6.Brian Booth — Direct
621 linesMS. HAJJAR: Your Honor, the Government calls Brian Booth.
COURT CLERK: Please raise your right hand.
(Witness sworn/affirmed.)
COURT CLERK: State and spell your name for the record.
BRIAN BOOTH: Brian Booth, B-R-I-A-N B-O-O-T-H.
BRIAN BOOTH, called by the Government, having been first duly sworn, was examined and testified as follows:
DIRECT EXAMINATION BY MS. HAJJAR:
MS. HAJJAR: Good afternoon Mr. Booth.
BRIAN BOOTH: Good afternoon.
MS. HAJJAR: Where do you work?
BRIAN BOOTH: I work for the Federal Bureau of Investigation.
MS. HAJJAR: And what is your title?
BRIAN BOOTH: Information technology specialist/forensic examiner.
MS. HAJJAR: How long have you held that position?
BRIAN BOOTH: I've held that position since 2007.
MS. HAJJAR: Are you a senior forensics examiner?
BRIAN BOOTH: Yes.
MS. HAJJAR: How long have you been a senior forensics examiner?
BRIAN BOOTH: I've been a senior examiner for over ten years now.
MS. HAJJAR: What does it mean to be a senior forensics examiner?
BRIAN BOOTH: There's a certain amount of training that we need. We have tests that we have to go through, and we have to do certain projects, and we have a senior exam that we have to fill out and take part in that's very lengthy. It's about a half a day.
MS. HAJJAR: Are you familiar with the term CART?
BRIAN BOOTH: Yes, I am.
MS. HAJJAR: What does CART stand for?
BRIAN BOOTH: It stands for Computer Analysis Response Team.
MS. HAJJAR: Are you part of a CART team?
BRIAN BOOTH: Yes, I am, in New York.
MS. HAJJAR: What are your responsibilities?
BRIAN BOOTH: As a forensic examiner, my job is to -- to protect and process and present digital evidence for courtroom testimony.
MS. HAJJAR: And when you say digital evidence, do you mean, like, cellphones and laptops, electronic devices?
BRIAN BOOTH: Yes, any kind of electronic device.
MS. HAJJAR: Have you received training in the field of forensic examination of electronic devices?
BRIAN BOOTH: Yes, I have.
MS. HAJJAR: Can you briefly describe to the jury the kind of training you've received?
BRIAN BOOTH: All of our basic training has to deal with A+ and Net+, which is a CompTIA course. Those are all basic computer training courses for technicians. I then had three or four different courses that we had to take within the Bureau. Those were taught down at Quantico. Those are part of our basic Wintel, which is an intel-based processing systems course.
We then have some basic courses after that that are mostly specific just for the way the Bureau runs and how we do our paperwork. Those are all of our basic courses.
MS. HAJJAR: Would you just breakdown what your training involves for the jury, what that means for someone who's a layperson?
BRIAN BOOTH: For the layperson's term, we take any kind of digital media that we get, we take it down to the zeros and ones, and we make sure we forensically handle it very carefully to make sure we don't modify anything that's on that device. It could be your cell phone; it could be your hard drive; it could be a server in a server system. It could be a car, for that matter, because we now do cars. We even make sure that we get all the zeros and ones off of the system, and we save them on the side, and then we're able to review them. We have a case agent that has a chance to even look through this stuff, for what we were working for at the time in the Bureau, and they want what's important and we produce reports for them for courtroom testimony.
MS. HAJJAR: Do you use specialized software to analyze electronic devices?
BRIAN BOOTH: Yes, we do.
MS. HAJJAR: Have you received training in using that software?
BRIAN BOOTH: Yes, I have.
MS. HAJJAR: Do you have an estimate of approximately how many pieces of digital evidence you've reviewed?
BRIAN BOOTH: Thousands.
MS. HAJJAR: Now, in connection with your testimony here today, did you review some electronic evidence?
BRIAN BOOTH: Yes, I did.
MS. HAJJAR: Are you familiar with what a forensic image is?
BRIAN BOOTH: Yes, I am.
MS. HAJJAR: And can you explain that to the jury, what a forensic image is?
BRIAN BOOTH: A forensic image is taking a piece of digital media and what we do is we put it behind a write blocker, which is a device to make sure we don't alter the device in any way. We read the information that's on the digital media and we save it -- what commonly would be referred to in the real world as a type of like a zip file, if you've ever used a zip file to compress data and hold it. A forensic image is a type of a zip file, it's like a container. It holds all the information we get off of the hard drive and we wind up saving it to a file format, which we call an EO1. That's what we use now. It's an EnCase file. I've had extensive training in EnCase and I've used that file system for now pretty much my whole career.
MS. HAJJAR: Does a forensic image contain all the digital material that's on a piece of digital evidence?
BRIAN BOOTH: Yeah, it actually includes more; not just the information from the actual device, but what type of device it is too. And in all of those zeros and ones that we obtain from the device, we look at the geometry of the device. We also put it through what's called a hash algorithm and that's to make sure that the data is exactly the same as the data we're taking off the device.
MS. HAJJAR: When you examine digital evidence, where physically do you work?
BRIAN BOOTH: At 26 Federal Plaza.
MS. HAJJAR: Is there a laboratory that you work in?
BRIAN BOOTH: Yes, we have a CART laboratory.
MS. HAJJAR: And initially, when you first examine a piece of digital evidence, what steps if any do you take to secure the data that's on that piece of evidence?
BRIAN BOOTH: Well, we first make sure that all the evidence that's brought down to us is referred exactly to what's on the evidence sheet that we receive. So we make sure that the numbers aren't -- for some reason they brought the wrong piece of evidence. The next thing we do is we make complete photos of all of our pieces of evidence, and that's just to do a physical verification of all of the items that we have and try to make sure that the state the item came in doesn't get altered in any way on the outside. The next way is now the physical protecting of the item. We use a write blocker, as I said before, and what that is it's an external little block that has a chip on it and what that chip does is that any time you hook a device up to a Windows computer, every time you hook up, say, a flashcard or a USB device to a Windows computer, the first thing Windows wants to do is talk to it and in talking to that thumb drive you have it alters the evidence as it's doing that. So what we want to make sure is nothing happens like that to that device. So we take our device, in this case, I remember it was an external hard drive, we hook up that to our box and then we hook that up to our computer. The computer then can read through the device, while stopping all the writes to the actual hard drive, and we can read all the data off and save it as an EO1 file.
MS. HAJJAR: You're calling it a write blocker; is it fair to say that the software or hardware you're using prevents writing onto that piece of evidence?
BRIAN BOOTH: Yeah. It's really important that we don't alter that evidence at all. We want to make it as pristine also possible and put it back into the evidence vault the same way that we got it. We don't touch it after that. The file that we create from it is the only thing we use after that. So, if for some reason we have a problem with our file, we can always go back to that piece of evidence that we have.
MS. HAJJAR: And do you -- the resulting file, do you sometimes call that a working copy?
BRIAN BOOTH: Yeah. We first make a master copy, we put that into evidence. So now we not only have the original, but we have a master copy, and then the copy we use to make all of these copies we use for our working copy and that we do all our processing on.
MS. HAJJAR: How do you verify that the copies match up?
BRIAN BOOTH: Well, previously I mentioned that we use what's called a hash algorithm, and what that is -- it's a very complex word it sounds like, but it's really quite simple. It's a mathematical equation and what we do is we look at a hard drive, and that's comprised of zeros and ones on this hard drive, that's the data. So every word file that you use, every text message you send back and forth, is comprised of a whole bunch of zeros and ones and what we do is we take this hash algorithm, which I said is a mathematical equation, and send the zeros and ones through it and the result that comes out is a big, long number. Now the thing is, if I had, say, a text file and I changed just one period on that text file, that big long equation that comes out is going to be a different number just by changing one period on that one sheet. So what we use this hash value for is to make sure that if anything gets changed on a hard drive, like a zero to a one on this hard drive, that this whole function that we wind up putting the zeros and ones through would be different and we know something has been changed. So it's our verification.
The one that we use for hash is Message Digest 5, called the MD5 verification, and we use it on everything from hard drives, to folders to just a file. So constantly we use MD5 to verify that files haven't been changed from me burning it onto a disk for you to then later look at, to going back to the original evidence and making sure that what we have as a copy hasn't changed.
(Continued on the following page.)
BY MS. HAJJAR (Continuing):
MS. HAJJAR: I'm going to show you what's in evidence as Government Exhibit 503.
(Exhibit published to the jury.)
MS. HAJJAR: Showing you what's in evidence as 503, Examiner Booth, are you familiar with this item?
BRIAN BOOTH: Yes, I am.
MS. HAJJAR: How do you know?
BRIAN BOOTH: The CART lab puts a sticker on every item that we wind up getting into our lab, and that NYC number is corresponding to one of the items that we wind up taking in and doing an exam on.
MS. HAJJAR: That's the sticker up top here, New York CART Lab, and the NYC number?
BRIAN BOOTH: Yes, it is.
MS. HAJJAR: And this information is also CART information?
BRIAN BOOTH: Yeah. That's the standard practice. We have to put the case number, initials, and a date, and where it's derived from.
And that one is saying part of 1B16, which is the number that the Bureau winds up giving to the item when we receive it.
MS. HAJJAR: That's the 1B16 you're referring to, right down here?
BRIAN BOOTH: Yes, it is.
MS. HAJJAR: Are you familiar with these initials?
BRIAN BOOTH: Yes. That's VD, for Virginia Donnelly.
MS. HAJJAR: And who is Virginia Donnelly?
BRIAN BOOTH: She is my trainee.
So, when I was going through the processing of this case with her, she was actually physically putting her hands and putting the labels and things on the evidence. So, she signs that she had actually seen and handled the evidence.
MS. HAJJAR: And this Government Exhibit 503, this is a Western Digital hard drive; is that right?
BRIAN BOOTH: Yes, it is.
MS. HAJJAR: And there's a serial number there.
You can see at the bottom?
BRIAN BOOTH: Uh-huh.
MS. HAJJAR: Was a forensic image created of that hard drive, Government Exhibit 503?
BRIAN BOOTH: Yes, it was.
MS. HAJJAR: And was the image created using the steps you described to the jury previously?
BRIAN BOOTH: Yes.
MS. HAJJAR: Did there come a time at which you had access to that forensic image?
BRIAN BOOTH: Yes.
MS. HAJJAR: And what, if anything, did you do to analyze Government Exhibit 503, that drive?
BRIAN BOOTH: We take that EO1 file and we use a piece of software called AD Lab, and that's one of the major premier forensic softwares that are out there on the market. Using that software, we're able to categorize all the files that are on the hard drive. We're also able to carve out data that might have been deleted. We're also able to find deleted files that might have been left on the drive. We also can open up ZIP files, see what's inside of those, look inside PDF files and see what's inside of those.
It really helps us to categorize and go through a vast amount of data because this might have been one hard drive, but sometimes we get large, large amounts of data.
MS. HAJJAR: And that Access Data Lab, is that a special kind of forensic software?
BRIAN BOOTH: It's one of the major producers of forensic software right now.
MS. HAJJAR: Do you have training in using this software particularly?
BRIAN BOOTH: Yes. I've been certified to use AD Lab.
MS. HAJJAR: I want to show you what's marked for identification as Government Exhibit 550.
THE COURT: Go ahead.
MS. HAJJAR: Do you recognize this exhibit?
BRIAN BOOTH: Yes.
MS. HAJJAR: What is this?
BRIAN BOOTH: This is a directory tree of what was obtained from the hard drive.
MS. HAJJAR: Your Honor, the Government offers Government Exhibit 550.
MR. DEROHANNESIAN: No objection.
THE COURT: All right. 550 is received in evidence.
(Government Exhibit 550 so marked.)
(Exhibit published to the jury.)
MS. HAJJAR: Thank you, your Honor.
MS. HAJJAR: So, this is 550. Examiner Booth, can you just kind of start at the top?
You see at the top where it says 1B16 WD HD 500GB?
BRIAN BOOTH: Yes.
MS. HAJJAR: What does that refer to?
BRIAN BOOTH: That's the common name that we gave to the image after it was imaged and brought into the system. We like to take common names instead of the EO1 label that we call the file.
We put it in a friendly name so when the case agent reviews and looks at stuff, he'll be able to know that this is Item 1B16 which was marked by us when it came in, and that is a western Digital hard drive, 500 gigabyte.
MS. HAJJAR: When you say friendly names, you mean a nontechical name so the case agent know what you're talking about?
BRIAN BOOTH: Yes.
MS. HAJJAR: Here, the friendly name is 1B16 WD HD 500GB?
BRIAN BOOTH: Yes. The case agent would understand what that means.
MS. HAJJAR: What about 1B16 is the piece of information the case agent will recognize?
BRIAN BOOTH: When we wind up putting things into evidence, they all get associated numbers with them, and it starts out 1B1 in the FBI when you start a case. And every piece of evidence that you add to the evidence chain as it gets bigger, you have bigger numbers.
MS. HAJJAR: "WD," is that Western Digital?
BRIAN BOOTH: Yes.
MS. HAJJAR: And the 500GB is the storage capacity of the device?
BRIAN BOOTH: Yes, it is.
MS. HAJJAR: Looking below that, can you just describe what this -- you called it a "directory tree."
Can you describe what this depicts?
BRIAN BOOTH: The first thing on top, it talks about a partition. A partition is the area of a hard drive that has been sectioned out for use.
If anyone has used a computer before, you usually see what's, like, a C drive. That is one partition on your computer, and that's an area that your computer has been allocated to be able to store something. The lowest level that you can store something is in a partition.
And in this Western Digital, we only had one partition and it's called Partition 1.
MS. HAJJAR: Under Partition 1, do you see Musica Fat32?
BRIAN BOOTH: Yes.
MS. HAJJAR: What does that mean?
BRIAN BOOTH: That's the volume name that was given to that.
So, sometimes we see a "C:" sign. That's the volume name that Windows winds up giving to your main volume when you start up your computer. But if you add, say, a thumb drive, sometimes you'll see, like, a D drive show up. That's a volume name that's been given to that.
Sometimes you can name them whatever you'd like, and, in this case, someone has gone and renamed it to Musica. So, not only would you, say, have a D drive if you plugged this into your computer, possibly, but you'll see Musica pop up because that's what he named the drive.
MS. HAJJAR: What about root?
I'm looking right here, what is "root"?
BRIAN BOOTH: Root would be the lowest place that you can wind up saving data.
So, in root for your local computer at home, that would be your C drive. So, when you look at your C drive on your computer, that's essentially what is called root.
MS. HAJJAR: And these subfolders, some of them have little cross-outs.
Do you know what that signifies?
BRIAN BOOTH: Yes. That means they've been deleted.
MS. HAJJAR: And these plus symbols, does that indicate there are subfolders underneath here?
BRIAN BOOTH: Yes.
MS. HAJJAR: Do you see where it says FLAC Keith and FLAC Library?
BRIAN BOOTH: Yes.
MS. HAJJAR: Do you know what "FLAC" means?
Does that signify anything to you?
BRIAN BOOTH: FLAC is an audio format as far as a naming convention is concerned.
MS. HAJJAR: What kind of audio format?
BRIAN BOOTH: It's an uncompressed audio format.
Like, WMA is a Windows-based audio format, which is very compatible. They are both "lossless," as we call them. They are file formats that don't lose any quality once you save them.
MS. HAJJAR: Are they considered higher quality in terms of the quality of the music than, say, an MP3?
BRIAN BOOTH: They're the best quality you can have. They are CD quality.
MS. HAJJAR: Do you see under here "Monkey Music February 08"?
BRIAN BOOTH: Yes.
MS. HAJJAR: And below that, "Backups," is that -- and below that, BKP Delta Dimension 8300.
The way that this is oriented, are these subfolders underneath Backups?
In other words, do these folders appear inside Backups based on the structure of this directory tree?
BRIAN BOOTH: Yes, they do.
MS. HAJJAR: And I want to direct your attention to "Studies," the folder here.
So, can you just slowly read the folder names that appear below Studies?
BRIAN BOOTH: The first folder is AL122505; the next folder is A11005; the third folder is BJ103005; the fourth folder is D100705; the fifth folder is DF101905; the sixth folder is J101605; the seventh, I think I'm on, is L102805; the eighth is MNP102005; ninth is M0101805; and the next is MSK101905; and the last folder is V110205.
MS. HAJJAR: And the first one up top is 4 -- I want to maybe zoom in on that -- that's 4L, right?
BRIAN BOOTH: Yeah, 4L122505.
MS. HAJJAR: The titles of these folders, do they appear default or custom-made?
BRIAN BOOTH: They don't look like a machine has made them.
MS. HAJJAR: How is that?
BRIAN BOOTH: Well, typical machine names would name something that would go in some sort of an order, and I'm not seeing order. It almost looks like date orders that are being put there with letters in front of them.
MS. HAJJAR: You mean date orders like 4L122505?
BRIAN BOOTH: Yeah.
MS. HAJJAR: Like day, month, year?
BRIAN BOOTH: Looking down at some of the folders, even in the B11 after that, you've got an actual date range in there that appears to be in the folder structure. So, I'm assuming that that's what's being done above.
MS. HAJJAR: When you see up top, My Music, My Pictures, My Videos, are you familiar with software that would automatically create those folders?
BRIAN BOOTH: Yes. This looks under a user data portion of a Windows computer. Usually Windows XP and above, up until 10, have used My DVDs, My Music, My Pictures kind of folders.
MS. HAJJAR: If I were to buy a Windows laptop, it might have folders like that named similar to those?
BRIAN BOOTH: Yes.
MS. HAJJAR: But the folders down here, they are not familiar to you in terms of any kind of software that would create those?
BRIAN BOOTH: They are not standards for Windows at all.
MS. HAJJAR: Now, you mentioned the folders within the V110205 folder, there are two folders under that.
BRIAN BOOTH: I see them.
MS. HAJJAR: The folders above them, though, the ones with letters and numbers that you just read, do they have subfolders too?
BRIAN BOOTH: Yes, they do.
MS. HAJJAR: Why can't you see them on Government Exhibit 550?
BRIAN BOOTH: Well, they haven't been opened to be able to be viewed at this point. This was presented just to see what was underneath one of them, at the last one.
MS. HAJJAR: You created this exhibit, but you only expanded the last folder.
But if you had expanded these, you would see expanded file folders and images within them?
BRIAN BOOTH: Yes.
MS. HAJJAR: In addition to Government Exhibit 550, did you create a folder directory file listing of all the files that are on the Western Digital 1B16 device?
BRIAN BOOTH: Yes. As a standard practice when we create our images, that gets created at the same time, a directory file listing.
MS. HAJJAR: Very generally, did you review the contents of all those files?
BRIAN BOOTH: Yes, I looked at them.
MS. HAJJAR: Were some of them music files?
BRIAN BOOTH: Yes.
MS. HAJJAR: Do you recall any in particular?
BRIAN BOOTH: I remember Genesis.
MS. HAJJAR: And classical music, did you see that?
BRIAN BOOTH: Yes, some child classical music I saw.
MS. HAJJAR: Ultimately, did you prepare certain reports as to the data that was obtained from Government Exhibit 550?
BRIAN BOOTH: Yes.
MS. HAJJAR: Did these reports pertain to specific files within the Western Digital hard drive that the case agents bookmarked for you?
BRIAN BOOTH: Yes.
MS. HAJJAR: Can you explain to the jury what the process is of bookmarking?
BRIAN BOOTH: When a case agent winds up seeing a file structure like this, on the bottom he also sees the files underneath that he can actually choose each of these files that he's seeing and right click and save them as a bookmark.
What that does is it saves that file off under another tab that they can later ask us to create a report for, which will include that file so he can then take it and put it on a disc and take it here to court. We can name those bookmarks whatever we'd like; usually, to reference what we're saving at that point or what wave we're referencing.
MS. HAJJAR: Did the reports you create, did some of them -- did nearly all of them deal with the Studies folder?
BRIAN BOOTH: Yes.
MS. HAJJAR: And the reports dealt with different subfolders underneath the Studies folder?
BRIAN BOOTH: Yes, they did.
MS. HAJJAR: May I show something that's marked just for identification to the witness?
THE COURT: Go ahead.
MS. HAJJAR: I'm going to go show you a series of exhibits starting with a disc that's marked Government Exhibit 505. I'll turn it over for you as well.
Do you recognize this exhibit?
BRIAN BOOTH: Yes, I do.
MS. HAJJAR: Is your name and initials on this disc?
BRIAN BOOTH: Yes, it is.
MS. HAJJAR: And what is the contents of this disc?
BRIAN BOOTH: This is one of the AD Lab reports that I made for the agents that he had bookmarked as Studies folder.
MS. HAJJAR: I'm going to show you what's marked for identification as Government Exhibit 505A.
Do you see that?
BRIAN BOOTH: Yes, I do.
MS. HAJJAR: This is a very large paper document.
Is 505A the same -- is this a printout of the material on the disc that you created?
BRIAN BOOTH: Yes, it is.
MS. HAJJAR: The Government offers Government Exhibit 505 and 505A.
MR. DEROHANNESIAN: May I address at sidebar several items?
THE COURT: Sure.
(Continued on the following page.)
(The following occurred at sidebar.)
MR. DEROHANNESIAN: I'd like to address prospectively some exhibits at once.
This report, as well as some others -- not all -- to which I won't object, have images on them of adults. In addition, there's going to be several offers of adults engaged in sexual acts; sometimes, with my client.
My objection is to the visual representations in this report. I object to the extent they are duplicated again in separate documents. I object that any of the images of the adults involve individuals either not subject of the indictment, not part of the inner circle, lacking a relationship with the charged offense.
They reflect prejudice in that they go more to sexual lifestyle of the accused rather than any count of the indictment. They are excessive because there's over 167 images that will be offered -- I can give you the exhibit numbers -- of these adults. They don't involve the racketeering acts relating to child pornography. They are not necessary to put in; that is, the adult images.
In the case of Lauren Salzman, there's insufficient foundation for images since there was not the opportunity to question her about those images. And they are unnecessarily duplicative also. There's no need for 167 plus the images in the reports.
I will not object to the report and there is, I believe, at least one that doesn't have the images.
(In open court.)
THE COURT: Could I ask that everyone please be seated and quiet? The jury is in the courtroom. It's not appropriate for the jurors to overhear conversations of the gallery.
If I have to ask the question again, everybody goes -- everybody -- out of the courtroom. I've said this before and I'm not going to say it again.
(Sidebar continues.)
THE COURT: The jury is looking right at these people and they're having conversations. One more time, everybody goes, including the reporters. Everybody goes. They can go watch somewhere else. This is number two.
I'm sorry to interrupt you, sir.
MR. DEROHANNESIAN: Do I need to repeat?
THE COURT: No, I heard what you said.
Let me hear from the Government.
MS. HAJJAR: Your Honor, this is critical evidence for the child exploitation charges. It's reports dealing with images in every folder. There are eleven folders, including the folder that contains the child pornography.
We're not going to go through every image, but this contains metadata for all the images in the drive.
THE COURT: How do the images of adults in this situation have relevance to the conduct which is alleged as a racketeering act?
MS. HAJJAR: Basically, your Honor, it establishes the time frame.
So, Lauren Salzman testified these photos were taken of her in 2005. Daniela testified these photographs were taken of her in 2005. The metadata bears that out.
But in addition, your Honor, the type of photographs that are depicted in these folders are exactly the same kind the Defendant later receives as part of DOS. So, it establishes the entire course of conduct, the basis for the means and methods that we've charged, which is that the Defendant obtained, among other things, nude photographs as a means of control and to satisfy sexual desire.
THE COURT: I see.
There's more?
MS. HAJJAR: I'll note also that at least three of the women depicted are first-line DOS slaves; Daniela, Marianna, Pam Cafritz. These are women the jury have heard about.
THE COURT: How much of this are you planning to put in?
MS. HAJJAR: Not much in terms of publication except for the metadata, your Honor, which will be significant. But we don't expect to -- one of the images per folder and we're going to elicit the metadata for those images, but we are admitting all of them.
THE COURT: And the metadata goes to the timing of the receipt of the photographs --
MS. HAJJAR: Yes.
THE COURT: -- into the hard drive?
MS. HAJJAR: Yes, when they were created, which is of significant importance in the case.
MR. DEROHANNESIAN: My objection is not to the metadata, it's to the images. Because they have the metadata is why it's unnecessary to put in images of adults.
DOS doesn't exist until long after that, until 2015 or so. So, it's remote also to try to connect it to DOS. It's the images I'm objecting to, not the metadata.
Again, one of the reports does not have any images, so there's no issue there.
MS. HAJJAR: That's the one with the images redacted because of child pornography. But your Honor, we've set forth in the means and methods for a long-range racketeering conspiracy.
THE COURT: I'm going to see where you're going with it. I'm going to overrule the objection subject to seeing where the testimony goes and how much of it there is.
Next?
MR. DEROHANNESIAN: I'll have this objection on other exhibits. I don't want to have to come back up here.
THE COURT: Go ahead, make your record.
MR. DEROHANNESIAN: It's the same objection that I just made as to other images of adults for the same reason. So, rather than have to repeat it...
THE COURT: You have your exception.
MR. DEROHANNESIAN: To any adult images coming in for the reasons that I said.
THE COURT: Exactly.
Anything else? Thank you.
(Continued on the following page.)
(Sidebar ends; in open court.)
THE COURT: You may continue your examination.
MS. HAJJAR: Thank you, your Honor.
May I publish Government Exhibit 505?
THE COURT: Yes.
MS. HAJJAR: Thank you, your Honor.
(Exhibit published to the jury.)
BY MS. HAJJAR:
MS. HAJJAR: Examiner Booth, you testified that Government Exhibit 505 was one of the reports that you generated in connection with the 1B16 Western Digital hard drive; is that right?
BRIAN BOOTH: Yes.
MS. HAJJAR: And does it contain -- the report, does it contain all of the data in the Studies folder that we looked at or just the subset?
BRIAN BOOTH: Just a subset.
MS. HAJJAR: Your Honor, can I approach the witness?
THE COURT: Yes, you may.
MS. HAJJAR: Examiner Booth, I've handed you a binder. I'd like you to direct your attention to the following Government exhibits which are in that binder: Government Exhibit 508-A through -F, 509-A through -O, 510-A through -O.
THE COURT: Hold on a second.
MS. HAJJAR: Sorry, your Honor.
THE COURT: 508-A through -F. Go on.
MS. HAJJAR: 509-A through -O, 510-A through -L, 511-A through -L, 512-A through -I, 513-A through -P, 514-A through -P, 515-A through -KK, 516-A through -H, 517-A through -O, and 519-A through -HH.
MS. HAJJAR: Examiner Booth, are these images that are also reflected in Government Exhibit 505, the report you created?
BRIAN BOOTH: Yes, they are.
MS. HAJJAR: Your Honor, the Government offers those exhibits into evidence.
THE COURT: Objection?
MR. DEROHANNESIAN: For the issues discussed at sidebar.
THE COURT: Your objections are noted.
Let's go over this. It's 505-A through -F?
MS. HAJJAR: 508-A through -F.
THE COURT: 508-A through -F, 509-A through -O?
MS. HAJJAR: Yes.
THE COURT: 510-A through -L?
MS. HAJJAR: Yes.
THE COURT: 511-A through -L?
MS. HAJJAR: Yes.
THE COURT: 512-A through -I.
MS. HAJJAR: Yes.
THE COURT: 513-A through -P?
MS. HAJJAR: Yes.
THE COURT: And then 514-A through?
MS. HAJJAR: -P.
THE COURT: And then 515-A through?
MS. HAJJAR: -KK.
THE COURT: 516?
MS. HAJJAR: -A through -H.
517-A through -O, and 519-A through -HH.
THE COURT: All right. All those exhibits are admitted into evidence over objection.
(Government Exhibits 508-A through -F, 509-A through -O, 510-A through -L, 511-A through -L, 512-A through -I, 513-A through -P, 514-A through -P, 515-A through -KK, 516-A through -H, 517-A through -O, and 519-A through -HH so marked.)
MS. HAJJAR: Thank you, your Honor.
MS. HAJJAR: I'll show you a disc marked for identification as well, Examiner Booth.
Do you recognize this exhibit?
BRIAN BOOTH: It's not on the screen.
Yes, I recognize it.
MS. HAJJAR: Is there a name and initials on this disc?
BRIAN BOOTH: Yes, there is.
MS. HAJJAR: And what does this disc contain?
BRIAN BOOTH: This was the lab report of the bookmarked items of suspected CP.
MS. HAJJAR: Is this part of 1B16, the Western Digital hard drive?
BRIAN BOOTH: Yes.
MS. HAJJAR: And this is a report you created and a disc you created?
BRIAN BOOTH: Yes, it is.
MS. HAJJAR: The Government offers Government Exhibit 506.
MR. DEROHANNESIAN: No objection subject to the same issue.
THE COURT: Subject to the same issue, yes. Government Exhibit 506 is admitted into evidence.
(Government Exhibit 506 so marked.)
THE COURT: Want to leave it up on the screen for a minute so I can show it to the jury?
(Exhibit published to the jury.)
MS. HAJJAR: This is the report you created, Examiner Booth?
BRIAN BOOTH: Yes, it is.
THE COURT: Go ahead.
MS. HAJJAR: Did you create a redacted report of this as well?
BRIAN BOOTH: Yes, I did.
MS. HAJJAR: I'd like to show you what's marked for identification as Government Exhibit 504.
Do you recognize that exhibit?
BRIAN BOOTH: Yes, I do.
MS. HAJJAR: Is your name on this disc as well?
BRIAN BOOTH: Yes, it is.
MS. HAJJAR: What's on this exhibit, Government Exhibit 504?
BRIAN BOOTH: This is the exact report of the previous one you just showed of another disc, but we've redacted all the images that were on the disc.
THE COURT: All the?
BRIAN BOOTH: All the graphic images.
THE COURT: Any objection?
MR. DEROHANNESIAN: This is 504 or 504-A?
MS. HAJJAR: This is 504.
MR. DEROHANNESIAN: No objection, subject to the issues I raised at sidebar.
THE COURT: Government Exhibit 504 is received in evidence.
(Government Exhibit 504 so marked.)
MS. HAJJAR: Can I show the examiner, the witness, one more thing, your Honor, for identification?
THE COURT: Go ahead.
MS. HAJJAR: This is 504-A, is this the printout of the report that you just -- is this a printout of Government Exhibit 504?
BRIAN BOOTH: Yes, it is.
(Continued on the following page.)
(Continuing.)
MS. HAJJAR: The Government also offers Government Exhibit 504-A.
MR. DEROHANNESIAN: No objections to this one, there are no issues.
THE COURT: There are no issues.
All right, Government's Exhibit 504-A is received in evidence.
(Government's Exhibit 504-A was received in evidence.)
MS. HAJJAR: Your Honor, can we switch the laptop, to be able to show -- to publish Government Exhibit 505?
THE COURT: Sure.
(Exhibit published.)
EXAMINATION CONTINUES BY MS. HAJJAR:
MS. HAJJAR: Examiner Booth, can you describe the reports that you create, are some of them in HTML format and some of them in PDF?
BRIAN BOOTH: Yeah, we produced a report in both formats.
MS. HAJJAR: Why? What's the advantage to having it in HTML format?
BRIAN BOOTH: Just that you can go through a link structure, like a web page, to be able to find more pages of something that you might be -- have interest in. So we don't have to produce everything on one page, which could be too voluminous to scroll through.
MS. HAJJAR: And are there hyperlinks in the HTML formats of certain reports?
BRIAN BOOTH: Yes.
MS. HAJJAR: I'd like to show you what's in evidence as Government Exhibit 505 in HTML format. And is this --
MS. HAJJAR: May I publish it, Your Honor?
THE COURT: To the courtroom?
MS. HAJJAR: Yes, Your Honor.
THE COURT: Go ahead.
(Exhibit published.)
BY MS. HAJJAR:
MS. HAJJAR: And is this what the first page looks like of the hyperlinked version?
BRIAN BOOTH: Yes, it is.
MS. HAJJAR: Okay.
MS. HAJJAR: And if I could click on "Case Information" on the left-hand side.
(Exhibit published.)
MS. HAJJAR: What is shown here?
BRIAN BOOTH: This is the basic case information that's generated from AD Lab Report.
MS. HAJJAR: Okay. And up at the top where it says "Version," can you just describe what the -- what is said up there?
BRIAN BOOTH: That actually tells the reviewer what version of FTK was used; or in this case, AD Lab.
I'll just stress that AD Lab and Forensic Toolkit are synonymously used alike. They are both the same product, it's just one is an enterprise-based product and one not. And in this case it uses both names, AccessData Forensic Toolkit Version 6.31.
MS. HAJJAR: And if we can click on "Evidence List."
(Exhibit published.)
BY MS. HAJJAR:
MS. HAJJAR: What does this show?
BRIAN BOOTH: In the session that we did with AD Lab, we enter all the evidence that's presented to us at the moment. And this shows all the evidence that was presented to us in that session.
MS. HAJJAR: And what does "Display Name" refer to?
BRIAN BOOTH: It is that friendly name that I explained before when we were looking at the file tree, where we try to create a name that the case agent would be able to identify what that evidence item is.
MS. HAJJAR: And so turning to the third item, 1B16 WD HD 500 gigabyte, is that the friendly name you described earlier?
BRIAN BOOTH: Yes, it is.
MS. HAJJAR: In this case, does this report refer to only one of the items in the evidence list?
BRIAN BOOTH: Yes.
MS. HAJJAR: Which one?
BRIAN BOOTH: The 1B16 item.
MS. HAJJAR: And I want to direct your attention, but don't click on the section entitled "Bookmarks."
Can you describe what this shows?
BRIAN BOOTH: As the agent had gone through and reviewed their items, they decided that -- to make bookmarks of things that were under different sub-folders. Each of these bookmarks contain the items that the agent had deemed necessary to place into a bookmark file.
MS. HAJJAR: And are these the same folder names that we were looking at earlier in the directory structure file you -- that you were showing the jury?
BRIAN BOOTH: Yes.
MS. HAJJAR: So that same 4L-122505, et cetera, those were the --
THE COURT: Slow down.
MS. HAJJAR: Sorry, Judge.
BY MS. HAJJAR:
MS. HAJJAR: The 4L-122505 and so on, those folders are ones that are listed on the left-hand side?
BRIAN BOOTH: Yes, they were.
MS. HAJJAR: Now, scrolling down to "File Paths" on Government Exhibit 505, just clicking "File Paths," can you describe what this shows, this page?
BRIAN BOOTH: This is the file directory listing, like I had shown earlier -- or what was shown earlier, that I had produced.
MS. HAJJAR: Okay. And these are the same in terms of the direct -- the structural directory of the -- of the hard drive, this sort of demonstrates the same thing?
BRIAN BOOTH: Yes.
MS. HAJJAR: In here --
MS. HAJJAR: If we could just scroll down a bit.
MS. HAJJAR: -- there are some -- there are lots of extra files, is that right?
BRIAN BOOTH: Yes, there is.
MS. HAJJAR: Can you explain that?
BRIAN BOOTH: Well, when we view the file directory normally, like you do on your C drive, it doesn't show the items that have been deleted or what we call "carved out" also.
Carving out a file allows us to get things that were deleted and lost. So a file might have extra information at the end of it, that when we delete the file we can't just recover by looking at it on our home computers.
Our specialized software can go in and look for those zeros and ones that are associated with, say, graphics or Word files, and carve those things out of the free space, and save them again for us to look at later.
MS. HAJJAR: And so these -- what you see here, "Carved JPEG," "Carved JPEG," can you explain what this is, what we're seeing here?
BRIAN BOOTH: "Carved" and the number "JPEG" is a file that AD Lab was able to find and resurrect. And in doing that, it has to give it a name because these files have been deleted, the names have been lost. So they give it a name, "Carved," along with a file after it that usually goes in order.
So as it finds a file, it will give a new number. And just keep going further down with new numbers.
MS. HAJJAR: And without clicking on these files, are some of them distorted Carve files?
BRIAN BOOTH: Yes, because JPEGs aren't always fully recoverable. So depending on where I found it on the hard drive, you might only get the top part of an image file. Sometimes you might just get a middle section. But mostly, it starts reading for a JPEG from the top down and recovers it in that kind of a format.
So a lot of them when you only find partial, it will only find, say, half of the JPEG picture that we were able to recover.
MS. HAJJAR: What about metadata for Carved files, is there something unusual about that?
BRIAN BOOTH: Well, metadata for Carved files can be found. And sometimes we can just find the metadata without the file, so it's a remnant of a file that's no longer there.
So what metadata is, is information about data. It could be information on who authored your Word document. Things of that nature are called metadata. So it's data about data.
So we are able to recover some metadata that are for files that should be there or were deleted and are no longer there.
MS. HAJJAR: And sometimes are you unable to recover that metadata in full?
BRIAN BOOTH: Unfortunately, yes.
MS. HAJJAR: Let's just scroll down to Folder Mo101805. This is near the bottom.
(Exhibit published.)
BY MS. HAJJAR:
MS. HAJJAR: And, again, Examiner Booth, we're scrolling through.
These are all images that were either recovered from or present in the drive you examined?
BRIAN BOOTH: Correct.
MS. HAJJAR: If we could click on Image 0078 in a new tab.
(Exhibit published.)
BY MS. HAJJAR:
MS. HAJJAR: Okay. So the JPEGs that you -- that are -- do they correspond to a visual image that's accessible in the report?
BRIAN BOOTH: Yes, this is actually the actual item. It forwards you to that item on the disk.
MS. HAJJAR: Okay. So IMG_0078 corresponds to this image?
BRIAN BOOTH: Yes.
MS. HAJJAR: Can we flip back to the report, please?
(Exhibit published.)
BY MS. HAJJAR:
MS. HAJJAR: And so the Carved images, they have different numbers that are immediately underneath IMG_0078?
BRIAN BOOTH: Right.
MS. HAJJAR: Do they correspond to it in some way?
BRIAN BOOTH: They -- they were found in the free space behind the image. So any free space that was behind, and if they could find associated images, say, in what's called slack space or allocated space that's no longer used, it tries to get those images out also. So those are found within the back part of the image file here.
MS. HAJJAR: Can you just very, very generally explain, like, slack space and unallocated space?
Can you just explain what that is in layperson's terms as much as you can?
BRIAN BOOTH: Yeah, if -- if -- think of it as having a library. And where do you store your books in a library -- are on the shelves. But how do you get to them?
And for the older bunch of us there -- that are in this courtroom, you used to use a card catalogue, right? You used to go to a card catalogue to find out where that book is, and then go off to the shelf and find your book.
When a librarian wanted to get rid of a book, how easy it would be just to be able to take the card out and just throw away the card. You would never know where that book is on that shelf, right?
So, essentially, that's what Windows winds up doing. We wind up with Windows just deleting. When we delete a file, it doesn't really get rid of the file. It just goes to that card catalogue, takes the card and throws it away.
Now, it marks that area where that book in their library reference would be. So if you wanted to put a new book up on a shelf and put a new card in, you can do that. But when you go to that library shelf, you are going to find a book there where you want to put your new book. In that instance, you wind up taking out that old book and putting in a new book.
So that's how we wind up carving out all this information. Because the information is still there, it's just that we've lost the location on where it's supposed to be.
MS. HAJJAR: So in that analogy, is the carved JPEG like a lost book, a book that doesn't have a spot?
BRIAN BOOTH: Yes, very -- very closely, yeah. That's a good analogy for it.
MS. HAJJAR: And the third file under there, IMG_0078.exif.html --
BRIAN BOOTH: Yes.
MS. HAJJAR: -- can you explain what that is?
BRIAN BOOTH: That directly relates to the image file, itself. It is a file that is metadata that is embedded within the JPEG image.
So I told you we have these image files, they're called JPEGs. Inside that JPEG there is actually a section at the very beginning of the file that you don't see when looking at the picture, that tells you tons of information.
It could be where you took the picture, if you did it on a camera phone. It could be who authored it. It could be time and date information. It could be lenses that they use, if they used a nice camera. Tons of information is put in there.
MS. HAJJAR: And this particular EXIF, E-X-I-F, file, which is IMG_0078, that corresponds to the JPEG we just looked at?
BRIAN BOOTH: Yes. What AD Lab does is it goes into that image, extracts that data, and saves it in a format that you can view it.
MS. HAJJAR: Before we click on that exif.html file, can you just explain to the jury what EXIF data is?
BRIAN BOOTH: EXIF data is exchangeable image file format. It's a standard. It's been around for quite some time. It was developed over in Japan back in the early 2000s to be able to add extra information to both JPEG files, which are graphic files, and TIFF files, which are also graphic files. One is compressed, one isn't.
But what's important about it is that they're able to use this information mainly for, say, news agencies that have incredible amounts of photos and they need to track, number one, maybe who took the photo, when it was taken, maybe the geolocation of the data that were -- where it was taken. And that's how these news broadcasts are very easily able to go look at -- look for photos and find a whole pool of photos that might have been from one section of town, for instance.
In this case, this EXIF data holds a lot of information about this. And mainly, it's mostly about, say, the author, the photographer, and the dates and times and things like that.
MS. HAJJAR: Is EXIF data considered metadata?
BRIAN BOOTH: Yes, it is.
MS. HAJJAR: And how does EXIF data get captured in an image, in a JPEG, for example?
BRIAN BOOTH: Well, there's multiple ways that can happen. The most common way is for the actual device, whether or not it be a camera or your phone, when you take the picture, the device will actually place that into the JPEG file.
Scanners can do this also. It originally, years ago, was developed for when you use a scanner to actually embed this stuff into a JPEG file.
MS. HAJJAR: Is there something unique about EXIF data?
BRIAN BOOTH: What's interesting about JPEG information with EXIF data is that when you move the JPEG, the information stays within the JPEG. So camera models, things of that nature, they go with it wherever it goes.
MS. HAJJAR: Can you explain that? What do you mean, like, "they go with it," and they stay the same?
BRIAN BOOTH: Well, say you want to put it on a thumb drive and then take it to your friend's computer. Times and dates change as you move across different kind of computers.
If you take it to a Apple computer, and then take it to, say, a Linux, which is a different type of computer, and then take it to your Windows computer, times and dates can change from that movement, depending on whether or not the computers' dates are on or off in different ways, or if someone's backdated a computer, or for some reason, the battery on your computer has been wiped out.
A lot of times we used to turn on old computers and it used to ask us for the date because of the fact that the battery that holds the date and time information had been lost. And then you wind up having to put the new time and date in.
But with EXIF data, once it's embedded in a picture, it doesn't matter how many times you move it around. It stays into that photo and it's very hard to remove. In fact, most commercial software will not touch EXIF data. It will allow you maybe to add data to it, but even in that sense, it's very -- it's very able to be corrupted.
So if you use, say, Photoshop to touch a photo like a JPEG, chances are Photoshop is gonna remove the metadata completely or it's gonna add "Edited by Adobe Photoshop," which is their way of just trying to protect the data from being corrupted.
MS. HAJJAR: But is EXIF -- does EXIF data remain the same when you -- even if you tried to open it in an Adobe product?
BRIAN BOOTH: In that sense, the photo stays the same. The EXIF data might be modified to let you know that you've tried to modify it in an Adobe product.
MS. HAJJAR: Is there a particular reason why EXIF data is more difficult to alter?
BRIAN BOOTH: They purposely designed it that way.
MS. HAJJAR: Do you know --
BRIAN BOOTH: It's mainly to be able to store information. And they don't want data to be moved around and changed, especially time and date information. Those things are very hard for the consumer to be able to modify, unless you wind up getting software that's just developed to do that.
MS. HAJJAR: Can we click on the EXIF.html file for IMG_0078?
(Exhibit published.)
BY MS. HAJJAR:
MS. HAJJAR: What does this page reflect?
BRIAN BOOTH: This reflects the EXIF data obtained from a file called IMG_0078.JPEG.
MS. HAJJAR: And do you see at the top where it says "exif.image.make"?
BRIAN BOOTH: Yes, I do.
MS. HAJJAR: And what is after that?
BRIAN BOOTH: It says "Cannon."
MS. HAJJAR: Okay. And what about "exif.image.model"?
BRIAN BOOTH: It says a "Cannon EOS 20D."
MS. HAJJAR: And what does that reflect?
BRIAN BOOTH: That reflects a model of camera that took the picture.
MS. HAJJAR: Looking down at "EXIF photo date time original," can you read what's -- what's -- what's after that?
BRIAN BOOTH: "2005:10:18 20:33:30."
MS. HAJJAR: What does that reflect?
BRIAN BOOTH: That reflects a date and time format.
MS. HAJJAR: So that's October 18th, 2005?
BRIAN BOOTH: Yes, it is.
MS. HAJJAR: And what about the -- what about right below it, "exif.photo.date time digitized"?
BRIAN BOOTH: That is when the item is actually saved on the card while you're using the camera.
Do you want me to read that?
MS. HAJJAR: Is it exactly the same as the one you read before?
BRIAN BOOTH: It is exactly the same.
MS. HAJJAR: Why is that?
BRIAN BOOTH: Well, because depending on how this -- how fast your camera is, and how you're storing your data, you might see some wedding photographers, they like to hold the camera, but they have a wire coming from it to a little hard drive. And they store some of their pictures on hard drives instead of putting it right in the -- in the camera.
But in this case, this -- this reflects that the time was so quick it didn't have time to register a different second. So this is showing that it's very fast saving the data from the time the picture is taken to the time that it actually gets put on the card.
MS. HAJJAR: But in theory, you could see a little lag time between those two?
BRIAN BOOTH: You possibly could, yes.
MS. HAJJAR: Then I'd like to scroll down to -- sorry, just "EXIF photo flash."
(Exhibit published.)
BY MS. HAJJAR:
MS. HAJJAR: Do you see that? It's two above the long string of digits.
BRIAN BOOTH: Yes.
MS. HAJJAR: What does that reflect?
BRIAN BOOTH: That reflects whether or not the flash has been used or not, and what level it was used at.
MS. HAJJAR: And the other things that are listed here: "Shutter speed value," "aperture value," "exposure bias value," are these features of the image, itself, in the camera?
BRIAN BOOTH: Well, it's where the camera was as it took the picture. So it captured all that kind of information. How fast the shutter speed was moving. How much light it was allowing to go into the lens. How the lens was focused then on at that point. Exposure value, how much -- like I said, how much light is being put into the system at that one point.
It's a lot of data that it winds up saving.
MS. HAJJAR: So all this data is captured at the time that the -- that the image is produced, is that right?
BRIAN BOOTH: Yes.
MS. HAJJAR: It's stamped on the image in some way?
BRIAN BOOTH: Yes, it is.
MS. HAJJAR: Can we scroll down a little bit? There is a lot of data associated with this.
Like, just scroll down to "EXIF Cannon serial number." Just right there above "EXIF Cannon camera info."
BY MS. HAJJAR:
MS. HAJJAR: Do you see "EXIF Cannon serial number"?
BRIAN BOOTH: Yes, I do.
MS. HAJJAR: Can you read that, please?
BRIAN BOOTH: "EXIF Cannon serial number: 1420908348."
MS. HAJJAR: Your Honor, can we switch to the ELMO, please, for a bit?
BY MS. HAJJAR:
MS. HAJJAR: I'd like to show you what's in evidence as Government Exhibit 520.
(Exhibit published.)
(Continued on the following page.)
BY MS. HAJJAR: (Continuing.)
MS. HAJJAR: Showing you what's in evidence already as Government Exhibit 520. It's a little blurry, but do you see that, Examiner Booth?
BRIAN BOOTH: Yes.
MS. HAJJAR: Are you familiar with this?
BRIAN BOOTH: Yes, I am.
MS. HAJJAR: Have you also prepared a report with respect to this camera?
BRIAN BOOTH: Yes.
MS. HAJJAR: Is it a Canon camera?
BRIAN BOOTH: Yes, it is.
MS. HAJJAR: Do you see the serial number there?
BRIAN BOOTH: Yes, I do.
MS. HAJJAR: Could you read it out?
BRIAN BOOTH: 1420908348.
MS. HAJJAR: I'm showing you what's in evidence as Government Exhibit 524.
(Exhibit published.)
BY MS. HAJJAR:
MS. HAJJAR: Have you seen this before?
BRIAN BOOTH: Yes, I have.
MS. HAJJAR: Okay, how do you -- how do you recognize it?
BRIAN BOOTH: I have my initials on it. I examined this card.
MS. HAJJAR: And did you produce a report as well for this card?
BRIAN BOOTH: Yes, I did.
MS. HAJJAR: Your Honor, can I show something just to the witness, please.
THE COURT: Go ahead.
BY MS. HAJJAR:
MS. HAJJAR: I'm showing you what's been marked as Government Exhibit 521. Do you recognize this exhibit?
BRIAN BOOTH: Yes, I do.
MS. HAJJAR: Did you conduct a forensic examination of the data extracted from the camera that I just showed you?
BRIAN BOOTH: Yes, I did.
MS. HAJJAR: What's on this exhibit?
BRIAN BOOTH: These are the images and the files that were contained on the camera card that was presented to me.
MS. HAJJAR: And showing you for identification Government Exhibit 521-A, is this a hardcopy printout of the report on the disk?
BRIAN BOOTH: Yes it is.
MS. HAJJAR: Your Honor, the Government offers Government Exhibits 521 and 521-A.
MR. AGNIFILO: Subject to the issues we addressed.
THE COURT: Yes. Government Exhibits 521 and 521-A are received in evidence.
(Government Exhibits 521 and 521-A received in evidence.)
(Exhibit published.)
BY MS. HAJJAR:
MS. HAJJAR: Now, I would like to show you what's already in evidence -- a portion of what's already in evidence as Government Exhibit 505-A. And I showed you the HTML version. I'm just going to show you the printout at this point. So, these are the studies folders, the folders that we reviewed earlier?
BRIAN BOOTH: Yes, it is.
MS. HAJJAR: Okay. I'm going to turn to page 453 of this exhibit. Now, is that the same -- does this reflect the same image that we were just looking at, IMG_0078?
BRIAN BOOTH: Yes, it does.
MS. HAJJAR: And are there other file attributes associated with this image on this page of the report?
BRIAN BOOTH: Yes. We have the MD5 hash that was generated automatically by AD Lab when I produced the report.
MS. HAJJAR: Let's go through it a little bit. So, first of all, the -- the name at the top, this is the exit data up here. This is the data we were just looking at?
BRIAN BOOTH: Yes.
MS. HAJJAR: And below that, this is the image that it corresponds to?
BRIAN BOOTH: Correct.
MS. HAJJAR: And what is the created date?
BRIAN BOOTH: Created dates are made when an item hits a digital media plot. It's something that could be pulled off the internet when it lands on your hard drive, this could be when you take a picture and it lands on your phone, this could be when you wind up saving something to a thumb drive. So as something gets put onto an item, it gets a created date.
MS. HAJJAR: What's an access date?
BRIAN BOOTH: The access date is the last time you opened it up and viewed something. Whether or not you open up a Word file. You can open it and not look at it or just scan it and not change it and close it, you will get a different access date change.
MS. HAJJAR: And the modified date?
BRIAN BOOTH: The modified date is anytime you've done any type of manipulation to whatever file you're looking at. It will record that.
MS. HAJJAR: Now just to note, the image name, IMG_000078, where does that name come from?
BRIAN BOOTH: There's two methods. One could be developed from whatever source you're making it from. So, your phone, as you're taking pictures, we usually wind up putting DCM maybe or IMG as an initial and then the number of photos as you take photos, it will just keep incrementing them. Or if you want to do it manually, you can make a file name by a certain name if you wanted to.
MS. HAJJAR: And this name is how it appeared on the hard drive?
BRIAN BOOTH: Yes, it is.
MS. HAJJAR: And what accounts -- you see the created date is 2003, modified date '05, access 2010. What accounts for the differences in those dates or what could account for those differences?
BRIAN BOOTH: Well, dates, times, and modified dates, they're all deriving from the operating system, and from the file system of the actual hard drive. As I told you, with our library reference, we have a card catalog that refers back to where we find data. All of this data, that date and times and access times, they're all derived within the computer file system on where things are on the hard drive.
As you move things from one computer to another, if the times are different and they're different types of file systems, they'll get a new created time and if dates are wrong they can be manipulated. So there's times that things can change going from one computer to another. Usually, if anything, it would be the created time that would be changed. Sometimes you can get a created date that's after your modified date, which happens when you just happen to move to a different type of file system later on after you've had the file.
But in this case it's actually reversed. Somehow it got changed to where the date is well, well, before then what might be the first modified date or a modified date.
MS. HAJJAR: You testified that the EXIF data shows the date and time associated with this image is October 18, 2005?
BRIAN BOOTH: Yes.
MS. HAJJAR: And so between the dates here and the EXIF data, what's the best evidence of when this photograph was taken?
BRIAN BOOTH: Well, the best reference is the EXIF data because that gets put into the JPEG file and it's not easily modifiable and it moves with the file the same way from device to device, no matter where you place it. It has nothing to do with the bearing of a file system at all or the dates and times associated with it. So it's on its own, but are created at the same time that you take the picture.
MS. HAJJAR: And does the EXIF data match roughly one of the dates here?
BRIAN BOOTH: Yes, it does.
MS. HAJJAR: Which one?
BRIAN BOOTH: The modified date.
MS. HAJJAR: Now, I would like to look -- you can direct your attention to what's the path here. What does the path reflect?
BRIAN BOOTH: When we looked at earlier and saw the directory file tree and how all the sub-folders moved out, you can see the different folders underneath the files and folders. This is the path on how you would find that data. The same way you would look down the file tree and find the data, this shows it to you in a linear format.
MS. HAJJAR: And so this image is found or located in a folder and I'm just -- this is StudiesMO101805 and then a subfolder; is that right, is that --
BRIAN BOOTH: That's what the slash is, yes.
MS. HAJJAR: And the subfolder is 2005-10180744-20?
BRIAN BOOTH: Yes.
MS. HAJJAR: Okay.
BRIAN BOOTH: Correct.
MS. HAJJAR: And then that's where the file is actually located in this -- in this folder?
BRIAN BOOTH: Yes.
MS. HAJJAR: And so the subfolder date appears to match the EXIF data in this case?
BRIAN BOOTH: Yes, it appears to.
MS. HAJJAR: Examiner Booth you testified about carved images. Could you remind the jury what that is?
BRIAN BOOTH: A carved image is looking at an allocated space that's not currently used by your computer that might have remnants of other files and what AD Lab does is it goes into those allocated areas, but that aren't being used, and looks for JPEGs that might have been remnants that were left from behind -- not just remnants, all different types of files we can do it for.
MS. HAJJAR: I want to show you page 325 of this report. The same report. Can you explain what this reflects?
BRIAN BOOTH: This reflects a carved image that was obtained underneath a TN.4/cache folder area. On the 1B16 drive.
MS. HAJJAR: What does that mean?
BRIAN BOOTH: AD Lab has gone and underneath what's called a subfolder of L102805. It was able to find a file called TN.4/cache and within that cache, we were able to pull out a JPEG.
MS. HAJJAR: Is that -- is that the lost books that have a corresponding card, is that sort of the analogy you were using before?
BRIAN BOOTH: Yes.
MS. HAJJAR: And just looking at this carved image, there's no -- not applicable is what's listed under created date, access date, modified date. Do you know why that might be?
BRIAN BOOTH: As soon as -- if I go back to the library analogy, as soon as you threw that card away, that card might have had the date and time and information of when that book was taken. And now if we just throw the card away to where we find it in the row maybe the book doesn't have all of that information. So in that sense here, we would lose all of that information about a file when it's recovered.
MS. HAJJAR: Is there one thing about the file attributes here that would help you identify that image if you saw it again?
BRIAN BOOTH: Yes, the MD5 hash algorithm would definitely help us find it.
MS. HAJJAR: If you saw another image with the same MD5 hash, how do you know that they're the same?
BRIAN BOOTH: Well, because of the long algorithm that we put all in zeros and ones that we get from that file. We put that through the algorithm and the result is -- it's like a thumbprint. It's something that's very unique to a file. It's akin to a thumbprint.
We use that term all the time. In this sense, it would verify that one file hasn't changed from another file, so if I duplicate this image hundreds of times on a CD and then run the MD5 on that file, it should match the same here and if it doesn't then it's been changed.
MS. HAJJAR: Your Honor, I'm moving to a new topic and I don't know if Your Honor wants to take --
THE COURT: Does the jury want to take a short break? Let's take five minutes and get back to work here.
(Jury exits.)
(In open court.)
THE COURT: You can go.
(Witness steps down.)
MS. HAJJAR: Your Honor, can I just mention one thing?
THE COURT: Yes.
MS. HAJJAR: Your Honor, just two items. The custodian, I believe, is here, Your Honor. Maybe we can just try to get this witness to testify immediately after the break just to get him on and off the stand.
THE COURT: This is the custodian from where?
MS. HAJJAR: From Yahoo, Your Honor.
THE COURT: Any objection?
MR. AGNIFILO: No.
THE COURT: Let's do it.
MS. HAJJAR: The only thing, Your Honor, at this point we do have the photographs, explicit photographs for the jury. We have them in binders and we wanted to ask Your Honor, rather than publishing them to the gallery --
THE COURT: How many of these are you planning on showing to the jury?
MS. HAJJAR: Just one from each folder. So, 11.
THE COURT: You have a folder with 11?
MS. HAJJAR: We have the full folder, Your Honor, with all of the images. I was only going to refer the jury to the 11 that we expect to introduce meta data for.
THE COURT: You're going to give them how many binders?
MS. HAJJAR: We have one binder for each juror with all of the images, but I'll only refer them to where there was testimony on the meta data associated with that image.
THE COURT: So you don't have -- you don't have a binder with the 11 images specifically without anything else?
MS. HAJJAR: No, Your Honor. We prepared the binders exactly as they appeared in the file structure that the Examiner Booth testified to.
THE COURT: I'll ask the jurors only to turn to the pages that you want them to make note of. Do you have one for me?
MS. HAJJAR: Yes, Your Honor.
MR. AGNIFILO: And for the defense?
MS. HAJJAR: Yes.
THE COURT: Absolutely. Anything else?
MS. HAJJAR: That's it, Your Honor. Thank you.
(Recess taken.)
(In open court.)
THE COURT: Let's bring in the new witness, please, from Yahoo.
(Witness approaches.)
THE COURT: All right, let's bring in the jury.
(Jury enters.)
THE COURT: Please be seated. Members of the jury, this is not the forensics individual from the FBI, but a very brief witness who we need to take out of turn by consent of the parties.
So, call your witness, please.