2.Brian Booth — Cross (Recall, Part 3)
959 linesCROSS-EXAMINATION BY MR. der OHANNESIAN:
MR. DEROHANNESIAN: Good morning. Is it Mr. Booth?
BRIAN BOOTH: Yes, it is.
MR. DEROHANNESIAN: Is that your official title that I should use?
BRIAN BOOTH: You may.
MR. DEROHANNESIAN: Okay, thank you.
In terms of the material you reviewed, is it only your material that you reviewed?
BRIAN BOOTH: Yes.
MR. DEROHANNESIAN: Do you understand my -- did you review any material prepared by anyone else, either from the FBI, any other lab or any other person?
BRIAN BOOTH: Well, I'm a coach. So I actually have a trainee that was with me at the time that was actually putting their hands on, on some of the stuff, as we did it. We did it in tandem.
MR. DEROHANNESIAN: Other than you and your trainee, did anyone else provide you with information concerning the digital items which you examined?
BRIAN BOOTH: No, I did -- everything else was done by hand.
MR. DEROHANNESIAN: And I believe you, on direct, explained that you're dealing with something called "digital evidence," is that the phrase you used?
BRIAN BOOTH: Yes, it is.
MR. DEROHANNESIAN: And is that how you would refer to the information that you have testified about concerning these images?
BRIAN BOOTH: Yes, I would.
MR. DEROHANNESIAN: And your examination of the hard drive would be a forensic examination of that hard drive, correct?
BRIAN BOOTH: Yes, it would be.
MR. DEROHANNESIAN: And the same with respect to the data card, is that correct?
BRIAN BOOTH: Yes, it would be.
MR. DEROHANNESIAN: You were indicating yesterday that you want to be very careful when you examine digital evidence, is that correct?
BRIAN BOOTH: That is correct.
MR. DEROHANNESIAN: Because digital evidence can be altered in the course of examination, correct?
BRIAN BOOTH: Yes, it can.
MR. DEROHANNESIAN: And digital evidence can be damaged in the course of handling, correct?
BRIAN BOOTH: It could be.
MR. DEROHANNESIAN: And digital evidence can be destroyed through improper handling, correct?
BRIAN BOOTH: Correct.
MR. DEROHANNESIAN: And that's why you testified you took special precautions to preserve the digital evidence that you were asked to examine in this case, correct?
BRIAN BOOTH: Correct.
MR. DEROHANNESIAN: In terms of the steps in digital forensics, the first step would be identifying the evidence that you want to collect?
BRIAN BOOTH: Correct.
MR. DEROHANNESIAN: That does not involve you, correct?
BRIAN BOOTH: No, it does.
MR. DEROHANNESIAN: That would be someone in the field who would do that?
BRIAN BOOTH: Well, it depends on how you identify identification, is -- when it comes to me in a lab, I have to identify the item as it is to me in the lab.
MR. DEROHANNESIAN: In terms of the information -- or excuse me.
In terms of the devices to collect, were you involved in that process in this case?
BRIAN BOOTH: No, I was not.
MR. DEROHANNESIAN: And then the next step would be to collect the item, correct?
BRIAN BOOTH: If the meaning of collect, you mean obtaining the digital information off of it?
MR. DEROHANNESIAN: No, to the physical item, the hard drive, the thumb drive, a camera.
You don't collect the physical item from the scene?
BRIAN BOOTH: I am capable of doing that. But in this instance, I have not.
MR. DEROHANNESIAN: And that's my question.
In this case, you did not collect the physical evidence, correct?
BRIAN BOOTH: No, I did not.
MR. DEROHANNESIAN: And you weren't asked to?
BRIAN BOOTH: No, I wasn't.
MR. DEROHANNESIAN: And then the next step would be preserving the digital evidence.
Is that something you were involved with?
BRIAN BOOTH: Yes, it is.
MR. DEROHANNESIAN: And then after you preserve it, you analyze it, correct?
BRIAN BOOTH: Yes.
MR. DEROHANNESIAN: And that's what you did.
And then the final step would be reporting the results of your examination, correct?
BRIAN BOOTH: Yes.
MR. DEROHANNESIAN: And part of collecting the evidence would be placing the evidence in a bag, correct?
BRIAN BOOTH: That's one means.
MR. DEROHANNESIAN: And identifying it or tagging it to identify what it is?
BRIAN BOOTH: Yes.
MR. DEROHANNESIAN: Now, in this case, when you received Government Exhibit 503, the Western Digital drive, was it bagged?
BRIAN BOOTH: I think it was in a paper bag.
MR. DEROHANNESIAN: But you --
BRIAN BOOTH: It was an evidence -- an evidence paper bag that was sealed.
MR. DEROHANNESIAN: Do you have any records or notes, which would reflect the condition of Government Exhibit 503, the Western Digital drive, at the time you received it?
BRIAN BOOTH: Not in front of me, no, I do not.
MR. DEROHANNESIAN: When you say not in front of you, does it exist?
BRIAN BOOTH: We -- we take great care in making sure that we document as we receive items.
MR. DEROHANNESIAN: And what kind of documentation would exist, which relates to your examination of Government Exhibit 503 at the time you received it?
BRIAN BOOTH: Well, we take typewritten notes as we go along, contemporaneously, to make sure that we can recreate any steps that we make during the exam process. So if we need to recreate them or if another examiner needs to recreate them, we can do that.
MR. DEROHANNESIAN: And would those typewritten notes reflect the condition or how you received Government Exhibit 503?
BRIAN BOOTH: Yes, it would.
MR. DEROHANNESIAN: Whether it was a paper or plastic bag?
BRIAN BOOTH: Yes, it would.
MR. DEROHANNESIAN: And whether it was sealed or not?
BRIAN BOOTH: Correct.
MR. DEROHANNESIAN: Do you know, without referring to those notes, whether you received Government Exhibit 503 in a sealed or unsealed bag?
BRIAN BOOTH: From what I recall, it was sealed. We -- we had to open up the seals on all the evidence that we got.
MR. DEROHANNESIAN: And with respect to Government Exhibit 520, the Cannon camera, do you recall if that was in a sealed bag when you received it?
BRIAN BOOTH: No, that -- that was in a box, a cardboard box. And, no, the box, itself, was not sealed at the time.
MR. DEROHANNESIAN: So the Cannon camera, which is Government Exhibit 520, was not in a bag, correct?
BRIAN BOOTH: The Cannon camera was in a Cannon camera bag in a brown paper box.
MR. DEROHANNESIAN: Okay. And was there any seal with respect to the box that the camera was in?
BRIAN BOOTH: Yes, there was a seal on the top of the box. But I understand the camera was used the day before in court and had, at least at that point, been unsealed.
MR. DEROHANNESIAN: Okay. So what date was the camera unsealed?
BRIAN BOOTH: I -- I don't know at that point.
MR. DEROHANNESIAN: Do you have notes that reflect when the box with the camera was unsealed?
BRIAN BOOTH: No, I don't know.
MR. DEROHANNESIAN: Do you have notes and records?
BRIAN BOOTH: My notes reflect what -- how I received the item.
MR. DEROHANNESIAN: And that would reflect the condition of the camera being in an unsealed box when you received it?
BRIAN BOOTH: Yes. I always -- we mention of what the box was in, what color the box was in. Whether it was in a paper bag or if it was in a plastic/cellophane bag, we note that.
MR. DEROHANNESIAN: And do you usually receive electronic evidence in unsealed boxes or bags?
BRIAN BOOTH: Not always. Sometimes the case agents would have needed to look at the item beforehand, and they might have unsealed it. So it doesn't always come to us sealed.
MR. DEROHANNESIAN: And when an agent unseals evidence, a record is made of that?
BRIAN BOOTH: Not always.
MR. DEROHANNESIAN: Should a record be made of when evidence is opened or unsealed?
BRIAN BOOTH: No, I don't think so. It doesn't necessarily need to be.
MR. DEROHANNESIAN: Is it fair to say you have no idea when the box with the camera was unsealed?
BRIAN BOOTH: No, I do not.
(Continued on the following page.)
BY MR. DER OHANNESIAN (Continuing):
MR. DEROHANNESIAN: Would it be fair to say you have no information on what happened to the camera prior to the time that you examined it?
BRIAN BOOTH: Well, with the evidence sheet, we know a path of who has gotten the evidence at any point in between me and it actually being obtained out in the field.
MR. DEROHANNESIAN: And who was it that had access to the camera or the box prior to the time of your examination of it?
BRIAN BOOTH: I don't have that evidence sheet in front of me to be able to refer.
MR. DEROHANNESIAN: If you had that evidence sheet, could you answer that question?
BRIAN BOOTH: Yes, I could.
MR. DEROHANNESIAN: And with respect to Government Exhibit 524, the LEXAR card, was that submitted to you in a bag of some sort?
BRIAN BOOTH: Yeah, it was a cellophane bag.
MR. DEROHANNESIAN: Was it a sealed cellophane bag?
BRIAN BOOTH: No, it was not.
MR. DEROHANNESIAN: Was Government Exhibit 524, LEXAR datacard, in the box?
BRIAN BOOTH: Yes, it was.
MR. DEROHANNESIAN: The box you previously described with the camera?
BRIAN BOOTH: Yes.
MR. DEROHANNESIAN: Was there a separate piece of paper which would identify who, if anyone, had access to that datacard prior to your examination of it?
BRIAN BOOTH: Any time we have a piece of evidence and it obtains other evidence in it -- say you have a laptop and you have a CD-ROM inside. We always package up the extra evidence that we've obtained from the device in with the original evidence.
We don't always modify or change and put it on separate chains. We keep it all together to show that it's reflective of coming through that item. We put a NYC barcode number to identify it as something that came from the parent.
MR. DEROHANNESIAN: The NYC barcode, is that applied by someone like yourself, Mr. Booth, in the CART lab?
BRIAN BOOTH: Yes, it is.
MR. DEROHANNESIAN: That's not applied by an agent in the field.
BRIAN BOOTH: No, it's only by CART examiners.
MR. DEROHANNESIAN: So, only when it gets to CART does that NYC CART number get on the device.
BRIAN BOOTH: Yes.
MR. DEROHANNESIAN: Have you produced your notes and records to the prosecution in this case concerning the condition of these items when you received it?
BRIAN BOOTH: No, I did not.
MR. DEROHANNESIAN: Were you ever asked by the prosecution in this case to produce the notes and records pertaining to your evidence collection and examination in this case?
BRIAN BOOTH: I was asked if I had notes, but, at this point, my notes aren't complete. So, my report is my notes. My report won't be done until all processing is complete, and processing was ongoing up until a couple days ago with some of these items.
MS. HAJJAR: Your Honor, can we have a sidebar?
THE COURT: All right.
(Continued on the following page.)
(The following occurred at sidebar.)
MS. HAJJAR: I just don't want there to be any misunderstanding with the jury. He's saying CART notes. He means the CART examiner under him, Virginia Donnelly, the primary examiner. I don't want there to be a misunderstanding that Mr. Booth -- that these are his notes. I think he's referring to them as CART's notes with respect to the receipt of this evidence and chain of custody.
It's fine if we're moving on, but I don't want there to be a misimpression with respect to that.
MR. DEROHANNESIAN: He said he had notes that would answer these questions. That's the reason they have notes, to know the condition of the evidence. They haven't been produced, and I think the defense is entitled to them, certainly after the direct examination, at least.
And I specifically asked for them this morning because when I read his testimony yesterday, there were other references to there probably may be notes in this case. I didn't realize this existed also. That's why we'd be entitled to that.
And I think there are some important issues and I've only scratched the surface of it. And I didn't realize this problem until a second ago. I think I'm entitled to it, whether his assistant made it or he did.
MS. HAJJAR: We don't have the notes, your Honor. They're Ms. Donnelly's 3500. We can obtain them, but they're not -- he testified yesterday he received the forensic image from Ms. Donnelly and he testified that he was not -- he never said I was the one who imaged the devices.
Those notes that reflect the way that they were obtained by CART are in Ms. Donnelly's possession. If the defense wants to call Ms. Donnelly, we can obtain the notes and we can complete the circle if that's an issue.
MR. DEROHANNESIAN: I'm not asking to call anybody, I want the prosecution to fulfill its obligation under Rule 16, 3500.
And I don't want them to show up later as a response to my cross-examination. I think it's grossly unfair to say oh, we do have evidence, that it was sealed --
THE COURT: You've just been told they don't have that evidence.
MS. HAJJAR: We don't have them currently, but if this is an issue we can ask -- we do not have them, but we can ask Ms. Donnelly if she has the notes, if you'd like them, or call Ms. Donnelly to establish --
MR. DEROHANNESIAN: I think the testimony also referred to photographs, which was my first indication that there may be more than we were given. That's why I checked again last night.
Are there photographs?
MS. HAJJAR: I believe you were provided with photographs through Special Agent Christopher Mills, who photographed every piece of evidence.
MR. DEROHANNESIAN: I'm talking about photographs of his examination.
MS. HAJJAR: What I believe Mr. Booth is saying is that when CART received them, the primary examiner Virginia Donnelly, if she had taken photographs, we don't have them. But if this is an issue, we can call her, we can get that material.
MR. DEROHANNESIAN: Donnelly was identified as a trainee. I do want any notes or photographs that relate to the examination and the condition of the evidence when it was received.
MS. HAJJAR: We can get Ms. Donnelly, your Honor, if this is an issue for the defense.
MR. DEROHANNESIAN: I don't think I need Donnelly, I think I just need the records. I don't think it's Donnelly. He said these are the records that he has that he used and how it's done.
If he has someone assisting him, that's fine, but I think that the testimony that we just received entitles me to receive that material as 3500 material. And it's not speculative and, believe me, it's not irrelevant in this case.
MR. AGNIFILO: I think it's Rule 16 for scientific evidence. I don't think it's a matter of 3500.
Here, we have the right to know under Rule 16 the steps that were taken in the creation of scientific evidence. And it sounds like maybe because this particular account wasn't indicted all that long ago --
I'm not trying to find fault with anybody. We have to protect the record and protect this particular issue.
THE COURT: Maybe we'll take the day off and look for notes. That's where we are.
MS. HAJJAR: That's fine, your Honor.
MR. DEROHANNESIAN: I don't think we need all day.
THE COURT: Really? How do you know where this person is? She may be off today.
Couldn't you have subpoenaed?
You knew who was going to testify.
MR. DEROHANNESIAN: Your Honor, it's not our duty to subpoena. The duty is under 3500 and Rule 16.
THE COURT: Yeah, I know about duties.
MR. DEROHANNESIAN: I specifically asked this morning again when I had a question to the prosecutors. I received no response. It's not like -- as I said, I think there may be photographs based on his testimony on direct.
MS. HAJJAR: Your Honor, this was never raised an issue except for this morning. We're happy to find Ms. Donnelly and see if there were additional photographs. But it's not this witness' 3500 and it's not Rule 16. Whether their CART took photographs that are in the possession of Ms. Donnelly we can certainly find out, but I only heard about this this morning.
MR. AGNIFILO: Just to complete the point, I raised in opening court, I think right after this count was indicted, that we needed all of the Government's materials on this because we were being asked to go to trial in a very short amount of time.
THE COURT: No, no, you weren't asked to go to trial, you insisted ongoing to trial in a short amount of time. Please don't. What we have gone through on this --
MR. AGNIFILO: I'm saying --
THE COURT: The short amount to trial is you made that record that you needed to have a trial immediately. I could have done this in the fall.
MR. AGNIFILO: Your Honor, we haven't --
THE COURT: I mean, really, this accommodated everyone's schedule, not mine.
MR. AGNIFILO: I'm not finding fault with the trial date.
THE COURT: I'm just saying the short amount of trial argument raises the specter of how we were pushed to trial. So, we've tried the case and now let's see if these notes exist.
Send somebody out there -- there are certainly enough people in this room -- to go find them. See if the notes exist. And you can finish the rest of your cross-examination. Let me know before it's over, that's all.
If we can't find the person or the notes don't exist, we'll take it up.
MS. PENZA: Your Honor, may I be excused to try to --
THE COURT: Please.
MS. PENZA: Thank you.
THE COURT: Well, can you talk about something else for a while?
MR. DEROHANNESIAN: Sure.
THE COURT: Great.
(Continued on the following page.)
(Sidebar ends; in open court.)
THE COURT: Please continue.
BY MR. DER OHANNESIAN:
MR. DEROHANNESIAN: Mr. Booth, the records that you refer to in terms of the condition of the evidence when you receive it, do you consider those part of your records that you use in this case?
BRIAN BOOTH: Yes, I do.
MR. DEROHANNESIAN: And in this case, you were working with another individual who was a trainee, correct?
BRIAN BOOTH: Yes.
MR. DEROHANNESIAN: And were the two of you generating notes and information together?
BRIAN BOOTH: Yes, she was typing up the notes. I had to verify the notes that she takes.
MR. DEROHANNESIAN: So, there's not two different sets of notes, one for the trainee and one for you?
BRIAN BOOTH: Well, I did the camera. When I received the camera, I did my own notes on the camera.
MR. DEROHANNESIAN: Were there photographs in this case as you examined the evidence?
BRIAN BOOTH: Yes, I think I definitely made the -- I made my FET take photos of the items as we did them.
MR. DEROHANNESIAN: Have you produced those photos to the prosecution?
BRIAN BOOTH: It's been months. I may have.
Those aren't something that I normally wind up producing. Those are for us to refer to, make sure of the condition of the item when we received it.
MR. DEROHANNESIAN: And the photos would help you do that correct?
BRIAN BOOTH: They could. It's not mandated that we do it, but I do it as a good faith practice.
MR. DEROHANNESIAN: In this case, you took photos to have a record of the condition of the evidence when you received it?
BRIAN BOOTH: I did it in this instance? No, I did not.
MR. DEROHANNESIAN: You had your assistant?
BRIAN BOOTH: I don't know off the top of my head if I had my assistant do it. It was months ago.
MR. DEROHANNESIAN: And do you know the date the evidence was collected in this case?
BRIAN BOOTH: No, I do not.
MR. DEROHANNESIAN: Do you have any information, like a property receipt done at the scene, which would reflect any date as to when the item was collected at a scene?
BRIAN BOOTH: That goes along with the piece of property that you're talking about. So, I'd have to produce that piece of evidence here with the property sheet to be able to tell you.
MR. DEROHANNESIAN: So, you would have that information in front of you when you do the examination. You don't have it here today.
BRIAN BOOTH: No, I do not.
MR. DEROHANNESIAN: One of the concerns -- you talk about a process, which I want to make sure we understand, that you took in this case with the evidence and break it down by particular pieces of evidence.
The first step, you said, was to duplicate the electronic data is that, correct?
BRIAN BOOTH: It's a forensic backup.
MR. DEROHANNESIAN: And by "backup," it's a separate piece of electronic information, correct?
BRIAN BOOTH: Yes, it is.
MR. DEROHANNESIAN: And I think the process you described yesterday, your word was right blocking, correct?
BRIAN BOOTH: We use a right blocker to block the device as we copy it.
MR. DEROHANNESIAN: And a right blocker is a separate device that attaches to the subject computer?
BRIAN BOOTH: Or device.
MR. DEROHANNESIAN: Any device, be it a computer, a thumb drive, a cell phone.
BRIAN BOOTH: Yes.
MR. DEROHANNESIAN: So this right blocker attaches to the subject device, whatever that may be, and wherever you will transfer the information to, correct?
BRIAN BOOTH: Correct.
MR. DEROHANNESIAN: And that's good practice as a forensic examiner?
BRIAN BOOTH: Yes, it is.
MR. DEROHANNESIAN: It's necessary practice.
BRIAN BOOTH: Yes.
MR. DEROHANNESIAN: And did you right block with respect to the datacard which is Government Exhibit 524?
BRIAN BOOTH: Yes, I did.
MR. DEROHANNESIAN: So, right blocking is something you do even with a device which might be the datacard from a camera, correct?
BRIAN BOOTH: Correct.
MR. DEROHANNESIAN: And do you know the date on which you did your right blocking for the Government Exhibit 503, the Western Digital external hard drive?
BRIAN BOOTH: No, I don't know the date off the top of my head.
MR. DEROHANNESIAN: Do you have a record of that?
BRIAN BOOTH: Yes, we'll have a record back at the lab.
MR. DEROHANNESIAN: Is that part of your notes?
BRIAN BOOTH: Yes.
MR. DEROHANNESIAN: And with respect to Government Exhibit 524, I believe you called it a media card; is that your phrase?
BRIAN BOOTH: SD?
BRIAN BOOTH: SD card. I think it's CF card coming from the camera, if I'm not mistaken.
MR. DEROHANNESIAN: You called it CF card?
BRIAN BOOTH: Yes, compact flash.
MR. DEROHANNESIAN: Is that a little, very small --
BRIAN BOOTH: It's a little bigger than a standard SD card that people are used to seeing in the cameras these days. It's a little fatter because it's mainly used for speed. An SD card is usually around the size of your thumb; these cards area a little bigger and they fit into a bigger slot in cameras.
They're really not in use as much anymore.
MR. DEROHANNESIAN: When you say "not in use," because this is a much older product?
BRIAN BOOTH: Yes, and we've moved on since then on SD card capabilities.
MR. DEROHANNESIAN: We have it in evidence, in any event, the size of it and what it is. Maybe while you mention it, we could use it now.
I'd like to show you Government Exhibit 524.
(Exhibit published to the jury.)
MR. DEROHANNESIAN: This is the device that you said what was not in the camera, correct?
BRIAN BOOTH: No, it was not.
MR. DEROHANNESIAN: It was in the box --
BRIAN BOOTH: Yes.
MR. DEROHANNESIAN: -- is your recollection.
And how do you call that?
BRIAN BOOTH: If you turn it over, I think it's a CF card, compact flash, CF. That's the common letters we use to call these cards.
MR. DEROHANNESIAN: And there's a similar device used on modern cameras but it's smaller, more compact, and holds more information?
BRIAN BOOTH: Correct.
MR. DEROHANNESIAN: Do you know the date on which you first examined the Canon camera, Government Exhibit 503?
BRIAN BOOTH: I think it was 6/10 or 6/11.
MR. DEROHANNESIAN: Of what year?
BRIAN BOOTH: Of this year.
MR. DEROHANNESIAN: 2019?
BRIAN BOOTH: Yes.
MR. DEROHANNESIAN: Did you examine the Western Digital drive around the same time that you examined the camera?
BRIAN BOOTH: No. The Western Digital drive was done months ago, from what I recall.
MR. DEROHANNESIAN: And was the media card examined in June of 2019 or at some other time, if you know?
BRIAN BOOTH: I wasn't analyzing a camera at that time.
MR. DEROHANNESIAN: Which time?
BRIAN BOOTH: At that.
MR. DEROHANNESIAN: June 2019?
BRIAN BOOTH: No, we're talking months ago when we first got the Western Digital hard drive. We didn't receive a camera with that.
MR. DEROHANNESIAN: Do you know when you received the camera?
BRIAN BOOTH: I just received it recently.
MR. DEROHANNESIAN: So, your forensic examination in this case took place in different months.
BRIAN BOOTH: Yes.
MR. DEROHANNESIAN: How about different years?
BRIAN BOOTH: Possibly.
MR. DEROHANNESIAN: In terms of the devices you examined in this case, one was, you said, a Western Digital hard drive, correct?
BRIAN BOOTH: Yes, it is.
MR. DEROHANNESIAN: And you were shown that on direct examination, correct?
BRIAN BOOTH: Yes.
MR. DEROHANNESIAN: Ms. Hajjar, the Western Digital drive?
(Exhibit published to the jury.)
MR. DEROHANNESIAN: Can you see this well enough to identify this as the drive that you examined?
BRIAN BOOTH: Yes, I can.
MR. DEROHANNESIAN: And this is the sticker here that you indicated is applied at the CART lab, correct?
BRIAN BOOTH: Correct.
MR. DEROHANNESIAN: This device has no markings on it when it's collected at the scene, correct?
BRIAN BOOTH: I am sure they put some markings. Possibly if they put it in a bag, they put markings on the outside of the bag.
MR. DEROHANNESIAN: I'm talking about on the device.
BRIAN BOOTH: No, not other than these that I know of, no.
MR. DEROHANNESIAN: This one you received in a sealed bag, correct?
BRIAN BOOTH: Yes.
MR. DEROHANNESIAN: Does this look like the bag you got it in?
(Exhibit published to the jury.)
BRIAN BOOTH: Yes it does.
MR. DEROHANNESIAN: This tells you the date that the agent may have collected it, March 27?
BRIAN BOOTH: Yes.
MR. DEROHANNESIAN: You said there was no sealed bag for the camera, correct?
BRIAN BOOTH: No. It was a box that I received it in.
MR. DEROHANNESIAN: And there was no sealed bag for the LEXAR card, correct?
BRIAN BOOTH: I don't recall it being sealed.
(Exhibit published to the jury.)
MR. DEROHANNESIAN: This hard drive, this cannot be accessed without being connected to another device, correct?
BRIAN BOOTH: Correct.
MR. DEROHANNESIAN: It's like a thumb drive; by itself, you can't just look at what's on it without connecting it with something, correct?
BRIAN BOOTH: Correct.
MR. DEROHANNESIAN: Now, you mentioned a LaCie hard drive, correct, LaCie?
BRIAN BOOTH: I don't recall mentioning a LaCie hard drive. Unless you're talking about in other pieces of evidence --
MR. DEROHANNESIAN: Ms. Hajjar?
(Exhibit published to the jury.)
MR. DEROHANNESIAN: Very quickly, can you read Exhibit 560 on it?
BRIAN BOOTH: Government Exhibit 560.
MR. DEROHANNESIAN: And see on the back there's a CART signature?
BRIAN BOOTH: Yes, I do.
MR. DEROHANNESIAN: Are those your initials?
BRIAN BOOTH: No, those are Virginia Donnelly's initials.
MR. DEROHANNESIAN: That date of 9/11/18, what is that?
BRIAN BOOTH: That's the date that she had received the evidence and did a physical query of it to make sure she had serial numbers, things of that nature.
MR. DEROHANNESIAN: Does that mean it was examined on that date or not?
BRIAN BOOTH: That's when the examination starts.
(Exhibit published to the jury.)
MR. DEROHANNESIAN: On this card here, Government Exhibit 524, there's a date of -- can you read it?
BRIAN BOOTH: 2/22/19.
MR. DEROHANNESIAN: Is that when you first examined?
BRIAN BOOTH: No, that's not.
MR. DEROHANNESIAN: What was the date you first examined this card?
BRIAN BOOTH: I have my initials on there and it's 6/10 of 19 and 11. Sorry, I couldn't tell from the tint.
MR. DEROHANNESIAN: Is this what you're referring to?
BRIAN BOOTH: Yes.
MR. DEROHANNESIAN: It says 6/10/19?
BRIAN BOOTH: Yes.
MR. DEROHANNESIAN: And your initials?
BRIAN BOOTH: Yes.
MR. DEROHANNESIAN: On February 22, 2019, what happened?
BRIAN BOOTH: Those are initials of Steven Flatley.
MR. DEROHANNESIAN: Who is Steven Flatley?
BRIAN BOOTH: He's another senior examiner at our lab.
MR. DEROHANNESIAN: Mr. Flatley examined this?
BRIAN BOOTH: He had received it on the 2/22 of 19, I see.
MR. DEROHANNESIAN: We'll come back to this card.
There were other items that you examined too that are in the reports that were placed in evidence by the prosecutor that you testified about?
BRIAN BOOTH: Yes.
MR. DEROHANNESIAN: You understand my question?
BRIAN BOOTH: Yes I do.
MR. DEROHANNESIAN: This is Government Exhibit 504-A.
(Exhibit published to the jury.)
MR. DEROHANNESIAN: Can you read that okay?
BRIAN BOOTH: I can read it.
MR. DEROHANNESIAN: The evidence list is where you indicate the items that were examined by the CART lab?
BRIAN BOOTH: Yes.
MR. DEROHANNESIAN: Standard practice is what you did here, to list everything; is that correct?
BRIAN BOOTH: This is something that's -- it's not standard, it's what AD Lab does for all evidence items that you put into it.
MR. DEROHANNESIAN: Again, AD Lab is a software used by forensic examiners?
BRIAN BOOTH: Yes, it is.
MR. DEROHANNESIAN: So, the first device here says Western Digital external drive; do you see that?
BRIAN BOOTH: Yes, I do.
MR. DEROHANNESIAN: Is that the external drive -- is that the Western Digital hard drive that you testified about on direct examination?
BRIAN BOOTH: No, it is not.
MR. DEROHANNESIAN: That's a separate Western Digital device, correct?
BRIAN BOOTH: Yes.
MR. DEROHANNESIAN: And the reason you know that's not the one that you testified about is the serial number?
BRIAN BOOTH: Yes, plus the NYC sticker that we assign it.
MR. DEROHANNESIAN: And then the next item is a LaCie external hard drive.
Is that the LaCie drive we just looked at?
BRIAN BOOTH: I believe it is. I'd have to look at the NYC sticker, but I think that's the only LaCie thing that we have in this list.
MR. DEROHANNESIAN: I'll put it up here for you.
(Exhibit published to the jury.)
BRIAN BOOTH: 23726, yes, I think that does match.
MR. DEROHANNESIAN: Third item is a Western Digital external hard drive?
BRIAN BOOTH: Yes, I see that.
MR. DEROHANNESIAN: Is that the Western external drive that you examined and testified about on direct examination?
BRIAN BOOTH: Yes, it is.
MR. DEROHANNESIAN: And the next item is a USB drive. I'll turn it over.
Have you read it?
BRIAN BOOTH: Yes.
MR. DEROHANNESIAN: Identified as a Toshiba drive, correct?
BRIAN BOOTH: Correct.
MR. DEROHANNESIAN: Next device is a tower.
Is "tower" a brand name?
BRIAN BOOTH: No, that's just a description that we gave to the device.
MR. DEROHANNESIAN: So, "tower" would be like a computer tower?
BRIAN BOOTH: I would have to reference that with something else, but this is the hard drive that was obtained. Her description was "tower hard drive."
MR. DEROHANNESIAN: Whose description?
BRIAN BOOTH: Virginia Donnelly's, as she was typing it in.
MR. DEROHANNESIAN: As you look at this report, Exhibit 504-A, do you know what kind of device "tower" is here?
BRIAN BOOTH: Not off the top of my head.
MR. DEROHANNESIAN: It's identified as being 500 gigabytes?
BRIAN BOOTH: Yes, it's a hard drive of 500 gigabytes. That, I know for sure.
MR. DEROHANNESIAN: Then there's a LaCie external of 500 gigabytes?
BRIAN BOOTH: That's the one you showed before.
MR. DEROHANNESIAN: That's the one I showed you.
And on the first page, I had referenced the LaCie external one terabyte. Is that a different device?
BRIAN BOOTH: It has to be a different device, yes.
MR. DEROHANNESIAN: Can you tell by looking at the lab sticker?
BRIAN BOOTH: Yes, because this one is 23730 and the other one matched the one that you showed me.
(Exhibit published to the jury.)
BRIAN BOOTH: This is 726 and we just got to the 722.
MR. DEROHANNESIAN: As with the Western hard drives, there were two LaCie drives.
BRIAN BOOTH: Yes.
MR. DEROHANNESIAN: You can't tell just by looking at a device, correct?
BRIAN BOOTH: Usually not. That's why we put the sticker on.
MR. DEROHANNESIAN: That's why you take the steps you do, so you know what LaCie we're talking about, correct?
BRIAN BOOTH: Correct.
MR. DEROHANNESIAN: And then the next device was a USB, 120 gigabytes; do you see that?
BRIAN BOOTH: Yes.
MR. DEROHANNESIAN: That was examined in this case?
BRIAN BOOTH: Correct.
MR. DEROHANNESIAN: And then a compact flash card?
BRIAN BOOTH: Correct.
MR. DEROHANNESIAN: Is that compact flash card the same as Government Exhibit 524?
BRIAN BOOTH: No, it is not.
(Exhibit published to the jury.)
MR. DEROHANNESIAN: So, on this report, the LEXAR drive, Government Exhibit 524, is not referenced, correct?
BRIAN BOOTH: No, it's not.
MR. DEROHANNESIAN: Now, in terms of the JPEG images that you testified about, what's the rough size of a JPEG image?
BRIAN BOOTH: JPEGs can get very large in size.
MR. DEROHANNESIAN: How about the ones you examined in this case?
BRIAN BOOTH: I wasn't referencing the size, to tell you the truth.
MR. DEROHANNESIAN: Is that something that's a gigabyte?
BRIAN BOOTH: Could be.
MR. DEROHANNESIAN: Do you know how many images were on the, let's say --
BRIAN BOOTH: There were over 200 on the CF card. I know that.
MR. DEROHANNESIAN: The CF card being Exhibit 524?
BRIAN BOOTH: Yes.
MR. DEROHANNESIAN: Is that total images?
BRIAN BOOTH: There are close to 300 images, I think, in total with card space that I recovered.
(Exhibit published to the jury.)
MR. DEROHANNESIAN: And you said this card was -- I think it says it on it -- two gigabytes?
BRIAN BOOTH: Yes.
MR. DEROHANNESIAN: And how many gigabytes in a terabyte?
BRIAN BOOTH: How many gigabytes?
BRIAN BOOTH: A thousand megabytes equal a gig. A thousand gigs equal a terabyte.
MR. DEROHANNESIAN: So, a terabyte would be a lot of information?
BRIAN BOOTH: Yes, quite a bit.
MR. DEROHANNESIAN: And if you want me to show you these for this question, I will.
Do you know about how much digital data was in the devices that were examined referenced in Exhibit 504?
BRIAN BOOTH: As far as raw data, you're talking about?
MR. DEROHANNESIAN: Space.
Does my question makes sense, first of all?
BRIAN BOOTH: It makes sense, but not in the way that we use it in forensics. We usually don't look at the amount of data that's roughly on a drive because we also could do compression when we wind up imaging files on our hard drives. We like to compress them down so they don't take as much space on the network as we're working with them.
So, unless I was actually asked to do an audit on the amount of total space that was used on a hard drive, I wouldn't have those numbers here with me.
MR. DEROHANNESIAN: Let me approach it this way: The first device had one terabyte of information?
BRIAN BOOTH: Yes.
MR. DEROHANNESIAN: The second device had one terabyte?
BRIAN BOOTH: Correct.
MR. DEROHANNESIAN: The third device had 500 gigabytes?
BRIAN BOOTH: Correct.
MR. DEROHANNESIAN: Half a terabyte?
BRIAN BOOTH: Yes.
MR. DEROHANNESIAN: Next device had four gigabytes?
BRIAN BOOTH: Yes.
MR. DEROHANNESIAN: Next device had 500 gigabytes?
BRIAN BOOTH: Yes.
MR. DEROHANNESIAN: Next device had 500 gigabytes?
BRIAN BOOTH: Yes.
MR. DEROHANNESIAN: Half a terabyte, correct?
BRIAN BOOTH: Correct.
MR. DEROHANNESIAN: The next device, 120, that's the capacity of the device, right?
BRIAN BOOTH: Capacity, yes.
MR. DEROHANNESIAN: That's what all these numbers I'm referring to on this exhibit are the capacity, right?
BRIAN BOOTH: Correct.
MR. DEROHANNESIAN: All the devices that we just went through on Exhibit 504-A were forensically examined by the Federal Bureau of Investigation?
BRIAN BOOTH: Yes.
MR. DEROHANNESIAN: And report was generated with respect to those devices?
BRIAN BOOTH: No, a report wasn't generated on those devices. Only on 1B16 was a report generated, that I know of.
MR. DEROHANNESIAN: If you felt there was anything of value to the investigators and prosecutors, you would have generated report on those cases?
MS. HAJJAR: Objection.
THE COURT: You may answer.
BRIAN BOOTH: If the case agent had asked for anything that he found of interest on any of the drives, a report would be generated from them.
MR. DEROHANNESIAN: Did you refer in your direct testimony to a Dell Dimension computer?
BRIAN BOOTH: I didn't refer. I think I saw the file path that indicated a Dell Dimension.
MR. DEROHANNESIAN: Was that file path on all of the images about which you testified on direct examination?
BRIAN BOOTH: No.
MR. DEROHANNESIAN: Do you know which ones the Dell Dimension was not associated with?
BRIAN BOOTH: I don't have any reference to that on any of the other devices we have.
MR. DEROHANNESIAN: Do you know on which images the Dell -- do you know on which images to which you testified the Dell Dimension computer was associated?
BRIAN BOOTH: 1B16 was the one that we saw a file path that mentioned a Dell Dimension.
MR. DEROHANNESIAN: What is 1B16?
BRIAN BOOTH: It is an external Western Digital hard drive.
MR. DEROHANNESIAN: So, the Western drive which is in evidence as Government Exhibit 503 was associated with a Dell Dimension computer?
BRIAN BOOTH: I have the file path that references a Dell Dimension. As far as an association, I can't make that determination because I don't have a Dell Dimension to refer back to, which would have been plugged into it.
MR. DEROHANNESIAN: That's my next question: You didn't have a Dell Dimension computer to look at, correct?
BRIAN BOOTH: No, I did not.
MR. DEROHANNESIAN: That's why there are certain things you can't tell when you don't have that Dell Dimension computer, correct?
BRIAN BOOTH: Exactly.
MR. DEROHANNESIAN: Do you have any knowledge of that Dell Dimension computer existing anyplace?
BRIAN BOOTH: We've done a query over all the devices that were actually gathered at the scene, and I asked the case agent federal come across any Dell Dimension -- and the model number is referred to in there -- and we've come back as not having that device.
MR. DEROHANNESIAN: So, the absence of the Dell Dimension computer was a topic of your discussion with the case agents, correct?
BRIAN BOOTH: Yes, it was.
MR. DEROHANNESIAN: Because you would have liked to have had that, correct?
BRIAN BOOTH: Definitely.
MR. DEROHANNESIAN: And it would help you in rendering opinions in this case, correct?
BRIAN BOOTH: Yes.
MR. DEROHANNESIAN: And when you talk about the evidence collected in this case, you're referring to all the evidence collected in this case of an electronic nature, correct?
BRIAN BOOTH: Yes.
MR. DEROHANNESIAN: Not just that one location, correct?
BRIAN BOOTH: Well, I wouldn't know the locations, I'm just noting what evidence is referred to in this case that the case agent might have access to.
MR. DEROHANNESIAN: So, you aren't limiting it to just the residence or a TAIL drive where a device was located, you just said, Is there any Dell Dimension collected in this case?
BRIAN BOOTH: Yes.
(Continued on the following page.)
(Continuing)
MR. DEROHANNESIAN: The Canon camera, which we haven't looked at yet together, let me first show you an exhibit number for the record, Exhibit 520.
(Exhibit published.)
BRIAN BOOTH: I see.
MR. DEROHANNESIAN: And I know you referenced a serial number. Is there a date of manufacturer for this item?
BRIAN BOOTH: Not that I see.
MR. DEROHANNESIAN: Did you look into what the date of manufacture was?
BRIAN BOOTH: I didn't. I know my case agent has. Not the actual manufacturer of it, but when the lot was normally developed at this time, from what I understand.
MR. DEROHANNESIAN: You don't have that? You don't know what it is?
BRIAN BOOTH: No, I don't.
MR. DEROHANNESIAN: So you don't know how long this camera has been in this world; correct?
BRIAN BOOTH: In production or just when they made this model camera specifically?
MR. DEROHANNESIAN: When they made this camera or when this model was in production.
BRIAN BOOTH: I know it was in production back right before 2005 or sometime.
MR. DEROHANNESIAN: You don't know whether it was 2004, 2003?
BRIAN BOOTH: No, I don't.
MR. DEROHANNESIAN: 2002.
BRIAN BOOTH: No.
MR. DEROHANNESIAN: Canon EOS has been around a long, long time?
BRIAN BOOTH: Oh, EOS cameras definitely have, yes.
MR. DEROHANNESIAN: Back to the 1980s?
BRIAN BOOTH: Yes.
MR. DEROHANNESIAN: This one has a battery?
BRIAN BOOTH: Yes, it does.
MR. DEROHANNESIAN: Did you examine the battery?
BRIAN BOOTH: The battery is not charged and we try to do a little trick where we try to boost the battery to try to allow it to take a charge, and I attempted that, and the battery wouldn't take a charge.
MR. DEROHANNESIAN: Is that what happens to batteries when the device isn't used for a long period of time?
BRIAN BOOTH: Yes. If they're not continuously charged, they can lose charge completely, and then they're not recoverable.
MR. DEROHANNESIAN: And with respect to Exhibit 520, what, if any, forensic examination did you conduct?
BRIAN BOOTH: Of the camera itself besides the physical looking at the camera?
MR. DEROHANNESIAN: Right.
BRIAN BOOTH: That was it.
MR. DEROHANNESIAN: There was no internal examination of this device; correct?
BRIAN BOOTH: I wasn't able to power it up.
MR. DEROHANNESIAN: On the same exhibit, 520, looking at the side here. You see where it says open?
BRIAN BOOTH: Yes.
MR. DEROHANNESIAN: Do you know what that is?
BRIAN BOOTH: That is a slot for a CF card.
MR. DEROHANNESIAN: That would presumably where Exhibit 524 goes?
BRIAN BOOTH: Yes.
MR. DEROHANNESIAN: And again, 524 cannot be used without a device; correct?
BRIAN BOOTH: Correct.
MR. DEROHANNESIAN: It has to be attached to something?
BRIAN BOOTH: Yes.
MR. DEROHANNESIAN: A camera would be one device it could be attached to?
BRIAN BOOTH: Yes.
MR. DEROHANNESIAN: But there were other external devices to which 524 could be attached; correct?
BRIAN BOOTH: Yes.
MR. DEROHANNESIAN: You earlier said that you asked the case agent or agents in this case about the Dell Dimension computer?
BRIAN BOOTH: I asked if there was any reference to a Dell Dimension in, I think the exact model number that was stated.
MR. DEROHANNESIAN: And who do you mean by -- what is the name of that agent or agents that you asked?
BRIAN BOOTH: Mike Lever.
MR. DEROHANNESIAN: And when you were asking about this Canon camera, and some historical information or biographical information about the camera, who was the case agent that you spoke to?
BRIAN BOOTH: That was the same case agent.
MR. DEROHANNESIAN: Any other agents besides Michael Lever?
BRIAN BOOTH: No.
MR. DEROHANNESIAN: Now, are you the first representative of the FBI to examine the Government Exhibit 503, the Western Digital drive?
BRIAN BOOTH: Yeah, from what I know, yes. I was the only person --
MR. DEROHANNESIAN: Are you the first person in the FBI --
BRIAN BOOTH: -- besides -- besides my trainee with me.
MR. DEROHANNESIAN: Which would be at or about the same time?
BRIAN BOOTH: At the same time. We were sitting together.
MR. DEROHANNESIAN: And with respect to Government Exhibit 520, the Canon camera, would you be the first representative of the FBI to look at the camera?
BRIAN BOOTH: No, I was not.
MR. DEROHANNESIAN: Who would be the first person?
BRIAN BOOTH: Stephen Flatley.
MR. DEROHANNESIAN: And Stephen Flatley, is that the person whose initials are on Government Exhibit 524?
BRIAN BOOTH: Yes.
MR. DEROHANNESIAN: And I think that was February 22, 2019.
BRIAN BOOTH: If I was going by his sticker, yes.
MR. DEROHANNESIAN: Should we look at the sticker of the camera to see if it's the same date?
BRIAN BOOTH: Well --
MR. DEROHANNESIAN: Let's look at Exhibit 520.
Is there anything on the camera that tells you when this was first examined by the representative of the FBI?
BRIAN BOOTH: No. The evidence sheet would show the date that Stephen actually got it.
MR. DEROHANNESIAN: So there's nothing on the device; correct?
BRIAN BOOTH: No.
MR. DEROHANNESIAN: And this doesn't have a bag, plastic or paper, with any markings on it to look at either; right?
BRIAN BOOTH: No, it's got a box.
MR. DEROHANNESIAN: A box?
BRIAN BOOTH: Yes.
MR. DEROHANNESIAN: And the box would have -- would that have when Mr. Flatley looked at it?
BRIAN BOOTH: It would have when he received it. With the evidence sheet, that always goes along with our evidence.
MR. DEROHANNESIAN: May I approach the witness, Your Honor.
No, I can put it on the screen just for the witness.
THE COURT: Just one moment.
Go ahead.
MR. DEROHANNESIAN: I'm going to show you what's been marked Defense Exhibit 945.
MR. DEROHANNESIAN: Do you recognize this?
BRIAN BOOTH: Yes, I do.
MR. DEROHANNESIAN: What is this?
BRIAN BOOTH: This is the sheet that came with the evidence.
MR. DEROHANNESIAN: Looking at the next page. When you say the evidence, does this -- well, let me go back to page 1.
Does -- this is just for one piece of evidence or is it for more?
BRIAN BOOTH: This is just for the digital camera, the Canon camera.
MR. DEROHANNESIAN: And looking at the second page of Defense Exhibit 945, is there anything on that page that helps refresh your recollection as to when any representative of the FBI first examined the Canon camera?
BRIAN BOOTH: You'd have to scroll down because I'm not seeing the whole sheet.
MR. DEROHANNESIAN: There's another page, too, if you don't see it here.
BRIAN BOOTH: Okay. You will have to show me the second sheet.
MR. DEROHANNESIAN: The second sheet is actually the third sheet of this exhibit so we're clear on the record.
BRIAN BOOTH: Yes, I do see that Stephen Flatley had gotten it around 2/22 of 19, which is the same as the sticker.
MR. DEROHANNESIAN: And while we're on this, does this help refresh your recollection as to when you first examined the Canon camera in evidence?
BRIAN BOOTH: Yes. I first got the camera on 6/10.
MR. DEROHANNESIAN: And then?
BRIAN BOOTH: Then the next day I did the examination and handed it back.
MR. DEROHANNESIAN: Would 6/10, 6/11 be at or about the time you had that discussion with Special Agent Lever about the camera?
BRIAN BOOTH: No.
MR. DEROHANNESIAN: Would it be before that?
BRIAN BOOTH: Which discussion about the camera are you talking about?
MR. DEROHANNESIAN: The biographical information about the camera.
BRIAN BOOTH: Do you mean as far as...
MR. DEROHANNESIAN: How long it's been around in existence.
BRIAN BOOTH: No, this was something that was referenced when Steve first got the camera back on 2/22.
MR. DEROHANNESIAN: So it would have been before you had it on June 10th?
BRIAN BOOTH: Yes, this is a long time ago.
MR. DEROHANNESIAN: Government's Exhibit 524.
MR. DEROHANNESIAN: Is there -- do you know the exact date that you first examined 524?
BRIAN BOOTH: That would on 6/11.
MR. DEROHANNESIAN: Let's talk about some of the electronic information, digital evidence in general, and then talk about this case.
When you examine, you said an image, you generate something you called a hash value?
BRIAN BOOTH: Correct.
MR. DEROHANNESIAN: And a hash value, you said, is an identifying piece of information about an image?
BRIAN BOOTH: Yes, it is.
MR. DEROHANNESIAN: And there are different types of hash values?
BRIAN BOOTH: Yes, there are.
MR. DEROHANNESIAN: MD5s been around a long time?
BRIAN BOOTH: Yes.
MR. DEROHANNESIAN: And I think you said it was, you say, like a fingerprint?
BRIAN BOOTH: We look at it as akin to a fingerprint.
MR. DEROHANNESIAN: Akin?
BRIAN BOOTH: Yeah.
MR. DEROHANNESIAN: Because it is possible to have two different images with the same MD5 value; correct?
BRIAN BOOTH: It is a possibility, but there's almost an impossibility. And then there's ways that I can explain that possibility.
MR. DEROHANNESIAN: Well, my -- there's a possibility you said?
BRIAN BOOTH: Yes.
MR. DEROHANNESIAN: And there's many images on the internet displaying two different messages with the same hash value; correct?
BRIAN BOOTH: I don't know that there's many, but I know there are some.
MR. DEROHANNESIAN: And you've seen those images; correct?
BRIAN BOOTH: Are you talking about graphic messages or forensic images?
MR. DEROHANNESIAN: Photographic images.
BRIAN BOOTH: No, I haven't seen all the MD5 collision messages that are on the net.
MR. DEROHANNESIAN: Were there issues with MD5 that led forensic examiners to adopt a different hash value system?
BRIAN BOOTH: No. There was no reason for someone to adopt a different hash value system, but there was a collision, as they call it, with an MD5 collision.
MR. DEROHANNESIAN: And a collision is another way of saying two pictures with the same --
BRIAN BOOTH: Not two pictures, two files.
MR. DEROHANNESIAN: And is there something called SHA hash value?
BRIAN BOOTH: Yes. Secure hash algorithm.
MR. DEROHANNESIAN: And is that used by some forensic labs?
BRIAN BOOTH: Yes, it is.
MR. DEROHANNESIAN: Is it used by the FBI?
BRIAN BOOTH: We use it alongside the MD5 cache, but the MD5 is what we use exclusively.
MR. DEROHANNESIAN: When you say use it alongside, did you use the SHA1 hash value alongside the MD5 value in this case?
BRIAN BOOTH: No, I did not.
MR. DEROHANNESIAN: The SHA1 value is also used even on home cameras; correct?
BRIAN BOOTH: It's used on many different devices.
MR. DEROHANNESIAN: First developed by the National Security Agency?
BRIAN BOOTH: If I recall, yes.
MR. DEROHANNESIAN: And there's been issues with SHA1 also; correct?
BRIAN BOOTH: Yes.
MR. DEROHANNESIAN: And it's led to a further revision called SHA256.
BRIAN BOOTH: No. SHA256 was developed well before they ever found an issue with SHA1.
MR. DEROHANNESIAN: And there is an SHA2?
BRIAN BOOTH: Yes, there is.
MR. DEROHANNESIAN: And that's considered the latest in terms of SHA hash value systems?
BRIAN BOOTH: Not necessarily.
MR. DEROHANNESIAN: SHA2 is more advanced than SHA1?
BRIAN BOOTH: It's a tougher algorithm, that's for sure.
MR. DEROHANNESIAN: When you saw tougher algorithm, again, trying to deal with this issue of whether two images will have the same hash value; correct?
BRIAN BOOTH: Two images will not have the same hash value. Two files can.
MR. DEROHANNESIAN: And two files, that's what you're talking about the collision; correct?
BRIAN BOOTH: Yes.
MR. DEROHANNESIAN: Two files having the same hash value.
So you reported an acquisition hash value for the images in this case; correct?
BRIAN BOOTH: Yes.
MR. DEROHANNESIAN: That's not something that you testified about on direct other than you did it; correct?
BRIAN BOOTH: Correct.
MR. DEROHANNESIAN: And then the discussion about metadata. There are different types of metadata; correct?
BRIAN BOOTH: Correct.
MR. DEROHANNESIAN: And some come from the file system; is that correct?
BRIAN BOOTH: Correct.
MR. DEROHANNESIAN: I think you touched on that yesterday; correct?
BRIAN BOOTH: Yes, I did.
MR. DEROHANNESIAN: A file system could be an operating system?
BRIAN BOOTH: Yes.
MR. DEROHANNESIAN: It could be Windows?
BRIAN BOOTH: Those are different -- different devices that use them. Operating systems use file systems in order to be able to store their data.
MR. DEROHANNESIAN: And different -- Linux is an operating system?
BRIAN BOOTH: Yes.
MR. DEROHANNESIAN: Apple is an operating system?
BRIAN BOOTH: Yes.
MR. DEROHANNESIAN: And then there are versions of each of those; correct?
BRIAN BOOTH: Of the file systems, yes. And of different kind of operating systems that run also.
MR. DEROHANNESIAN: And with respect to your analysis in this case, were you able to determine the operating system which was utilized?
BRIAN BOOTH: In which way?
MR. DEROHANNESIAN: For the Western Digital device.
BRIAN BOOTH: No, I was not.
MR. DEROHANNESIAN: That's because you didn't have the Dell Dimension computer; correct?
BRIAN BOOTH: Not necessarily. There were three computers that were listed under those backup folders. Any one of those could have been used to actually have this device plugged into it.
MR. DEROHANNESIAN: So there were three devices that had been connected to this hard drive at some point?
BRIAN BOOTH: I don't know if they were connected. I just know there was a file system, a folder named after a file system.
MR. DEROHANNESIAN: So --
BRIAN BOOTH: Or a computer.
MR. DEROHANNESIAN: Did you want to say something else?
BRIAN BOOTH: The folders were named after a computer, a type of computer. So we have a Dell Dimension. I think there was a Mac that was named as a folder.
MR. DEROHANNESIAN: Correct.
BRIAN BOOTH: I'm not thinking that the computer actually generates those. I'm thinking that someone just names a folder. And I'm not assuming that someone had to attach to that computer, but that's the only information we have to go on. So we need to try to run down all that information to see if we can find one.
MR. DEROHANNESIAN: Not having access to any of those three computers makes it more difficult to identify data, metadata from the operating system; correct?
BRIAN BOOTH: From the OS, from the FS, the file system itself, to see if something's been plugged in, yes, in that respect, it is hard.
MR. DEROHANNESIAN: Was there any other reason that you wanted to see that Dell Dimension computer?
BRIAN BOOTH: Well, if I had that Dell Dimension computer, I would do a full workup of that computer. And I would look to see if that USB drive was plugged it, when it was plugged in, how often it was plugged in, what letter was generated when it was plugged in, how the files were copied to and from it, things of that nature.
MR. DEROHANNESIAN: There's also, I think -- I don't know if you used the word application metadata?
BRIAN BOOTH: Yeah, it could be file metadata.
MR. DEROHANNESIAN: That's, for example, on a Word file?
BRIAN BOOTH: Yes.
MR. DEROHANNESIAN: To say who created the document; right?
BRIAN BOOTH: Yes, an author would be named sometimes.
MR. DEROHANNESIAN: When you get the software for Word you put the name in, could be Brian's computer or Brian Booth; right?
BRIAN BOOTH: Correct.
MR. DEROHANNESIAN: But somebody else can use Brian's computer, the document would still have metadata saying Brian Booth; correct?
BRIAN BOOTH: Correct.
MR. DEROHANNESIAN: And then there's also embedded metadata?
BRIAN BOOTH: Yes, there is.
MR. DEROHANNESIAN: Is that something you discussed in this case?
BRIAN BOOTH: We were talking about the embedded metadata for a .jpg file.
MR. DEROHANNESIAN: For what?
BRIAN BOOTH: On a .jpg file.
MR. DEROHANNESIAN: Now, metadata can be changed; correct?
BRIAN BOOTH: It can. Depending on what type of metadata you're talking about, and how hard it is, really depends on what version or what type of metadata you're talking about.
MR. DEROHANNESIAN: And metadata can be changed by the end-user?
BRIAN BOOTH: Yes.
MR. DEROHANNESIAN: The end-user being the person who's at the computer; right?
BRIAN BOOTH: Sometimes, yes.
MR. DEROHANNESIAN: So you go on your computer, anyone can, and change the date and time; correct?
BRIAN BOOTH: Yes.
MR. DEROHANNESIAN: You can change the year; correct?
BRIAN BOOTH: Yes.
MR. DEROHANNESIAN: That can be done at any time?
BRIAN BOOTH: It depends on what operating system and what type of security you have on the operating system. If you have a laptop from your corporation, they may block you from doing that.
MR. DEROHANNESIAN: But here you don't know what, if any, security was on any of the operating systems involved in the images that you testified about; correct?
BRIAN BOOTH: You're talking about the Restistive, the 1B numbers or are you talking about --
MR. DEROHANNESIAN: From the Western Digital, yes, the 1B.
BRIAN BOOTH: The 1B is an external hard drive. It can be plugged into any type of operating system. I have no knowledge of it.
MR. DEROHANNESIAN: Also, there can be automatic actions that can change the metadata?
BRIAN BOOTH: In some software can do that, yes.
MR. DEROHANNESIAN: When we talk about automatic actions, computer antivirus software can change metadata?
BRIAN BOOTH: It would actually quarantine something if it deemed it to be an issue, but I don't know about it changing metadata. It depends on what kind of metadata you're talking about right how, because there's --
MR. DEROHANNESIAN: Some metadata?
BRIAN BOOTH: There's various different metadatas that we're talking about in this courtroom, so you're throwing a very broad stick at this.
MR. DEROHANNESIAN: We'll narrow down.
But with respect to metadata, the copying process or -- can affect metadata?
BRIAN BOOTH: Yes, it can.
MR. DEROHANNESIAN: When we say copying process, what do you mean by that?
BRIAN BOOTH: If you drag and drop a file or a folder from one device to a USB device, or a thumb drive, and then take it to another one and copy and drag it, it could do that. That will change metadata.
MR. DEROHANNESIAN: Backing up a computer can be an automatic function; correct?
BRIAN BOOTH: Yes, it can.
MR. DEROHANNESIAN: Like an office can back up every night its files?
BRIAN BOOTH: Correct.
MR. DEROHANNESIAN: And that would change the metadata?
BRIAN BOOTH: It could.
MR. DEROHANNESIAN: And I think you said data changes, metadata changes, as it moves across computers.
BRIAN BOOTH: Yes, it does. File system metadata.
MR. DEROHANNESIAN: And that's something that happened with respect to this Western hard drive; correct?
BRIAN BOOTH: In possibility, it could.
MR. DEROHANNESIAN: Pardon?
BRIAN BOOTH: Considered in a possibility, it could.
MR. DEROHANNESIAN: So you can backdate metadata?
BRIAN BOOTH: You can change a computer's date and time and then copy data on to it and have it backdated in that sense.
MR. DEROHANNESIAN: And is there something called time stomping?
BRIAN BOOTH: Yes, there is.
MR. DEROHANNESIAN: Is there that different from just backdating, time stomping?
BRIAN BOOTH: That's very close to -- if you want to use a similar term to say, you can use that as a term for it.
MR. DEROHANNESIAN: There's actually softwares that do that for you?
BRIAN BOOTH: It could. It's not something normally out there in use.
MR. DEROHANNESIAN: And somebody with hacking skills might know about time stomping software?
BRIAN BOOTH: Yes.
MR. DEROHANNESIAN: That's something you've seen?
BRIAN BOOTH: Yes, I have.
MR. DEROHANNESIAN: And you talked about a file creation date yesterday? Yes?
BRIAN BOOTH: Yes, I have.
MR. DEROHANNESIAN: So you had information concerning -- yesterday did you testify to the file creation date for any of the images from the Western Digital drive?
BRIAN BOOTH: I think I mentioned one file creation date in particular.
MR. DEROHANNESIAN: Do you remember what that date was?
BRIAN BOOTH: It was a 2003 date.
MR. DEROHANNESIAN: And then the last modified date is when the user last modified a file?
BRIAN BOOTH: That's usually what happens.
MR. DEROHANNESIAN: When you say usually, there's other ways that last modify date can be there; correct?
BRIAN BOOTH: Yes.
MR. DEROHANNESIAN: For example?
BRIAN BOOTH: Well, from moving computers across from one computer to another, if you've got a file system that is a very, what we call a young file system, like something we use with floppy disks, they don't actually hold on to all that data because newer file systems can hold modified data, access data, much differently.
So sometimes when you move the files across, a creation date would be made, but a last access date wouldn't be created completely. You'd only have a date. So in some ways you can actually modify dates and times as you move across different file systems.
MR. DEROHANNESIAN: And that's not something you're able to determine without examining the computers along the way?
BRIAN BOOTH: Not unless we have them in our hand, no.
MR. DEROHANNESIAN: So, for example, in this case, we know there was a Dell Dimension computer?
BRIAN BOOTH: I don't know that, but if you're telling me.
MR. DEROHANNESIAN: Your analysis reflected a path that said Dell Dimension?
BRIAN BOOTH: Yes, I do.
MR. DEROHANNESIAN: And you said there were two other computers?
BRIAN BOOTH: Two other file paths that indicated other computers.
MR. DEROHANNESIAN: Like an Apple?
BRIAN BOOTH: Like an Apple computer, yes.
MR. DEROHANNESIAN: What was the third?
BRIAN BOOTH: It was another Dell computer.
MR. DEROHANNESIAN: And then you mentioned last access date?
BRIAN BOOTH: Yes, I did.
MR. DEROHANNESIAN: And last access date can have many meanings also; correct?
BRIAN BOOTH: Yes.
MR. DEROHANNESIAN: It can mean literally the last time someone accessed it; correct?
BRIAN BOOTH: Correct.
MR. DEROHANNESIAN: And it can also mean the last time it was copied?
BRIAN BOOTH: A last access date can be moved across one computer to another, but the access date, if they're like devices, would stay. So unless you've actually opened up an item and looked at it, it wouldn't change the last access date.
MR. DEROHANNESIAN: So last access doesn't even mean last view?
BRIAN BOOTH: In some cases, software will change the last access date if you've opened it up. But it's really software dependant.
MR. DEROHANNESIAN: So last access date does not necessarily mean last viewed?
BRIAN BOOTH: Correct.
MR. DEROHANNESIAN: But if a file is viewed, it would be reflected in an access date?
BRIAN BOOTH: If it's opened up?
BRIAN BOOTH: Depending on what piece of software.
MR. DEROHANNESIAN: And in terms of file folders, files can be moved from one folder to another; correct?
BRIAN BOOTH: Yes.
MR. DEROHANNESIAN: And you don't have that information when you examine a hard drive such as this, whether files were moved or not?
BRIAN BOOTH: Well, between devices, I do not.
MR. DEROHANNESIAN: Or even when it was on a Dell Dimension, Dell computer or Apple computer?
BRIAN BOOTH: No, I do not.
MR. DEROHANNESIAN: Does DOS script also impact the file names?
BRIAN BOOTH: Does what? Excuse me?
MR. DEROHANNESIAN: DOS. D-O-S script?
BRIAN BOOTH: I don't know what you're referring to.
MR. DEROHANNESIAN: Your examinations were at different times; correct?
BRIAN BOOTH: As far as my two examinations here were at two different times, yes.
MR. DEROHANNESIAN: With respect to the images that you testified about this morning, Government Exhibits 518, A through U, they're also reflected in your report.
You understand my question?
BRIAN BOOTH: As far as looking at the actual items themselves?
MR. DEROHANNESIAN: Let me try to break it down then.
So Government Exhibit 518-A through U are like images, printed images?
BRIAN BOOTH: Okay, yes.
MR. DEROHANNESIAN: In addition, you have a report that talks about those images and the data for those images; correct?
BRIAN BOOTH: Yes.
MR. DEROHANNESIAN: And some of those were reviewed with you on direct examination by the prosecutor; correct?
BRIAN BOOTH: Correct.
MR. DEROHANNESIAN: Do you know, without looking at your report, what the file creation date is for each and every one of Government Exhibit 518-A through U?
BRIAN BOOTH: No, I'd have to see the report itself.
MR. DEROHANNESIAN: Then we can do that.
MR. DEROHANNESIAN: This is Government Exhibit 504-A. I'm going to put it on the screen.
(Exhibit published.)
MR. DEROHANNESIAN: Starting with -- first of all, can you read it?
BRIAN BOOTH: The highlighted item?
MR. DEROHANNESIAN: Yes, .jpg 150?
BRIAN BOOTH: Yes, I can.
Would you like me to read it out loud?
MR. DEROHANNESIAN: Does that help you recall the file creation date for .jpg 150?
BRIAN BOOTH: Yes, it does.
MR. DEROHANNESIAN: July 26th, 2003?
BRIAN BOOTH: Correct.
MR. DEROHANNESIAN: 151, file creation date.
BRIAN BOOTH: Correct.
MR. DEROHANNESIAN: Same?
BRIAN BOOTH: 2003.
MR. DEROHANNESIAN: .jpg 152?
BRIAN BOOTH: Correct.
MR. DEROHANNESIAN: July 2003.
.jpg 153, July 2003?
BRIAN BOOTH: Correct.
MR. DEROHANNESIAN: .jpg 154, creation date of July 2003?
BRIAN BOOTH: Yes.
MR. DEROHANNESIAN: .jpg 155, creation date of July 26th, 2003?
BRIAN BOOTH: Yes.
MR. DEROHANNESIAN: .jpg 156, creation date of July 2003?
BRIAN BOOTH: Correct.
MR. DEROHANNESIAN: .jpg 160, a creation date of July 26th, 2003?
BRIAN BOOTH: Correct.
MR. DEROHANNESIAN: .jpg 161, creation date of July 26th, 2003?
BRIAN BOOTH: Correct.
MR. DEROHANNESIAN: .jpg 162, creation date of July 26th, 2003?
BRIAN BOOTH: Correct.
MR. DEROHANNESIAN: And .jpg 163, a creation date of July 26th, 2003?
BRIAN BOOTH: Correct.
MR. DEROHANNESIAN: So with respect to .jpg images 150 to 163, they were all created, according to your forensic examination, on July 26th, 2003; correct?
BRIAN BOOTH: Yes.
MR. DEROHANNESIAN: And in terms of the times, going back, we'll go backwards. That date, 2:05:16, 2:05:16, 2:05:15, 2:05:15, 2:05:15, 2:05:14, 2:05:14, 2:05:14, 2:05:13, 2:05:13?
BRIAN BOOTH: Correct.
MR. DEROHANNESIAN: 2:05:12, 2:05:12, 2:05:12, and 2:05:11.
So on those, the first set of .jpg images, there was a creation date of July 26th, 2013?
BRIAN BOOTH: Correct.
MR. DEROHANNESIAN: Now, with respect to .jpgs 184 to 191, which you talked about this morning and yesterday, which were also contained in Exhibit 518, do you know what the file creation date was for those messages?
BRIAN BOOTH: I recall, I thought they were 2003, also.
MR. DEROHANNESIAN: Would you know for sure if you looked at --
BRIAN BOOTH: The report would show it.
MR. DEROHANNESIAN: The one we were just looking at?
BRIAN BOOTH: Yes.
MR. DEROHANNESIAN: So this is Exhibit 504-A. This is the second set of images that you testified about with the prosecution. .jpg 184 creation date, July 26th, 2003, 2:05 p.m.?
185, July 26th, 2003?
BRIAN BOOTH: Correct.
MR. DEROHANNESIAN: 205.
.jpg 186, creation date, July 26th, 2003, 2:05 p.m.
.jpg 187, file creation, July 26th, 2003, 2:05 p.m.
.jpg 188, file creation, July 26th, 2003, 2:05 p.m.
.jpg 189, July 26th, 2003, 2:05 p.m.
.jpg 190, July 26th, 2003, 2:05 p.m.
And the last in this series from 184 to 191, file creation date of July 26th, 2003, at 2:05 p.m.?
BRIAN BOOTH: Correct.
MR. DEROHANNESIAN: So looking at that, it's fair to say that for images 184 to 191, they have the same file creation date as .jpg images 150 to 163.
BRIAN BOOTH: Yes.
MR. DEROHANNESIAN: And in your opinion, is the metadata that was generated with respect to file creation reliable?
BRIAN BOOTH: No.
MR. DEROHANNESIAN: Is it possible these images were created in 2004?
BRIAN BOOTH: Yes.
MR. DEROHANNESIAN: Is it possible they were created in 2005?
BRIAN BOOTH: Yes.
MR. DEROHANNESIAN: Is it possible they were created in 2006?
BRIAN BOOTH: You can keep going on what dates. I don't know.
MR. DEROHANNESIAN: Right. It could be 2008?
BRIAN BOOTH: Yes.
MR. DEROHANNESIAN: It could be 2010?
BRIAN BOOTH: Correct.
MR. DEROHANNESIAN: Because the file creation metadata is not reliable in this case, according to you; correct?
BRIAN BOOTH: The file -- the file system metadata for those dates and times are not accurate.
MR. DEROHANNESIAN: That issue has nothing to do with how you may have conducted your examination; is that correct?
BRIAN BOOTH: Correct.
MR. DEROHANNESIAN: And these images which form the basis of the photographs which were displayed today, also had modified dates on them?
BRIAN BOOTH: Yes, they did.
MR. DEROHANNESIAN: And do you remember what the modified date was for .jpg images 150 to 163?
BRIAN BOOTH: If I recall, it came back to a 2005 date.
MR. DEROHANNESIAN: Okay. And with respect to .jpg images 184 and 195, do you recall what the file modified date was?
BRIAN BOOTH: I think they call came back to 2005.
MR. DEROHANNESIAN: And then did you determine in your analysis file access dates?
BRIAN BOOTH: No, I did not.
(Continued on following page.)
EXAMINATION CONTINUES BY MR. der OHANNESIAN:
MR. DEROHANNESIAN: Again, I'm focusing on JPEG Images 150 to 163, and 184 to 191.
Looking, again, at Exhibit 284, starting with Exhibit 150, did you determine an access date on that?
BRIAN BOOTH: Software has produced an access date of 2010.
MR. DEROHANNESIAN: And do you know what the access date -- now, there's no time on that, right?
BRIAN BOOTH: No, there's not.
MR. DEROHANNESIAN: And was there an access date for the other JPEG images?
BRIAN BOOTH: Yes, there were.
MR. DEROHANNESIAN: Do you know what that access date was for each image, JPEG 150 to 190?
BRIAN BOOTH: I recall they were all alike.
MR. DEROHANNESIAN: Well, let's make sure.
BRIAN BOOTH: Okay.
MR. DEROHANNESIAN: Let's not guess.
(Exhibit published.)
MR. DEROHANNESIAN: Looking at JPEG 151, 152, 153, 154, 155, 156, 157, 158, 159, so far all generating the same access date?
BRIAN BOOTH: Yes.
MR. DEROHANNESIAN: Of 2/12/2010?
BRIAN BOOTH: Yes.
MR. DEROHANNESIAN: So this is refreshing you that you did do that, correct?
BRIAN BOOTH: Well, I didn't -- you asked me if I had -- if you would rephrase how you said it. You said --
MR. DEROHANNESIAN: Generated or reported.
BRIAN BOOTH: Well, I -- the system reported this information. I'm not reporting back with my past testimony. We didn't talk about access dates.
MR. DEROHANNESIAN: Fair enough, you're absolutely correct.
So, JPEG 160, file access date, again, the same, 2/12/10; JPEG 161, which is a separate series of JPEGs that you were asked about that were contained in Exhibit 518, also has the access date of 2/12/2010; same for JPEG 162; yes?
BRIAN BOOTH: Yes.
MR. DEROHANNESIAN: And finally, JPEG 163, that also -- excuse me, that was in the same series.
The next series begins with JPEG 184, that also, though, has the same access date?
BRIAN BOOTH: Correct.
MR. DEROHANNESIAN: And, again, just quickly looking at 184, 185, which starts at the bottom of page 46, access date of 2/12/2010, same for 186, 187, 188, 189, 190 and 191, correct?
BRIAN BOOTH: Correct.
MR. DEROHANNESIAN: So for all these images your metadata reflected a last access date of February 12th, 2010, correct?
BRIAN BOOTH: Correct.
MR. DEROHANNESIAN: And I think you said accessing does not necessarily mean viewing either, correct?
BRIAN BOOTH: Not necessarily.
MR. DEROHANNESIAN: Would it be fair to say that you have no information of any file access date after February 12th, 2010 for any of these images?
BRIAN BOOTH: Not that I know of.
MR. DEROHANNESIAN: Is there another form of metadata called thumbs.db or thumbs database?
BRIAN BOOTH: Yes.
MR. DEROHANNESIAN: And is that something that you reviewed in this case?
BRIAN BOOTH: That was processed, but as far as going in and reviewing each of the thumb.db's, no, I did not.
MR. DEROHANNESIAN: Do you have any notes concerning your findings on the thumbs database?
BRIAN BOOTH: No, I do not.
MR. DEROHANNESIAN: But you did it?
BRIAN BOOTH: We looked at it, yes.
MR. DEROHANNESIAN: You didn't report it though?
BRIAN BOOTH: No.
MR. DEROHANNESIAN: And let's define what thumbs database is.
BRIAN BOOTH: Well, thumbs.db is -- is part of the Microsoft operating system that when you open up folders and view contents and you usually see them come up in thumbnails, a thumbs.db file is created in that folder to hold that data.
Depending on what file system you have, it can actually be saved in the user's data portion of the computer. So instead of saving it in the folder, Windows 10 likes to save it in a users data folder, and that will hold different size versions of the thumbnails that you find in there, too.
MR. DEROHANNESIAN: It's supposedly makes it more convenient or easier for you to view the image?
BRIAN BOOTH: To browse through, yes.
MR. DEROHANNESIAN: And that is a form of metadata that forensic examiners look at, correct?
BRIAN BOOTH: Sometimes, yes.
MR. DEROHANNESIAN: And that thumbs.db data or browsing should be after the photo is taken?
BRIAN BOOTH: Not necessarily. Not all operating systems make a thumb.db folder.
MR. DEROHANNESIAN: Well, this case, the Western Digital did have a thumbs.db on it, correct?
BRIAN BOOTH: Yes, it had multiples.
MR. DEROHANNESIAN: Okay.
And when there is thumbs.db, you can't view a file before it exists, correct?
BRIAN BOOTH: You can double click on it and open it.
MR. DEROHANNESIAN: But the date and time of a thumbs.db entry cannot be before the creation of the file?
BRIAN BOOTH: No -- well, the thumbs.db might be there before you add files into the folder. So yes, a thumbs.db can be there and created before you add more files to it.
MR. DEROHANNESIAN: Did you notice any anomalies in the thumbs database in this case when we talk about JPEG images, any of the JPEG images from 150 to 191?
BRIAN BOOTH: And those were on 1B16, I gather?
BRIAN BOOTH: Not that I had noticed.
MR. DEROHANNESIAN: Did you notice that some of these files say they were created an hour before they were created according to thumbs.db?
BRIAN BOOTH: No, I did not notice that.
MR. DEROHANNESIAN: That wouldn't be good, would it?
BRIAN BOOTH: I would want to look at it, but no, I wouldn't say it's good or bad.
MR. DEROHANNESIAN: Do any of the reports that you put into evidence in this courtroom say anything about the thumbs database metadata?
BRIAN BOOTH: No, it does not.
MR. DEROHANNESIAN: Who determines whether to report the thumbs database data in a forensic report?
BRIAN BOOTH: An examiner would.
MR. DEROHANNESIAN: Pardon?
BRIAN BOOTH: An examiner would.
MR. DEROHANNESIAN: Brian Booth?
BRIAN BOOTH: Could be me, could be another examiner.
MR. DEROHANNESIAN: And in this case, who would it be?
BRIAN BOOTH: Well, when I'm asked to produce the report, if I deemed it necessary I would add it.
MR. DEROHANNESIAN: So that's your -- your call?
BRIAN BOOTH: It would be on my purview.