3.Mark Spencer — Cross/Redirect/Recross (Part 2)

MR. CHAKRAVARTY: Good morning, Mr. Spencer.

MR. CHAKRAVARTY: We've met before?

MR. CHAKRAVARTY: That other case that you testified in, I had the privilege of cross-examining you in that case, correct?

MR. CHAKRAVARTY: That was another case where you testified for the defense, right?

MR. CHAKRAVARTY: Now, you said that you had spent about 400 hours so far on this case?

MR. CHAKRAVARTY: Is that how much you've billed for or how much your firm has spent on the case?

MR. CHAKRAVARTY: You still have another bill, I hope, to submit?

MR. CHAKRAVARTY: About how much do you expect to be billing for it?

MR. CHAKRAVARTY: And that's getting ready for trial. And you digging into each of these materials that Mr. Fick asked you about takes a lot of time, right?

MR. CHAKRAVARTY: And that's both your time as well as the other people in your firm?

MR. CHAKRAVARTY: Do you think it's going to be more than 400 hours additional?

MR. CHAKRAVARTY: So just in terms of the limitations of your science, you can't tell who is actually using a computer at any given time; is that fair to say?

MR. CHAKRAVARTY: Unless you have a video camera or some other way to have some extrinsic evidence saying that Mark Spencer is using a computer, then you just have to infer it from the activity on the computer, right?

MR. CHAKRAVARTY: And one of the ways that you do that is you check to see if the person is logging into his email account, for example?

MR. CHAKRAVARTY: Or his Twitter account, that kind of thing, right?

MR. CHAKRAVARTY: Having looked at the computers, you recognize that the Sony VAIO computer, the 1R6, was the defendant's computer, Dzhokhar Tsarnaev's, right?

MR. CHAKRAVARTY: So the fact that the user account name was called Anzor was simply what the user of the computer decided to name his computer, correct?

MR. CHAKRAVARTY: In fact, the full name on the Windows information was that it was -- Jahar was the full name of the user?

MR. CHAKRAVARTY: Through similar analysis, you gleaned that the Samsung computer that was found in Watertown, what was called the 1W3 today, that was Tamerlan's computer, correct?

MR. CHAKRAVARTY: And some of the other devices, it's less clear, right?

MR. CHAKRAVARTY: Because those are not complete computer operating systems in which one person was the exclusive user. There were actually -- if it was a removable media, it was put into many different devices?

MR. CHAKRAVARTY: And I think some of the exhibits you pointed to today actually showed that there were migrating files between devices, right?

MR. CHAKRAVARTY: And, in addition, there was a desktop computer found at the 410 Norfolk Street residence in the defendant's room that was used by a lot of different people, right?

MR. CHAKRAVARTY: There were some children's shows on that as well as some jihad-related materials as well as innocuous materials, correct?

MR. CHAKRAVARTY: Now, both the defendant's computer and his brother's computer had searches for the Boston Marathon explosions after the Boston Marathon, correct?

MR. CHAKRAVARTY: And both of them had the Inspire magazines, some of the collection which you pointed out today as well as some additional issues, correct?

MR. CHAKRAVARTY: Both of them had other radical Islamist extremist material as well, correct?

MR. CHAKRAVARTY: You pointed out that there was a search on Tamerlan's computer in March of 2013 for a Ruger P95; do you remember that?

MR. CHAKRAVARTY: And that was -- from the internet history, you saw that somebody plugged into Google or something "Ruger P95," right?

MR. CHAKRAVARTY: And so do you also know that that is after the defendant had already obtained the P95?

MR. CHAKRAVARTY: Were there searches for other guns on Tamerlan's computer?

MR. CHAKRAVARTY: And the -- you also were shown a search on Tamerlan's computer on April 7, 2013 -- this is about a week before the Marathon -- for "fireworks" and "detonation" -- or "detonator," is that right?

MR. CHAKRAVARTY: So that was only a week before the Marathon is when the "detonator" and "fireworks" were sought, according to your analysis?

MR. CHAKRAVARTY: And do you know that the defendant had actually returned to Cambridge the week before the Marathon?

MR. CHAKRAVARTY: Now, on the Sony VAIO computer, the defendant's computer, there were also some additional searches of interest; is that fair to say? You looked at some of the searches on the Sony VAIO computer?

MR. CHAKRAVARTY: Mr. Bruemmer.

MR. CHAKRAVARTY: Your Honor, the witness was asked if he had searched -- had found evidence --

MR. CHAKRAVARTY: -- on all the things he looked at.

MR. CHAKRAVARTY: Now, Mr. Spencer, is it true that the defendant made some searches just before the Boston Marathon, on April 11, 2013, for the -- under the search term "the call of jihad"? Do you remember that?

MR. CHAKRAVARTY: And this is a -- I'm pulling up 3303-02, which is a parsed web search from the Sony VAIO computer that you had created, correct?

MR. CHAKRAVARTY: Your Honor, if I could ask to publish just that search entry, just this page?

MR. CHAKRAVARTY: I think just the file area. I'll zoom in as much as I can.

MR. CHAKRAVARTY: I don't have objection to that.

MR. CHAKRAVARTY: Yes, please, your Honor.

MR. CHAKRAVARTY: So this entry shows that the user of this device, the weekend before the Boston Marathon bombing, searches for "the call of jihad," correct?

MR. CHAKRAVARTY: Your Honor, just for the witness again, please.

MR. CHAKRAVARTY: Again, sometime before the Marathon, back in February of 2013, the user of this device also searched for "Jannah al Firdaus," is that accurate?

MR. CHAKRAVARTY: February 2.

MR. CHAKRAVARTY: Again, your Honor, I would ask to publish Page 29 of this exhibit.

MR. CHAKRAVARTY: That's this entry here that I'm just circling.

MR. CHAKRAVARTY: And do you know what "Jannah al Firdaus" means?

MR. CHAKRAVARTY: Again, just for the witness, your Honor.

MR. CHAKRAVARTY: This is some of the internet search history for -- that include references to the Boston Marathon explosions at the finish line, is that accurate?

MR. CHAKRAVARTY: And there are a few different pages related to the searches of the Boston Marathon, correct?

MR. CHAKRAVARTY: And there are multiple entries related to searches related to jihad as well, correct? We saw one of them. I'm just asking are there others in addition to the "call of jihad" search.

MR. CHAKRAVARTY: Now, if we could turn to the 1W16, this was the hard drive that was found on the street in Watertown. You had examined that hard drive and recognized that there were a number of files that were in what we call the unallocated space of that hard drive; is that fair to say?

MR. CHAKRAVARTY: And so that means that there were -- I think there were mostly MP3-type audio files, maybe somebody's song collection?

MR. CHAKRAVARTY: And amongst the maybe thousands of songs that had been on that hard drive, there were also some files related to some homework or school work of somebody named Giovanni, correct?

MR. CHAKRAVARTY: And all of that stuff was deleted, and it was replaced with some of the files that Mr. Fick asked you about today, right?

MR. CHAKRAVARTY: So the Inspire magazines, the Awlaki lectures, all that stuff replaced this hard drive that had a lot of MP3 songs on it and some homework assignments, correct?

MR. CHAKRAVARTY: And so the homework assignments, did you recognize were in 2012 for a UMass Dartmouth student?

MR. CHAKRAVARTY: In any event, those were still -- you could still see traces of those files on the computer. That's how you know it was all on there?

MR. CHAKRAVARTY: And after the -- those files were placed on that hard drive, that hard drive was then plugged into the defendant's Sony laptop, right?

MR. CHAKRAVARTY: So you said that the external hard drive was plugged into Tamerlan's computer, I think, back in January of 2013, correct?

MR. CHAKRAVARTY: Sure. Let me go to some of your exhibits. You recognize this? This is 3302-04.

MR. CHAKRAVARTY: And this is a list of various removable storage devices that were plugged -- that the external hard drive that we're talking about was plugged into various devices, right?

MR. CHAKRAVARTY: Sorry, plugged into various computers. In fact, there's two computers it was plugged into, according to this chart: Tamerlan's computer and the defendant's computer, right?

MR. CHAKRAVARTY: According to this chart, on January 21, 2013, there was a file called setupapi.dev.log. That's a file that simply tells you that this device is plugged into a computer, correct?

MR. CHAKRAVARTY: So this is the first time that this device was plugged into the -- Tamerlan's computer?

MR. CHAKRAVARTY: So on January 21, 2013, it was first plugged in. By the way, for the benefit of the jury, is this chart helpful to explain what this -- the removable storage attachment sequence was?

MR. CHAKRAVARTY: Your Honor, I would move in evidence 3302-04.

MR. CHAKRAVARTY: And ask to publish.

MR. CHAKRAVARTY: So this shows that on January 21, 2013, this device, which is the laptop -- excuse me, the external hard drive, was plugged into Tamerlan's computer, the Samsung 1W3, right?

MR. CHAKRAVARTY: And then this chart shows that in March, again, of 2013, about a month before the Marathon, it was plugged in for the first time, it looks like, into the Sony 1R6, which is the defendant's computer, right?

MR. CHAKRAVARTY: And then a few minutes later, it goes back into Tamerlan's computer, right?

MR. CHAKRAVARTY: And then later, the next morning, it goes back into the defendant's computer, right?

MR. CHAKRAVARTY: And then it gets plugged in two more times, both times into the defendant's computer, right?

MR. CHAKRAVARTY: In fact, the last time it goes in is about a week and a half before the Marathon, correct?

MR. CHAKRAVARTY: And, in fact, the defendant's computer, the Sony 1R6, actually accessed this Samsung -- excuse me, the 1W16, the external hard drive, on March 18th. It watched some videos. It did some other activity on that day, correct?

MR. CHAKRAVARTY: Okay. So let's go to --

MR. CHAKRAVARTY: Thank you, your Honor.

MR. CHAKRAVARTY: -- 3300. Now, I've just put up for you what you've labeled as the live MFT record, Laurel 1W16. And that is the master file table drawn from Windows for that device, correct?

MR. CHAKRAVARTY: And so this is a six-page document?

MR. CHAKRAVARTY: Again, is this an extraction that you had from the external hard drive that was found on Laurel Street?

MR. CHAKRAVARTY: I would move into evidence 3300-07, your Honor.

MR. CHAKRAVARTY: So this shows some of the files that were on that device, correct?

MR. CHAKRAVARTY: And so we were just talking about the March 18, 2013, day that this device was plugged into the Sony VAIO; do you remember that?

MR. CHAKRAVARTY: And so this first column, is this the first -- this is the name of the file, and then this is the creation date, correct?

MR. CHAKRAVARTY: So this entry -- let's use, for example, Entry 67 -- shows that that file was created on this device on March 18, 2013, right?

MR. CHAKRAVARTY: And it was accessed on April 6, 2013, correct?

MR. CHAKRAVARTY: And, again, we just looked at the earlier exhibit, which showed that that access, April 18th and April 6th, were both on the Sony VAIO, correct?

MR. CHAKRAVARTY: The chart speaks for itself.

MR. CHAKRAVARTY: This also shows that some of those files that you had talked about before, the Inspire magazines, over in this section, correct?

MR. CHAKRAVARTY: And, specifically, it shows -- I'll zoom in here -- the Complete Inspire magazine that Mr. Fick asked you about, that you heard a lot about when Agent Swindon testified, that's this entry, Exhibit 38, right?

MR. CHAKRAVARTY: Now, you said that this device was first plugged into Tamerlan's computer on January 21, 2013, is that right?

MR. CHAKRAVARTY: And so there's a creation date of December 27, 2012, on this file list, right?

MR. CHAKRAVARTY: And that means that on this computer this file existed on December 27, 2012, is that accurate?

MR. CHAKRAVARTY: So then why is this date, which predates the date that the computer was plugged in -- the device was plugged into Tamerlan's computer, how else can you explain this December 27, 2012?

MR. CHAKRAVARTY: So you're suggesting then that that's the date that it existed on Tamerlan's computer or however the file got to this hard drive, right? That date preexisted the existence -- creation date on this hard drive?

MR. CHAKRAVARTY: So that's inconsistent with what you described as the creation date, right?

MR. CHAKRAVARTY: The creation date you said that was on this hard drive. You described the creation date as -- you told Mr. Fick that it was the date that the file was either created in a specific location or it was moved to a specific location, right?

MR. CHAKRAVARTY: Okay. So for all of these other files, January 25, 2013, all of the other Inspire magazines were January 25, 2013, right?

MR. CHAKRAVARTY: Yup. And all of these other files on the next page, including the Awlaki lectures, were sometime in March of 2013, right?

MR. CHAKRAVARTY: In fact, there's no other entry for 2012 except for that one entry, right? That's the only entry that shows a creation date of 2012, correct?

MR. CHAKRAVARTY: And so you analyzed all of the devices in this case, but you only presented some charts from -- for some of those devices, correct?

MR. CHAKRAVARTY: If this hard drive actually were not plugged into Tamerlan's computer but was plugged into the Norfolk desktop that also accessed Complete Inspire around that same time, then you would expect to see a setup API log file on the desktop, correct?

MR. CHAKRAVARTY: Right. And you didn't put that into your chart, did you?

MR. CHAKRAVARTY: It's the lack of completeness of the chart that the defendant --

MR. CHAKRAVARTY: So this file could have come from any computer in which the creation date that existed was December 27, 2012, correct?

MR. CHAKRAVARTY: So there's something on this file that tells you that it had to have come from the Samsung?

MR. CHAKRAVARTY: Yes.

MR. CHAKRAVARTY: Which means that at some time that file, the origination of that file, was on the Samsung computer, correct?

MR. CHAKRAVARTY: And then however -- wherever that files goes, that SID follows it?

MR. CHAKRAVARTY: So if it goes then to the Norfolk computer, then the Norfolk computer SID would be imparted into it?

MR. CHAKRAVARTY: On the Norfolk computer.

MR. CHAKRAVARTY: So you did recognize -- you do recognize that the Norfolk computer did access on an external drive around the same time the Complete Inspire magazine?

MR. CHAKRAVARTY: On December 23rd and December 26th of 2012.

MR. CHAKRAVARTY: You were here for Agent Swindon's testimony, right?

MR. CHAKRAVARTY: You were seated here at counsel table. You saw some of the charts that showed that that file was accessed on an external drive on the Norfolk Street computer. You have no reason to question that, right?

MR. CHAKRAVARTY: Now, going back to -- I guess staying on this, there were some other files on this external hard drive that included appeared to be some movies. One of them was a Django Unchained, right?

MR. CHAKRAVARTY: I'm sorry. I'm looking -- I'll move it up here a little bit. Entry 74 and 75 and 76 appear to be records of the movie Django Unchained. It appears from -- in a folder called -- that ends with -- not in a folder, excuse me -- that has a text file that goes along with it called "torrent downloaded from extratorrent.com," correct?

MR. CHAKRAVARTY: Is that all an indication that these are movies that were downloaded through peer-to-peer network, some kind of torrent program?

MR. CHAKRAVARTY: Somebody downloaded those files onto this external hard drive, right?

MR. CHAKRAVARTY: So they were created on the drive. They weren't created on the 1W3?

MR. CHAKRAVARTY: Okay. So these were created -- I'm not following what you mean in terms of whether a file was created on 1W16 or transferred to 1W16 from another device. I thought you just said that the Inspire magazines were transferred from Tamerlan's computer.

MR. CHAKRAVARTY: But you don't know then whether it was downloaded from the internet or downloaded from Tamerlan's computer?

MR. CHAKRAVARTY: I understand that the drive was connected to the computer. The drive was connected to Tamerlan's computer and to the defendant's computer. I'm trying to figure out how these files got onto this computer, onto this hard drive. I'm simply asking you that -- there's a creation date for Django Unchained on March 18th. It's fair to say that those were downloaded from some source, either the internet or some computer, correct?

MR. CHAKRAVARTY: And that's the same date as these Anwar Awlaki lectures, right?

MR. CHAKRAVARTY: And so you can't say with any more specificity where any of that stuff was downloaded from? All you can say is that that's the date that they were created on this hard drive?

MR. CHAKRAVARTY: And then the use of that hard drive later was all on April 6th or on April 19th -- or March 19th, correct?

MR. CHAKRAVARTY: But since this hard drive was not plugged into Tamerlan's computer after March 18, 2013, it's a fair inference that any access that postdates April -- March 18 of 2013 was done on the defendant's computer?

MR. CHAKRAVARTY: You showed us 3302-04, which shows the dates that this device was plugged into the various computers, the two computers particularly. It does not include the Norfolk drive. It just includes the Sony laptop and the Samsung laptop, right?

MR. CHAKRAVARTY: And so these are the dates that those files -- that that device was accessed on -- after March 18th, correct?

MR. CHAKRAVARTY: So on April 6, March 21, and March 19 of 2013, this device was only plugged into the defendant's laptop?

MR. CHAKRAVARTY: Let me ask you a question.

MR. CHAKRAVARTY: I think he had answered my question.

MR. CHAKRAVARTY: So these accesses -- this was the simple question that I was trying to get to you. These accesses correlate to the accesses on the defendant's Sony laptop, correct?

MR. CHAKRAVARTY: Right. But those are the dates that this file was manipulated on this hard drive?

MR. CHAKRAVARTY: And, in fact, there is a link file -- you're aware of what a link file is?

MR. CHAKRAVARTY: And you heard Agent Swindon talk about link files?

MR. CHAKRAVARTY: And they show that some user uses an application to actually access a file?

MR. CHAKRAVARTY: In fact, the Django Unchained video was watched on the defendant's computer on March 19, 2013, as well as on another date, a couple days later?

MR. CHAKRAVARTY: And that file was not accessed on Tamerlan's computer, the Samsung? There was no such link file, right?

MR. CHAKRAVARTY: Now, let's just get quickly to the idea of Tamerlan's computer, the 1W3. Now, you said that you don't know whether -- you can't make conclusions about what somebody is thinking or who the person is that's actually accessing a particular file, correct?

MR. CHAKRAVARTY: So no matter what computer files are on somebody's computer, you can't say, Oh, this person must have been thinking something, right? That's beyond what a computer forensic scientist can do?

MR. CHAKRAVARTY: So the 1W3, what you say is Tamerlan's computer, in fact, other people used that computer as well, right?

MR. CHAKRAVARTY: In fact, the defendant used Tamerlan's computer, correct?

MR. CHAKRAVARTY: In fact, he logged onto his email on Tamerlan's computer?

MR. CHAKRAVARTY: All right. And I think right around the time that this -- several of these files -- I think you described January 21, 2013, being the date that the external hard drive was set up on Tamerlan's computer, is that right? Let's go back to your chart. January 21, 2013, is the date that --

MR. CHAKRAVARTY: -- the hard drive was set up? This is the hard drive that had the homework assignments on it. It was cleaned, and the new jihadi material was put on it, right?

MR. CHAKRAVARTY: And so a few days before that, during Christmas break of 2013, the defendant was checking his email on Tamerlan's computer, is that right?

MR. CHAKRAVARTY: Okay. The exact date and time, I think, is less important than the fact that the defendant was actually using the defendant's -- Tamerlan's computer.

MR. CHAKRAVARTY: The defendant was actually using Tamerlan's computer near the time that this hard drive was set up?

MR. CHAKRAVARTY: You don't know who made the decision to download these files or where they got these files from, right?

MR. CHAKRAVARTY: Let's start with the Complete Inspire magazine. You don't know -- all you know is that that first appears on the Tsarnaev brothers echo system on January 21, 2012?

MR. CHAKRAVARTY: Excuse me, 2011.

MR. CHAKRAVARTY: December of 2011.

MR. CHAKRAVARTY: And that means that it could have been plugged into another computer that nobody has ever found, right?

MR. CHAKRAVARTY: In fact, do you know that the defendant purchased a computer that nobody ever found?

MR. CHAKRAVARTY: I think that's all, your Honor.

MR. CHAKRAVARTY: No objection.

MR. CHAKRAVARTY: Objection, your Honor.

MR. CHAKRAVARTY: Object to that, your Honor. This is beyond the scope of what -- certainly what the cross was. I didn't refer to this history.

MR. CHAKRAVARTY: Just on that point.

MR. CHAKRAVARTY: Mr. Spencer, the exhibit that Mr. Fick just showed you, there were several searches on April 15 and April 16, 2013, correct, for the Boston Marathon explosion?

MR. CHAKRAVARTY: On those two dates, April 15 and April 16, the day of the Marathon and the day after?

MR. CHAKRAVARTY: Those are dates where you don't know who the actual searcher was for that information?

MR. CHAKRAVARTY: If the defendant and Tamerlan were together, you wouldn't be able to tell which one of them made those searches?

MR. CHAKRAVARTY: That's all I have.