5.Kevin Swindon — Direct (Part 3)
306 lines(SIDEBAR CONFERENCE AS FOLLOWS:
MR. FICK: So, as far as I understand, the only real content of this thumb drive is some of Dias Kadyrbayev's homework. So other than the fact it was found on Laurel Street, I'm not sure what it has to do with the case.
MR. CHAKRAVARTY: It just goes to the association. It's not the substance of the content. We expect the defense is going to say that everything on Laurel Street was Tamerlan's. This was actually the defendant's friend's stuff.
THE COURT: Okay.
. . . END OF SIDEBAR CONFERENCE.)
(Exhibit No. 1149 received into evidence.)
MR. CHAKRAVARTY: Your Honor, may I go ahead and publish 1149?
THE COURT: Yes, okay.
MR. CHAKRAVARTY: 1149, 1149-01, is this the file listing?
KEVIN SWINDON: It is a derivative file listing.
MR. CHAKRAVARTY: So this is a portion of what was on there?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: And does it list apparently some homework and some things about Kazakhstan?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: 1149-01-A, this is the more complete file listing?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: Again, a log file?
KEVIN SWINDON: Yes, of the imaging.
MR. CHAKRAVARTY: Of the image. Then there's just a couple of homework assignments in here that are on that CD, correct?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: I'm going to click on 1149-03. This appears to be some kind of a term paper or something called, "The Definition and Examples of Manifest and Latent Function in Society"?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: Is the name at the top Dias Kadyrbayev?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: And do you know that Dias Kadyrbayev was one of the defendant's friends?
THE COURT: Sustained to the form of the question.
MR. CHAKRAVARTY: Do you know who he is?
KEVIN SWINDON: I do know who he is.
MR. CHAKRAVARTY: Who do you know him to be?
THE COURT: Overruled.
KEVIN SWINDON: During my involvement with the initial investigation and in the command post, the name was recognized both to me as a part of the investigation that was going on in the New Bedford area.
MR. CHAKRAVARTY: 1149-04, is that another homework assignment?
KEVIN SWINDON: Yes, it is.
MR. CHAKRAVARTY: Again, it's from the same person, Dias Kadyrbayev?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: Now, at some point did you actually examine Dias Kadyrbayev's cell phone?
KEVIN SWINDON: I did. Similar to the process here, I verified and validated that there was information on the phone.
MR. CHAKRAVARTY: And just for the witness, your Honor, 1553 -- I'm sorry. Did I say that wrong here? 1153.
MR. CHAKRAVARTY: What do you recognize this to be?
KEVIN SWINDON: As titled, I recognize it to be text messages from Dias' phone.
MR. CHAKRAVARTY: In fact, with respect to communications between Dias and the defendant's phone number, 857-247-5112, did you verify that these text message exchanges were actually on Dias Kadyrbayev's phone?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: Your Honor, I'd move to introduce 1153 for -- primarily for the communications between the defendant and Dias, not the extraneous communications.
MR. FICK: Well, I think I have the same objections as before, and then perhaps we ought to have a redacted exhibit if they're only offering it for --
THE COURT: I agree. I won't admit it unless it's redacted.
MR. CHAKRAVARTY: We'll do that, your Honor.
Mr. Bruemmer, we can go back to --
MR. CHAKRAVARTY: Can we go now to Exhibit 1150? What is that?
KEVIN SWINDON: 1150 is a -- corresponds with the Kingston thumb drive, 1B2734L14. Location was the Crapo landfill. It was imaged at Quantico and processed at Center Plaza.
MR. CHAKRAVARTY: Was this a thumb drive that was found in a backpack that was found in the landfill down in New Bedford?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: Does 1150, the disk in front of you, reflect files that were on that thumb drive?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: I'd move 1150, your Honor.
THE COURT: All right. Admitted.
(Exhibit No. 1150 received into evidence.)
MR. CHAKRAVARTY: Now, we'll go to 1150-01-A. Is this the complete file listing?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: 1150-01-B, is this the X-Ways derivative file listing?
KEVIN SWINDON: It's a derivative file listing. It's a derivative list or derivative file that was made from the other information on the complete list.
MR. CHAKRAVARTY: Does this also include a translation column?
KEVIN SWINDON: Yes, it does.
MR. CHAKRAVARTY: And so, again, was that created by FBI translators to explain what the foreign language was?
KEVIN SWINDON: Yes, it was.
MR. CHAKRAVARTY: 1150-01, what's that?
KEVIN SWINDON: It's an additional derivative file listing from the drive.
MR. CHAKRAVARTY: This doesn't have that translation, correct?
KEVIN SWINDON: It does not.
MR. CHAKRAVARTY: 1150-02, what's that?
KEVIN SWINDON: It's the log file showing the imaging.
MR. CHAKRAVARTY: And 1150-03, are these translations for some of those foreign language files?
KEVIN SWINDON: Yeah. That -- yeah. This was not on the thumb drive, so I did not verify that it came from the thumb drive because it didn't. But it's added to the data set because it includes translations from the files that are on there.
MR. CHAKRAVARTY: So that the jury can understand what those files are?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: Let's open the folder "carved, recovered files of interest." What are these?
KEVIN SWINDON: Back to the carving process again, the -- back to the carving process again, it recovers files from unallocated and deleted space. And also -- these are also -- in this file is carved and recovered, so there are carved files and also recovered files, which are, as we spoke before, stuff that's recovered from deleted space.
MR. CHAKRAVARTY: Now, are carved files always able to be recovered in the sense of being able to access and treated like as if they had never been deleted?
KEVIN SWINDON: Carved files are kind of hit or miss. If it can recover part of the file, it will -- the application software will do as much as it can to render what it would -- what it used to be or using the data that it can get back. But it's not -- it doesn't always be able to render the entire file. So, for example, if it was a JPEG, it may render only half of the file, and the bottom may be pixilated, and you may not get the entire file back.
MR. CHAKRAVARTY: So the files on this, 1150, on this piece of media, were all of these files that we can see the titles of, are all of them able to be opened and accessed?
KEVIN SWINDON: Can you scroll down to see the -- they should be able to, yes.
MR. CHAKRAVARTY: Okay. Is it possible that some of them are corrupted?
KEVIN SWINDON: I'm sorry?
MR. CHAKRAVARTY: Is it possible that some of them are actually corrupted and you can't open them?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: So they appear as if they're an intact file, but you can't actually open it?
KEVIN SWINDON: Exactly, yes.
MR. CHAKRAVARTY: So why would that happen in the carving process?
KEVIN SWINDON: If it can't get the whole file back and it knows that it's a PDF, Adobe or another application might try and open that file. And when it doesn't have all of the data from that file, it doesn't allow it to open.
MR. CHAKRAVARTY: I'm going to click on 1150-34. Did we get an error saying that it can't be opened?
KEVIN SWINDON: Right. That would be an example. So it was able to recover the title of the file and maybe a portion of the data but not be able to be opened.
MR. CHAKRAVARTY: So I opened a file called 1150-14-169, "A Message to Every Youth." Is this a document that on the top says, "At-Tibyan Publications, A Message to Every Youth, by the martyred Imam Abdullah Azzam"?
KEVIN SWINDON: Yes, it is.
MR. CHAKRAVARTY: Is this a 28-page document?
KEVIN SWINDON: Yes, it is.
MR. CHAKRAVARTY: Which is in English but also has Arabic in it?
KEVIN SWINDON: I'm not sure if that's Arabic, but, yes, it's English in there.
MR. CHAKRAVARTY: At the end of this document, is there also a section called, "Also available from Tibyan Publications"?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: Does this list other titles of documents?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: Now, opening 1150-09-02, does this appear to be a scanned document that was also found on this thumb drive?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: Again, this was also in carved space?
KEVIN SWINDON: It was either recovered or carved.
MR. CHAKRAVARTY: And it was in the folder called "carved, recovered files of interest"?
KEVIN SWINDON: They're both carved and recovered files.
MR. CHAKRAVARTY: Yup, carved or recovered. Does this appear to be a rental application from a -- prepared by Katherine Tsarnaeva?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: Do you know who she is?
KEVIN SWINDON: The defendant's sister-in-law is what I know.
MR. CHAKRAVARTY: Go on to 1151. What is that?
KEVIN SWINDON: 1151 is one CD containing the reports for 2W1 and 2W2, which is an iPhone 4s and an iPhone 5, from Watertown, on Franklin Street. They were both attempted to be processed. They were processed -- imaged down at Quantico, processed at Quantico. The phones were physically broken, as noted there, and the only data that could be collected from it was the SIM data, or the SIM card.
MR. CHAKRAVARTY: Were these the two phones that were found nearby to where the defendant was arrested?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: Mr. Bruemmer, if we could just call up Exhibit 810, which is in evidence?
MR. CHAKRAVARTY: Are these those smashed phones?
KEVIN SWINDON: Without looking at the serial -- they appear to be the smashed phones, but without being able to verify the serial number, yes.
MR. CHAKRAVARTY: Where were these sent?
KEVIN SWINDON: Down to Quantico, Quantico, Virginia, the lab. I'm sorry.
MR. CHAKRAVARTY: Could we go to 811.
MR. CHAKRAVARTY: 811, did you see these phones shortly after they were seized?
KEVIN SWINDON: Yes. They came into -- they came into the lab, but they were -- came into evidence -- the Evidence Response Team before they were shipped down to Quantico.
MR. CHAKRAVARTY: As you did with Dias' phone and with the Samsung phone, did you attempt to extract the data that was on these phones?
KEVIN SWINDON: Because -- due to the conditions of the phones, it was impossible to extract the data from the phones.
MR. CHAKRAVARTY: So what did you do?
KEVIN SWINDON: They were shipped down to Quantico, to the lab, to attempt to try and extract the information. They have different techniques that we don't have available to us in the field.
MR. CHAKRAVARTY: Were they able to do that?
KEVIN SWINDON: They were unsuccessful also.
MR. CHAKRAVARTY: Was there any part of the phone from which they were able to get any data from?
KEVIN SWINDON: Well, the phones themselves contain SIM cards. As we had mentioned earlier, the SIM card is a small sort of almost like an SD card that would go in your phone. The SIM card has a unique serial number which is associated with that SIM card. The SIM cards are utilized by the carriers to authenticate your phone. And on that SIM card will have information such as your telephone number and -- potentially the telephone number, serial number of the phone, and, in Apple's case, not much more information than that.
MR. CHAKRAVARTY: Was the lab able to extract information from the SIM card?
KEVIN SWINDON: The SIM cards were imaged, yeah. There was an extraction done of the SIM cards, yes.
MR. CHAKRAVARTY: Did that also happen back at Center Plaza when you were --
KEVIN SWINDON: Yes, we did -- yes.
MR. CHAKRAVARTY: So on Exhibit 11 -- excuse me, 1151, what exists on that?
KEVIN SWINDON: 1151 are the reports from the SIM cards.
MR. CHAKRAVARTY: They're not. I'm going to move it in now.
MR. CHAKRAVARTY: I haven't gone to it yet. At this time, I'd move in 1151, which is the content of the SIM card reports.
THE COURT: All right. Admitted.
(Exhibit No. 1151 received into evidence.)
MR. CHAKRAVARTY: Now, Agent Swindon, was one of the phones given the alphanumeric identifier of 2W1 and the other given 2W2?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: Going first to 2W1, are these a series of images of that item?
KEVIN SWINDON: Those are images taken, yes, of that item.
MR. CHAKRAVARTY: These are just evidence images of the bag and the remnants of the device?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: And then I'm opening up 1151-10. Is this a photo of the SIM card?
KEVIN SWINDON: This is a SIM card mounted in sort of a tray-type piece.
MR. CHAKRAVARTY: So unlike the other exhibits which you've talked about, this actually has images of the item that you extracted data from?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: Are those fair and accurate images of what the device looked like?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: Now I'm opening up 1151-14-report. Is that an Internet Explorer file -- sorry, an HTML file?
KEVIN SWINDON: Yes. That's the format that the forensic process or the UFED CelleBrite presents the report in.
MR. CHAKRAVARTY: So what is this that we're looking at now?
KEVIN SWINDON: This is the report.
MR. CHAKRAVARTY: And does it list the ICC ID number up here?
KEVIN SWINDON: Yes, which is unique to the SIM card. And if you scroll down in the report, you'll see the phone number.
MR. CHAKRAVARTY: Is this the phone number here?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: 617-286-9151?
KEVIN SWINDON: With this SIM card, yes.
MR. CHAKRAVARTY: Do you know that to be the phone that was subscribed to by Jahar Tsarni on April 14, 2013?
KEVIN SWINDON: I don't have that information here in front of me.
MR. CHAKRAVARTY: Is that one of the two phones that was subscribed to Jahar Tsarni?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: Let's go to the other one. Does this also have a number of images of the device?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: And both in the evidence bag as well as outside the evidence bag?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: And also has pictures of the SIM card?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: Are all of those fair and accurate?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: Clicking on the report, is this the SIM card extraction report for 2W2, the other phone?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: Does this show both the unique ICC ID number --
KEVIN SWINDON: For that SIM card, yes.
MR. CHAKRAVARTY: -- as well as the phone number?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: Is the phone number here 857-247-5112?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: Is that the same number that was on the defendant's resume?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: Was that the same number that was on Dias' phone?
KEVIN SWINDON: In the text chat, yes.
MR. CHAKRAVARTY: Now, were you able to extract any other information from the phones that were destroyed?
KEVIN SWINDON: They were unsuccessful in extracting any other information off of the chips or off of the phones themselves.
MR. CHAKRAVARTY: Does that mean --
KEVIN SWINDON: The only thing that was available was the SIM card.
MR. CHAKRAVARTY: Were you able to get any of the content off the phone, like internet surfing history?
MR. CHAKRAVARTY: How about any songs or video files?
MR. CHAKRAVARTY: Any documents that had been accessed?
MR. CHAKRAVARTY: Any chats or communications with anyone?
MR. CHAKRAVARTY: Now, earlier -- it must be my head cold, but I think I asked you whether you had Exhibit 1457 in that folder. I meant to ask you if you had Exhibit 1475 in that folder.
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: What does Exhibit 1475 correspond to?
KEVIN SWINDON: 1475 corresponds to a -- the 1W16 CD external hard drive, was seized in Watertown, Laurel Street. It was imaged at Center Plaza, processed at Center Plaza.
MR. CHAKRAVARTY: Was that the hard drive that was found on the street in Watertown after the shootout?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: Does 1475 reflect data that was extracted from that hard drive?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: Like the other devices that you've talked about, have you personally verified that those -- each of these CDs contains data that was on each of those devices?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: I'd move to introduce Exhibit 1475, please.
THE COURT: All right. Admitted.
(Exhibit No. 1475 received into evidence.)
MR. CHAKRAVARTY: First I'm going to open 1475-01. What is that?
KEVIN SWINDON: It's the FTK report, the log report that shows the imaging.
MR. CHAKRAVARTY: Does that reflect that the descriptor for this device was a My Passport, 500 gigabyte USB HDD, or hard drive?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: 1475-02-A, what is that?
KEVIN SWINDON: It is a complete file listing.
MR. CHAKRAVARTY: 1475-2-B?
KEVIN SWINDON: Was a derivative file listing.
MR. CHAKRAVARTY: This is a portion of the --
KEVIN SWINDON: Portion of the complete file listing, yes.
MR. CHAKRAVARTY: So just looking through this listing, is there -- let's focus on this one. Is there a foreign-language word followed by a completeinspire.pdf as one of the files?
KEVIN SWINDON: That's the name of the folder that the -- that that would have been on the drive -- on the thumb drive.
MR. CHAKRAVARTY: So the v-d-o-h-n-o-v-l-y-a-i is a folder name?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: Do you know what that means in Russian?
KEVIN SWINDON: I don't.
MR. CHAKRAVARTY: But the completeinspire.pdf you've seen before?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: You've seen that on a variety of the devices that we've gone through today, correct?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: Does this say that it was created on this device at 12/27/2012?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: Does this column have a translation that is consistent with the translations that the linguists at the FBI put on there after they were processed?
KEVIN SWINDON: Yes. I didn't create that column, but, yes, that's consistent with the other --
MR. CHAKRAVARTY: As with all of the other CDs that you've described, the translation column is not one that was native on those original electronic media? That's something the linguists did and added to the spreadsheet?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: Were there additional files that you saw on other media, like inspirefall2010.pdf, inspirejanuary2011.pdf, inspiremarch2011.pdf, inspirenovember2010.pdf, inspiresummer2011.pdf, issue9.pdf, jointhecaravan.pdf?
KEVIN SWINDON: Those were consistent with file names that we recognized across several other pieces of data.
MR. CHAKRAVARTY: And all these files that we've seen throughout your examination today, is that fair to say? The Sheikh Anwar Awlaki, Battle of Badr, Sheikh Anwar Awlaki, Battle of Uhud, do you recognize those?
KEVIN SWINDON: I recognize those names, yes.
MR. CHAKRAVARTY: The files folder on this device, were there -- this is the file structure that was in that folder or partial file structure?
KEVIN SWINDON: Partial file structure that was in that -- on that --
MR. CHAKRAVARTY: Was there a folder called, "Anwar al-Awlaki lectures"?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: Were Exhibits 1475-04 through 1475-11 in that?
KEVIN SWINDON: Yes, they were.
MR. CHAKRAVARTY: Is there a folder marked "tema"?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: Are there foreign-language files in this folder that were actually converted from a proprietary e-book format into a PDF file?
KEVIN SWINDON: I confirmed that these files were resident on the original image.
MR. CHAKRAVARTY: Was there a folder called "TT" as well, which have more foreign-language files?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: Then there's a folder called v-d-o-h-n-o-v-l-y-a-i that has what appears to be a number of Inspire magazines; is that fair to say?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: 1475-03 is marked "English 2612.docx." Is that a Word document?
KEVIN SWINDON: Appears to be a Word document, yes.
MR. CHAKRAVARTY: Does that appear to be a submission for English class by someone named Giovanni Norgill (ph), on February 4, 2012?
KEVIN SWINDON: His name is on the document.
MR. CHAKRAVARTY: Do you know who he is?
KEVIN SWINDON: I do not.
MR. CHAKRAVARTY: Do you know whether he was a classmate of the defendant's?
KEVIN SWINDON: I do not.
MR. FICK: Your Honor, I object to the way this one is presented, which I'm seeing for the first time now. As I understand it, if I'm not mistaken, that last file, 1475-03, was actually carved and was not actually in the top structure of the drive. As I see this, I believe it's misleading, so I lodge the objection.
THE COURT: Again, I think it's a matter for your examination.
MR. CHAKRAVARTY: This external hard drive that you verified the files were on there --
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: -- did you export all of the files that you were able to recover from that drive?
KEVIN SWINDON: We -- these files were selected by the team, the investigative team, and we verified that these files existed on the computer.
MR. CHAKRAVARTY: In fact, were there, on some of these devices, many more audio files and pictures and documents and surf history that we haven't presented?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: Let's go back to the 1R6, the 1142. The Hereafter Series, this is a folder and a collection of files that we've seen on some of these other devices; is that fair to say?
KEVIN SWINDON: I recognize the name al-Awlaki, yes.
MR. CHAKRAVARTY: And this 1142, Sony Vaio laptop, it had several Inspire magazines on it; is that fair to say?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: 1142-79, 1142-82, 1142-88, 89, 91, and 93, are all Inspire magazines, is that correct?
KEVIN SWINDON: Those are the titles.
MR. CHAKRAVARTY: In addition, it had a number of audio files that you saw on all the devices, correct? An example, "Rasool Allah, Inspiring Words of Truth"?
KEVIN SWINDON: You're referring to these here, or which are you referring to?
MR. CHAKRAVARTY: Yes. I'm sorry. The ones that are in front of you.
KEVIN SWINDON: I would have to actually see them all together. I can't confirm that they were all in all the other places.
MR. CHAKRAVARTY: And some of these files under the papka folder you found throughout all the other devices; is that fair to say?
THE COURT: Sustained.
MR. CHAKRAVARTY: Fair enough.
MR. CHAKRAVARTY: Do you recognize these files from the thumb drive that was found in the landfill?
THE COURT: You may answer that.
KEVIN SWINDON: We need to compare the two.
MR. CHAKRAVARTY: 1150-10 was entitled "completebalance.pdf," is that fair? And that is also on the file called -- "complete balance" is also on the --
KEVIN SWINDON: The names are similar, yes -- or the names are the same, yes.
MR. CHAKRAVARTY: We can do that with a variety of different devices and variety of different files from the 1142, is that accurate?
KEVIN SWINDON: From 1142, from 1R6, yes.
MR. CHAKRAVARTY: From 1R6, comparing that to a variety of other devices that you talked about?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: I don't need to do that with every one, but I wanted to use that as an example.
MR. CHAKRAVARTY: Just one moment, your Honor.
Your Honor, I believe I'm done. Given that we're at the end of the day, however, I would like -- before I turn it over to the -- for cross-examination, I would just ask to hand that baton over on Monday morning.
THE COURT: That's fine. This is as far as we'll go today, jurors, and this week. So we're off for the next three days.
Again, I remind you of all of my cautions, no discussion, no exposure to any media, no independent research. Don't try to educate yourself on computers over the weekend. Your evidence must come here from the courtroom and not from other sources.
Enjoy the weekend. We'll see you Monday, and we'll continue with the evidence.
(Whereupon, at 3:56 p.m. the trial recessed.)