.
MR. CHAKRAVARTY: So do you know what it is?
KEVIN SWINDON: I know it's from -- other than reading the first page, I know it's a magazine and in -- from what it says on the cover.
MR. CHAKRAVARTY: Does the cover call it "The Periodical Magazine Issued By the Al-Qaeda Organization in the Arabian Peninsula"?
KEVIN SWINDON: Yes, it does.
MR. CHAKRAVARTY: Is this a 67-page document?
KEVIN SWINDON: Yes, it is, 67 pages.
MR. CHAKRAVARTY: Is one of the articles, Make A Bomb In The Kitchen Of Your Mom?
KEVIN SWINDON: That's what it says on the cover, yes.
MR. CHAKRAVARTY: Now, you're not an expert on this document, right?
KEVIN SWINDON: No, sir.
MR. CHAKRAVARTY: Is this, on Page 33, the beginning -- apparently the beginning of the article, Make A Bomb In The Kitchen Of Your Mom?
KEVIN SWINDON: Yes, Page 33, yes.
MR. CHAKRAVARTY: And go through how many pages the article is. Is that a seven-page article?
KEVIN SWINDON: It started on 33 and ended on 40. Yes.
MR. CHAKRAVARTY: Going to the subfolder, the Hereafter Series, on the desktop under Anzor, what are these files?
KEVIN SWINDON: They are -- can you display them differently, please? File details. Those are depicted by the icon on the left. They apparently -- they appear to be RealPlayer files.
MR. CHAKRAVARTY: So the icon on the left, you mean these icons?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: It tells you generally what kind of a file Windows recognizes it to be?
KEVIN SWINDON: Windows would associate -- with that file type would associate the RealPlayer icon.
MR. CHAKRAVARTY: And do 1142-49 through 1142-70 appear to be different files with the name -- different titles, all of which have the name Imam Anwar al-Awlaki?
KEVIN SWINDON: If you could please scroll down? Yes. They all appear to say al-Awlaki.
MR. CHAKRAVARTY: Going now to the folder "papka," you don't know what "papka" means in Russian, do you?
KEVIN SWINDON: I do not.
MR. CHAKRAVARTY: So there are a number of PDF files in this folder, is that right?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: And clicking on 1142-36 called Join the Caravan --
MR. CHAKRAVARTY: Can we try to get that again, Mr. Bruemmer? Sorry. There we go.
MR. CHAKRAVARTY: Is this the substance of the document called Join the Caravan?
KEVIN SWINDON: It is labeled "Join the" -- it's labeled "Join the Caravan," yes.
MR. CHAKRAVARTY: Is this a 35-page PDF?
KEVIN SWINDON: It's a 35-page PDF, yes.
MR. CHAKRAVARTY: Mr. Bruemmer, if you can just get me back to that title screen?
MR. CHAKRAVARTY: It's not evidence. Clear the screen as well. Thank you.
The one with all the folders.
THE COURT: I've taken it down until you get to the place you want.
MR. CHAKRAVARTY: Thank you, your Honor.
I'm there, your Honor. Thank you.
MR. CHAKRAVARTY: Back in that papka folder, is there a document in here called "Issue 9," 1142-35?
KEVIN SWINDON: Sorry. Yes.
MR. CHAKRAVARTY: Does that appear to be another issue of the Inspire Magazine?
KEVIN SWINDON: Yes, it does.
MR. CHAKRAVARTY: Is there a folder called "Islam" in this subfolder?
KEVIN SWINDON: Yes, there is.
MR. CHAKRAVARTY: Exhibit 1142-45 entitled, "Saif al Bader," is this a 56-page PDF?
KEVIN SWINDON: Yes, it is.
MR. CHAKRAVARTY: Does the cover page indicate that the name of the document is "The Slicing Sword"?
KEVIN SWINDON: Yes, it does.
MR. CHAKRAVARTY: Now, were these documents that were -- that you verified on these disks, were these English-language documents with the exception of the two, I think, that -- or the one, I guess -- two that we talked about?
KEVIN SWINDON: I'm sorry?
MR. CHAKRAVARTY: Were these English-language documents?
KEVIN SWINDON: Not all of them were English-language documents.
MR. CHAKRAVARTY: If they were in a foreign language, with the exception of the two that we saw, would there be a translation as well?
KEVIN SWINDON: If there was a requested translation done and it was included on the disk, it would be depicted in the same path as where the file was you're seeing here.
MR. CHAKRAVARTY: And all these are English-language titles, correct?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: There's also 1142-41 entitled, Sheikh Anwar al-Awlaki -- sorry, "Sheikh Anwar Awlaki: The Battle of Uhud, Part 5-5, YouTube," what kind of a file is that?
KEVIN SWINDON: Can you please extend the file to the right? It's an MP3 file.
MR. CHAKRAVARTY: An MP3 file is an audio file?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: Now, we've looked at files of a general type. Were there other types of files on this computer?
KEVIN SWINDON: Yes. There were a lot of files on the computer.
MR. CHAKRAVARTY: What kinds of files were on the computer?
KEVIN SWINDON: There was the -- just like any other computer, there was the Windows Operating System. There was a lot of other files that existed there that would be a part of a normal Windows installation.
MR. CHAKRAVARTY: What other types of files were there?
KEVIN SWINDON: I'm sorry?
MR. CHAKRAVARTY: What other types of files were there?
KEVIN SWINDON: There were other -- when we went back into the thing to verify that these documents -- and we looked at the drive -- there was over -- as we had showed earlier in the directory list, there's over a half million files on the drive itself. So this was a representative sample that was given to us to verify.
MR. CHAKRAVARTY: Were there internet search histories or other things related to sports or homework or other types of topics?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: We didn't ask you to pull those and put those on the CDs, right?
KEVIN SWINDON: You did not.
MR. CHAKRAVARTY: Let's move onto Exhibit 1143. Would it be helpful to have 1557 up for you?
MR. FICK: Just to clarify, this next one is not yet in evidence, as I understand it, is that correct?
MR. CHAKRAVARTY: It is not.
Can we have 1557, please? Thanks.
MR. CHAKRAVARTY: Now, what does disk 1143 correspond to?
KEVIN SWINDON: 1143 corresponds to 2R14, which is the second one on the list.
MR. CHAKRAVARTY: Is that a desktop computer that was seized from 410 Norfolk Street in Cambridge?
KEVIN SWINDON: According to the list, yes.
MR. CHAKRAVARTY: Was that also imaged and processed like the defendant's computer?
KEVIN SWINDON: I'm sorry?
MR. CHAKRAVARTY: Was that also imaged and processed like the defendant's computer?
KEVIN SWINDON: It was imaged at Black Falcon and processed at Center Plaza.
MR. CHAKRAVARTY: It was pursuant to the same protocols you had described earlier?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: The disk that you have in front of you as 1143, did you verify that all of the information, with the exceptions of the titles of some of the documents, the exhibit numbers and the translations, that all of that content was on that computer?
KEVIN SWINDON: Existed on the computer, yes.
MR. CHAKRAVARTY: I would move in 1143.
THE COURT: Overruled. I'll admit it.
MR. FICK: And, actually, the translations. Those, I think, we got yesterday. I haven't had a chance to verify them yet.
THE COURT: Well, I'll admit it.
(Exhibit No. 1143 received into evidence.)
MR. CHAKRAVARTY: Sorry. I'm just waiting. Thank you, your Honor.
MR. CHAKRAVARTY: Is this the file directory or the files that are in the 2R14 HP desktop folder?
KEVIN SWINDON: These are the files. These are the files that are on 1143.
MR. CHAKRAVARTY: We'll just go through them again. You can explain what they are. What's the first folder?
KEVIN SWINDON: First folder was a folder called "Umar," which, like on 1R6, was the user folder that was on the Windows machine.
MR. CHAKRAVARTY: So somebody named this computer account Umar?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: 1143-01, what is this?
KEVIN SWINDON: This is a report that was generated utilizing Internet Evidence Finder, which depicts social media and internet activity on the desktop.
MR. CHAKRAVARTY: Okay. Is this, like the one for the defendant's computer, it's a portion of the internet evidence that was found, correct?
KEVIN SWINDON: Yes, yes.
MR. CHAKRAVARTY: 1142-3, what is this?
KEVIN SWINDON: Again, like 2R6, this is a directory listing or a listing of the link files, or the shortcut files, that existed on -- I'm sorry. These are the files from the desktop on 2R14.
MR. CHAKRAVARTY: And 1143-4, what is that?
KEVIN SWINDON: It's the log file for the original imaging.
MR. CHAKRAVARTY: And this lists again the person who imaged it as well as the type of hard drive it was?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: And was this a one-terabyte hard drive?
KEVIN SWINDON: Yes. That's the software that the hardware is reporting, yes.
MR. CHAKRAVARTY: 1143-05, what is this?
KEVIN SWINDON: It's a -- it's a select -- as the title notes, it's a selected user files from the computer on the Umar folders.
MR. CHAKRAVARTY: What does that mean?
KEVIN SWINDON: These folders would have existed -- or these files -- these paths would have existed in the Umar user on the computer of 2R14.
MR. CHAKRAVARTY: Again, is this all of the activity on that computer?
KEVIN SWINDON: It is not all the activity on the computer.
MR. CHAKRAVARTY: 1143-05-A, what is this?
KEVIN SWINDON: That's the complete file listing for the computer.
MR. CHAKRAVARTY: So this is a 2,544-page document. Is this similar to the defendant's computer, or is this a listing of all the files on the computer?
KEVIN SWINDON: This is a complete file listing for the entire computer.
MR. CHAKRAVARTY: 1143-06, what's that?
KEVIN SWINDON: This is the -- a list of the installed software that was on 2R14.
MR. CHAKRAVARTY: Is this -- like you did for the defendant's computer, this is --
MR. FICK: Objection to the continued use of defendant's computer, which I don't think has been established.
THE COURT: Refer to it by its number.
MR. CHAKRAVARTY: I will, your Honor.
MR. CHAKRAVARTY: Like you did for 1142, is this a list of the applications that were installed on this computer?
KEVIN SWINDON: On 2R14, yes.
MR. CHAKRAVARTY: 1143-07, what is this?
KEVIN SWINDON: This is the file for the information that holds the security account manager for Windows, which would include the names of the users that were on that computer.
MR. CHAKRAVARTY: So unlike the other computer that had the full name Jahar, in this case, the 2R14, there was no full name listed, correct?
KEVIN SWINDON: There was no full name listed, no.
MR. CHAKRAVARTY: Whoever set this computer up, just called the account Umar without putting their own name in?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: Does it list on here -- excuse me -- when the last login date was?
KEVIN SWINDON: The last login for the user?
MR. CHAKRAVARTY: For the Umar account, yes.
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: When was that?
KEVIN SWINDON: March 21, 20:34:07, on 2013. But, again, the Z would denote that it was Zulu time.
MR. CHAKRAVARTY: 1143-08, what is this?
KEVIN SWINDON: This is the information, like 1R6, which is the Windows installation -- or the Windows information for the computer, verifies that the licenses are -- gives the user license for the Windows and what version it's running.
MR. CHAKRAVARTY: And 1143-09, what is that?
KEVIN SWINDON: This is an internet activity history report.
MR. CHAKRAVARTY: Is this also generated with the Internet Evidence Finder tool?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: Again, is this a partial internet history?
KEVIN SWINDON: The data that's on this spreadsheet was generated from Internet Evidence Finder.
THE COURT: All right.
MR. CHAKRAVARTY: This is a 20-page document, is that right?
KEVIN SWINDON: Yes, it's a 20-page document.
MR. CHAKRAVARTY: And like the spreadsheet that we saw on the previous computer, there are dates on some of the entries, and there are no dates on some of the entries?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: So let's pick a couple of these to focus in on. So this file here, it says, "J:completeinspire.pdf." What does that entry mean to you?
KEVIN SWINDON: On the column on the right, all the way -- I'm sorry, all the way to your right. The Internet Evidence Finder would have grabbed this information out of what we would call -- okay -- the "U" would be for unallocated space. So that remnant or that file structure, that file name, was recovered by Internet Evidence Finder and shows possibly at some point that file -- that this file was accessed on this computer by -- on a J drive.
MR. CHAKRAVARTY: What's the J drive?
KEVIN SWINDON: The J drive -- J would be the file letter that Windows would give whatever -- the next one in line or assigned by a user to a removable media device or something that was plugged into the computer.
MR. CHAKRAVARTY: There's a date over here. What does that date correspond to?
KEVIN SWINDON: Well, because it came out of an unallocated space, the date really -- it's not really very reliable.
MR. CHAKRAVARTY: Okay. And you say "unallocated space." Do you know that because of --
KEVIN SWINDON: Because of the --
MR. CHAKRAVARTY: This U?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: What does unallocated space mean?
KEVIN SWINDON: That's the portion of the computer that we talked about earlier where it's sort of the space that's not being used by the hard drive or by the operating system or by any applications anymore.
MR. CHAKRAVARTY: Now, going down a few entries, we see the same file name being accessed on the J drive, right?
KEVIN SWINDON: Yup, yes.
MR. CHAKRAVARTY: And that's an allocated space, right?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: And what's the date of that access?
KEVIN SWINDON: 12/26/2012, at 2:39 p.m.
MR. CHAKRAVARTY: Now, this email address, j.tsarnaev@yahoomail, is that the email address that was on the 1R6, the Exhibit 1142 user profile?
KEVIN SWINDON: That was in the -- that was in several locations on 1R6.
MR. CHAKRAVARTY: Excuse me. That wasn't on the user profile. I think it was on the resume?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: Does it show that that access, according to the Internet Evidence Finder, that email account was accessed on New Year's Day?
KEVIN SWINDON: Right.
MR. CHAKRAVARTY: On 2013?
KEVIN SWINDON: Right. If we look at the column to the left, that's going to give you the URL or the web page that was accessed, that it grabbed as a part of the history. And that's the -- the Internet Evidence Finder generates that middle column, and it then associates the date and time with that activity -- internet activity.
MR. CHAKRAVARTY: This column called "title," this column, what kind of data is indicated in that?
KEVIN SWINDON: Well, the title is generated by the Internet Evidence Finder. It types -- it's the type of traffic that it recognizes.
MR. CHAKRAVARTY: And the various content of these columns, what does that indicate?
KEVIN SWINDON: Did you want me to read every single one?
MR. CHAKRAVARTY: No. Just for the first one, what does it say, if you can read it?
KEVIN SWINDON: It says, Junies Uderoff (ph) Google search.
MR. CHAKRAVARTY: What does that tell you?
KEVIN SWINDON: It says that that string to the left would be something -- if you were going to go to Google.com and do a search for something, and you typed, for example, that name in the box in the middle of Google and sent that search request back to Google, that's -- the string on the left would be the actual request going back to Google. So Internet Finder would parse out that information, recognize that it's a Google search, and include that in the title.
MR. CHAKRAVARTY: So I just underlined the entry in the URL field. Is that what you were talking about?
KEVIN SWINDON: Yeah. Actually, you can see -- if you go up to the first line, you can see -- after Google.com, you can see the search term there.
MR. CHAKRAVARTY: And so on the entry that says, "Anwar Awlaki Abu Bakr (RA), Part 1/8, YouTube," does that mean that that website titled that was accessed on January 1, 2013, at about 3 p.m.?
KEVIN SWINDON: If you look to the left, again, Internet Evidence Finder identified the URL on the computer as being that number or that URL and then associated it with that file name -- or with that name and then created the date visited.
MR. CHAKRAVARTY: I'm going to go through a few more pages and then move on. Are these -- in the URL column, are these various websites that were visited?
KEVIN SWINDON: In the URL column, Internet Evidence Finder would have parsed out through the internet history files associated with all the different browsers that are available and then would have been exported to this report. So, yes, these are -- those are websites that would have been visited.
MR. CHAKRAVARTY: So those websites like ghuraba.info, Jamaat Shariat, as well as Netflix?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: There's a lot of entries for this website called Kav Kaz Center. Did you see that throughout this computer?
KEVIN SWINDON: I recognize that from the report, yes.
MR. CHAKRAVARTY: And the -- for a lot of the Kav Kaz entries, there is Cyrillic writing; is that fair to say?
KEVIN SWINDON: That's -- I recognize it as Cyrillic writing, yes.
MR. CHAKRAVARTY: Now, just as we had talked about the general content that was on the 1R6, the Sony Vaio laptop that's numbered 1142, was there a variety of different types of content on the 1143 desktop that was seized from Norfolk Street?
KEVIN SWINDON: There was a variety of different files on the computer, yes.
MR. CHAKRAVARTY: And were you able to determine whether this was used by only one person or many people?
KEVIN SWINDON: Given -- as we spoke this morning about combining the investigative information with the information that's on the computer, I think it was used by many people.
MR. CHAKRAVARTY: 1144, what does that correspond to?
KEVIN SWINDON: Back to the report, 1144 corresponds to 3R4, which would have been a thumb drive designated as Micro Center, two-gigabyte thumb drive, seized from the Pine Dale Hall and imaged at Black Falcon and processed at Center Plaza.
MR. CHAKRAVARTY: Pine Dale Hall you know is a dormitory at the UMass Dartmouth campus?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: And "TD" means thumb drive?
KEVIN SWINDON: Yeah. That was our designation, yup.
MR. CHAKRAVARTY: As with the computer devices, did you confirm that the contents on the disk 1144 reflects a selected portion of the contents of that thumb drive?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: I'd move in 1144, your Honor.
THE COURT: Same ruling. Admitted.
(Exhibit No. 1144 received into evidence.)
MR. CHAKRAVARTY: So in the 3R4 folder, what do we see here?
KEVIN SWINDON: 3R4 folder, there are a file listing PDF, a text file, which is a log file, as we've looked at the other two. And there are two files that were found on that thumb drive.
MR. CHAKRAVARTY: And so the first folder says "carved files." What does that mean?
KEVIN SWINDON: As discussed earlier, when the software application that we use has the ability to carve files out of that unallocated space where a file may have previously been. Those would have been files that were associated with that process of carving that were identified by the software application.
MR. CHAKRAVARTY: Let's click on 1144-01. What is this?
KEVIN SWINDON: It's a file listing for the 3R4.
MR. CHAKRAVARTY: So unlike the computers, which have thousands of pages of files, this only has three. Why is that?
KEVIN SWINDON: It's a smaller device. It doesn't have an operating system. And it would be used just to transfer files.
MR. CHAKRAVARTY: 1144-02, what is this?
KEVIN SWINDON: It's the log file. The log file for FTK Imager, which was used to image the thumb drive.
MR. CHAKRAVARTY: Again, this also shows how much storage you had on this --
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: -- on this -- I'm just trying to find out how much storage that is. Can you tell?
KEVIN SWINDON: It's approximately two gig.
MR. CHAKRAVARTY: Two gigs, all right. 1144-05, completeinspire.pdf, is that the same file or same document that was on the -- both of the two computers we've seen already?
KEVIN SWINDON: With the visual inspection, yes.
MR. CHAKRAVARTY: In fact, I actually hadn't done that with the second computer so go back a second. I went through the spreadsheets with you on the desktop computer, but I didn't go through each of the user files. I'll try to do it quickly.
MR. CHAKRAVARTY: Sure. We're back on 1143.
MR. CHAKRAVARTY: On the desktop, were there a number of folders in the desktop?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: There were subfolders as well?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: And they had audio files just like the other computer?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: And they had these YouTube files as well?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: They had a folder called the Hereafter Series also?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: And like the 1142, it had a number of Anwar al-Awlaki documents or audio files in that folder?
KEVIN SWINDON: Yes. Could you change the view to details, please?
MR. CHAKRAVARTY: Sure.
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: And in 1143, it was 1143-43 to 1143-64 that were all these Anwar al-Awlaki audio files, correct?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: Then there were a number of documents on the desktop that would be visible to somebody who was accessing that user account, correct?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: The documents folder went into subfolder called "blio," subfolder entitled "tema." Is there a document called 1143-69, Inspire, March 2011?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: And that reflects another copy of Inspire Magazine for a different issue?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: Now, that March 2011 magazine has this picture and the title called, "The Tsunami of Change," is that correct?
KEVIN SWINDON: That's what's depicted, yes.
MR. CHAKRAVARTY: Going back now to where we had left off at 1144, which was the thumb drive that was found in the defendant's dorm room, is that right? Sorry. Do you need the chart again?
KEVIN SWINDON: 1144 was -- yeah, Pine Dale Hall, yes.
MR. CHAKRAVARTY: Now, in the carved files, what are these?
KEVIN SWINDON: Again, the forensic software is able to carve files out of that -- the unused space on that device by that process of identifying a file header and trying to capture as many or as much of that files as it can. And it carved JPEGS out of the unallocated space on the thumb drive.
MR. CHAKRAVARTY: I called up 1144-07-24. Is that the same JPEG or image file of the cover of the Spring 2011 issue of Inspire Magazine?
KEVIN SWINDON: That's a JPEG, a single JPEG, depicting the first page of the PDF that we looked at.
MR. CHAKRAVARTY: So it's not -- what you were able to recover on the thumb drive was not the entire PDF document but rather a series of images or JPEGS, correct?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: Did you verify that that's, in fact, what all of these images are?
KEVIN SWINDON: I'm sorry?
MR. CHAKRAVARTY: What are all of these images in this folder?
KEVIN SWINDON: These are carved images out of the unallocated space on the thumb drive that match photos or images that are on that -- the March 2011 Inspire Magazine.
MR. CHAKRAVARTY: In addition to that Inspire -- issue of Inspire Magazine, was that Complete Inspire magazine that we had seen before also on there?
KEVIN SWINDON: In PDF form, yes.
MR. CHAKRAVARTY: Was this in the active space so it wasn't carved? It didn't have to be recovered?
KEVIN SWINDON: I'm sorry. Yes, it was in active space.
MR. CHAKRAVARTY: In addition, 1144-06, was this a scanned document that was on the thumb drive?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: What does it appear to be?
KEVIN SWINDON: It appears to be a pay stub for Katherine -- from Donald Larking, 1600 Washington Street.
MR. CHAKRAVARTY: It was found in the defendant's dorm room?
KEVIN SWINDON: The thumb drive was found in the dorm room, yes.
MR. CHAKRAVARTY: Let's move onto 1145. What is that?
KEVIN SWINDON: 1145 was the files extracted from an iPod Shuffle.
MR. CHAKRAVARTY: And 1146?
KEVIN SWINDON: 1146 was from an iPod Nano.
MR. CHAKRAVARTY: And the files on those CDs, are those, like the other ones, you verified that they're actually on those items of evidence?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: Were those iPod -- the iPod Shuffle and Nano found in the Honda Civic that was recovered in Laurel Street?
KEVIN SWINDON: If you could bring back up --
MR. CHAKRAVARTY: Sure, sorry.
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: Those are the items that actually already have been introduced in this case?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: I'm sorry. I would move in the data collected from 1145 and 1146.
THE COURT: Admitted.
(Exhibit Nos. 1145 and 1146 received into evidence.)
MR. CHAKRAVARTY: I've opened 1145. Can you explain this structure?
KEVIN SWINDON: 1145 would have been the -- an iPod Shuffle. So the text file would show the imaging log for the imaging of the device.
MR. CHAKRAVARTY: And I'm first opening 1145-02. What is that?
KEVIN SWINDON: That's the log file for the imaging that took place on that.
MR. CHAKRAVARTY: 1145-01?
KEVIN SWINDON: Is a derivative file list, a file list of files that were found on the iPod Shuffle.
MR. CHAKRAVARTY: So this is some of the audio files that was on the iPod Shuffle?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: And 1145-01-A?
KEVIN SWINDON: Is the complete file list of all the files that were found on the Shuffle.
MR. CHAKRAVARTY: So the previous exhibit was a subset of this?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: Under "files," are these that subset of the audio files that were on the computer -- excuse me, on the iPod?
KEVIN SWINDON: I'm sorry?
MR. CHAKRAVARTY: Were these a subset of files that were on the iPod?
KEVIN SWINDON: These files we verified were on the iPod, yes.
MR. CHAKRAVARTY: 1145-24, entitled, "The Man Who Went to Jannah Without Praying, MP3," did you see that in your verification of other devices?
KEVIN SWINDON: I recognize the title from other places.
MR. CHAKRAVARTY: Do you remember which other devices that was on?
KEVIN SWINDON: I don't. But if I had the directory listings, I'd --
MR. CHAKRAVARTY: Can we call up just for the witness 1553, please. Court's indulgence, your Honor.
I'll move on in the interest of time and come back.
MR. CHAKRAVARTY: Let's go to 1146, which is the other iPod that I believe I've moved into evidence now. On this iPod, the 1146, there are four-digit names for files. Why is that?
KEVIN SWINDON: I'm aware that the iPod, or the iTunes software, when they install the MP3s or the files on of the device that it changes the name of the file and creates a pointer to that. So if you go back, there will be, like, a playlist, as you had recognized from all of your songs, and it creates that -- the playlist would create pointers to those files.
MR. CHAKRAVARTY: And 1146-01, is this a derivative file listing, listing those files?
KEVIN SWINDON: Yes, it is.
MR. CHAKRAVARTY: 1146-01-A, is this the complete file listing for all the files on that --
KEVIN SWINDON: Complete file listing of everything that was on the device.
MR. CHAKRAVARTY: And 1146-27, is this a log file?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: It's listed as an iPod, Apple iPod device?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: Now, were you -- did you compare whether some of the audio files were common across various devices?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: Okay. Explain what you did.
KEVIN SWINDON: Well, we -- I mean, when we recognized the names across several of the devices, we -- when we were going through verifying and validating, we recognized that some of the titles were the same and played them to verify that they were on the devices.
MR. CHAKRAVARTY: So some of the iPod files that come in four-digit titles, did you verify that those files were actually also the same files that were -- the same audio files that were on some of these other devices?
KEVIN SWINDON: It's difficult to do through just listening, but we did use another process to verify that they were the same.
MR. CHAKRAVARTY: What was that process?
KEVIN SWINDON: We talked earlier about the MD5 hash values. We use them to verify images of computers, but we can also use them to compare files. So if we created an MD5 hash value for a file, we then could run that -- find that value in other places, and then it would show scientifically that it was the same file.
MR. CHAKRAVARTY: Now, your Honor, just for the witness, please, 1438, please.
MR. CHAKRAVARTY: Do you recognize what this is?
KEVIN SWINDON: It's a spreadsheet that was put together by the team that was depicting the propagation of the files.
MR. CHAKRAVARTY: All right. Did, actually, you create an updated version of this particular spreadsheet?
KEVIN SWINDON: There's an updated version of this spreadsheet, yes.
MR. CHAKRAVARTY: Does that updated version actually compare the MD5 hash values?
KEVIN SWINDON: It does. It includes the MD5. We added a column of the MD5 hash values for each of the files across the devices.
MR. CHAKRAVARTY: What commonalities did you find over -- after looking at the MD5 hash values?
KEVIN SWINDON: If the hash values matched, the file is essentially the same or is the same. So we just compared the MD5 hash values. And once we were able to show that it was the same across all of the devices, we can verify that it's the same files.
MR. CHAKRAVARTY: Did you, in fact, find that some of the audio files were the same across various devices?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: What were devices that you found being similar across the --
KEVIN SWINDON: 1R6, 1437, 14-6, and 3R5.
MR. CHAKRAVARTY: We haven't discussed 3R5 yet, right?
KEVIN SWINDON: We have not.
MR. CHAKRAVARTY: Were these particular audio files that were common across those devices?
KEVIN SWINDON: They were MP3 files.
MR. CHAKRAVARTY: Particularly the file that I had just clicked on but haven't played is, "The Man Who Went to Jannah Without Praying." Was that one of them?
KEVIN SWINDON: Yes. That was one of them that was common all across all four devices.
MR. CHAKRAVARTY: Was there also another audio file called "The Most Amazing Nasheed" that was common across all four devices?
KEVIN SWINDON: Yes, across all four devices, yes.
MR. CHAKRAVARTY: Was there also the file called "The Most Wonderful Nasheed" that was common across all four devices, although the title of the file was different?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: So was that -- did the MD5 hashes compare favorably on that? How does an MD5 hash stay the same if the file name changes?
KEVIN SWINDON: It doesn't change any substance of the file. This could have been a pointer. If you could -- I'm sorry. So depending on how the file was handled within the device or the iPod, it wouldn't make any substantive changes to the file which wouldn't change the MD5.
MR. CHAKRAVARTY: All right. Thank you, Mr. Bruemmer. Go back to the other screen.
MR. CHAKRAVARTY: The 3R5, does that correspond with Exhibit 1141?
KEVIN SWINDON: Yes, it does.
MR. CHAKRAVARTY: I've just called up 1557 again. What was the 3R5?
KEVIN SWINDON: The 3R5 was a Samsung Finesse cell phone seized at the Pine Dale Hall location. It was imaged at Black Falcon and processed at Black Falcon.
MR. CHAKRAVARTY: Again, was this a cell phone found in the defendant's dorm room?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: And was this one of the devices that had those audio files on it?
KEVIN SWINDON: Yes, it was.
MR. CHAKRAVARTY: I'd move in 1141 into evidence, your Honor.
THE COURT: All right. Noted and admitted.
(Exhibit No. 1141 received into evidence.)
MR. CHAKRAVARTY: Now, this is the first cell phone that we're looking at the digital extraction for, is that right?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: So what do we see here in the UFED Samsung CDMA SCHR810 finds?
KEVIN SWINDON: Cell phones are processed a little differently. They're several different ways we can process cell phones. One way is through a product called UFED, or CelleBrite. And that's how this phone was imaged. And it creates a report from the phone and allows you to extract the files from the phone.
MR. CHAKRAVARTY: The first file, 1141-01-07211546.jpeg, what's that?
KEVIN SWINDON: It's a JPEG that was extracted from the phone.
MR. CHAKRAVARTY: Were there several other JPEGS or image files that were found on this phone?
KEVIN SWINDON: Yes, there was.
MR. CHAKRAVARTY: You didn't extract them all, right?
KEVIN SWINDON: I was asked to verify this was on the phone.
MR. CHAKRAVARTY: Were there other pictures of the defendant on that phone?
KEVIN SWINDON: Yes, there were.
MR. CHAKRAVARTY: What is this?
KEVIN SWINDON: This is a copy of the phone examination report.
MR. CHAKRAVARTY: Is this something that the software generates?
KEVIN SWINDON: Yes. This is software-generated.
MR. CHAKRAVARTY: What type of information is in this 131-page document?
KEVIN SWINDON: This would -- depending on the type of phone and the process used, this could include contacts, text messaging, photos, files that were on the phone. It would include maybe the SIM card information if there was a SIM card associated with the phone. It would be anything -- or data that would be associated with the phone.
MR. CHAKRAVARTY: Does it also include the phone contacts?
KEVIN SWINDON: Contact lists, yes.
MR. CHAKRAVARTY: So I'm just going to scroll through the list of contacts here. Is that about 17 pages of contacts?
KEVIN SWINDON: Which page did you start on?
MR. CHAKRAVARTY: Sorry. I start on Page 2.
KEVIN SWINDON: 2 to --
MR. CHAKRAVARTY: 2 to 18?
KEVIN SWINDON: I can't really tell because the pagination might not be right, but it's on or about --
MR. CHAKRAVARTY: Thank you.
KEVIN SWINDON: -- that number pages.
MR. CHAKRAVARTY: Then there's some call data here?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: And is the call data obtained from the phone handset or from the telephone company that provides service?
KEVIN SWINDON: This report is generated from data that's on the phone.
MR. CHAKRAVARTY: In your experience as a computer forensic examiner, have you compared whether phone data from a handset is the same as phone data from a cell phone company?
KEVIN SWINDON: I mean, it would be a separate legal process, but you would have to subpoena the phone records or -- and do a comparison.
MR. FICK: I'm actually going to object to this version of this exhibit which appears to have lost the image -- I'm sorry. I'm objecting on completeness grounds because it looks like this version that's now the exhibit has lost the image thumbnails that go in the report.
THE COURT: You can examine on it. We'll deal with it if --
MR. CHAKRAVARTY: These are bookmarks for a variety of different images that were taken on the phone?
KEVIN SWINDON: On the left-hand column is the information that is -- is the file names that were on the phone, yes.
MR. CHAKRAVARTY: And looks like there are hundreds of images on this phone, right?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: And then, in addition to images, are there audio files on this phone?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: And, again, like the images, all of these -- the audio files themselves are not on this disk, correct?
KEVIN SWINDON: They are not.
MR. CHAKRAVARTY: I'm just getting to the bottom. It looks like there's over a hundred audio files in this phone as well?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: Then there are some video files, correct?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: And all of that data was not exported to these CDs, correct?
KEVIN SWINDON: It was not.
MR. CHAKRAVARTY: Going into the audio folder on this now, was this the folder that contains the files that were actually extracted and put on the CD for the jury?
KEVIN SWINDON: Was that the actual folder that was on the phone?
MR. CHAKRAVARTY: No. Was the folder on the CD --
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: Does that contain the actual files that --
KEVIN SWINDON: Yes. These audio files were on the phone, yes.
MR. CHAKRAVARTY: So this is not the hundreds of audio files that may have been on the CD?
KEVIN SWINDON: No, no.
MR. CHAKRAVARTY: Can we just go through and read the titles of these files that were on the Samsung phone?
THE COURT: Sustained.
MR. CHAKRAVARTY: Is it fair to say that 1141-03 through 1141-11 were all audio files that were on the Samsung phone?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: And several of them were also on those other devices that you just described, the two iPods as well as the laptop computer, the Sony Vaio?
KEVIN SWINDON: 1R6, yes.
MR. CHAKRAVARTY: 1R6. Let's move onto the next CD. I think it's 1147 -- 1147 and 1148. What are those?
KEVIN SWINDON: 1147, 1148 correspond to 2V7B and 32-2. They were CD-ROMs. One was seized -- or identified and seized in the Honda Civic. It was imaged at Center Plaza, processed at Center Plaza, and contained audio files. And 32-2 was a CD-ROM seized in the Mercedes, imaged at Center Plaza, processed at Center Plaza, and contained audio files.
MR. CHAKRAVARTY: And so these were the two CDs that were found in the two vehicles that were in Watertown on April 18 and April 19, 2013?
KEVIN SWINDON: Yes. They were found in the Honda Civic and the Mercedes, yes.
MR. CHAKRAVARTY: The Mercedes one, do you recall if that was the CD that was in the radio that they -- the state police was able to get out?
KEVIN SWINDON: I didn't seize it from the Mercedes but, according to the description and the location, yes.
MR. CHAKRAVARTY: And the other CD, was that the one from the Honda Civic? I think it was in the glove box?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: And, again, did you extract -- did you verify that the data on the extracted CDs that you have in front of you is, in fact, data from those two CDs?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: I'd move in Exhibits 1147 and 1148.
THE COURT: All right. Admitted.
(Exhibit Nos. 1147 and 1148 received into evidence.)
MR. CHAKRAVARTY: 32-2, the folder marked 32-2, which is in 1147, is this the one-page file listing of the files on that?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: 1147-03, is that a playlist for the CD?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: Clicking on the files folder, is this the file structure that was on that CD?
KEVIN SWINDON: Those were the files that were on the CD, yes.
MR. CHAKRAVARTY: And for 1147, in the parent folder under "files," are there several documents with the name Sheikh Anwar Awlaki in them?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: At least Exhibits 1147-09 through 1147-16?
KEVIN SWINDON: I'm sorry?
MR. CHAKRAVARTY: Sorry. Do those -- just for the record, I just wanted to make clear which of those files we're referring to. 1147-09 through 1147-16, do these all start with "Sheikh Anwar Awlaki and the Battle of Badr and the Battle of Uhud"?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: Each of the subfolders themselves have additional files? Some appear to be in a foreign language, correct?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: If we go to 1148, do we see similar file structure?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: Instead of those Sheikh Anwar Awlaki Battle of Uhud and Battle of Badr, we see, "Minor Signs of the Day, Anwar Awlaki, the Hereafter Series," 1148-07 through 1148-11, correct?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: And then, like the other CD, there are a variety of additional folders which themselves have audio files in them, is that correct?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: Like the other CD, did you verify that this was the file listing on the CD?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: Now, this is -- again, is this all of the files on them or just a select files?
KEVIN SWINDON: This was all of the files.
MR. CHAKRAVARTY: What is this, 1148-02?
KEVIN SWINDON: This was a different -- these are -- as opposed to the log file, as we had previously -- these are screenshots that are depicting the same information that would be available in that log file.
MR. CHAKRAVARTY: Does a CD have to be processed differently than a cell phone or a thumb drive or a computer?
KEVIN SWINDON: I mean, the imaging process is different because you're using maybe a different device, but the forensic process is similar.
MR. CHAKRAVARTY: And this 1148-05, what is that?
KEVIN SWINDON: It's an FTK image or log file. So there's a bit of redundancy here because the same information is --
MR. CHAKRAVARTY: Sorry. The same information is?
KEVIN SWINDON: Is in the previous screenshots.
MR. CHAKRAVARTY: In the screenshots, right. Can we go to 1149, please?
KEVIN SWINDON: 1149?
MR. CHAKRAVARTY: Yes, please.
KEVIN SWINDON: Is a thumb drive corresponding with 1W15. Media description is a Patriot thumb drive, seized or found at the Watertown, Laurel Street, location. It was imaged at Black Falcon, processed at Center Plaza.
MR. CHAKRAVARTY: Now, Patriot thumb drive, is that the brand of the memory that allows -- that's put onto a memory stick?
KEVIN SWINDON: What Patriot designates -- I believe designates the type of thumb drive it was. Like, there are different brands, and this happened to be a Patriot thumb drive.
MR. CHAKRAVARTY: Does the Patriot also sub-brand out their memory so they can be branded in different ways?
KEVIN SWINDON: That, I don't know.
MR. CHAKRAVARTY: The contents of that thumb drive, was that -- excuse me. Was that thumb drive found in Laurel Street in Watertown?
KEVIN SWINDON: That's the search location it was seized from, yes.
MR. CHAKRAVARTY: We had seen earlier on the -- on a couple of these histories, the spreadsheets that you had described earlier, a Patriot external device plugged into a phone. Is this the same device?
KEVIN SWINDON: It is not.
MR. CHAKRAVARTY: How do you know that?
KEVIN SWINDON: Well, when a -- there's a -- a thumb drive has a unique serial number associated with it. So when you put it into a computer, the registry would record that serial number. And it sits in the registry until either it's removed or the registry would make a change to it. But that serial number is collected in the registry.
MR. CHAKRAVARTY: And so the contents of 1149, is that -- are the contents of that CD files from the Patriot thumb drive marked as 1W15 that was seized in Laurel Street?
KEVIN SWINDON: Are you going to --
MR. CHAKRAVARTY: Yeah.
KEVIN SWINDON: Yes. The files from the thumb drive are on the CD.
MR. CHAKRAVARTY: Not all of them, though?
KEVIN SWINDON: If you could open the file up, please?
MR. CHAKRAVARTY: Well, I'd move into evidence 1149 first.
MR. FICK: Same objection and a relevance objection on this one, which I could explain perhaps at sidebar.
THE COURT: All right. I'll see you.