4.Kevin Swindon — Cross/Redirect/Recross (Part 6)

MR. FICK: So, Agent Swindon, I'd like to talk a little bit now about how one traces the history of when a USB device was attached to a computer, okay?

MR. FICK: Okay? So you've heard of something called SetupAPI is a registry artifact in Windows. You're aware of that?

MR. FICK: Right. And that captures information about when a USB memory device is plugged into a computer for the first time, correct?

MR. FICK: SetupAPI stores information about USB device attachments into a computer?

MR. FICK: Well, I'm not talking about a specific computer, I'm talking about the methodology of doing the investigation now, okay? So as a general matter, SetupAPI contains date and time information about when a device is first plugged into a computer, correct?

MR. FICK: So you don't know what SetupAPI is sitting here today?

MR. FICK: And so you're not aware that that records the first time a USB device is attached?

MR. FICK: The registry, apart from SetupAPI, also contains other information about incident -- incidents when a USB is attached, correct?

MR. FICK: Okay. Now, these two sources I've mentioned, the SetupAPI and other data in the registry, actually record the event of the attachment, right?

MR. FICK: And in addition to those pieces of data, there's -- there are also artifacts called shortcuts and links that I think you testified about with Mr. Chakravarty, right?

MR. FICK: Okay. And shortcuts and links and jump lists contain information about files that a user may have accessed on a USB device, right?

MR. FICK: Okay. So those record information about the files themselves, not the event of the USB connecting, correct?

MR. FICK: So in other words, you might be able to infer something about when a USB was attached from the jump list or link information but that's -- the jump list or link information itself records information about the file on the USB storage device, right?

MR. FICK: Right. So those are -- they're related but different things, right?

MR. FICK: Okay. So I'm going to pull up Exhibit 1142-02 which is the exhibit called "External Device Access on the Sony." You remember this spreadsheet that you talked about with Mr. Chakravarty, right?

MR. FICK: Okay. And this spreadsheet is based on jump list and shortcut data about files that were viewed on the Sony that were located on external devices, correct?

MR. FICK: Okay. Jump list and shortcut records?

MR. FICK: Okay. So this is not a listing of the device attachment registry information?

MR. FICK: It's not the registry report about the event of the device attachment, it's information about the files that were viewed on the external devices?

MR. FICK: Okay. Now, the creation date for each of these entries is the date the file was created on the external device, correct, because these are jump lists and links, right?

MR. FICK: Do you know?

MR. FICK: Well, this is a spreadsheet that you reviewed and deemed to be accurate enough to include in an exhibit, correct?

MR. FICK: So sitting here today, you don't know what the creation date column refers to?

MR. FICK: Sitting here today you don't remember what those other two pieces of information were?

MR. FICK: Okay. So sitting here you cannot tell me, then, whether this is the creation date of the file on the thumb drive or whether it's the date the thumb drive was inserted in the computer?

MR. FICK: You just don't know?

MR. FICK: Okay. Now, this Patriot thumb drive here, I believe you talked about that with Mr. Chakravarty, the serial number reflected there, that's not the same as the Patriot thumb drive that was recovered in the investigation and was included as an exhibit, correct?

MR. FICK: Right.

MR. FICK: And, in fact, this Patriot thumb drive with this volume serial number was never recovered in the investigation, was it?

MR. FICK: You're not aware of it being recovered?

MR. FICK: Now, do you know whether the FBI ever traced the artifacts from this missing Patriot across all of the electronic devices in the case?

MR. FICK: Well, for example, what we have here on this chart reflected in the first line is a data artifact taken from the Sony about this particular Patriot thumb drive at a particular point in time, right?

MR. FICK: At some point in time, it was attached to the Sony and this file on the Patriot thumb drive was viewed from the Sony, right?

MR. FICK: Okay. Now, did the FBI, to your knowledge, do any investigation of whether this Patriot thumb drive, the missing Patriot, was attached to other devices seized in the case?

MR. FICK: And was any kind of writing produced from that analysis?

MR. FICK: Do you know whether --

MR. FICK: Now, another one of the devices you talked about was the Hewlett Packard desktop computer seized from 410 Norfolk Street, the Tsarnaev family apartment. You remember that?

MR. FICK: Of course. I'm bringing back up 1557. The second line here, 2R14, HP Pavilion, 410 Norfolk, that's a desktop computer seized from 410 Norfolk Street, the Tsarnaev family apartment in Cambridge, correct?

MR. FICK: Okay. And I think you testified on direct with Mr. Chakravarty last week that you acknowledge -- the FBI acknowledges that that computer was used by many people, right?

MR. FICK: A large number of Tsarnaev family members at various times lived in that apartment, right?

MR. FICK: Well, you testified that you're aware of Tamerlan's wife Katherine, who she is, right?

MR. FICK: You heard the name, Jahar's father, Anzor?

MR. FICK: You have no other knowledge of his father's name being Anzor from the investigation?

MR. FICK: Ever heard of his mother, Zubeidat?

MR. FICK: So you know a number of people had access to the computer at 410 Norfolk Street, this computer, but you don't know who that might have been?

MR. FICK: Well, apart from the information in front of you, from your knowledge of the investigation, being a supervisor of the CART team for two years -- for the last two years, do you know anything about that?

MR. FICK: And when you say "pattern-of-life information," that's information developed from the investigation about people who may have had access to the computer, right?

MR. FICK: And your testimony was you do know that multiple people had access to this computer, right?

MR. FICK: But you don't know who -- you can't sort of list for me who that might have been?

MR. FICK: Now, one of the artifacts that you looked at in Exhibit 1143-01, which I will pull up here -- these are exhibits in evidence. I'm going to go to 1143, 1143-01. You testified about an artifact in this derivative spreadsheet noting that on January 1st at 2013 at 1:47 a.m. there was a log in to Yahoo email for Jahar Tsarnaev. Do you see that?

MR. FICK: Isn't it true that that is the one and only time there is any record on this computer of that email account being accessed?

MR. FICK: And apart from it being in front of you, do you know that to be true or not?

MR. FICK: But you don't know that is not true?

MR. FICK: Sitting here today you can't say whether there was ever another occasion on which Jahar Tsarnaev's email was accessed from that computer?

MR. FICK: Did anyone ever ask you to make that determination?

MR. FICK: And I'm going to also open 1143-05A, which is a derivative spreadsheet -- sorry. One moment. Bear with me one moment.

MR. FICK: So 1143-05A is the complete -- well, it's the lengthy 2,000 page or so long complete spreadsheet of the files from the Hewlett-Packard computer at 410 Norfolk, correct?

MR. FICK: And I just want to draw your attention to the date and time information that's generated on this spreadsheet on this computer. You see there's some -- some of the date and time information has real, like, normal dates and times after it. Do you see that? And then some of the same columns have information that does not appear to be in the format of a date or time?

MR. FICK: Well, that's what was submitted to the Court as an exhibit, right?

MR. FICK: And that's what this is, right?

MR. FICK: 1145- -- 1143-005A?

MR. FICK: So at least in this form, this spreadsheet could not be used to verify any of the filed time data in your derivative spreadsheet because it's missing --

MR. FICK: Do you know which one you used in this particular instance?

MR. FICK: Can you explain why this particular tool generated date and time information that's not comprehensible?

MR. FICK: I'm going to go now to Exhibit 1150 which is the Kingston thumb drive found in the landfill that you talked about. Do you remember that? Do you remember talking about that?

MR. FICK: Hold on. Exhibit 1145-01 -- I'm sorry -- 1150-01. Now, the bulk of the files that you talked about on this thumb drive were carved; in other words, they were recovered from deleted space, correct?

MR. FICK: And when we see this path, "path unknown" with all of that -- those numbers, et cetera, directory markers before the file name, that's an indication that the file was carved, right?

MR. FICK: And there's no way to know when the files were deleted off that thumb drive, correct?

MR. FICK: And one of the carved items retrieved from this thumb drive, Exhibit 1150-09, was a rental application from Katherine Tsarnaev, correct?

MR. FICK: Okay. And a few pages in it includes her pay stub, right?

MR. FICK: Let's talk a little bit more about 1475 which is the hard drive seized from the street in Watertown. The derivative file listing for that exhibit -- actually, rather than showing you the file listing, what I think I'm going to do is go to the file directory here. Now, you testified last week and I think today that these four folders at the top here actually existed in that form on that hard drive, right?

MR. FICK: And this English paper that's still listed on the top here, that actually was not visible in the hard drive as an active file at the time it was seized. That, in fact, was carved from having been deleted at some point in the past, correct?

MR. FICK: And the hard drive sort of contains a kind of greatest hits collection, right? There's Awlaki materials, audio files in that first folder, right?

MR. FICK: Well, a lot of files that we've seen on -- that you talked about from the Sony and other devices, a lot of those files -- a very large number of them are all here collected together on this hard drive from Laurel Street in Watertown. Is that right?

MR. FICK: I'm sorry. So that's a collection of Awlaki audio files, correct?

MR. FICK: And there are these Russian textbooks about explosives, et cetera, right?

MR. FICK: Well, and you remember looking at the translations from the derivative file exhibit that the titles have to do with explosives and munitions and that kind of thing, right?

MR. FICK: Well, as a general category. You've looked at the translations of these titles in your spreadsheet, right?

MR. FICK: I'm trying to ask some general questions about the category, the type of materials first. If you want to look at the list, we can.

MR. FICK: Well, the first thing I want to do is ask as a general matter this collection of DjVu e-reader files in Russian, it's a collection of lengthy texts about explosives and munitions, correct?

MR. FICK: Well, your own exhibit, the derivative exhibit, contains translations in the side, right, titles include "Detonation of Explosive Media," "Physics of Explosion and Impact," "Blast Effects of Explosions," "Initiating Explosive Substances," et cetera, right? Those are the titles of those files, correct?

MR. FICK: And you testified that carved artifacts of those files were found on one of the thumb drives, right?

MR. FICK: But it's true, isn't it, that none of these files or any artifacts reflecting these files exist on the Sony VAIO computer?

MR. FICK: As far as you know sitting here today it's true, isn't it, or at least as far as you can recall, that these files do not exist on the Sony VAIO?

MR. FICK: You don't know?

MR. FICK: Okay. Now, in addition to those materials, there's a collection of Inspire magazines as well, right?

MR. FICK: Okay. And there were also some files on the top level of this hard drive that -- when it was recovered that were not included in this exhibit, correct?

MR. FICK: Okay. I just want to pull out some things from the complete file listing just to nail that down. Pulling up a page out of 1475-02A, which is the complete file listing from this drive, there were some other items at the top level of the drive that are highlighted in yellow here that we have seen on other exhibits but that also were on this hard drive recovered in Watertown, correct?

MR. FICK: So "Book of the End," "Join the Caravan," those are all on, as well, the top level of this hard drive when it was recovered, correct?

MR. FICK: And further down the file list you're aware that there are a couple of Russian language documents also on the top level of this drive when it was recovered, correct?

MR. FICK: And these are documents that have Russian language instructions about making explosives, correct?

MR. FICK: You don't know what these files have?

MR. FICK: Did anybody under your supervision at the CART team of the FBI ever find out what was in those files?

MR. FICK: Now, isn't it true that this hard drive retrieved on Laurel Street in Watertown was formatted by Tamerlan's Samsung computer?

MR. FICK: You don't know?

MR. FICK: Well, whether you have it in front of you now, do you know from anything you ever did in the case whether that is true?

MR. FICK: Again, putting apart what you do or don't have in front of you, did you ever become aware from your work on this case as a supervisor of the Boston CART team whether Tamerlan's computer was the computer that formatted this hard drive?

MR. FICK: Again, I'm asking not only about today but whether you ever came to know -- or whether this was true in the past?

MR. FICK: You don't know?

MR. FICK: Do you know whether anybody else at the FBI checked?

MR. FICK: Checked to see what computer formatted this hard drive.

MR. FICK: Isn't it true that every single file and folder on this hard drive is owned by Tamerlan's computer, using the "owner" as used in Windows parlance?

MR. FICK: Well, whether you have it in front of you now or validated it or verified it, did you ever become aware in your role as a supervisor of the CART team in Boston that every single file and folder on this hard drive was created by Tamerlan's Samsung computer?

MR. FICK: You never became aware of that?

MR. FICK: Do you know whether anyone else at the FBI ever became aware of that?

MR. FICK: If I may have one moment, your Honor?

MR. FICK: I have nothing further.

MR. FICK: Objection.

MR. FICK: Can I ask to see what he's showing the witness?

MR. FICK: Objection.

MR. FICK: Objection.

MR. FICK: Objection. Those aren't the dates on the screen. The dates on the screen are 2013 dates. Oh, I'm sorry. I'm on the wrong screen.

MR. FICK: Object to the scope at this point.

MR. FICK: Object to the scope.

MR. FICK: Very briefly. Just one moment.

MR. FICK: Could we have the screen back to the monitor here?

MR. FICK: Okay. Is this the cord that's attached, because it should be --

MR. FICK: Oh, I see.

MR. FICK: Now, Mr. Chakravarty asked you some questions to clarify -- or at least try to clarify the meaning of this file -- system record date in local time, right?

MR. FICK: He showed you something on a handwritten piece of paper. Who wrote that?

MR. FICK: So anyway, your answer to the question was the data from the second column came from the AD Labs tool, right?

MR. FICK: All right. But regardless of what tool we're talking about, all of these tools extract information from the -- from Windows and from the Windows metadata, correct?

MR. FICK: But ultimately there is an answer, for example, to the question about when a file was created on a local computer, right?

MR. FICK: And if tools conflict, one would have to look deeper to figure out what the conflict is and answer the question, right?

MR. FICK: Now, quite apart from what tool generated this file system record date, my question is still which Windows artifact is the file system record date?

MR. FICK: Okay. So even if now you remember from the handwritten note that AD Labs generated this information, you still can't tell me what that information means?

MR. FICK: Okay.

MR. FICK: That's all.

MR. FICK: May we approach for one moment, your Honor, on an evidence matter?

MR. FICK: In light of the witness's testimony on his lack of foundation and knowledge about how the various derivative spreadsheets were generated and the accuracy of the data they're in, we would renew our foundation and confrontation objections and move to strike all of the exhibits.