2.Mark Spencer — Direct (Recall, Part 1)
573 lines(Discussion at sidebar and out of the hearing of the jury:)
MR. WEINREB: Your Honor, we filed a motion in limine with respect to -- first of all, we had made a general objection to all of these computer exhibits on the grounds that hundreds and thousands of files are being offered potentially as exhibits without any demonstration of the actual relevance of each one. And we singled out two in particular in a motion that we think are particularly irrelevant and prejudicial. I don't know if you had a chance to look at it, but one --
THE COURT: Last night?
MR. WEINREB: Yes.
THE COURT: Yeah, I did.
THE COURT: It's on the docket.
THE COURT: It's sealed.
MR. WEINREB: We emailed it.
MR. BRUCK: This is part of the long motion?
MR. WEINREB: No, this is something we emailed to you last night, about six o'clock, I think.
THE COURT: Do you have a copy of it?
MR. WEINREB: I don't think I do have a copy.
THE COURT: I don't remember if I printed it or just looked at it.
Yeah, this is it.
All right. That's it?
MR. WEINREB: Yes.
MS. CONRAD: I don't know. I didn't notice.
(Pause.)
MR. WEINREB: The only thing I would add is, in putting in the Internet search history of Katherine Tsarnaev, we were getting quite far afield from the defendant's moral culpability for these offenses and whether he deserves the death penalty or not. We are really going way off to the side.
And particularly when you're talking about the Internet search history of someone twice removed from the defendant, what people search on a computer is already of tenuous significance. And compounded by the levels of indirection, the lack of foundation, the lack of context and its tenuous relationship to the mitigation case, we think that should be excluded.
And then as for these translations, again, we are talking about something which has no context, for which there will be little or no foundation, and which is quite far removed from the defendant's moral culpability, particularly when the links between it and what the defendant did or may have done or thought or felt or its influence are going to be left to the jury to speculate about.
MR. FICK: So the issue of Tamerlan's radicalization, the timing of that radicalization, the intensity of that radicalization are a central part of the mitigation case and always has been. Katherine Tsarnaev's searches are a -- very telling pieces of circumstantial evidence that add to the picture of Tamerlan's intentions when he went to Russia in 2012. Within a short time before and a short time after those trips, her computer is making searches for things like what happens to the wife of a shahid, what are the rewards for the wife of a mujahidin.
The arguments Mr. Weinreb is making about their significance are standard jury arguments. What significance there is to a piece of circumstantial evidence is a quintessential matter to be argued about, and this is actually a very powerful corroboration of a variety of evidence we're going to present about Tamerlan's intentions when he went to Russia, which is, in turn, a central part of the sort of story of radicalization I'm hearing from whence all of this came.
With regard to the audio recordings, first of all, the government has had -- well, they've always had the recordings, but they've had the translations for weeks. The recordings themselves are, again, some of the best evidence of what was going on in Tamerlan Tsarnaev's mind when he was in Russia. There are multiple reasons to believe that these recordings are of him.
One reason is that the other speakers on the recordings refer to one of these speakers as Tamerlan Tsarnaev. It's clear from the context of the conversation when someone is talking to somebody else, you know, "Tamerlan this," "Tamerlan that," that's part of the conversations.
Second, the recordings were found both on Tamerlan Tsarnaev's computer and some of them on Tamerlan Tsarnaev's phone, leading to the inference they probably came from the phone to the computer. It's, again, another piece of evidence pointing to the fact that they are Tamerlan.
We expect the members of the Tsarnaev family can identify the voice on the recording as Tamerlan, and Professor Reynolds will talk about his having listened to these conversations and the things that he -- essentially what he draws from them, what significance he draws from them.
MR. WEINREB: There is no relevance --
THE COURT: We'll come to that when he testifies.
MR. WEINREB: I don't think Professor Reynolds can testify about these in any way.
THE COURT: But, anyway, to cut it short, you're quite right, but I'll allow it anyway. I'll give him some leeway, at least at this stage. I agree with you it's remote, but that's their --
MR. FICK: In terms of the recordings, I -- the way we structured our exhibit about the Samsung computer essentially is a mirror image of what the government did with the various devices they put in. There's a selection of files, they're extracted, we're putting them in, and we're not going to go into depth into what's in there.
THE COURT: You've got it.
(In open court:)
MARK SPENCER, duly sworn.
COURT CLERK: State your name, spell your last name for the record, keep your voice up, and speak into the mic.
MARK SPENCER: Mark Spencer, M-A-R-K, S-P-E-N-C-E-R.
DIRECT EXAMINATION BY MR. FICK:
MARK SPENCER: Good morning.
MR. FICK: If you'll bear with me one second, I'll finish setting up my equipment here. So, Mr. Spencer, can you please remind the jury where it is that you work?
MARK SPENCER: I'm the president of Arsenal Consulting, a digital forensics consulting company in Chelsea.
MR. FICK: And, again, in just a couple of words, describe the kind of work that you and your company do.
MARK SPENCER: We practice digital forensics, which involves the identification, preservation, analysis, and reporting on electronic evidence.
MR. FICK: And just to orient us a little bit from where we kind of left off in the prior phase of the case, I would like to put up on the screen what's previously been admitted into evidence as Exhibit 3308. So, Mr. Spencer, do you remember testifying about this chart when you were previously here?
MARK SPENCER: I do.
MR. FICK: And is this a summary of some information about three of the computers that you analyzed in your work?
MARK SPENCER: It is.
MARK SPENCER: That's correct.
MR. FICK: And there was testimony from, I think, both the FBI and from you suggesting that Tamerlan Tsarnaev was the principal user of that one?
MARK SPENCER: Correct.
MARK SPENCER: Yes.
MR. FICK: And there was evidence and testimony from various sources that Jahar Tsarnaev was the principal user of that computer?
MARK SPENCER: Correct.
MR. FICK: And then this HP, that was a desktop computer from Norfolk Street in Cambridge. Is that right?
MARK SPENCER: That's my understanding.
MARK SPENCER: Yes.
MR. FICK: Okay. So those are three of the computers that you talked about when you were here before?
MARK SPENCER: Yes.
MR. FICK: Okay. Now, again, just to tie up a loose end, do you recall some testimony about a couple of compact disks that were recovered from a couple of vehicles in connection with the investigation?
MARK SPENCER: Yes.
MR. FICK: And did you investigate, at my request, whether the audio files on those CDs could be found on either the Samsung or the Sony computers?
MARK SPENCER: Yes, we did.
MARK SPENCER: Yes.
MARK SPENCER: This is a chart that depicts the file names of each multimedia file that was found on the CD, in this case the Honda, and whether it was found on the Sony and whether it was found on the Samsung.
MARK SPENCER: Yes.
MR. CHAKRAVARTY: No objection.
THE COURT: No objection? All right.
(Defense Exhibit No. 3320 received into evidence.)
BY MR. FICK:
MARK SPENCER: The CD recovered from the Honda, 14-31.
MARK SPENCER: File names.
MARK SPENCER: Correct.
MARK SPENCER: That column indicates whether we found that particular file on the Sony laptop.
MR. FICK: Okay. And then similarly, does the third column reflect that same information with regard to Tamerlan's Samsung?
MARK SPENCER: Yes.
MARK SPENCER: I think so.
MARK SPENCER: Yes.
MR. CHAKRAVARTY: No objection.
THE COURT: Okay.
(Defense Exhibit No. 3321 received into evidence.)
BY MR. FICK:
MR. FICK: And so does this chart similarly reflect whether -- or where the files on that CD were found as to each of the two computers?
MARK SPENCER: This chart reflects whether they were found on each of the computers, yes.
MR. FICK: Now, in addition to the three computers that we've just talked about, did you also examine a MacBook computer seized from Norfolk Street?
MARK SPENCER: Yes, two MacBook computers.
MARK SPENCER: Yes.
MR. FICK: Putting up on the screen just something for your own memory reference. I probably won't seek to admit it. But let me ask you, did you examine the MacBook Pro computer to determine what was the username for the Mac operating system on that computer?
MARK SPENCER: I did.
MARK SPENCER: The username was Katherine Russell.
MR. FICK: And did you also -- well, let me ask this: Was the Skype communication software on that computer?
MARK SPENCER: It was.
MARK SPENCER: Skype is a communications program which allows you to make calls between computers -- between a computer and what you would think of as a regular phone or traditional phone. It even allows instant messaging and file transfer.
MR. FICK: And did you determine what was the active Skype user on this MacBook computer from your analysis?
MARK SPENCER: Yes, that was --
MARK SPENCER: KTsarnaev26.
MR. FICK: And did the computer -- or did the Skype software also reflect the existence of a prior username for this?
MARK SPENCER: Yes.
MARK SPENCER: KORussell26.
MR. FICK: Now, did -- you testified, I think the last time you were here, about extracting the Internet search history from a computer to find out what search terms may have been entered in Internet searches. Do you recall that testimony?
MARK SPENCER: Yes.
MARK SPENCER: Yes.
MR. FICK: And did you create a summary of your -- or a summary of the data about the search history?
MARK SPENCER: Yes.
MR. FICK: I'd like to put up on the screen, your Honor, just for the witness, if I could, Exhibit 3303-7. If I can get my computer to cooperate with me.
(Pause.)
MR. FICK: Well, let me show you instead what has been identified as 3307A. Is that a page from the Internet search history that you -- I'll put this back. Here we go. 3307A, is that an extraction -- a page from the Internet search history of the MacBook Pro computer?
MARK SPENCER: Yes.
MR. FICK: And is that search history something you used with standard forensic tools that are used by professionals in your field?
MARK SPENCER: In this case, a combination of tools.
MARK SPENCER: Yes.
MR. FICK: And are these tools considered to be a reliable means of establishing the Internet search history and then summarizing the results?
MARK SPENCER: Yes.
MR. CHAKRAVARTY: No objection.
THE COURT: Admitted.
(Defense Exhibit No. 3303-7A received into evidence.)
THE COURT: Can I just be sure of the identification. You've said 3303-7A, but you've also said 3307. I just want to be sure.
THE COURT: Thank you. I want the record to be clear.
BY MR. FICK:
MR. FICK: Highlighting the search here from January 23rd of 2012, can you just read what that search is there, the top one?
MARK SPENCER: "If your husband becomes a shahid, what are the rewards for you?"
MARK SPENCER: January 23rd, 2012.
THE COURT: Okay.
(Defense Exhibit No. 3303-7B received into evidence.)
BY MR. FICK:
MR. FICK: Is this another page out of that Internet history extraction that you did for the MacBook Pro?
MARK SPENCER: Yes.
MR. FICK: And just to -- can you read the search terms there that were searched on January 7th of 2012?
MARK SPENCER: "Wife of mujahidin." "Rewards for wife of mujahidin."
MR. FICK: Now, returning to the Sony and the Samsung specifically, did you, as part of your work, do an analysis of what software was installed on each of those two computers?
MARK SPENCER: Yes.
MR. FICK: And did you create a summary chart or a checklist with regard to certain selected pieces of software on each of those two computers?
MARK SPENCER: I did.
MR. FICK: -- what's been identified as Exhibit 3309. Is this the summary chart you created with regard to five specific pieces of software?
MARK SPENCER: It is.
MARK SPENCER: It is. It's based off of the forensic images of each computer.
MR. CHAKRAVARTY: No objection.
THE COURT: Okay.
(Defense Exhibit No. 3309 received into evidence.)
BY MR. FICK:
MR. FICK: So is it fair to say the left column lists the name of the software, and then the two following columns have each of the computers with check boxes either filled in or not on them?
MARK SPENCER: That's correct.
MARK SPENCER: TrueCrypt is an encryption application which allows you to encrypt or protect either an entire storage device or storage volume or a portion of a device or volume.
MR. FICK: And how powerful or strong is TrueCrypt? How solid is the protection that it provides for anything inside?
MARK SPENCER: If TrueCrypt is used properly, we are unaware of any way to compromise it.
MARK SPENCER: I'm referring to password strength, length and complexity of the password -- passwords generally are used with TrueCrypt -- physical security, meaning you maintain some physical custody of the computer; and just basic practices like not writing your password on a sticky note.
MARK SPENCER: Correct.
MR. FICK: And were there also some folders or volumes that were actually encrypted using TrueCrypt on Tamerlan's Samsung?
MARK SPENCER: There were.
MARK SPENCER: There were three files which represented -- each represented a TrueCrypt volume.
MR. FICK: When you say "volume," inside each volume, then, there can be multiple additional folders and files. Is that fair?
MARK SPENCER: Right. When you access a TrueCrypt volume, it looks essentially like another disk on your computer.
MARK SPENCER: Yes.
MARK SPENCER: The password to all three TrueCrypt volumes was provided by the government, and it also existed in clear text elsewhere on the Samsung computer.
MR. FICK: So the fact that it existed elsewhere just in a text file, is that an example of what you were talking about before, a not-good practice to keep things secure?
MARK SPENCER: Right. We would consider that a poor practice.
MARK SPENCER: AllahuAkbar1.
MARK SPENCER: That's a proxy service, "proxy" meaning it sits between the user and the Internet. And the basic functionality there is to make it more difficult to trace your activity on the Internet.
MARK SPENCER: Correct.
MARK SPENCER: YouTube -- it's against YouTube's policy to download -- normally to download videos, so there's a variety of services online and software products that allow you to circumvent that policy and download the video.
MR. FICK: Why was that something that you chose to break out for the summary in this case? What is it about that software that was of significance to you?
MARK SPENCER: In terms of the data that we were looking at on these computers, we saw quite a bit of both Internet history involving YouTube as well as videos which included "YouTube" in their file names.
MR. FICK: And does that include some of what has been referred to by various witnesses as the kind of jihadi-type material on the computers?
MARK SPENCER: Those are included, yes.
MARK SPENCER: Correct.
MR. FICK: Now, with regard to the Samsung, did you create a summary of files -- audio, visual, multimedia files on the Samsung that have "YouTube" in the file name?
MARK SPENCER: Yes.
MR. FICK: I'm putting up on the screen what's been marked as 3306-14. Is this the summary chart that you created of the -- of those files?
MARK SPENCER: It's a part of it, yes.
MARK SPENCER: Yes.
MR. FICK: And is this based on data that you, as a forensic expert, extracted from the forensic images of the Samsung -- image of the Samsung?
MARK SPENCER: That's correct. This came -- this data came from within the TrueCrypt volumes on the Samsung and outside the TrueCrypt volumes on the Samsung.
MR. CHAKRAVARTY: No objection.
THE COURT: All right.
(Defense Exhibit No. 3306-14 received into evidence.)
BY MR. FICK:
MR. FICK: So this is the first page of that 13-page document of multimedia files on the Samsung that have "YouTube" in the file name. Is that right?
MARK SPENCER: That's correct.
MR. FICK: Okay. And what does it mean that "YouTube" is in the file name? Does that necessarily mean the file came off of YouTube?
MARK SPENCER: No. Many of these services which allow you to facilitate circumventing YouTube's policy relating to downloads, they embed the title, which is going to include a -YouTube in the file name.
MR. FICK: Now, I'd like to show you a document that's already in evidence as Exhibit 3303-10. This is something we've all seen before. Can you remind the jury what this file is, what this chart depicts?
MARK SPENCER: This chart depicts the raw number of hits on domain names from Internet history.
MARK SPENCER: Correct.
MARK SPENCER: Yes.
MR. FICK: Did you -- using the same forensic tools, did you create a similar graph for Tamerlan's Samsung laptop, the 1W3 identified --
MARK SPENCER: Yes. In this case, tool.
MARK SPENCER: NetAnalysis.
MARK SPENCER: I would say relatively common, yes.
MARK SPENCER: Yes.
MR. CHAKRAVARTY: No objection.
THE COURT: All right.
(Defense Exhibit No. 3303-9 received into evidence.)
BY MR. FICK:
MR. FICK: So is this the chart that you created reflecting the Internet history on Tamerlan's Samsung laptop?
MARK SPENCER: Yes.
MR. FICK: And I'm just pulling out the first couple of things here, and then this one in particular. HorizonHobby.com, have you gone on the Internet to see what that website is?
MARK SPENCER: I have.
MARK SPENCER: It looks like a retailer of radio-controlled planes, boats, cars, accessories.
MARK SPENCER: Yes.
MR. FICK: And did you create a summary chart of the browsing history from the Samsung laptop analogous to what you did with the other computers in the case?
MARK SPENCER: Yes.
THE COURT: Is there any objection?
MR. CHAKRAVARTY: No, your Honor.
THE COURT: All right.
(Defense Exhibit No. 3303-005 received into evidence.)
BY MR. FICK:
MR. FICK: So showing you on the screen what's been marked as 3303-005, is that, in fact, a summary of the Samsung browsing history that you were just talking about?
MARK SPENCER: Yes.
MR. FICK: And so, for example, on April 18th of 2013, what's the page title of the page that I've got highlighted there?
MARK SPENCER: "Photos: Boston bombing suspects. CNN.com."
MR. FICK: And just paging through, for example, to page 151 of the history, can you just read the search -- or not the search terms, but the page titles for like the first two of those items here on the screen?
MARK SPENCER: "Browning hi-power pistols, firearms, product family."
MARK SPENCER: "P95 Ruger detail, strip and info, YouTube."
MR. FICK: And then on the next page of the exhibit, read those two search terms for March 4th -- or not search terms, but those two page titles for March 4th, 2013.
MARK SPENCER: "Ruger P95 problems, YouTube"; "Ruger P95 review, YouTube."
MR. FICK: Now, was the Skype communication software also found on the Samsung, Tamerlan's Samsung laptop?
MARK SPENCER: Yes.
MR. FICK: And did you do an analysis to extract some of -- the sort of text-like conversations using Skype on that computer?
MARK SPENCER: Yes.
MARK SPENCER: Yes.
MR. FICK: I'm putting up what's been previously marked as Exhibit 3308-001. What is this document I have here on the screen?
MARK SPENCER: This is a summary of a particular conversation on this day, April 19th, 2012, between these two accounts, via Awliya1500 and KTsarnaev26.
MR. CHAKRAVARTY: No objection.
(Defense Exhibit No. 3318-1 received into evidence.)
THE COURT: All right. Do you want it displayed?
BY MR. FICK:
MR. FICK: Up here at the top, what are the two terms here, the Awliya1500 and KTsarnaev26? What do those represent?
MARK SPENCER: Those are Skype usernames.
MARK SPENCER: Tamerlan Tsarnaev.
MR. FICK: So is that the Skype username that was sort of the active user on the Samsung laptop computer?
MARK SPENCER: Yes.
MR. FICK: And so is this essentially a series of kind of Skype instant messages that went back and forth between those two accounts on April 19th of 2012?
MARK SPENCER: Right, including images.
MR. FICK: So in other words, in addition to sending texts back and forth, you can send images back and forth. Is that fair?
MR. CHAKRAVARTY: I'd object to some of the leading that Mr. Fick is doing. We're moving along but --
THE COURT: It is a little leading, but go ahead.
BY MR. FICK:
MARK SPENCER: Yes.
MR. FICK: Can you read the text that I've just highlighted there from that piece of the conversation?
MARK SPENCER: "I want to eat. And you want an iPhone."
MR. FICK: And the next page of the exhibit, can you read that piece of text that was sent from the Awliya to the KTsarnaev?
MARK SPENCER: "Tell them how hard your life is."
MR. FICK: And does -- the image I've highlighted here also an image that was sent from Awliya to KTsarnaev as part of that conversation?
MARK SPENCER: Yes.
MR. FICK: Moving to the next page of the exhibit, these are also images that were sent as part of that conversation. Is that right?
MARK SPENCER: That's right.
MR. FICK: Now, did you extract a couple of other similar Skype conversations and similarly put them into summary charts like this?
MARK SPENCER: Yes.
MR. CHAKRAVARTY: No objection.
THE COURT: All right.
(Defense Exhibit No. 3318-003 received into evidence.)
BY MR. FICK:
MR. FICK: Now, is this another Skype conversation between the accounts we've been talking about from April 30th of 2012?
MARK SPENCER: It is.
MR. FICK: And are these images that were sent from the Awliya account to the KTsarnaev account on that day?
MARK SPENCER: If you back out of there.
MARK SPENCER: Those are links.
MR. CHAKRAVARTY: Your Honor, again, if we could ask the witness to describe what things are as opposed to Mr. Fick asking -- telling him what they are.
THE COURT: Okay.
BY MR. FICK:
MR. FICK: Let me ask the question a little bit differently. We saw before images that were actually sent. What's going on here? What is actually reflected in this particular Skype conversation that may or may not be different from what was on the previous one we looked at?
MARK SPENCER: These are links to particular YouTube videos.
MARK SPENCER: Being sent from Awliya1500 to KTsarnaev26.
MARK SPENCER: Those are screen shots from the videos.
MARK SPENCER: Yes.
MR. FICK: Showing you a folder that we've identified as Exhibit 33 -- I'm sorry. Wrong one. 3306. Do you recognize the contents of this folder, Exhibit 3306?
MARK SPENCER: I do.
MARK SPENCER: This folder contains derivative spreadsheets and summaries of information from the Samsung laptop; also, folders and files which have been extracted from the forensic image of the Samsung laptop, particular folders; and translations that were provided to me for certain files.
MR. FICK: And with putting aside the translations, are the selected folders and files and the various derivative evidence, the spreadsheets -- are those things that you either created or verified the accuracy of against the forensic image of the Samsung?
MARK SPENCER: Yes. The folder and file extraction is an extraction based on what the user would have access to, which is similar to the summaries that are associated with it.
MR. FICK: And is that -- well, similar, essentially, in structure to the exhibits that we talked about with Mr. Swindon a couple of weeks ago from the various devices the government put in evidence?
MARK SPENCER: Similar, yes.
THE COURT: The entire folder?
MR. CHAKRAVARTY: As noted, your Honor.
THE COURT: Okay. I'll admit it.
(Defense Exhibit No. 3306 received into evidence.)
BY MR. FICK:
MR. FICK: In your analysis of Tamerlan's Samsung, did you take steps to re-create what the user desktop or wallpaper on that computer would look like?
MARK SPENCER: Yes.
MARK SPENCER: We took the forensic image that was obtained from the Samsung laptop, and we booted that forensic image up in what's known as a virtual machine, essentially, a virtual computer. So once it booted, we were able to look at the Windows desktop in a way similar to the user would have if he was sitting in front of a real computer.
MARK SPENCER: Standard technical tools, yes.
MR. FICK: Okay. And so the screen shot or image that you created, is that what the desktop of the Samsung would have looked like sort of the last time it was on?
MARK SPENCER: Very similar to. The relative location of certain objects might be different. The date and time in the bottom right-hand corner of the screen is going to be different. But in terms of which objects are on the screen, imagery, that's going to be the same as what the user saw.
MR. FICK: So I'm going to put on the screen what is in evidence as part of 3306, 3306-001. Is this what you just described, what Tamerlan Tsarnaev's Samsung desktop looked like?
MARK SPENCER: Yes, that's the Windows desktop.
MR. FICK: And what are those sort of boxes of text kind of on the left side of the screen? Like what is that?
MARK SPENCER: Those are Windows 7 sticky notes.
MARK SPENCER: It's a very basic function. It allows you to take -- the user to jot down some notes with some basic formatting and stick them on the desktop.
MR. FICK: And in this case, did you separately extract those texts so that they could be looked at sort of separately as a whole?
MARK SPENCER: We did. We located the sticky notes file itself and extracted out -- they actually have multiple streams of text or multiple copies of text. We extracted out the formatted text for each sticky note.
MR. FICK: So I'm going to put up on the screen now what is in evidence as the first of those sticky notes and the translation of it, 3306-2 and 3306-2A. On the left here, 3306-2, is that the sticky note itself with various Cyrillic and a few non-Cyrillic characters?
MARK SPENCER: Yes.
MR. FICK: I'm just going to ask you to read the portions of the translation here that are in English.
MR. CHAKRAVARTY: Objection, your Honor. There's no foundation to the nature of this translation and the accuracy of it.
THE COURT: It was represented it was already in evidence.
MR. CHAKRAVARTY: It's one thing for it to be in evidence, but another thing for somebody to describe what it is and --
THE COURT: I think if it's in evidence, it can be read.
BY MR. FICK:
MR. FICK: So, anyway, Mr. Spencer, can you please read the English portions of the translation of the sticky note?
MARK SPENCER: "We all belong to Allah, and to him is our return. Join the campaign, whether it's easy or burdensome, and fight in the way of Allah with your possessions and your souls. It is better for you, if only you knew. If they expected easy profit and a light road, then they would have followed you, but the distance seemed too far for them. Repentance, 9:41-42."
MR. FICK: And then you can skip the two things that seem to be vehicle related, and if you could just read the last line for me, please?
MARK SPENCER: "If you help Allah, so he will help you. Muhammad 7."
MR. FICK: So that was sticky note number 1. I'm now going to put on the screen what has previously been admitted as 3306-3 and -3A, the other sticky note. So, again, similarly, is it fair to say this is the sticky note you extracted in Cyrillic letters, right?
MARK SPENCER: Yes.
MARK SPENCER: "If Allah had so willed, he would have taken revenge himself, but he wanted to test some of you by means of others,
(Muhammad, 4).
MARK SPENCER: "He who is fighting, fights for himself. Truly, Allah does not need the worlds. (Al-Ankabut, 6.) "And no one knows your lord's army but him, (Al-Mudassir, 31). "Following the words of almighty Allah, who said: Fight them, Allah will punish them through your hands, will belittle them and will grant you a victory over them, and will heal the breasts of the believers. "And if they turn away, say: It's enough for me to have Allah. There is no god but him. I trust only in him, as he is the lord of the great throne (9:129). "Truth has arrived, and falsehood perished; for falsehood is bound to perishe [sic]. "The one for whom Allah stands will not perish. "Allah says in the Qur'an: Fighting may be imposed on you, even though you dislike it. But you may dislike something which is good for you, and you may like something which is bad for you. Allah knows while you do not know. (Surah-2, Bakara, ayat 216).
MR. FICK: Thank you. And so, again, those are the full texts of what we can only see partially on the screen on the desktop itself. Is that fair?
MARK SPENCER: Yes.
MR. FICK: Now, putting on the screen what is in evidence as 3306-5, what is this document on the screen?
MARK SPENCER: This document provides a summary of what a user -- it's a list of what files and folders a user would see with their default options.
MARK SPENCER: In this case, the Document TrueCrypt volume.
MARK SPENCER: That's correct.
MR. FICK: And so is this what you would see if you had the password and you opened it up? If you were the user, this is what -- the summary of what you would see inside that TrueCrypt volume?
MARK SPENCER: This is the list of files and folders that you would see, right. You would not see, with default settings, the system files, for example, and temporary copies of documents.
MARK SPENCER: Right.
MR. FICK: -- that I just circled on the left here? And then this, for example, that I circled now toward the right, what is that?
MARK SPENCER: That's a PDF document.
MARK SPENCER: Correct.
MR. FICK: So this first page of the exhibit, what -- well, these TrueCrypt folders, these volumes, are they in any kind of hierarchical structure?
MARK SPENCER: They are just like any other folder structure on your Windows computer.
MARK SPENCER: Right. That's the top, or root level, of that TrueCrypt volume.
MARK SPENCER: That's the contents of the folder 2012-02-24 TT.
MR. FICK: So in other words, underneath the top level, there's a folder with the name I just circled there on top, that 2012 number you just read, right?
MARK SPENCER: Right.
MARK SPENCER: Right. These are the files that a user would see, correct.
MARK SPENCER: This is a list of the files in another folder, 2012-07-16 001.
MR. FICK: And if we go back up to the top -- again, we just talked about the contents of the first folder and the second. Is that correct, that I just circled there?
MARK SPENCER: Correct.
MR. FICK: And so moving, then, to the third page of the exhibit, what does this page of the exhibit represent? Or the fourth page of the exhibit. I'm sorry.
MARK SPENCER: Again, this is a list of files that are inside that folder. In this case, they're audio files.
MR. FICK: Okay. And the next -- I'm sorry. When you say "folder," is that a subfolder of the Document TrueCrypt volume?
MARK SPENCER: Yes.
MARK SPENCER: A list of files within this particular folder called the "Hereafter Series."
MARK SPENCER: A list of files within the -- I'm not going to be able to pronounce it -- this folder on the TrueCrypt volume.
MARK SPENCER: Yes.
MARK SPENCER: Another list of files within this particular folder.
MR. FICK: Okay. Now, within -- so is it fair to characterize what we just looked at a summary of the directory structure of the files that are within this particular TrueCrypt volume?
MARK SPENCER: Yes.
MR. FICK: Now, also within 3306, Exhibit 3306, I'm going to put on the screen the exhibit itself with its contents and open up folders and files. What is it that's depicted on the screen right here, this list?
MARK SPENCER: These are folder names.
MR. FICK: And so does each one correspond to the -- well, each of the ones named -- with TC in the title, does that correspond to the two -- or to the three TrueCrypt volumes?
MARK SPENCER: That refers to TrueCrypt. "TC" is short for TrueCrypt.
MR. FICK: So I just want to -- I'm sorry. "Document" is the one we just looked at, the summary, the sort of pictorial summary a few minutes ago, that's the one that's currently highlighted, correct, "Document"?
MARK SPENCER: Correct.
MR. FICK: And so if we go inside, for example -- and we go inside this folder, I'm going to put up on the screen one of these folders, and I'll assign it a separate sub exhibit number. We will call this one Exhibit 3306A. So is this one of the files that we just clicked on and opened from inside this TrueCrypt volume?
MARK SPENCER: Yes.
MR. FICK: I'm going to open another one and assign it the sub number 3306B, and one more and assign it the sub number 3306C. And moving back up a level within, again, the same TrueCrypt volume, I'll open a file and assign it a letter 3306D, and then one more -- one more picture here, 3306E. Again, these are all things that are contained within this one encrypted volume on Tamerlan's Samsung laptop. Is that right?
MARK SPENCER: That's correct.
MR. FICK: I'm now putting on the screen what's been admitted as Exhibit 3306-8. What does this exhibit represent, this sub exhibit?
MARK SPENCER: This is a list of the files and folders that a user would see at the top level of the "Document" -- plural, "Documents" TrueCrypt volume.
MARK SPENCER: Yes.
MARK SPENCER: The file name, yes.
MARK SPENCER: Yes.
MARK SPENCER: This is the contents, a list of files and folders within the "Stuff" folder off of the top or root.
MR. FICK: And so where I just circled at the top of the exhibit, does that sort of represent where in the structure we're looking right now?
MARK SPENCER: Yes.
MARK SPENCER: This is the list of files and folders within the "doc" folder -- subfolder of "Stuff."
MARK SPENCER: A list of files and folders within the "DomAshnee" subfolder of "doc," which itself is a subfolder of "Stuff."
MARK SPENCER: A list of files and folders within the "DomAshnee" subfolder of "doc," which itself is a subfolder of "Stuff."
MARK SPENCER: Again, this is the list of files, in this case within the "Videos" folder, which is underneath "DomAshnee," "doc" and then "Stuff."
MARK SPENCER: Folders within "Lekcii Abu Saad."
MARK SPENCER: Files underneath "Lekciya po knige Abdully."
MARK SPENCER: Yes.
MR. FICK: And this is just more of that same folder? Or actually, I'm sorry. A different subfolder?
MARK SPENCER: Yes.
MARK SPENCER: A list of, again, files from another folder.
MARK SPENCER: Same.
MR. FICK: I'm sorry. When you say "same," it's a distinct folder within -- going further down the structure as reflected on top. Is that right?
MARK SPENCER: A list of files within the folder "Zhadnost."
MARK SPENCER: A list of files and folders underneath the "Nasheed" folder.
MARK SPENCER: A list of files under the "New" folder.
MARK SPENCER: A list of files under the "New Nasheed" folder.
MARK SPENCER: A list of files under the "Said Abu Saas Lekcii" folder.
MARK SPENCER: A list of files under the "Ukaz Fatwa" folder.
MARK SPENCER: A list of files underneath that particular folder.
MR. FICK: And the various names of the files here, these are names of some of the Inspire magazine files we've been looking at at various points in the case?
MARK SPENCER: Yes.
MARK SPENCER: Files within the "Vdokhnovlyai" folder.
MARK SPENCER: Yes.
MR. FICK: Putting up on the screen what's been admitted as 3306-6. And, again, is this the top level of the third encrypted volume?
MARK SPENCER: It is. This is the top level of documents 11, as a user would see it.
MARK SPENCER: That's a list of files within the "al-Makdisi" folder.
MARK SPENCER: A list of files with the "Islamic literature" folder.
MARK SPENCER: A list of files within that particular folder.
MR. FICK: And apart from the TrueCrypt volumes, did you make similar summary exhibits like this for a small handful of other folders on the Samsung?
MARK SPENCER: Yes.
MR. FICK: I'm going to put on the screen what's been admitted as 3306-10. What is this a depiction of?
MARK SPENCER: This is a list of files and folders within "New Folder," which existed on the Windows desktop for the user Umar.
MARK SPENCER: Additional items.
MARK SPENCER: More items.
MARK SPENCER: Yes.
MARK SPENCER: More files.
MARK SPENCER: This is the last page of files.
MARK SPENCER: Correct.
MARK SPENCER: This is the contents as a user would see it of the "RRRR" folder, underneath the folder we were previously in.
MARK SPENCER: Additional files.
MARK SPENCER: Yes.
MR. FICK: Then putting on the screen what has been admitted as 3306-12, what does this summary chart represent?
MARK SPENCER: This is a list of files within the "RealPlayer downloads" folder. That's a subfolder of videos, which itself is a subfolder of "Umar."
MARK SPENCER: Right.
MARK SPENCER: RealPlayer is a multimedia player, similar to, in some ways, Windows Media Player.
MARK SPENCER: That's correct.
MARK SPENCER: This is a list of files and folders within the "Downloads" folder, which is a subfolder off of "Umar."
MARK SPENCER: Additional files in "Downloads."
MARK SPENCER: Additional files.
MR. FICK: And, finally, what's been admitted as 3306-10, putting on the screen, what does this summarize?
MARK SPENCER: The contents of a folder named "New Folder" off of the Windows desktop under the "Umar" folder.
MARK SPENCER: Images.
MARK SPENCER: More images.
MARK SPENCER: More images.
MARK SPENCER: Images.
MARK SPENCER: The final page of images.
MARK SPENCER: The contents of the folder "RRRR" underneath the "New Folder" on the Windows desktop underneath the "Umar."
MR. FICK: And, again, the -- the format of what's included in this folder, what kind of files are these?
MARK SPENCER: Images.
MARK SPENCER: More images.
MR. FICK: The last thing I want to do is just publish very short bits of two more items from inside one of the TrueCrypt volumes.
If I may just have a moment.
I'll mark these respectively as 3306F and G.
(Pause.)
(Audio recording played.)
MR. FICK: So that was a portion of what's marked as 3306F, sub exhibit 3306-F -- not dash F, but F. And then 3306 -- sub exhibit 3306G, again, a small portion to publish.
(Audio recording played.)
MR. FICK: Your Honor, if I may have one moment, I think I'm almost done. In fact, perhaps it makes sense to take the eleven o'clock break.
THE COURT: All right. We'll do that.
COURT CLERK: All rise for the Court and jury. The Court will take the morning recess.
(The Court and jury exit the courtroom and there is a recess in the proceedings at 10:48 a.m.)
(The Court entered the courtroom at 11:22 a.m.)
THE COURT: There's a request for a brief sidebar?