3.Kevin Swindon — Cross (Part 5)

MR. FICK: Good morning, Agent Swindon.

MR. FICK: My name is Bill Fick. I'm one of Mr. Tsarnaev's attorneys. You spent a good part of your testimony, both today and last week, talking about Exhibit 1142, which are the collection of files from the Sony VAIO, right?

MR. FICK: And at one point last week when you were talking about that exhibit, you said -- and I think -- I'm quoting, "This was a representative sample that was given to us to verify." Do you remember saying that?

MR. FICK: And that actually wasn't an accurate statement, right, because there's nothing representative at all about what's on 1142, fair to say?

MR. FICK: A sample selected by the investigative team at the FBI, right?

MR. FICK: So it's not representative in some proportional way of what was on the Sony, right?

MR. FICK: Just to make it a little more concrete, there was a lot of Mr. Tsarnaev's homework on the Sony, right?

MR. FICK: There was one homework assignment among the exhibits that you talked about, right? And that was an assignment about drones from high school; do you remember that?

MR. FICK: Just to go backwards, you recognize this as being Exhibit 1142, right? Going inside the Sony laptop, going to public, and the first document there is the assignment about drones that I believe you talked about, is that right?

MR. FICK: You're aware that there were other homework assignments on the computer right? You looked at the computer, and this was one file that was selected for you to make sure was there?

MR. FICK: And the Exhibit 1142 that you talked about also included a selection of audio files, music, right? The nasheeds we've been talking about that you verified?

MR. FICK: That was a selection that the investigative team gave you that you then verified were there, right?

MR. FICK: And we're talking about -- it was a couple dozen files, something like that, that you talked about?

MR. FICK: All right. Well, we can do that again.

MR. FICK: I'm going through stuff that's in evidence, your Honor, so I would leave it on the screen if that's okay.

MR. FICK: Thank you.

MR. FICK: Well, whatever the number was, the bottom line is there was a group of files that were on the disk that we talked about -- that you talked about last week that you verified, right?

MR. FICK: And it was a small collection of the over 400 MP3 audio files that were on that computer, right?

MR. FICK: When you were in the process of verifying the files, you looked at the 4,000-or-so-page long list of everything on the computer, right?

MR. FICK: So you have noticed, in looking at that list, there were many hundreds of audio files on the computer, correct?

MR. FICK: Are you willing to even estimate that we're talking many hundreds of files?

MR. FICK: Well, in any event, in addition to the nasheeds that you talked about in your testimony --

MR. FICK: If I can get my screen back here.

MR. FICK: -- there were -- there was pop music on the computer, right? Did you happen to notice that when you were looking at the audio files?

MR. FICK: Fair to say you recognized a large number of pop music audio titles in verifying the MP3 files on the computer, correct?

MR. FICK: Just by way of example, I'm going to pull up a screenshot of Page 2126 of Exhibit 1142-152. And, for example, the title we've heard other times in this trial is on this computer, Jay-Z, Ain't No Love in the Heart of the City; do you see that?

MR. FICK: Yes. You're looking at Page 2126 from Exhibit 1142-151. Do you see that?

MR. FICK: And that's the complete file listing or something like it that you used to go through and verify whether various files were on the computer, correct?

MR. FICK: And the total number of exhibits -- sub-exhibits numbered on 1142, I think the highest number is 151 or something like that, is that right?

MR. FICK: Okay. We'll pull it up again. 1142-151, that's the sort of last document there. That's the giant file listing we were just looking at, right?

MR. FICK: 151 sub-exhibits from this computer out of a half a million files, is that right?

MR. FICK: So we're talking about something like three-ten-thousandths of one percent of the files from that computer, right?

MR. FICK: I'm not asking you if you looked at every single solitary file. I'm just asking whether the selection that the investigative team included on this disk is a flyspeck compared to 500,000?

MR. FICK: Who selected what files were going to go on this disk? You said it wasn't you.

MR. FICK: Can we put some names on that? Do you know who actually made the choice?

MR. FICK: So do you believe it was different people that did it, multiple people that did it?

MR. FICK: Who sort of provided you with the finished package? Who tasked you with, Here's a list? Check and see if they are there?

MR. FICK: So who's the senior investigative analyst?

MR. FICK: And him and a collection of case agents and the prosecutors together, in some ceremonial forum, gave you the disks altogether?

MR. FICK: Bottom line is you're not the one who selected them?

MR. FICK: Okay. Now, what about the various spreadsheets that are in each of these exhibit files, the various -- these derivative exhibits you talked about, the spreadsheets of internet history selections, et cetera? Who made those?

MR. FICK: So as to any individual spreadsheet, can you say who in particular actually made it?

MR. FICK: For any of them, do you know who made them?

MR. FICK: For example, can you just tell me one of the ones on the screen here and tell --

MR. FICK: Yes, please.

MR. FICK: Well, no. You said you only knew some of them. So pick one that you know who made it and tell me.

MR. FICK: Yes.

MR. FICK: Who made that one then?

MR. FICK: When you went through to verify the materials on these disks, did you verify each of the spreadsheets for accuracy as well?

MR. FICK: So did you compare them line by line?

MR. FICK: Now, what about exhibits that aren't from internet evidence, exhibits that are fileless from the computer, did you verify those line by line?

MR. FICK: I understand, for example, that -- correct me if I'm wrong -- something like Exhibit 151, the massive 4,000-page list, that's generated by a computer or software, right?

MR. FICK: But the other exhibits, the sort of subsets, the derivative samples, the extractions of a limited number of files, that's done by some human being, right? If you just take, for example -- let me just ask the question more generally. There's the 4,000-page list of all the files in the computer, right?

MR. FICK: There were various other spreadsheets with lesser lists of certain files that the FBI determined were relevant to the investigation you should talk about, right?

MR. FICK: Lists, sublists of the big one. They contain a smaller number of files in the list.

MR. FICK: For example, 1142-13, right, these are various selected user files from the Sony laptop, right?

MR. FICK: And this is a five-page spreadsheet as opposed to 4,000 pages, right?

MR. FICK: So some human being picked some of the files on the 4,000-page list and included them on the smaller five-page list, right?

MR. FICK: Okay. As to such spreadsheets, the smaller lists, the sublists, did you go through each of those and verify that each of the actual entries, the files and the dates and times associated with them, were actually on the master list?

MR. FICK: They were generated from the master list in the form of somebody cuts and pastes different entries, right?

MR. FICK: Okay. Did you go through them line by line and make sure there was no error in the moving from here to there, as a general matter, for all of these spreadsheets?

MR. FICK: My question is a little bit different. I'm talking about did you go through line by line and make sure nothing extraneous got in there, nothing fell out that should be there?

MR. FICK: Did you do that on a line-by-line basis?

MR. FICK: For each of the spreadsheets that you've talked about here.

MR. FICK: Every single one?

MR. FICK: Speaking generally now about the collection of exhibits that was put into evidence through you last week, each of those disks has a number of derivative spreadsheets on them, fair to say?

MR. FICK: Among those spreadsheets on each of them is a derivative spreadsheet, a selected file list from each of the devices, right?

MR. FICK: Let me try and ask the question a little bit more specifically then. As to Exhibit 1142-13, the selected file list off of the Sony, did you review that spreadsheet line by line to make sure it was all accurate?

MR. FICK: Okay. And did you do the same thing for all of the other like spreadsheets that are derivative file lists in the other exhibits?

MR. FICK: Okay. As a general matter, for whatever the technique was, did you verify each spreadsheet line by line?

MR. FICK: Now, you are a supervisory special agent, right?

MR. FICK: And you're both an agent and a certified computer analyst, right?

MR. FICK: Well, you talked about the various kinds of training and certification you have in computer forensics, right?

MR. FICK: And so you have training as both sort of the standard FBI agent training, and you have additional specializations in computer forensics, fair to say?

MR. FICK: And you are the supervisor in Boston for both the Cyber National Security Squad and for the CART team; as I understood it, correct?

MR. FICK: And remind us again what CART stands for.

MR. FICK: And so the people you supervised did a lot of work collecting, processing and analyzing the hundreds of pieces of digital evidence that were collected in this case, right?

MR. FICK: But you are the CART supervisor in Boston, right?

MR. FICK: And the various items, if we pull up, for example, the little exhibit, the chalk, that Mr. Chakravarty talked about with you a fair amount -- I believe it was marked as 1557. In general, the items that you've been talking about were all processed at either Black Falcon or Center Plaza here, right?

MR. FICK: Or Quantico, a few of them down at the bottom. But a large number of them at Black Falcon and Quantico, right?

MR. FICK: I'm sorry, Black Falcon and Center Plaza, right?

MR. FICK: Those are the -- these -- that's where the CART people worked that you supervise, right?

MR. FICK: It was temporary?

MR. FICK: But you supervise CART in Boston; that's the bottom line?

MR. FICK: Now, so you then had an oversight role in the activities of analyzing the data from the devices collected in the Boston Marathon investigation, right?

MR. FICK: As time went on, as a supervisor, you reviewed their work product from time to time, right?

MR. FICK: But you're certainly aware of what the people under your supervision are doing, right?

MR. FICK: And you discuss issues that may come up from time to time, right?

MR. FICK: Issues related to the work that they are doing on the investigation.

MR. FICK: So you have an awareness of the investigation of digital evidence related to the Boston Marathon bombing?

MR. FICK: Pretty big investigation in your career, I take it, right, in terms of scope and complexity?

MR. FICK: Big, big operation?

MR. FICK: I think you testified that the FBI has a very standardized process for acquiring and processing digital evidence, right?

MR. FICK: The process of actually doing the investigation, taking the device, imaging it, processing it, that's all very standardized also, isn't it?

MR. FICK: It's important to document that process, too, at each step of the way, to record what has happened and who did it, right?

MR. FICK: Well, there's a standard chain of custody, for example, that the FBI maintains for electronic evidence in these kinds of investigations, right?

MR. FICK: So that keeps track of a device gets imaged, right? That's part of what happens here. There's a recording of the fact of the device being imaged, right?

MR. FICK: Right.

MR. FICK: When a piece of evidence comes in and is imaged, that fact is recorded as part of the chain of custody, right?

MR. FICK: It's not?

MR. FICK: Is there any other form in which the various steps taken by the various people along the way in processing a piece of digital evidence are recorded?

MR. FICK: So there's no sort of ongoing, something -- there's nothing analogous to a chain of custody for each step in the process for a forensic investigation?

MR. FICK: So, for example, going back now, we couldn't retrace the steps of who did what from the moment of collecting the Sony laptop through the present? We couldn't retrace that in a paper trail?

MR. FICK: Using what then if there's no chain of custody that records that?

MR. FICK: What about somebody who then processed the image, is that recorded somewhere?

MR. FICK: So is it standard then for there to be some kind of a final 302 report or other report about the analysis of a piece of digital evidence?

MR. FICK: A narrative report describing the examination of a device is typically produced at the end of the road?

MR. FICK: I'm going to show you a document and see if you recognize it.

MR. FICK: May I approach, your Honor?

MR. FICK: Take a quick look at that, and tell me if you're familiar with that document or you recognize what it is. You recognize that document?

MR. FICK: It's a document you've seen before?

MR. FICK: Is that something that you were involved in helping to prepare?

MR. FICK: Do people you supervise -- were people you supervised involved in helping to prepare that?

MR. FICK: Who is that?

MR. FICK: Were you aware of the work being done on an ongoing basis as that report was being put together?

MR. FICK: Okay. So the report is 53 pages long, right?

MR. FICK: And this is -- it's essentially a report of examination by FBI personnel about their review of the Sony VAIO, right?

MR. FICK: Well, it's a report of what the examiners found in looking at the Sony VAIO, right?

MR. FICK: Now, you see at the end -- actually, before the appendices, there's a line that says --

MR. FICK: Well.

MR. FICK: This is not a final report, fair to say?

MR. FICK: Well, toward the end it says, "Analysis remains ongoing," right?

MR. FICK: If we could turn to Page --

MR. FICK: Thank you.

MR. FICK: Very last page, actually, 53.

MR. FICK: Last sentence, "Digital forensic analysis remains ongoing"?

MR. FICK: Do you know if there was a later iteration of this, a further iteration of something like this, an update to it?

MR. FICK: You're not aware of any additional version?

MR. FICK: This version is undated, by the way, right?

MR. FICK: And do you know whether similar types of reports were written about any of the other devices seized in the case?

MR. FICK: So there were narrative reports describing the findings of the examiners, right, for other pieces of evidence?

MR. FICK: So the Sony was treated uniquely? It wasn't treated the same as like the Samsung or the HP computers?

MR. FICK: Do you know whether analytic reports were produced as to the HP or the Sony?

MR. FICK: Do you know whether analytical reports were produced as to the HP or the Sony?

MR. FICK: Going to your chart on your screen, the HP is 2R14 from Norfolk Street, and the Samsung is the 1W3 from Watertown, right?

MR. FICK: You don't know?

MR. FICK: Anyway, these are the kinds of reports -- or this report of the Sony is the kind of report that FBI agents and analysts rely upon in the process of doing their investigations, correct?

MR. FICK: It's produced by the senior analyst and then provided to people like investigating agents and prosecutors, right?

MR. FICK: And the purpose is to give them some insight into what's on that digital device, right?

MR. FICK: So this is a standard part of your practice, is to create an analytical report and provide it to the people who need it, right?

MR. FICK: So, again, the Sony was somehow treated differently?

MR. FICK: Now, looking again at the chart on the screen, you testified last week and introduced a bunch of exhibits related to each of these devices, right?

MR. FICK: Do you know if the FBI has analyzed the interrelationships between these devices themselves and between these devices and other devices?

MR. FICK: Do you know if there's been analysis of whether files, for example, can be traced moving from one to another?

MR. FICK: Do you know whether there's analysis of whether these devices were connected to each other at specific times?

MR. FICK: Attached.

MR. FICK: For example, a few minutes ago with Mr. Chakravarty you talked about a single event where you looked at the registry and found that the Kingston was plugged into the Sony at a certain time, right?

MR. FICK: Do you know whether's there's been sort of more symptomatic investigation tracing the history of a thumb drive among all the devices in the case?

MR. FICK: Sure. Let's start with that.

MR. FICK: Right.

MR. FICK: So 1R6 is the Sony, and 2R14 is the Hewlett-Packard from Norfolk Street, right?

MR. FICK: Do you know if there's been similar analysis of tracing of various devices to the Samsung, 1W3?

MR. FICK: Yes.

MR. FICK: I'm not asking about your search of 385 yourself. I'm asking whether you are aware of whether the FBI did an investigation of the history of device attachments into D385.

MR. FICK: You don't know?

MR. FICK: It is fair to say you would agree with me, wouldn't you, that the interrelationship among devices can be an important thing to know in an investigation, right?

MR. FICK: Yes.

MR. FICK: Yes.

MR. FICK: That can tell you something about, for example, the interrelationship among suspects, among other things, right?

MR. FICK: But it's useful to know when various devices might have been connected to each other and interacted with each other, right?

MR. FICK: That can give you some evidence to make inferences about the relationships among the people who may have used those devices, right?

MR. FICK: You would also agree with me, wouldn't you, that there were other devices that were important to the Boston Marathon investigation that are not listed here at all?

MR. FICK: You have some knowledge, though, certainly of what the investigation found and how it happened, right?

MR. FICK: Right. So you supervised the CART team, the people that are analyzing these devices, right?

MR. FICK: Along the way then, you have knowledge of the kinds of things the people that work under you are discovering, correct?

MR. FICK: You're aware, for example, that there were a couple computers seized also from Katherine Tsarnaeva, Tamerlan's wife, correct?

MR. FICK: It doesn't stick out in your mind whether or not a couple of devices were seized from Tamerlan's wife?

MR. FICK: I'm not asking that question. That wasn't my question, sir. My question was whether you have a memory or whether you have knowledge that computers were seized from Tamerlan Tsarnaev's wife.

MR. FICK: Whether you have knowledge that computers attributed to Tamerlan Tsarnaev's wife were seized in the investigation?

MR. FICK: You don't recall. Are you aware that cell phones attributed to Tamerlan Tsarnaev were seized in the investigation on Laurel Street in Watertown? They're not on the list either, are they?

MR. FICK: You would agree, right, that the cell phones belonging to one of the two suspects are important pieces of evidence, right?

MR. FICK: In general. If the suspect -- one of the two suspects in the bombing has a cell phone, you understand that's going to be an important piece of evidence, a valuable piece of evidence, right?

MR. FICK: Okay. Just trying to establish those are also not on this list, right, Tamerlan's phones?

MR. FICK: Understood. You would also agree with me that it can be important -- sometimes be important to know when a computer first began to operate or was manufactured, right?

MR. FICK: Well, if you're trying to figure out when certain digital events on a computer happened and how that fits into an overall investigation, it can be a useful piece of information to know when the computer first came into existence as we know it, right?

MR. FICK: Any number of those things. Any one of those facts could be a useful fact, right?

MR. FICK: The date Windows was installed on a Windows computer is an important fact to know in understanding where a particular device fits into the history of events, right?

MR. FICK: So you're not willing to say whether it's at least a piece of information that might be useful to know?

MR. FICK: Are you willing to acknowledge that the date Windows was installed on a computer could be an important piece of information to place the device in a time context relative to the investigation?

MR. FICK: Okay. Let's actually make it a little bit more concrete. Now, I'm going to pull up Exhibit 1142-11. This is a document that describes or shows the date Windows was installed on the Sony VAIO, correct?

MR. FICK: So that's the date here, 2/26/11, correct?

MR. FICK: 1142-11, right?

MR. FICK: Now, there's no evidence that any other version of Windows previously existed on the Sony VAIO, is there?

MR. FICK: There's no indication, no digital artifacts, on the Sony VAIO to indicate Windows was ever installed before this date, is there?

MR. FICK: But as far as we know for purposes of this investigation, the Sony laptop, as we know it, Windows on that laptop was born on February 26, 2011, correct?

MR. FICK: Okay. And you're not aware of any evidence to suggest the computer existed earlier or that -- I'm sorry, that there was ever an earlier version of Windows, that the computer existed in some earlier form?

MR. FICK: You don't know the answer?

MR. FICK: As far as the evidence that's in the case then at least, the install date of Windows on the Sony was February 26, 2011, right?

MR. FICK: And the Hewlett-Packard, the 2R14, from the family apartment in Cambridge -- I'm going to pull up 1143-08. This shows that the Windows install date on that computer was September 23, 2011, right?

MR. FICK: Again, there's no evidence, at least none you're aware of, to suggest that there was ever an earlier version of Windows on that computer, correct?

MR. FICK: You don't know, in other words?

MR. FICK: It's not something that was ever brought to your attention, right?

MR. FICK: Sitting here today, you are not aware of any evidence to suggest Windows ever previously existed on that computer?

MR. FICK: Okay. My question is: You're not aware of any evidence to suggest that Windows was ever there earlier, correct?

MR. FICK: I understand. But my question simply was: You're not aware of evidence that Windows was there earlier?

MR. FICK: Now, as to the Samsung -- no -- yes, the Samsung, the Samsung from Laurel Street in Watertown, Tamerlan's computer, as you put it?

MR. FICK: Going back to your exhibit -- I'm sorry, your chalk, so to speak, 1577, I believe, talking about the Samsung laptop, 1W3, Watertown.

MR. FICK: D385. 1W3 is in parentheses, yes.

MR. FICK: Right. So my question is: Are you aware of when Windows was installed on that computer?

MR. FICK: Did you ever have an awareness of when Windows was installed on that computer?

MR. FICK: If I could just have the screen for the witness, your Honor?

MR. FICK: Showing you a document and see if this helps you to answer the question. First of all, do you recognize, in general, what this kind of document is?

MR. FICK: Does this help you answer the question, for example, of when the Windows administrator account on the 1W3 was installed?

MR. FICK: Does this enable you to say or does this enable you to agree with me that the Windows administrator account on the Samsung laptop was created on September 21, 2011?

MR. FICK: If we can clear this, and we'll go back for everyone in the courtroom to see again Mr. Swindon's summary exhibit. Are we back up?

MR. FICK: So just to review, we established, if I'm not mistaken, that the Sony VAIO Windows install was dated to February of 2011 just a few minutes ago, right?

MR. FICK: And we established that the HP Pavilion was September of 2011, right?

MR. FICK: And you're unable to say, sitting here today, when the Samsung Windows install happened, right?

MR. FICK: Now, at the time the Sony VAIO Windows install happened in February of 2011, Mr. Tsarnaev was still a high school student, right?

MR. FICK: Well, I mean, you know things like the names of his friends, right?

MR. FICK: You know he was arrested after the Marathon bombings in 2013 when he was a sophomore at UMass Dartmouth, right?

MR. FICK: So back in 2011, two years prior, he would have still been in high school, correct?

MR. FICK: You're not aware of what, if any, computer the family might have shared on Norfolk Street before September of 2011 when the HP Windows was installed, right?

MR. FICK: We established, I think, with you that the desktop computer, the Hewlett-Packard, at Norfolk Street, Windows was installed on that computer in September of 2011, right?

MR. FICK: You're not aware of any evidence that that computer existed earlier, right?

MR. FICK: You're not aware of any other evidence to suggest if any computer existed earlier or if there was some other computer, right?

MR. FICK: You just don't know. But what we do know is that the Sony VAIO, the Windows install on that that we know about, was in February of 2011, right?

MR. FICK: And that's two years prior to the time when Mr. Tsarnaev is a sophomore in college, right?

MR. FICK: Now, talking further about the Sony, you talked a little bit in your direct testimony about device attachments -- you remember that -- just a few minutes ago with Mr. Chakravarty?

MR. FICK: Device attachments. You talked about finding the date -- that one date when the Kingston was inserted into the Sony?

MR. FICK: Were you aware that Tamerlan's HTC phone was connected to the Sony at least twice prior to September of 2011?

MR. FICK: Is it something you ever came to learn in your investigation, in your work on the investigation?

MR. FICK: But you're not -- sitting here today, you're not aware whether Tamerlan's phone was attached twice prior to September?

MR. FICK: Do you know if anybody at the FBI ever dug that information out?

MR. FICK: Was there some kind of written report prepared about that that you know of?

MR. FICK: You don't know?

MR. FICK: Are you aware that the Sony was used by multiple Skype accounts, over the course of its existence, from your review of the Internet Evidence Finder reports?

MR. FICK: Okay. Do you also know that Skype was used by an account called Bella Rizvan?

MR. FICK: So that's not something that you recall?

MR. FICK: Do you have it with you?

MR. FICK: Your report wasn't given to us. I'm asking you if you've got access to it.

MR. FICK: Well, in your testimony last week, you talked about reviewing the various computers with an application called Internet Evidence Finder, right?

MR. FICK: And that extracts certain information about the computer's internet activity over its life, right?

MR. FICK: Among the things Internet Evidence Finder isolates are artifacts indicating or suggesting uses of Skype, correct?

MR. FICK: That includes Skype, right?

MR. FICK: Skype is a communication program, voice and text-type messages between computers over the internet, right?

MR. FICK: Okay. And you just said a minute ago you are aware that there was a log-in for Jahar Tsarnaev on Skype on the Sony, right?

MR. FICK: I'm asking you now: Are you also aware there was an account on there called Bella Rizvan on the Sony?

MR. FICK: My question, sir, wasn't whether you were asked to verify that. It's whether you know that from yourself looking, presumably recently, at the Internet Evidence Finder reports?

MR. FICK: Whether or not you have it here in front of you now, do you recall seeing that information when you looked at the evidence --

MR. FICK: You do not recall?

MR. FICK: You do know that Bella is the name of one of Jahar's sisters, right?

MR. FICK: So you know a friend of his from UMass Dartmouth is Giovanni Norgill, right? You said that last week?

MR. FICK: You know that Dias Kadyrbayev is a friend of his, right?

MR. FICK: You know that Katherine Tsarnaeva is Tamerlan's wife, right? You said that last week?

MR. FICK: But you don't know that Jahar had a sister named Bella?

MR. FICK: That name never came up in your work with people under your supervision about the electronic devices in the case?

MR. FICK: Now, I'm going to go to Exhibit 1142-01, which is the selected internet history from the VAIO. I'm going to zoom in on sort of part of it here, just the beginning. Now, Exhibit 1142, this -- whoever created this called Key Internet History it's just one page, right? It's one page pulled out of the internet history?

MR. FICK: Okay. And so I think you said there was something like 30,000 internet history entries on the Sony, right?

MR. FICK: And so this one-page selection is a very, very small part of that, right?

MR. FICK: Substantially less?

MR. FICK: And this was a selection made not by you but by the investigative team, right?

MR. FICK: But in the process of verifying this, you went back for each -- if I understood your testimony, you went back for each of these line items and went to the internet history to confirm it's there, right?

MR. FICK: To confirm that everything in this spreadsheet is actually there?

MR. FICK: You've been saying "we" again. You said "we" a few times last week. When you say "we," do you really mean I, or were there multiple people doing it?

MR. FICK: In verifying the spreadsheets line by line, you did that together, is that fair to say?

MR. FICK: But you personally participated in every aspect of it, correct?

MR. FICK: Now, in the process of verifying these items, you obviously saw the entirety of the internet history, correct?

MR. FICK: But in order to confirm them, you had to go back to the original, to the collective, right?

MR. FICK: Yes.

MR. FICK: And so, in the process of doing that, you had occasion to observe that the bulk of the internet history on the Sony was activity on Facebook and VK, which is a Russian Facebook equivalent, right?

MR. FICK: Is it fair to say that the course of seeing the entire internet history --

MR. FICK: -- you could observe -- you did observe that the bulk of the internet history on the Sony was Facebook activity and VK.com activity, a Russian Facebook equivalent?

MR. FICK: You didn't even notice in passing where most of the web addresses were coming from on that giant collection?

MR. FICK: So you were narrowly focused on these entries, didn't even notice anything else on the overall record you were reviewing?

MR. FICK: Wasn't of interest to you where the predominant amount of internet activity was?

MR. FICK: That's your sole and narrow focus; is this information there? That's it?

MR. FICK: In the course of your investigation earlier, in dealing with the people under your supervision who reviewed the Sony over the course of two years, did that topic ever come up?

MR. FICK: Never had a discussion inside the FBI CART team about the nature of the Sony's internet activity?

MR. FICK: Now, you're aware, correct, that the FBI did an analysis of the search history, the internet search history, on the Sony, right?

MR. FICK: You are aware that the FBI did a separate analysis of the search history on the Sony, correct?

MR. FICK: Well, let me just put more of a point on it. The 53-page report we were talking about before in front of you that contains an analysis of the search history, correct?

MR. FICK: Sure, Page 46.

MR. FICK: Right. So you testified that you're familiar with this report, right?

MR. FICK: You've seen it before, right?

MR. FICK: Petrozelli and Nathans, the people who worked on it, are people you work with, right?

MR. FICK: And so you're aware that the FBI did an analysis of search terms on the Sony that are indicative of his predominant internet usage, right?

MR. FICK: Well, you don't have any reason to think the report is wrong, do you?

MR. FICK: And it's fair to say that the top two terms in the predominant search history are words that you might --

MR. FICK: -- expect to see in the computer of an adolescent male?

MR. FICK: The top two search terms are terms you would not be surprised to find in the computer of adolescent male, fair to say?

MR. FICK: Among the top 16 search terms identified in this predominant usage chart is the single word "Chechnya," correct?

MR. FICK: You're aware that the defendant's family, his paternal side of the family, comes from Chechnya, correct?

MR. FICK: Also fair to say that, among these top 16 predominant usage search terms, there is nothing about Islam or jihad?

MR. FICK: Now, I'm going to move on to Exhibit 1142-13.

MR. FICK: For the moment. You can leave it on your desk if you'd like. This is 1142-13, selected user files from the VAIO, correct?

MR. FICK: And this is a report that's about four-and-a-half-pages long, correct?

MR. FICK: And this is, again, a list of files selected by somebody on the investigative team, correct?

MR. FICK: And in addition to the name and path of the file, if we go back to the top of the spreadsheet, there are these two columns here, "created in local time" and "file system record in local time." Do you see that?

MR. FICK: It's correct, isn't it, that Windows maintains a variety of date-and-time information about files?

MR. FICK: And that's -- there are certain descriptors or categories of each of the pieces of information Windows maintains, correct? One of them is "created"?

MR. FICK: "Modified"?

MR. FICK: "Accessed"?

MR. FICK: Something called "MFT entry modified," the "master file table entry modified"?

MR. FICK: You're familiar with those categories of information that Windows holds about files, right?

MR. FICK: And fair to say the meaning and significance of that data is not always intuitive or obvious?

MR. FICK: Okay. Now, the created date is, generally speaking, the date or time that the file appeared on the computer or device where the file is located, correct?

MR. FICK: And for the purposes of your chart here, which of the Windows time categories is file system record date in local time?

MR. FICK: I want to break that down into two pieces. Put aside the time zone issue for a moment. What is meant by "file system record date"? That's not a term that shows up in Windows itself, right? So what do you mean?

MR. FICK: But both of these are local time, right? We have "created in local time," and we have "file system record date in local time," right? Both are local time?

MR. FICK: Sure .

MR. FICK: I'm asking you about "file system record date in local time." What is that? Which of the Windows time artifacts does that come from?

MR. FICK: So added by the analyst on what basis?

MR. FICK: Sir, you didn't create the report, but you verified the report, right?

MR. FICK: How did you verify file system record date in local time if you can't tell me which Windows artifact it is?

MR. FICK: So are you saying you did not verify the time entries in the spreadsheets?

MR. FICK: You didn't create the category. I'm asking if you verified it.

MR. FICK: So what? They just told you it was correct?

MR. FICK: I understand you verified created in local time with the analyst. What is file system record date in local time?

MR. FICK: Based on what?

MR. FICK: So when you sat with the analyst and verified the entries line by line, the question didn't come up: What is that?

MR. FICK: Well, apart from this particular document, these two categories, right, "created in local time" and "file system record date in local time," those are all over multiple spreadsheets that you put into evidence with Mr. Chakravarty last week, right?

MR. FICK: So what is "file system record date in local time"?

MR. FICK: So bottom line is you can't answer that question sitting here today, What is file system record date?

MR. FICK: You don't recall even knowing at the time you verified the spreadsheet?

MR. FICK: Right. But this category, file system record date on multiple spreadsheets, you don't remember what that is?

MR. FICK: Okay. So then, certainly, you would agree then, since you don't know what it is, that the fact that the time the file was created and the time in the second column doesn't necessarily say anything about whether the file was ever opened?

MR. FICK: Right. So it's simply the fact that there's another column with a different time on it that's later doesn't mean the file was opened on that date because you don't even know what that column means, right?

MR. FICK: It's at least fair to say that from this spreadsheet one cannot infer that the fact that there are two different times means this file was ever opened?

MR. FICK: Right. There's no information?

MR. FICK: Now, I want to go to a particular file on here. I'm going to expand it just by way of example. See this fundamentalconcepts.pdf? See that?

MR. FICK: Created date, September 1, 2004?

MR. FICK: That can't be right, can it?

MR. FICK: I thought you just told us a few minutes ago that all of the created dates here are the dates the file was created on the Sony?

MR. FICK: So your belief then is that this created in local time simply reflects when Fundamental Concepts might have been created on some other device?

MR. FICK: Well, let's try comparing then to see what created certain looks like on the master file table for this item. If I can open Exhibit 1142-151, Page 1872, can you see that on your screen, fundamentalconcepts.pdf, and then the highlighted creation date?

MR. FICK: You know, I think I might have to actually open it in PDF to do that. But one moment. Go to Page 1872; zoom. Here we have Fundamental Concepts. I thought I had it. Sorry. Fundamental Concepts, going across, across, across. Creation date of October 10, 2011.

MR. FICK: Which one?

MR. FICK: Yes, absolutely. So we will go back to that, which is 1142-13, Fundamental Concepts, September 1, 2004.

MR. FICK: Sure.

MR. FICK: So the created file in the master list, the 4,000-plus page document, September 10, 2011, for Fundamental Concepts, on your derivative -- or the FBI's derivative spreadsheet, it's the 2004 date?

MR. FICK: So there's -- a different software might give a different answer to a question to when a file was created on a computer?

MR. FICK: What did you actually use when you verified the derivative exhibit, the one that showed 2004? How did you verify that date?

MR. FICK: So you're saying you didn't verify the dates?

MR. FICK: So different products, you're saying, can give a different answer about when a file was created on a computer?

MR. FICK: Sitting here today, you don't know which is correct?

MR. FICK: It sort of stands to reason, though, that a computer where Windows was installed in 2011 couldn't have had a file created on it in 2004, right?

MR. FICK: But it still has a creation date, a date it was born on the device where it was --

MR. FICK: As I understood it, the derivative spreadsheet was supposed to show, as I understood it, the date the file was born on the Sony, right?

MR. FICK: As I understood the purpose of the derivative spreadsheet and your description of it a few minutes ago, that column is supposed to tell us when the file was born on that computer, right?

MR. FICK: On that computer or not?

MR. FICK: Not necessarily, right?

MR. FICK: So how do you know the difference? How can we interpret any one of these items what it means? Are you able to do that sitting here today?

MR. FICK: But you're not confident about the dates in these spreadsheets?

MR. FICK: I'm still curious. What happened when you tried to verify this date? You must not have compared it to the 4,000-page list that's in the exhibit because that has a different date, right?

MR. FICK: But sitting here today, you don't know what device output or what software output you used to make the verification?

MR. FICK: For any of the spreadsheets, can you say where the data came from?

MR. FICK: So you didn't have a standard procedure to verify the dates and times in the spreadsheets?

MR. FICK: Let's just stick with computers. Did you have a standard operating procedure to verify dates and times for lists of files from computers?

MR. FICK: Just to -- this is not an isolated problem, fair to say?

MR. FICK: Well, let's take a look at a couple more examples at least. I'm going to go to Page -- well, there's the next one right here, fundamentalconcepts.pdf, February 14, 2006. That's also a date that's like -- something like five years before the Windows install on the Sony, right?

MR. FICK: So certainly would raise a question in your mind: How is it that a file could be created on the Sony in 2006, right?

MR. FICK: Again, it's just --

MR. FICK: It's just an example of that date doesn't necessarily reflect the creation date on the Sony?

MR. FICK: Just as a point of comparison, going to the master file table for that file, the Exhibit 1142-151, Page 150.

MR. FICK: For purposes of the exhibit in this case, there was a 4,000-plus-page exhibit which you represented to be a complete list of all the files on the Sony, right?

MR. FICK: And so if we go to that list and look for the fivegrounrules.pdf document, we again see a September 2011 creation date rather than a 2006 date, right?

MR. FICK: Go to Page 150. Here we go. Five Ground Rules. Scroll across. We get a date September 10, 2011, again, right?

MR. FICK: So the created data in this file listing doesn't match the created data on the FBI's derivative exhibit again, right?

MR. FICK: So fair to say it would not be appropriate to rely on the derivative exhibit, which is 1142-13, to figure out what date a file might have appeared on the Sony VAIO?

MR. FICK: Okay. Now, if I'm hearing you, you're saying the complete list is correct?

MR. FICK: So the derivative list was generated by some unapproved software tool?

MR. FICK: Out of the air or they used some tool?

MR. FICK: Okay. They used an unapproved tool to create the derivative exhibit?

MR. FICK: You don't know what tool was used to generate the data on the derivative spreadsheet, one, right?

MR. FICK: Wherever it came from, you don't know where it came from?

MR. FICK: Okay. And the authoritative, I guess, you're saying, table, you didn't -- in the process of verifying the derivative spreadsheet, you didn't check that data against the authoritative table?

MR. FICK: So the tools conflict with each other?

MR. FICK: So --

MR. FICK: Where does that leave the bottom line? What's your -- as an expert computer forensic examiner on the witness stand today, which set of data can we rely on? The complete list we've got up on the screen here showing September 11th or the derivative list showing a date in 2006? Can we rely on either of them?

MR. FICK: If you're trying to determine when a file will appear or was created on the Sony VAIO, what would you rely on?

MR. FICK: Which is the thing that's on the screen right now?

MR. FICK: So if that's what the reliable source is, why didn't you verify the derivative evidence against the reliable source?

MR. FICK: But if that's not what the exhibit is supposed to be portraying, why wouldn't you correct it?

MR. FICK: The spreadsheet doesn't say anything about what created means. That's why I asked you initially. If I understood you correctly, your initial response was created means the date it was born on the Sony.

MR. FICK: Okay. At least we're clear now. Created date on those derivative listings is not a reliable way to assess when a file appeared on the Sony?

MR. FICK: It would not be indicative of when it potentially could have been created on the Sony, okay. Now, I'm going to return to discussing a few more big-picture things about some of these devices. I'm going to go back to your list, 1577 -- I'm sorry, 1557. I'm going to talk about the Samsung a little bit here again, the 1W3, D385. Do you see that?

MR. FICK: Now, you testified last week that the FBI concluded that this was, in fact, Tamerlan's laptop computer, correct?

MR. FICK: And you know that both from your understanding of what was found on the computer itself and other investigative information, correct?

MR. FICK: You're also aware of other investigative information that ties the computer to Tamerlan, right?

MR. FICK: Well, you are aware, for example, it was found in a computer bag with his high school diploma, right?

MR. FICK: You're aware that the computer was connected to the internet in Russia multiple times between January and July of 2012 when Tamerlan was there, right?

MR. FICK: Well, is that something you ever became aware of in your work on this investigation?

MR. FICK: You never became aware of information that Tamerlan traveled to Russia from January to July of 2012?

MR. FICK: Let's take it step by step. Are you aware of information that Tamerlan Tsarnaev traveled to Russia between January 21 and July 17 of 2012?

MR. FICK: In roughly that time frame?

MR. FICK: And are you aware that there are digital artifacts on the Samsung showing that that computer was connected to the internet in Russia during that time frame?

MR. FICK: You never were aware of that?

MR. FICK: Are you aware that the web history on the Samsung includes information about Tamerlan's log-in to multiple accounts associated with him?

MR. FICK: You said you did a cursory review of the Samsung in connection with preparing for your testimony here, correct?

MR. FICK: And during the course of the last two years, you supervised individuals who worked on the analysis of this computer, correct?

MR. FICK: And you over that time became aware of things that they were doing and finding, correct?

MR. FICK: Particular findings were never brought to your attention?

MR. FICK: Reports that they wrote -- that the people under your supervision wrote about the Samsung were never brought to your attention?

MR. FICK: Well, again, part of the general approval process, you're the supervisor. You would review reports written by the people you supervise, correct?

MR. FICK: That would include reports that people you supervise wrote about the Samsung, correct?

MR. FICK: Okay. And that's a normal kind of thing that you would rely on in the course of your work as a supervisor, correct?

MR. FICK: Rely on for performing your duties.

MR. FICK: You still have occasion to read the reports that the analysts write about the Samsung, correct?

MR. FICK: The forensic analysts write reports about their findings to pass them along to others in the FBI and the prosecution team to know what the evidence means, correct?

MR. FICK: They go through you, and they go from you to investigating agents, case agents, prosecutors, and the like, correct? That's the reason they exist?

MR. FICK: So you don't know whether the reports that your subordinates write about important pieces of digital evidence ever see the light of day?

MR. FICK: Well, you did tell Mr. Chakravarty, right, that you're aware from your exposure to the Samsung over the last two years that a lot of similar kinds of files to those on the Sony were on the Samsung, correct?

MR. FICK: Okay. So you became aware, if you weren't already aware, that a lot of the same kinds of material is also on the Samsung, right?

MR. FICK: And you also talked about the fact that there is encryption software on the Samsung, correct?

MR. FICK: And TrueCrypt is a very powerful piece of encryption software, fair to say?

MR. FICK: Well, if one has a good password in TrueCrypt, it's pretty hard, even for very sophisticated tools, to get inside, right?

MR. FICK: Even for the most sophisticated U.S. Government tools, very difficult, right?

MR. FICK: But you understand, because you supervised the people who did it, that it was possible to get into Tamerlan's encrypted volumes because he had a bad password, right?

MR. FICK: You're not away the password was Allahu Akbar, with a number after it?

MR. FICK: You don't know how FBI analysts managed to find out what was in the encrypted volumes on Tamerlan's computer?

MR. FICK: Now, fair to say that the use of encryption is considered something -- in investigative terms, it's considered tradecraft when it's used by terrorists or criminals, right?

MR. FICK: As a trained FBI agent, that's not the kind of assessment you would make?

MR. FICK: Well, what constitutes tradecraft for criminals or terrorists.

MR. FICK: Is it fair to say that the use of encryption by a terrorism suspect is an example of tradecraft?

MR. FICK: Well, are you aware that Inspire Magazine, one of the ones that you talked about with Mr. Chakravarty last week, recommends that people who want to engage in terrorism should use encryption?

MR. FICK: I'm just going to pull up a copy of Exhibit 1475-22.

MR. FICK: Sure. Thank you.

MR. FICK: Yes, your Honor. Thank you.

MR. FICK: So good morning again, Agent Swindon.

MR. FICK: Just a few more questions about your knowledge of the Samsung laptop here among the devices seized, Tamerlan's laptop. We talked a bit about TrueCrypt a few minutes ago. Do you remember that? That's the encryption software?

MR. FICK: It's true, isn't it that TrueCrypt is not among the software on the Sony VAIO?

MR. FICK: Well, and, in fact, you introduced last week an exhibit listing all of the software on the Sony VAIO, correct?

MR. FICK: And that list did not include TrueCrypt, correct?

MR. FICK: So it's not just that you're not aware of TrueCrypt being on the Sony VAIO, in fact, TrueCrypt is not on the Sony VAIO?

MR. FICK: Thank you. Now, in the course of your cursory review of the Samsung, or previously in your work as the supervisor of the CART team, did you ever have occasion to see what the desktop of the Samsung looked like, the wallpaper, the background, all of that?

MR. FICK: On the Samsung, Tamerlan's laptop?

MR. FICK: You never saw what the desktop looked like?

MR. FICK: Did your cursory review of the Samsung include the Internet history of the Samsung?

MR. FICK: I'm sorry?