2.Kevin Swindon — Direct (Part 4)
171 linesCONTINUED DIRECT EXAMINATION BY MR. CHAKRAVARTY:
MR. CHAKRAVARTY: Good morning, Agent Swindon.
KEVIN SWINDON: Good morning.
MR. CHAKRAVARTY: I just wanted to clarify a few things before I hand you over for cross-examination. We had talked on Thursday about some of the items that you had found on the Sony VAIO laptop, what you called the 1R6, Exhibit 1142. Do you remember that?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: Was one of those items a folder that was marked as a Mobilsync backup?
KEVIN SWINDON: There was a file named Mobilsync backup.
MR. CHAKRAVARTY: Can you just explain again what that was?
KEVIN SWINDON: The Mobilsync backup is a backup of the iPhone or an Apple device that would be stored on the computer if you backed it up.
MR. CHAKRAVARTY: And what kinds of data were stored in the Mobilsync backup?
KEVIN SWINDON: The Mobilsync backup has a standard set of things it attempts to try and store but not always successful. Typically it would be contacts, text messages, the actual ID of the phone, of the SIM card ID on the phone, and maybe images and other data that would be on the phone.
MR. CHAKRAVARTY: And so on the -- on that device, did you locate several text messages that were then exported and you verified that those did appear, in fact, on the Sony VAIO computer?
KEVIN SWINDON: The text messages were in the Mobilsync backup data that was exported.
MR. CHAKRAVARTY: Specifically, were there Exhibits No. 1385 through 1389, 1393, and 1395? Would it help to put them up on the screen?
KEVIN SWINDON: It would, yes.
MR. CHAKRAVARTY: Your Honor, for the witness, please.
MR. CHAKRAVARTY: So this is 1385, 1386, 1387, 1388, 1389, 1393, and 1395. Do you recognize those as being text messages that were exported from the Sony VAIO laptop along with a redaction of the identifying information of the counterparty to a conversation?
KEVIN SWINDON: Yes. Those messages were located in Mobilsync backup data from the 1R6.
MR. CHAKRAVARTY: I'd move into evidence 1385 through 1389, 1393, and 1395.
THE COURT: All right. Overruled. Admitted.
(Government Exhibit Nos. 1385-1389, 1393, 1395 received into evidence.)
MR. CHAKRAVARTY: With regards to this Mobilsync backup, I had asked you a little bit on Thursday with regards to whether you were able to identify which phone actually produced those text messages. I should say which phone had synced with the laptop that resulted in those text messages going over to the laptop. Were you able to determine that?
KEVIN SWINDON: Yes. With the exception of 1385, the messages were included in the iPhone 5 backup.
MR. CHAKRAVARTY: I'm sorry. 1385, was that a different iPhone?
KEVIN SWINDON: Yes. That came from the iPhone 3. That was another Mobilsync backup that was on the device.
MR. CHAKRAVARTY: Thank you for clarifying that. For the remainder, which phone were you able to attribute those to?
KEVIN SWINDON: All but 1385?
MR. CHAKRAVARTY: All but 1385.
KEVIN SWINDON: Yes. The iPhone 5.
MR. CHAKRAVARTY: And that's --
MR. CHAKRAVARTY: I think this is in evidence. Your Honor, if I could have this published?
THE COURT: Displayed?
MR. CHAKRAVARTY: Yes, please.
MR. CHAKRAVARTY: This is what's marked 1411, also on the 1R6 device. Was there an ICC ID number on this?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: Were you able to match that up with an ICC ID number somewhere else in the investigation?
KEVIN SWINDON: Yes, from the iPhone 5 on -- I believe it's 2W1.
MR. CHAKRAVARTY: Moving over to --
KEVIN SWINDON: I'm sorry.
MR. CHAKRAVARTY: 2W2?
KEVIN SWINDON: 2W2, I'm sorry.
MR. CHAKRAVARTY: Were you able to read the SIM card, and is that the same number?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: I just pulled up on the screen 1151-16, which is a photograph of the SIM card that you looked at on Thursday, is that right?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: In addition, I had asked you on Thursday whether there were some text messages that were extracted from an iPhone of Dias Kadyrbayev. Do you recall that?
KEVIN SWINDON: I do, yes.
MR. CHAKRAVARTY: Over the weekend, were we able to redact a version of those text messages?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: And I'd move into evidence Exhibit 1153, which is the redacted version.
THE COURT: All right. Subject to that objection, overruled. Admitted.
(Exhibit No. 1153 received into evidence.)
MR. CHAKRAVARTY: Call up 1153 on Sanction, please.
THE COURT: Publish?
MR. CHAKRAVARTY: Yes, please. Thank you.
MR. CHAKRAVARTY: Agent Swindon, are these text messages that were from April 18, 2013, from Dias Kadyrbayev's phone between Dias and the person listed as Jahar, with a phone number 857-247-5112?
KEVIN SWINDON: These messages were present on that phone, yes.
MR. CHAKRAVARTY: The text box on the right, does it say, "I saw the news"? "Better not text me, my friend." And then --
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: And then does that same user say, "If you want, you can go to my room and take what's there, Smiley face, Bro, salaam alaikum"?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: Now, I wanted to clarify --
MR. CHAKRAVARTY: Thank you, Mr. Bruemmer.
MR. CHAKRAVARTY: I wanted to clarify a few points about a couple of the devices, the external hard drive devices. There was one that was found in Watertown, on Laurel Street, that we've introduced as Exhibit 1475. Do you recall that?
KEVIN SWINDON: Yes. Can you bring up the original exhibit that had the list, please?
MR. CHAKRAVARTY: Sure. You want the list, the spreadsheet?
KEVIN SWINDON: Yes, please.
MR. CHAKRAVARTY: So we were talking about the 1W16, is that right?
KEVIN SWINDON: Yes, sir.
MR. CHAKRAVARTY: And were there certain files that were -- appeared to be scanned versions of Russian textbooks on this hard drive?
KEVIN SWINDON: There were files on that 1W16 that were in a format -- that were recovered in a format called DjVu. DjVu is a proprietary format, similar to, like, a PDF file or an Adobe PDF, although not widely used anymore. Those files were converted from DjVu to PDFs for trial purposes or exhibit purposes.
MR. CHAKRAVARTY: And so moving into that hard drive, is this an example of the fact that those are now PDFs so that they can be opened in front of the jury?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: On that same hard drive, I think you mentioned on Thursday that there was a file that appeared to be a document which was a homework assignment of somebody that -- named Giovanni Norgill. Was that in the active directory of the computer hard drive, or where did you locate that?
KEVIN SWINDON: Could you go back one, please?
MR. CHAKRAVARTY: Sure.
KEVIN SWINDON: Thank you. Yeah, the 1475-03 was a carved/recovered file from a previous directory structure that existed on the hard drive.
MR. FICK: Your Honor, I'd just ask the exhibit be modified at a convenient time to conform to the format of the other exhibits where carved files were stored separately so as not to mislead anybody.
THE COURT: I'm not sure I followed that. They're organized --
MR. FICK: The exhibits have largely been organized to sort of show the location of the files the way they were on the active device. Where there were carved files on most of the other exhibits, those were put in a separate folder so no one is confused about whether they were there or whether they were deleted and recovered.
MR. CHAKRAVARTY: I don't have a problem with that, your Honor.
THE COURT: Okay.
MR. CHAKRAVARTY: Now, these DjVu files -- DjVu is just a -- is that a software tool?
KEVIN SWINDON: It's a file format that they would be put into.
MR. CHAKRAVARTY: Were there also DjVu files found on the thumb drive that was found in the landfill that you've called L14 and we've marked as 1150?
KEVIN SWINDON: Could you go back to the spreadsheet, please? Yes.
MR. CHAKRAVARTY: And with regards to those DjVu files, were those also converted to PDF?
KEVIN SWINDON: Those were also converted to PDF.
MR. CHAKRAVARTY: Were some of those DjVu files actually corrupted, and you weren't able to access them?
KEVIN SWINDON: I believe that four of those files were corrupted and unable to be accessed.
MR. CHAKRAVARTY: To refresh your memory, was it Files No. 26, 27, 28, and 33 that were corrupted?
KEVIN SWINDON: Yes, it was.
MR. CHAKRAVARTY: For purposes of trial presentation, were those replaced with intact versions of those PDFs from another device?
KEVIN SWINDON: The disks that I was asked to review had an intact version of that file on it.
MR. CHAKRAVARTY: But it wasn't intact when you found it?
KEVIN SWINDON: It was not.
MR. CHAKRAVARTY: Again, no objection, your Honor.
THE COURT: Okay.
MR. CHAKRAVARTY: Now, the names of carved files, you explained what carving is. I'm not going to ask you to rehash what that is. But what did the names of carved files appear as when they're carved out of this unallocated space?
KEVIN SWINDON: In the application software, it doesn't -- it's not coming out of a directory so it doesn't have the name of the file, although it might be able to carve that file out of the unallocated space. It has to find some way of accessing it in the application software. So it starts a numerical numbering system unique to that carved file.
MR. CHAKRAVARTY: What is the name when your software exports a carved -- a series of 1's and 0's that software recognizes to be a file, what does it name that file?
KEVIN SWINDON: It would be a sequential number that was generated by the application software.
MR. CHAKRAVARTY: Again, for trial presentation purposes, where there was no name on the file itself, or no decipherable name on the file itself, but there was in the document, were any of the documents' titles changed in order to reflect the content?
KEVIN SWINDON: The carved file titles were changed to reflect the content, yes.
THE COURT: Okay. All right.
MR. CHAKRAVARTY: Now, sticking with this thumb drive that was found in the landfill, were you able to determine whether that thumb drive had ever been plugged into the Sony VAIO laptop computer, 1R6, Exhibit 1142?
KEVIN SWINDON: Yes, we were.
MR. CHAKRAVARTY: How were you able to do that?
KEVIN SWINDON: Again, from Thursday, the registry file which is associated with every Windows computer collects and stores information of devices that were installed into that -- into that computer. And there was an entry in that registry that showed the serial number from that thumb drive in the registry file.
MR. CHAKRAVARTY: If I may ask to publish Exhibit 1142-02, does this show a Kingston thumb drive being plugged into the 1R6 computer from the registry information?
KEVIN SWINDON: This information was extracted from a link file, and it shows the volume serial number which is unique to the Kingston thumb drive -- or this particular Kingston thumb drive.
MR. CHAKRAVARTY: You checked the registry to match up that Kingston thumb drive to the one that was found in the landfill?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: We had talked a little bit about Tamerlan's computer, the D385 that was found in Laurel Street in Watertown; do you remember that?
KEVIN SWINDON: We did, yes.
MR. CHAKRAVARTY: You didn't do the same extraction of files or verification of files that were on that computer, did you?
KEVIN SWINDON: We did not.
MR. CHAKRAVARTY: Did you find files of a similar nature on that computer as those that you talked about?
KEVIN SWINDON: There was a cursory look of that computer done, and there were numerous files that were of the same title.
MR. CHAKRAVARTY: Was there anything unique about how Tamerlan's computer was set up?
KEVIN SWINDON: One unique thing is that on D385 had a TrueCrypt volume on the drive. And TrueCrypt is an encryption software. It's readily available and it's actually freeware. You can download, and it will allow you to be able to encrypt a file, a folder or a drive -- or a volume, I'm sorry.
MR. CHAKRAVARTY: When you say "encrypt," what does that mean generally?
KEVIN SWINDON: Encrypt would be to change it from cleartext, which is readable, to a ciphertext, which would be unreadable to anybody who didn't have the password to decrypt it.
MR. CHAKRAVARTY: That's another type of password protection?
KEVIN SWINDON: It would be more data protection than password protection.
MR. CHAKRAVARTY: Finally, I asked you about some of the commonalities of files across some of the devices on Thursday.
MR. CHAKRAVARTY: Can we call up Exhibit 1438 just for the witness?
MR. CHAKRAVARTY: Do you recognize this chart?
KEVIN SWINDON: I do, yes.
MR. CHAKRAVARTY: What is it?
KEVIN SWINDON: This is an MD5 hash analysis, as we talked about on Thursday, which is the sort of fingerprint for the file. And this is an analysis of files that are common across 1R6, 1437, 14-6, and 3R5.
MR. CHAKRAVARTY: So those are four devices that you talked about on Thursday?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: And would this chart help you explain some of the propagation of those files across those devices to the jury?
THE COURT: Overruled. You may answer.
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: Your Honor, I'd mark this as a chalk, please, and ask to publish.
THE COURT: Okay.
MR. CHAKRAVARTY: Agent Swindon, is this a selected file listing from the 1R6 Sony VAIO laptop, 1142?
KEVIN SWINDON: Yes, it is.
MR. CHAKRAVARTY: And are these some of the audio files from that computer that we can see from the MP3 file type?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: Did you see these across various devices?
KEVIN SWINDON: We did.
MR. CHAKRAVARTY: Moving on in the same chart, did you see the same files on the iPod Nano labeled "Jahar"?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: How did you determine that they were the same files?
KEVIN SWINDON: Not only do the -- in most cases, the title of the files match but the MD5 hash value matches.
MR. CHAKRAVARTY: And the MD5 hash value you described as the fingerprint for each file?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: And did you find the same files on the iPod Shuffle that was found in Watertown that was labeled "MP3 play"?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: Again, was it through the same MD5 hash value analysis?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: And the 3R5, which was the Samsung Finesse phone that was found in the dormitory room at UMass Dartmouth, did you find those same files?
KEVIN SWINDON: Yes.
MR. CHAKRAVARTY: And so does this table indicate the common files that -- those common files that you just mentioned that were on all four of those devices?
KEVIN SWINDON: Those particular files, yes.
MR. CHAKRAVARTY: Your Honor, I think foundation has been met to move to introduce this as evidence under 1006, your Honor, so I would so move.
MR. FICK: I'd object to the word -- the title of the file because it suggests a direction of the movement has not been established.
THE COURT: Overruled. I'll admit it as an exhibit. What's its number?
MR. CHAKRAVARTY: 1438.
THE COURT: Okay.
(Exhibit No. 1438 received into evidence.)
MR. CHAKRAVARTY: Those are all the questions I have for Agent Swindon at this time, your Honor.