2.Mark Spencer — Direct (Part 1)
547 linesMARK SPENCER, Sworn
COURT CLERK: Have a seat. State your name. Spell your last name for the record. Keep your voice up and speak into the mic so everyone can hear you.
MARK SPENCER: Mark Spencer, M-a-r-k, S-p-e-n-c-e-r.
DIRECT EXAMINATION BY MR. FICK:
MARK SPENCER: Good morning.
MR. FICK: I'm going to ask to pause for a minute and just do a housekeeping thing we talked about with the Court. I would move into evidence Government's Exhibit 1433, which is the Tamerlan Tsarnaev certified travel record from Customs and Border Protection.
THE COURT: That may be admitted.
(Defendant's Exhibit No. 1433 received into evidence.)
THE COURT: From your computer?
MR. FICK: From my computer, yes. Thank you. Turning now to Page 2 of the document and highlighting the portion reflecting Tamerlan Tsarnaev's departure from the United States on January 21, 2012.
MR. CHAKRAVARTY: Your Honor, the government doesn't have an objection with using this exhibit with the witness, but Mr. Fick shouldn't be testifying to it.
THE COURT: Well, I think he was reading what it said but fine.
MR. FICK: Thank you, your Honor. I will now commence with my examination.
I'm going to display on the screen before I begin what was used as a chalk with Mr. Swindon government's marked as 1557 if that's satisfactory.
THE COURT: This is a chalk?
MR. FICK: This is a chalk that was used -- shown to everyone, though, with Mr. Swindon. And I will --
THE COURT: Does it have a number?
MARK SPENCER: Good morning.
MARK SPENCER: I work for Arsenal Consulting in Chelsea, Massachusetts. I'm the president.
MARK SPENCER: Arsenal Consulting is a digital forensic company. We focus on digital forensics consulting and software development.
MARK SPENCER: Digital forensics involves the identification, preservation, analysis and reporting on electronic evidence, electronic data.
MARK SPENCER: Since mid-2009.
MARK SPENCER: I have a bachelor of arts from UMass Boston, which I received in 2003.
MR. FICK: Do you have training in digital forensics specifically apart from your education, your formal university education?
MARK SPENCER: I do. I have attended approximately 50 courses in training events, courses from Guidance Software, AccessData, SANS, Cytech.
MR. FICK: And the companies you just mentioned, those are vendors of digital forensic software, among other things?
MARK SPENCER: Or training providers, yes.
MARK SPENCER: I do.
MARK SPENCER: EnCase certified examiner; ProDiscover certified examiner; digital forensics certified practitioner.
MARK SPENCER: Yes.
MARK SPENCER: That's the organization that sponsors the digital forensics certified practitioner, an organization started by the National Institute of Justice.
MARK SPENCER: Yes.
MARK SPENCER: I do.
MARK SPENCER: Frequently, approximately a hundred presentations and courses between teaching for organizations at the college level or at legal events, law enforcement events.
MARK SPENCER: I have.
MARK SPENCER: RCMP.
MARK SPENCER: That's Canadian law enforcement. Hong Kong Police Department; Taiwan's MJIB.
MARK SPENCER: Typically civil cases, private sector matters, intellectual property. Theft is by far the most common type of case we work on, both on behalf of defendants and plaintiffs, depending on the case.
MARK SPENCER: Yes.
MARK SPENCER: Approximately 50.
MR. FICK: Can you give a ballpark estimate of how many digital devices you've analyzed in the course of your career?
MARK SPENCER: Over a thousand.
MARK SPENCER: I did.
MARK SPENCER: Yes. Prior to founding Arsenal Consulting, I worked for First Advantage Litigation Consulting from 2009 back to 2006. Prior to 2006, I worked for Evident Data, from 2006 back to 2002, until Evident Data was acquired by First Advantage. Prior to working in the private sector, I worked for the Suffolk County District Attorney's Office in Boston.
MARK SPENCER: I do.
MARK SPENCER: Yes.
MARK SPENCER: Yes.
MARK SPENCER: Russian.
MARK SPENCER: She is.
MARK SPENCER: I have.
MR. FICK: Have you previously testified in this court, before this judge, about digital forensics?
MARK SPENCER: I have.
MARK SPENCER: We do.
MARK SPENCER: $425 an hour.
MARK SPENCER: 375.
MARK SPENCER: The federal court.
MARK SPENCER: Approximately 400.
MARK SPENCER: Approximately 400 hours.
MARK SPENCER: Yes.
MARK SPENCER: We were asked to review electronic evidence and reports related to that evidence.
MARK SPENCER: The FBI's.
MR. FICK: When you say "electronic evidence," does that include forensic images of various devices?
MARK SPENCER: Yes.
MARK SPENCER: A forensic image is essentially a copy of a storage device or volume which includes deleted space. And a fairly important matter is that at any time in the future, you can authenticate that forensic image. You can authenticate that it's good data.
MARK SPENCER: Yes.
MR. FICK: I'm going to put up on the screen a chalk or a chart listing a number of devices that he talked about in just a moment. Do you remember seeing that list last week?
MARK SPENCER: Yes.
MARK SPENCER: Three computers, three thumb drives, and an external hard drive.
MARK SPENCER: Yes.
MARK SPENCER: Yes.
MARK SPENCER: Approximately 30.
MR. FICK: Across all of the devices you analyzed, can you give a ballpark estimate of how many files existed on those devices, discrete files?
MARK SPENCER: In terms of active files, over five million, five million files and folders. That does not include the contents of containers, like zip files, or the contents of deleted space.
MR. FICK: Now, when you begin work on a case, do you do some background workup on devices or images that you're going to analyze?
MARK SPENCER: We do.
MARK SPENCER: We refer to it as case initiation. But even if our own clients give us a laptop, for example, we determine what users exist on that laptop, when Windows was installed on that laptop.
MR. FICK: Do you also investigate the manufacturing date of devices if that information is available?
MARK SPENCER: In some cases, yes.
MR. FICK: Why do you look for information or why do you compile the information about the Windows installation and the manufacturing date?
MARK SPENCER: We -- in general, it's because it helps us with connections between computers, between files, between data, events. More specifically, in some cases, our clients will give us a laptop and say, This is our employee's laptop. When we look at it closer, we'll realize it's only been the employee's laptop for three months. And we'll have to ask the question, Well, where is the previous laptop?
MR. FICK: Now, did you do a workup in this case for the three computers we've been hearing a lot about: the Samsung, the Sony, and the Hewlett-Packard?
MARK SPENCER: Yes.
MR. FICK: Do you recognize the document that's on the screen, which has been previously marked as Exhibit 3308?
MARK SPENCER: I do.
MARK SPENCER: This is a summary of our findings related to the three computers.
MARK SPENCER: Yes.
MR. FICK: Does this gather together and compile information from a variety of different forensic sources?
MARK SPENCER: It is.
MR. CHAKRAVARTY: The government's position is that this should be a chalk.
THE COURT: I'll admit it as a summary.
(Defendant's Exhibit No. 3308 received into evidence.)
MR. FICK: Now, the Samsung computer, you heard testimony last week, didn't you, that it was recovered on Laurel Street in Watertown, and the FBI called it Tamerlan's laptop? Do you recall that?
MARK SPENCER: Yes.
MARK SPENCER: December 21, 2011.
MARK SPENCER: Umar.
MARK SPENCER: September 2011.
MR. FICK: Now, the Hewlett-Packard, the second one there, HP 2R14, you understand that was a computer seized from Norfolk Street in Cambridge, correct?
MARK SPENCER: Yes.
MARK SPENCER: September 22, 2011.
MARK SPENCER: Umar.
MARK SPENCER: Yes.
MR. FICK: And down at the bottom, the Sony 1R6, seized from an apartment down south in the New Bedford area, what was the Windows installation date on that computer?
MARK SPENCER: February 26, 2011.
MARK SPENCER: Anzor.
MARK SPENCER: That's correct.
MR. FICK: Now, did you have occasion to extract the internet search history on the Samsung computer, Tamerlan's laptop?
MARK SPENCER: Yes.
MARK SPENCER: We used a combination of two tools: Internet Evidence Finder and NetAnalysis.
MARK SPENCER: The tools aren't going to have the exact same criteria for what constitutes a search, so we want to have as comprehensive a set of potential searches as possible.
MR. FICK: Are these tools tools that are widely accepted and used in the digital forensics field?
MARK SPENCER: Yes.
MR. FICK: I'm going to show you a document on the monitor previously marked as Exhibit 3303-6 and ask if you recognize it.
MARK SPENCER: I do.
MARK SPENCER: This is a spreadsheet. This is essentially output from NetAnalysis and IEF related to searches.
MARK SPENCER: For the Samsung computer.
MARK SPENCER: Yes.
MR. FICK: I want to draw your attention now to a particular search in this document from March -- first of all, before I do that, time on computers is measured or stated in different formats in different instances; is that fair to say?
MARK SPENCER: Yes.
MARK SPENCER: UTC is Universal Time. No one is going to like this explanation. Universal Time for forensic people, some technical people, is the most accurate time. Computers, generally speaking, store time either in Universal Time or in local time. The problem with local time is that we may know exactly when local time really was. It might be Eastern. It might be Pacific. It might be some other time zone. There are situations in which we won't know exactly what local time was, and there's complications which include Daylight Savings and Daylight Savings happening in different years, when it started, when it stopped. So, generally speaking, Universal Time is just a much simpler time for us to stay in.
MR. FICK: Is there a calculable relationship between UTC and Eastern Time depending on whether we're in Daylight Savings or not?
MARK SPENCER: Yes.
MARK SPENCER: When we are not in Daylight Savings, you would subtract five hours from UTC.
MARK SPENCER: For Eastern Time. When we are in Daylight Savings, you would subtract four.
MR. FICK: Okay. Now I'm going to show you a portion of this search history in just a moment if my computer will cooperate with me.
MR. FICK: Your Honor, I would ask to publish what is now on the screen, a portion of the document as we discussed, identifying it as Exhibit 3303-6A.
THE COURT: All right.
THE COURT: They should have it.
MR. FICK: Mr. Spencer, is this a sort of blow-up of a particular line entry on your search history spreadsheet?
MARK SPENCER: Yes.
MR. FICK: Is this the date and time that the search was conducted in UTC that I just circled there on the screen?
MARK SPENCER: Yes.
MARK SPENCER: It says, "Ruger P95."
MR. FICK: Is this a portion of the document showing search terms on or about April 6 and 7 of 2013?
MARK SPENCER: Yes.
MR. FICK: Are the search terms various versions of words including "transmitter" and "receiver" and "oscilloscope"?
MARK SPENCER: Yes.
THE COURT: All right.
MR. FICK: The highlighted portions that should be coming up on the screen now, are these the searches and terms from Tamerlan's Samsung that we just talked about on or about April 7 of 2013?
MARK SPENCER: Yes.
MR. FICK: I'm going to page through the document for you, Mr. Spencer, for a couple of other days on the screen here. The prior page, April 7th, are there terms on this screen that include the terms "fireworks," "firing system," and "detonator"?
MARK SPENCER: Yes.
MR. CHAKRAVARTY: Your Honor, object to the leading for each page. I don't mind the signposts but just leading the witness as to what to say.
THE COURT: Okay.
MR. FICK: I'd ask to publish this page to the jury, your Honor, as 3306-6C [sic], I think we're at.
MR. FICK: Does this reflect certain search terms that were used on Tamerlan's Samsung on April 7 of 2013?
MARK SPENCER: Yes.
MARK SPENCER: "Fireworks firing system" and "detonator."
MR. FICK: Showing you a portion of the exhibit, does this page of the exhibit reflect certain search terms and -- from the Samsung computer on April 10 and 11 of 2013?
MARK SPENCER: Yes.
THE COURT: Okay.
MR. FICK: If I could just ask you, Mr. Spencer, to read each of the highlighted search terms on this page at least until you hit the foreign language at the bottom?
MARK SPENCER: "Gun stores in N.H."; "gun stores in N.H., Salem"; "gun stores in N.H.," "Boston Marathon."
MARK SPENCER: April 10, 2013.
MARK SPENCER: Yes.
MR. FICK: Did the search term "Ruger" appear anywhere in the search history of the Sony VAIO computer?
MARK SPENCER: No.
MR. FICK: Did the search term "gun store" appear anywhere in the history of the Sony VAIO computer?
MARK SPENCER: No.
MR. FICK: Did the terms "transmitter," "receiver," "firework" or "detonator" appear anywhere in the search history of the Sony VAIO computer?
MARK SPENCER: No.
MR. FICK: Was the search term "Boston Marathon" evident in the search history of the Sony VAIO computer prior to the bombings on April 15th of 2013?
MARK SPENCER: There were references to the Boston Marathon bombing on the Sony. There were no references to the Boston Marathon without the context of the bombing.
MR. FICK: In other words, there were no searches using the term "Boston Marathon" prior to the bombing?
MARK SPENCER: Correct.
MR. FICK: I'm going to show you, Mr. Spencer, what we've previously identified as Exhibit 3303-10. Do you recognize what this is?
MARK SPENCER: Yes.
MARK SPENCER: This is an output from the tool I referred to earlier called NetAnalysis.
MARK SPENCER: This is a visual representation of hits, the number of times a domain name exists in the internet history, the web browser history.
MARK SPENCER: The tool basically will look at the total number of occurrences of the domain name in the internet history.
MARK SPENCER: Yes.
MR. CHAKRAVARTY: Your Honor, same position. I think this should be a chalk.
THE COURT: All right. I'll admit it as an exhibit as a summary.
(Defendant's Exhibit No. 3303-10 received into evidence.)
MARK SPENCER: www.facebook.com and vk.com.
MARK SPENCER: Yes.
MARK SPENCER: My understanding is it's a Russian social networking site.
MARK SPENCER: As far as I know, yes.
MARK SPENCER: 1,378.
MARK SPENCER: 1,275.
MR. FICK: Now, last week there was -- do you recall hearing testimony about an external hard drive recovered at Laurel Street in Watertown?
MARK SPENCER: Yes.
MARK SPENCER: Correct.
MARK SPENCER: Generally, an external hard drive is going to be a larger device, both in terms of physical size and in terms of storage capacity.
MR. FICK: Does the file system on an external hard drive frequently differ from the file system on a thumb drive?
MARK SPENCER: It many cases, yes. A thumb drive normally will have an older type of file system known as FAT, or file allocation table. External hard drives, being generally much larger devices, will have a more advanced file system on them, either NTFS or something known as HFS.
MR. FICK: Can you glean more forensic information from a hard drive that has the NTFS file system on it?
MARK SPENCER: Yes.
MARK SPENCER: From a laymen's perspective, format means to reset the hard drive, start fresh. More specifically or more technically, you're creating a new file system on that device.
MARK SPENCER: A user who engages in a format isn't going to see the previous files and folders that were on that drive.
MR. FICK: Is it possible to recover specific forensic information about what computer and what user on that computer formatted an external hard drive?
MARK SPENCER: It is.
MARK SPENCER: Based on the way NTFS works, the file system, you can identify the owner of files and folders that are on that drive, including critical files and folders that allow the file system to operate. That file system information includes security information about not only the computer that, by default, was responsible but the user.
MARK SPENCER: Correct.
MR. FICK: Can you also recover information about what computer created individual files on an external hard drive?
MARK SPENCER: Yes.
MARK SPENCER: It is.
MR. FICK: Now, you talked about security streams or security identifiers, something like that. What is a security identifier?
MARK SPENCER: The actual information, the security information, stored on the hard drive that contains the NTFS file system includes things called security descriptors. Basically, these are things that tell the operating system what access various users should have to the various device and what types of auditing are correct on that device. It's basically a big index, and it says, This user can do this thing. This user can do that thing. This user is the owner of a certain thing.
MR. FICK: So when you talk about the security identifier, what is it exactly? What does it look like? How is it depicted?
MARK SPENCER: It looks like a long string of numbers and letters. It's a globally unique identifier designed by Microsoft. So it's a long list.
MARK SPENCER: Yes.
MARK SPENCER: Well, the intent of a global unique identifier is so that they don't. You could force a collision but in practice, no, in our experience, no.
MR. FICK: Did you make efforts to determine the security identifier associated with various files on the 1W16 hard drive recovered at Laurel Street in this case?
MARK SPENCER: Yes.
MR. FICK: Were you able to associate the security identifiers on that hard drive with another piece of evidence in this case?
MARK SPENCER: We were.
MARK SPENCER: The security identifier for the files and folders on the Laurel Street hard drive was related to the Samsung laptop and the Umar user.
MR. FICK: When you say "related to," what does that mean with respect to the security identifier?
MARK SPENCER: Specifically, the owner of the files and folders was the Umar user on the Samsung laptop.
MR. FICK: Did you create a chart to summarize your review and the results of the information that you took from various sources?
MARK SPENCER: Yes.
MARK SPENCER: Yes.
MARK SPENCER: This is a listing of the files and folders currently on Laurel 1W16, the Laurel hard drive, which includes the SID information, which user --
MARK SPENCER: Security identifier.
MR. FICK: Ownership information, which computer, which owner, is associated with each file and folder in this list. And do we know what that SID is? What does SID, security identifier, relate to?
THE COURT: Is this a single page?
MR. CHAKRAVARTY: No objection, your Honor.
(Defendant's Exhibit No. 3301-01 received into evidence.)
THE COURT: No. Do they all look like this since I'm only seeing the first one?
THE COURT: No objection?
THE COURT: 3301.
MR. FICK: What does the first column on the left here that I've highlighted, what does that depict?
MARK SPENCER: Those are objects related to the file system itself that a -- a normal user would not see these.
MARK SPENCER: Essentially, yes.
MARK SPENCER: There are.
MARK SPENCER: That stands for master file table. That's a critical database that's used for the file system to function. It tracks the files and folders on that device.
MR. FICK: What is the relationship of that file to the formatting process of a hard disk? In other words, is that a file that is associated with the process of formatting a hard disk?
MARK SPENCER: Yes.
MARK SPENCER: When you format a storage device, thumb drive or an external hard drive, if you're using the NTFS file system, there's going to be a suite of objects that have to be created for it to function properly. This $MFT is one of those objects that is required for it to operate properly.
MR. FICK: This second column, the long string of a letter and some numbers here that I've just circled, what is that?
MARK SPENCER: That's the security identifier.
MR. FICK: In this particular line, does this reflect the security identifier for this file we were just talking about?
MARK SPENCER: Yes.
MR. FICK: And then were you able to associate that security identifier with a particular item of evidence?
MARK SPENCER: Yes.
MARK SPENCER: It is.
MR. FICK: So, in other words, the file here, the security ID owner of that file is the user Umar on the Samsung computer?
MARK SPENCER: Correct.
MR. FICK: Now, in addition to system files, you undertook similar analysis for sort of ordinary user files that a user would see on this hard drive, is that right?
MARK SPENCER: Yes.
MR. FICK: I'm going to page ahead. Up on the screen now from a further page into this document, do you see file names on the -- in the left column?
MARK SPENCER: Yes.
MARK SPENCER: Not all of them; minus two.
MARK SPENCER: Yes.
MARK SPENCER: It did.
MARK SPENCER: Yes.
MR. CHAKRAVARTY: Objection to the leading, your Honor.
THE COURT: Go ahead.
MR. FICK: Moving ahead to another page just as a few more examples, for those files listed on the left side, did you similarly -- did you reach a similar conclusion about what computer and user was the owner of those files on this hard drive?
MARK SPENCER: Yes, the same conclusion.
MR. FICK: Were there any files on this hard drive that were not owned by the security identifier associated with the Samsung?
MARK SPENCER: Other than system files, which do not have traditional security identifiers like this, no.
MR. FICK: Now, I'm going to show you a government exhibit already in evidence, Exhibit 1475-02A, which is -- one moment. Do you recognize this as being the blowup of the government's exhibit which listed all the files on the Laurel Street hard drive?
MARK SPENCER: I really can't see much of that other than what you've blown up, but it looks similar.
MR. FICK: The two file names highlighted there in Cyrillic letters, did you have occasion to verify whether those two files, in fact, exist on the Laurel Street hard drive?
MARK SPENCER: Yes.
MARK SPENCER: They do.
MR. FICK: And the documents, were you able to verify that the documents previously marked as Exhibits 3310-1 and 3310-2 are correct copies of those two files?
MARK SPENCER: Could you say that again?
MR. FICK: Did you verify whether the exhibits previously marked as 3310-1 and 3310-2 are true and accurate copies of those two files off the Laurel Street hard drive?
MARK SPENCER: Yes. We compared the actual files to make sure that the content was the same.
MR. FICK: Your Honor, I would move into evidence 3310-1 and 3310-2 as well as the translations which I believe are agreed upon.
THE COURT: Okay.
MR. CHAKRAVARTY: No objection, your Honor.
THE COURT: All right.
(Defendant's Exhibit Nos. 3310-1 and 3310-2 received into evidence.)
MR. FICK: Now, first of all, as a general matter, do you have an understanding of what the English meaning of those two file names are from your employee's assistance?
MARK SPENCER: I do.
MR. CHAKRAVARTY: Objection, your Honor.
THE COURT: Well, we have the translation, don't we?
MR. CHAKRAVARTY: We do have the files. I'm not sure that the file names are also translated. It sounds like he's getting it from his employee.
THE COURT: My point -- you're right, strictly speaking. But is it inevitable that we're going to get it anyway? The objection is sustained. Go ahead.
MR. FICK: I'm going to pull up on the screen what's now in evidence two different items. On the left side of the screen is Exhibit 3310-01, a document in a foreign language; and on the right side of the screen is 1475-21, a copy of Complete Inspire, a particular page. Do you see that on the screen in front of you?
MARK SPENCER: I do.
MR. CHAKRAVARTY: Your Honor, the government doesn't object to the authenticity of either of these documents, but this witness is not -- it's not in his expertise to be testifying about comparing those documents.
THE COURT: That seems to be right.
MR. FICK: I just want to show a few contents next to each other, your Honor, on the screen. I'm not going to ask him to analyze them.
MR. CHAKRAVARTY: This seems argumentative, your Honor.
THE COURT: The exhibits are in evidence. Okay. Go ahead. I guess what can be absorbed is the pictures, is that it?
THE COURT: Okay.
MR. FICK: I'll now put up on the screen the translation of 3310-01A, which is the translation of the first of those two files. Can you just read this paragraph of the translation that I highlighted there, the full paragraph?
MARK SPENCER: "Your task is to make use of this material which is translated into Russian from Inspire, the mujahideen magazine of the Arabian Peninsula. The text was translated into Russian so that our Russian brothers and sisters could make use of it. And let Allah help you. Amen."
MR. FICK: I'm now going to put up on the screen the translation, 3310-02A, the other of those two files. I'll move ahead a page.
MR. FICK: Can I just ask you to read the first couple sentences of this paragraph? You can skip, I guess, the foreign language in the first clause if you'd like. "Good article."
MARK SPENCER: "As-salaam aleikum Ali Abu (ph). Good article but novices will not be able to understand. They were somewhere around video lessons in three parts on how to make a bomb."
MARK SPENCER: "And the refrigerator temperature should be between 3 and 5 degrees to make the powder."
MARK SPENCER: "And also, when you are making the bomb, get rid of all metal things as they might detonate the powder. Work only with wooden and plastic things."
MR. FICK: Now, did you have occasion to investigate whether -- first of all, what kind of files were these original files, the two that we just talked about and were entered into evidence, not the translations but the originals?
MARK SPENCER: These files were in Word document format.
MR. FICK: Did you have occasion to determine whether those files were ever opened in Microsoft Word on any of the computers available in evidence in this case?
MARK SPENCER: We did.
MARK SPENCER: We found event log records. Windows event logs are diagnostic logs kept by Microsoft in some applications. In this particular case, Microsoft Office recorded some alerts related to when files were saved, these files in particular.
MARK SPENCER: On the Samsung.
MARK SPENCER: Yes.
MARK SPENCER: No.
MR. FICK: Now, I'm going to put up on the screen a couple of pages of what is in evidence as 1475-21, which is a PDF document called Complete Inspire. Do you recall seeing this PDF and hearing testimony about it last week when you were observing Mr. Swindon?
MARK SPENCER: Yes.
MR. FICK: Did you undertake any analysis across the forensic devices or the images available to you to trace the history and origin of this file across those devices?
MARK SPENCER: Yes.
MARK SPENCER: At the most basic level, we looked to see where this document existed, when it was created.
MARK SPENCER: Yes.
MARK SPENCER: Yes.
MARK SPENCER: This is a summary of our findings related to the created date and times of this document.
MR. FICK: Is it a summary of information taken from a variety of different forensic sources across the images you had in your possession?
MARK SPENCER: Yes, essentially file and folder listings.
MR. CHAKRAVARTY: Same objection, your Honor.
THE COURT: Okay. All right. I'll admit it as an exhibit.
THE COURT: The number?
(Defendant's Exhibit No. 3312-1 received into evidence.)
MR. FICK: So can you just describe briefly for the jury what the different columns of this chart represent?
MARK SPENCER: The first column represents the piece of evidence we were referring to it. The second column, if the value is not in italics, that's the Universal Time for the created date, for that item. If it's in italics, then it's in local time.
MR. FICK: What is the -- what is the created date of a file on a device? What does it mean? What's its significance?
MARK SPENCER: The created date normally refers to when a file was originally created in its current location. So that could mean copied there. It could also mean originally created there, or it could refer to when a file was moved there. The reference would be to its creation time in its original location if it was moved there.
MR. FICK: Now, some of these entries are in italic, which meant you left them in local time. Why did you do that?
MARK SPENCER: Again, that's because the local time in these cases, it's -- that is how the value was stored by the operating system, by the file system. In many cases we can assume that we're referring to Eastern Time, and we can simply -- if we wanted to go back to Universal Time, we could add hours. If we wanted to come back from Universal Time, we would subtract them. But the Eastern Time is an assumption. We know that laptops can travel. Time zones can change. We may not know exactly when a time zone was set one way versus another way.
MR. FICK: In other words, where your data was in local time, you left it in local time? Is that essentially what you're saying?
MARK SPENCER: If the data was originally stored by the file system or the operating system in local time, we left it that way here, yes.
MR. FICK: So across all the evidence you had available to you, did you find any sign of or reference -- any evidence of the Complete Inspire PDF being created prior to the circled date here, December 21, 2011?
MARK SPENCER: Creation time, no.
MARK SPENCER: That refers to an encrypted container, a TrueCrypt container on the Samsung laptop.
MARK SPENCER: Yes.
MR. FICK: And so that's among all -- across all of the evidence you had available, that is the -- was that the first reference to creation of Complete Inspire that you could find?
MARK SPENCER: Yes.
MARK SPENCER: That's a Patriot thumb drive. We do not have a forensic image for it, so we refer to it with its known volume serial number.
MR. FICK: Do you recall testimony from Agent Swindon where he also referred to it or agreed with me referring to it as the missing Patriot thumb drive?
MARK SPENCER: Yes.
MR. FICK: And so the second reference -- so how do -- where did you come up with the reference to the file being created on the Patriot thumb drive on that date, the thumb drive itself?
MARK SPENCER: This particular entry came from target information of a jump list. A jump list is similar to a shortcut that you've heard about before. It's data that points somewhere else. This jump list data will contain specific information about the thing it points at including the thing it points at, its created time, its last access time, its last modified time. In this case, a jump list on one of the computers pointed at Complete Inspire, on this Patriot thumb drive, and recorded at that time that its created date was as you see, January 21, 2012.
MARK SPENCER: Correct.
MR. FICK: Did you undertake further analysis of exactly what may have happened to Complete Inspire on January 21 of 2012?
MARK SPENCER: Yes.
MR. FICK: I'm going to put up on the screen what's previously been marked as 3312-02. Do you recognize this document?
MARK SPENCER: Yes.
MARK SPENCER: This is a summary of events that are in some way related to Complete Inspire on this particular day.
MARK SPENCER: This information comes from three sources: the jump list information I mentioned, file system information; the file and folder listings; and Windows registry information.
MR. FICK: Those are all -- fair to say those are all sort of sources of forensic digital information in the various images you looked at?
MARK SPENCER: Yes. All of this information exists within the forensic images.
THE COURT: All right. On the same basis, I will allow it.
(Defendant's Exhibit No. 3312-02 received into evidence.)
MR. FICK: Can you just explain for the jury what this slide depicts and sort of go through step by step the events that are listed here?
MARK SPENCER: The first line indicates that we see an attachment event of this Patriot, this particular Patriot, January 21, 2012, 6:22 a.m.
MARK SPENCER: The Samsung laptop.
MARK SPENCER: Windows registry information.
MARK SPENCER: That's correct.
MR. FICK: Now, the second line, January 21, 2012, about two seconds or so later, explain what that is.
MARK SPENCER: Two minutes later.
MARK SPENCER: That is information from a jump list, which pointed at the Patriot, actually pointed at completeinspire.pdf on the Patriot, which indicates that that file was created in that location, on that device, on January 21, 2012, 6:24:18.
MARK SPENCER: That's an attachment event, which shows the attachment of this Patriot to the Sony laptop.
MARK SPENCER: Correct, less than a minute later.
MARK SPENCER: That's the file creation time on the Sony of completeinspire.pdf.
MR. FICK: What, if anything, can you infer from this data about how Complete Inspire wound up on the Sony?
MARK SPENCER: The window is very, very tight here in terms of the attachment of this device onto which we know this particular file was copied and then its creation onto another device. So this would appear to indicate that completeinspire.pdf was copied from the Samsung laptop and then copied to the Sony laptop. There's also the issue of evidence which does not reflect anything else occurring. There was very, very little activity around these times on either of these computers.
MR. FICK: So to put that another way, did you find, for example, any indication whatsoever that Complete Inspire came off the internet at this time?
MR. CHAKRAVARTY: Objection, your Honor. It's argumentative.
THE COURT: No, overruled. You may answer that.
MARK SPENCER: No.
MR. FICK: Did you find any information to suggest that Complete Inspire was created at this time from any other source?
MARK SPENCER: No.
MR. FICK: Now, did you have occasion to investigate whether other copies of Inspire -- when they were created on the Sony, other copies of Inspire Magazine?
MARK SPENCER: Yes.
MARK SPENCER: This chart is a little bit more general than the last one in terms of file creation. This is the creation -- essentially shows the creation of all issues of Inspire on the Sony on January 21, 2012.
MARK SPENCER: Multiple sources from the forensic images, yes.
THE COURT: All right. Admitted.
(Defendant's Exhibit No. 3313-03 received into evidence.)
MARK SPENCER: The first line shows an attachment event on the Samsung laptop of the Patriot that we've been discussing. The second line shows a file creation of completeinspire.pdf on that Patriot device. Third line shows an attachment of that Patriot thumb drive to the Sony laptop. Then the next four lines depict file creation date and times for multiple issues of Inspire on the Sony laptop.
MARK SPENCER: This was between 6:22:31, again, Universal Time, and 6:26:10.
MARK SPENCER: A few minutes.
MR. FICK: Do you understand the date of January 21, 2012, to have other significance in the case?
MR. CHAKRAVARTY: Objection, your Honor.
THE COURT: Sustained.
MR. FICK: Do you recall at the beginning, right before I started asking you questions, we put up a travel document showing Tamerlan's departure from the United States on January 21, 2012?
MR. CHAKRAVARTY: Objection, your Honor.
THE COURT: Sustained.
MR. FICK: After January 21, 2012, is there any evidence across any of the forensic images at your disposal to suggest or to show the Patriot, the missing Patriot, ever being attached to a device again that we're aware of?
MARK SPENCER: No.
MR. FICK: So what was the last date in all the evidence that you have available to you where we see indicia of the Patriot being attached to something?
MARK SPENCER: Later in the day on January 21, 2012.