Skip to content
personpersonBrian BoothBrian BoothFBI computer forensic examiner.← All People
WitnessFederal Bureau of Investigation

Brian Booth

FBI computer forensic examiner.

948 lines·12 proceedings·4 mentions

About

Brian Booth testified for the prosecution on Day 22 and Day 23 as an FBI forensic examiner, authenticating digital reports and linking photographs to embedded dates and camera serial numbers. He explained write-blocked copying, MD5 verification, and recovery of deleted images from a Western Digital hard drive. His testimony supplied technical evidence about photograph chronology and camera associations, rather than identifying who took or viewed the images.

On direct examination, Booth read EXIF dates from October through December 2005 and described matching camera serial numbers across examined photographs. He favored embedded EXIF dates over conflicting file-system timestamps. The court provisionally overruled a defense objection to adult photographs, which prosecutors argued helped establish chronology and an alleged course of conduct. On Day 23, photographs in Government Exhibits 518-A through 518-U and EXIF data in Government Exhibit 504-B were admitted without objection; Booth identified November 2 and November 24, 2005 dates.

Cross-examination focused on evidence handling and the limits of those conclusions. Booth said the camera and card arrived in unsealed packaging, he could not power on the camera, and an unavailable computer would have helped reconstruct connections and transfers. He acknowledged inaccurate file-system creation dates and apparent changes to card access dates during FBI possession. He did not know who accessed the card on September 19, 2018, cautioned that access did not necessarily mean viewing, and could not identify users or photographers. Asked about Raniere's knowledge of the images, he said he did not know what Raniere knew.

On redirect, Booth emphasized the greater reliability of embedded EXIF data, reported no attempted EXIF manipulation on the drive, and compared image dates with folder and Photoshop album-file dates. On recross, he agreed that EXIF can be altered and limited his knowledge of an earlier examiner's camera work. Further redirect clarified that the examined images came from a Canon camera, not a social-media company. The court then excused him.

Trial Record (12)

2019 Trial2019 Federal TrialMay 7, 2019 – Oct 27, 2020Called by prosecution

Brian Booth authenticated digital forensic reports and linked photographs to 2005 EXIF dates and a Canon camera. On cross-examination, he acknowledged unreliable file-system dates, apparent card access-date changes during FBI possession, and limits on identifying photographers, users, or Raniere's knowledge of the images.

Day 22

DirectBrian Booth β€” DirectBrian BoothTanya Hajjar1highlightMentioned208lines spoken

Summary

Booth explained photograph metadata and a camera serial-number match, acknowledged conflicting file dates, and authenticated reports. The court provisionally rejected the adult-image objection.

Mentioned in this proceeding.

Highlights (1)

testimony highlightBooth read IMG_0078's EXIF timestamp as October 18, 2005, at 20:33:30. The EXIF serial number and the serial number read from the camera in Government Exhibit 520 were both 1420908348.Open in transcript →

Day 23

CrossBrian Booth β€” CrossBrian BoothPaul DerOhannesian II3highlights95lines spoken

Summary

Booth acknowledged apparent changes to media-card access dates during FBI possession and limits on identifying users or photographers. Two defense evidence-handling records were admitted.

Highlights (3)

admissionBooth agreed that file-system access dates appeared to have changed and, based on the receipt dates, appeared to have changed while the card was in FBI possession. He knew neither who accessed it on September 19, 2018, nor of a record documenting that access.Open in transcript →
testimony highlightBooth did not identify who accessed the digital information or who took the photographs. Asked about digital evidence of Raniere's knowledge of the images, he responded that he did not know Raniere or what he knew.Open in transcript →
Quoteβ€œI don't know Mr. Raniere, so I would never know what he knows.”— Brian BoothBooth answered the question about evidence of Raniere's knowledge with a limitation on his own knowledge, rather than an express conclusion about the absence of digital evidence.Open in transcript →
RedirectBrian Booth β€” RedirectBrian BoothTanya Hajjar2highlights56lines spoken

Summary

Booth emphasized EXIF dates over file-system timestamps, compared folder and album-file dates, and explained the examination notes and replacement camera report.

Highlights (2)

testimony highlightBooth distinguished embedded EXIF data from file-system timestamps and identified EXIF camera serial numbers, dates, and times as the most reliable metadata discussed.Open in transcript →
Quoteβ€œAnd, make no mistake, that's the data that I'm after as a forensic examiner. I can rely on that time and date. I can't rely on the date that someone else put on the files.”— Brian BoothStates Booth's reason for prioritizing embedded metadata over file-system dates challenged on cross-examination.Open in transcript →

Day 26