4.Brian Booth — Cross/Redirect/Recross/Further Redirect (Recall, Part 4)
382 linesCROSS-EXAMINATION CONTINUED BY MR. der OHANNESIAN:
MR. DEROHANNESIAN: Mr. Booth, I'm going to show you some items first.
MR. DEROHANNESIAN: Judge, this will just be for the witness.
THE COURT: All right, let me see.
Go ahead.
MR. DEROHANNESIAN: This is Exhibit 945, which we looked at from this morning. And could you reiterate what 945 is?
BRIAN BOOTH: 945 is the package sheet from the digital camera piece of evidence.
MR. DEROHANNESIAN: And does this include the data card, Exhibit 524, or not?
BRIAN BOOTH: From what I -- my understanding was that was what was obtained outside the -- or inside the actual camera.
MR. DEROHANNESIAN: So do you know if there is a separate document for the data device?
BRIAN BOOTH: No, there isn't.
MR. DEROHANNESIAN: Then I want to show you document 960.
What is that?
BRIAN BOOTH: It's a evidence bar code. It's 1B16. It's the -- one red rope containing the Western Digital storage device.
MR. DEROHANNESIAN: And what do you call this document?
BRIAN BOOTH: This is the evidence sheet.
MR. DEROHANNESIAN: And this would be for the Western Digital drive?
BRIAN BOOTH: Yes.
MR. DEROHANNESIAN: I'll offer 945 and 960 at this time.
MS. HAJJAR: No objection.
THE COURT: All right, Defense Exhibits 945 and 960 are received in evidence.
(Defendant's Exhibits 945 and 960 were received in evidence.)
BY MR. der OHANNESIAN:
MR. DEROHANNESIAN: Mr. Booth, Exhibits 945 and 960 are in evidence. If you need them to answer my questions, please ask me for them.
BRIAN BOOTH: Okay.
MR. DEROHANNESIAN: This will be just for the witness, Your Honor.
MR. DEROHANNESIAN: This is several sheets of paper. So what I am going to do is show it to you directly, so you can look through all of them, rather than my doing it from the ELMO.
MR. DEROHANNESIAN: Is that okay, Your Honor, if I give it to the witness?
THE COURT: Sure.
BRIAN BOOTH: (Witness complies.)
BY MR. der OHANNESIAN:
MR. DEROHANNESIAN: First, the number on that exhibit on the front page, just so I -- for the record, is DX what?
BRIAN BOOTH: DX 961.
MR. DEROHANNESIAN: And what is DX 961?
BRIAN BOOTH: DX 961 is a rough draft of the examination notes.
MR. DEROHANNESIAN: Are those the notes that you were referring to this morning?
BRIAN BOOTH: Yes, I am.
MR. DEROHANNESIAN: That you said you didn't have?
BRIAN BOOTH: Yes.
MR. DEROHANNESIAN: That might help you answer some questions?
BRIAN BOOTH: Yes.
MR. DEROHANNESIAN: Does it contain the photos that were taken in this case also?
BRIAN BOOTH: Yes, they do.
MR. DEROHANNESIAN: Okay. And, again, if you need that to answer my questions, to refresh your recollection, just let me know.
The first question is: Are there any photos that were taken of the box in which the Cannon camera and storage device were located?
BRIAN BOOTH: No, there wasn't.
MR. DEROHANNESIAN: Now, you can answer that with certainty, correct?
BRIAN BOOTH: Yes, because the -- because of the speed of having to do the camera at this point, and that the camera was also produced in court already, that I just needed to actually process the item, and get it -- get the item processed.
MR. DEROHANNESIAN: When you say the camera was produced in court, when was that?
BRIAN BOOTH: I think it was that morning, if I'm -- if I'm not mistaken. I wasn't in court, so I don't know.
MR. DEROHANNESIAN: Will those notes in Exhibit 961 help you answer that question, if you believe the camera was produced in some court proceeding?
BRIAN BOOTH: No.
MR. DEROHANNESIAN: Okay. That's just your guess?
BRIAN BOOTH: Yeah, that was what I heard from someone on the squad. So I don't know for sure.
MR. DEROHANNESIAN: That's not reflected in the notes, correct?
BRIAN BOOTH: No, it's not reflected in the notes.
MR. DEROHANNESIAN: Does Exhibit 961 help you answer the question when the Cannon camera and storage device were delivered to the FBI CART office?
BRIAN BOOTH: No, the evidence sheet would have that information.
MR. DEROHANNESIAN: Is that one of the two exhibits that we just put in evidence?
BRIAN BOOTH: Yes, I would believe it would be.
MR. DEROHANNESIAN: Looking at Exhibit 945.
(Exhibit published.)
BRIAN BOOTH: That's the Cannon camera?
MR. DEROHANNESIAN: Yes.
BRIAN BOOTH: Yes.
MR. DEROHANNESIAN: And this morning, I think -- looking at the first page, does that tell you when it came to the CART office?
BRIAN BOOTH: You'll have to scroll down a little -- scroll up a little bit, and it's up to the right. It says when we received it.
(Exhibit published.)
BRIAN BOOTH: You're going down. You need to go up.
MR. DEROHANNESIAN: What's the date?
BRIAN BOOTH: You need to go up.
THE COURT: To the top of the page?
BRIAN BOOTH: Yes, top of the page.
THE COURT: Hold on.
MR. DEROHANNESIAN: This can be for the jury.
THE COURT: Yes, I know. I just want it to be up.
Yeah, okay.
(Exhibit published.)
BRIAN BOOTH: And you need to move it to the left a little bit, so I can see it.
MR. DEROHANNESIAN: Here you go.
BRIAN BOOTH: 3/27 of '18.
BY MR. der OHANNESIAN:
MR. DEROHANNESIAN: So March 27th, 2018, is when the Cannon camera and Exhibit 524 were delivered to the lab?
BRIAN BOOTH: Yes.
MR. DEROHANNESIAN: And do your notes now, Exhibit 961, help you answer the question when the Cannon camera and storage device, 524, were first examined by the CART unit?
BRIAN BOOTH: The -- the -- my notes reflect when I examined and had access to the Cannon camera.
MR. DEROHANNESIAN: Okay. And that's what --
BRIAN BOOTH: And only -- and only me having access to that.
MR. DEROHANNESIAN: And what do your notes reflect?
BRIAN BOOTH: I received it on 6/10 of '19.
MR. DEROHANNESIAN: June 10th, 2019?
BRIAN BOOTH: Yes.
MR. DEROHANNESIAN: And then you generated a report, correct?
BRIAN BOOTH: Correct.
MR. DEROHANNESIAN: And February 22nd is when the CART office first put an evidence sticker on the device, correct?
BRIAN BOOTH: Correct.
MR. DEROHANNESIAN: And then June 11th is your initials when you did your work with this device, correct?
BRIAN BOOTH: Correct.
MR. DEROHANNESIAN: You prepared a report concerning the metadata obtained from the storage device, which is Exhibit 524, correct?
BRIAN BOOTH: Correct.
MR. DEROHANNESIAN: Exhibit 521, which is in evidence, contains information about metadata associated with images from this electronic device, correct?
BRIAN BOOTH: Correct.
MR. DEROHANNESIAN: It's okay to call it an electronic device?
BRIAN BOOTH: Yes, you can.
MR. DEROHANNESIAN: And when we talk about the metadata in this case for this card, it would include when it was created, correct?
BRIAN BOOTH: The metadata will have a date/time that would say a created date.
MR. DEROHANNESIAN: When it was accessed?
BRIAN BOOTH: It will have an access time/date.
MR. DEROHANNESIAN: And when it was modified?
BRIAN BOOTH: And modified dates, yes.
MR. DEROHANNESIAN: And was this device also taken through the process of write copied -- write protected?
BRIAN BOOTH: When it was in my hands it was write protected, yes.
MR. DEROHANNESIAN: Can you tell me when that was?
BRIAN BOOTH: That happened on 6/11.
MR. DEROHANNESIAN: And, again, the reason you write protect to be -- the -- whether it's a hard drive or a piece of data, like this data disk, forensically you don't access it directly, correct?
BRIAN BOOTH: No, we don't.
MR. DEROHANNESIAN: And that's what you described yesterday to the prosecutor, that's what you described to me this morning, correct?
BRIAN BOOTH: Correct.
MR. DEROHANNESIAN: And that's very, very important, correct?
BRIAN BOOTH: Yes, it is.
MR. DEROHANNESIAN: Because you want to maintain the integrity of the electronic evidence?
BRIAN BOOTH: Yes, I do.
MR. DEROHANNESIAN: I'd like to take you to -- this is page 84 of Exhibit 521. And I'd like to begin with JPEG on top here, 224.
(Exhibit published.)
BY MR. der OHANNESIAN:
MR. DEROHANNESIAN: First of all, I want to make sure you can read that.
BRIAN BOOTH: I can see it.
MR. DEROHANNESIAN: You say that this image was created on March 9th, 2006?
BRIAN BOOTH: That's the created date that's --
BRIAN BOOTH: That's the created date that's listed for the file.
MR. DEROHANNESIAN: It was modified on March 9, 2006?
BRIAN BOOTH: That's the modified date that's reflected from the file system.
MR. DEROHANNESIAN: And then it was accessed, correct, on a certain date?
BRIAN BOOTH: Yes, I see it's been accessed.
MR. DEROHANNESIAN: It was accessed on September 19, 2018, correct?
BRIAN BOOTH: Correct.
MR. DEROHANNESIAN: Look at exhibit -- the same exhibit, Image 225.
The next item reflects what might be called "carved data"?
BRIAN BOOTH: Yes.
MR. DEROHANNESIAN: Okay. It doesn't mean the image doesn't exist on the computer, though, correct?
BRIAN BOOTH: Well, if you're talking about the EXIF HTML, is that what you're referencing?
MR. DEROHANNESIAN: No. Well, for example, right below it you see Image 225?
BRIAN BOOTH: Yes.
MR. DEROHANNESIAN: Let's continue. Image 225 created in March 9, 2006, correct?
BRIAN BOOTH: Correct.
MR. DEROHANNESIAN: Modified in 2006 and it was accessed on September 19, 2018, correct?
BRIAN BOOTH: Correct.
MR. DEROHANNESIAN: And that's according to what you're reading off this Exhibit 524, correct?
BRIAN BOOTH: Correct.
MR. DEROHANNESIAN: And Image 227, that was also accessed on September 19, 2018, correct?
BRIAN BOOTH: Correct.
MR. DEROHANNESIAN: Exhibit [sic] 228 was accessed on September 19, 2018?
BRIAN BOOTH: Which number again, excuse me?
BRIAN BOOTH: Yes.
MR. DEROHANNESIAN: Image 229, that was also accessed on September 19, 2018, correct?
BRIAN BOOTH: Correct.
MR. DEROHANNESIAN: Image 230 was accessed on September 19, 2018, correct?
BRIAN BOOTH: Correct.
MR. DEROHANNESIAN: Image 231, JPEG, accessed on September 19, 2018? Is that what the access date is?
BRIAN BOOTH: Is that a question or --
MR. DEROHANNESIAN: Yes. My question is: Does your report, in Exhibit 521-A of the Government, reflect that JPEG Image 231 was accessed on September 19, 2008 [sic]?
BRIAN BOOTH: Correct.
MR. DEROHANNESIAN: Does your report reflect that Image 233 was accessed on September 19, 2018?
BRIAN BOOTH: Correct.
THE COURT: Could you repeat that?
BY MR. der OHANNESIAN:
MR. DEROHANNESIAN: Does your report reflect that JPEG Image 233 was accessed by September 19 -- on September 19, 2018?
BRIAN BOOTH: Correct.
MR. DEROHANNESIAN: Image 234, JPEG, accessed on September 19, 2018?
BRIAN BOOTH: Correct.
MR. DEROHANNESIAN: Image 235 accessed on September 19, 2018?
BRIAN BOOTH: Correct.
MR. DEROHANNESIAN: Image 236 accessed on September 9, 2018?
BRIAN BOOTH: Correct.
MR. DEROHANNESIAN: Image 237, on page 89 continuing into page 90, accessed on September 9, 2018?
BRIAN BOOTH: Correct.
MR. DEROHANNESIAN: Image 238 accessed on September 19, 2018?
BRIAN BOOTH: Correct.
MR. DEROHANNESIAN: JPEG 241 accessed on September 19, 2018?
BRIAN BOOTH: Correct.
MR. DEROHANNESIAN: There is no entry for JPEG 242 in the report.
On JPEG 243, that was accessed on September 19, 2018?
THE COURT: He can't see it.
MR. DEROHANNESIAN: I'm sorry.
BRIAN BOOTH: Yes.
(Exhibit published.)
BY MR. der OHANNESIAN:
MR. DEROHANNESIAN: Is that correct?
BRIAN BOOTH: Correct.
MR. DEROHANNESIAN: The metadata for JPEGs 224, 225, 227 to 241, and 243 from Government Exhibit 524, the media card, changed after it was collected on March 27, 2018, correct?
BRIAN BOOTH: The access dates appear to be.
MR. DEROHANNESIAN: The metadata for Exhibit 524, the media card, reflects that the digital evidence on Exhibit 524 changed while it was in the possession of the FBI, correct?
BRIAN BOOTH: Which -- which metadata are you specifically --
MR. DEROHANNESIAN: The date accessed.
BRIAN BOOTH: You're talking from the file system?
MR. DEROHANNESIAN: I'm talking about the data that we just looked at.
BRIAN BOOTH: That file system data appears to have been changed.
MR. DEROHANNESIAN: When we say "changed," it was changed while it was in the possession of the FBI?
BRIAN BOOTH: If I'm taking the dates on when we received it, it would appear so.
MR. DEROHANNESIAN: And the dates that you received just now came from your report, correct?
BRIAN BOOTH: Yes.
MR. DEROHANNESIAN: That you generated as evidence in the case against -- United States against Keith Raniere, correct?
BRIAN BOOTH: Yes.
MR. DEROHANNESIAN: The goal of forensic examination is to preserve the electronic data, so that the metadata doesn't change, correct?
BRIAN BOOTH: Correct.
MR. DEROHANNESIAN: Do you know the name of the person who accessed the SD or media card, Exhibit 524, on September 19, 2018?
BRIAN BOOTH: No, I do not.
MR. DEROHANNESIAN: Do you have any record in any piece of evidence or notes that reflects the accessing of Government Exhibit 524 by any representative of the FBI on September 19, 2018?
BRIAN BOOTH: No, I do not.
MR. DEROHANNESIAN: Based on your forensic examination of the Western Digital drive, or Government Exhibit 524, do you have any digital evidence that Keith Raniere knew the content of any of the electronic images on either Government Exhibit 503 or 524?
BRIAN BOOTH: I don't know Mr. Raniere, so I would never know what he knows.
MR. DEROHANNESIAN: Do you have any -- based on your forensic examination, do you have any digital evidence as to the identity of any individual who at any time may have accessed any information on the Western Digital hard drive?
BRIAN BOOTH: I do not know.
MR. DEROHANNESIAN: Based on your forensic examination, do you have any digital evidence of the identity of any individual who may have accessed any electronic information on Government Exhibit 524?
BRIAN BOOTH: I don't know who had access to this.
MR. DEROHANNESIAN: And based on your forensic examination of Government Exhibit 503 or 504, do you know the identity of any person who took any particular image about which you have testified before this grand jury -- before this jury?
BRIAN BOOTH: I just know people's pictures that are in the images, that's it.
MR. DEROHANNESIAN: You don't know the identity of any person who would have been behind the camera at any particular time --
BRIAN BOOTH: No.
MR. DEROHANNESIAN: -- fair to say?
BRIAN BOOTH: Fair.
MR. DEROHANNESIAN: Nothing else, Your Honor. Thank you.
(Continued on the following page.)
(Continuing.)
THE COURT: Redirect?
MS. HAJJAR: Yes, briefly, Your Honor.
REDIRECT EXAMINATION BY MS. HAJJAR:
MS. HAJJAR: Good afternoon, Examiner Booth.
BRIAN BOOTH: Good afternoon.
MS. HAJJAR: Mr. DerOhannesian talked a lot about metadata previously with you.
BRIAN BOOTH: Yes.
MS. HAJJAR: He asked you questions about various types of metadata, is that right, on cross-examination?
BRIAN BOOTH: Yes.
MS. HAJJAR: He didn't once mention EXIF data; is that right?
BRIAN BOOTH: Correct.
MS. HAJJAR: You spent the majority of your testimony on direct examination referring to EXIF data?
BRIAN BOOTH: Yes, I did.
MS. HAJJAR: Why is that?
BRIAN BOOTH: There's two types of metadata. There's the stuff that you find on file systems which is called file system metadata, and then there is metadata that is embedded into images and into audio files and things of that nature. That's EXIF data. And EXIF data is actually put inside the file. Unlike the metadata that we've talked about previously which is attached outside of the file by the operating system. The file system moves that along from place to place with it. So, at any point of giving that movement from place to place, there are times that things can get modified.
But when it comes to EXIF data, it used to be it would only be hard-coded in. You couldn't modify it. And only during changes during the years did they open up that you could change the author's name of a photo or even a Word document that you might have. You can always go in and change the author and put comments in and things like that and that's metadata for a Word file. But when it comes to photos, they still keep you from changing dates and times. It's not easy to change those. You have to go through special processes to change those things.
Adobe will allow you to copy a photo and modify it and it will take some of that metadata over, but it will actually put in that. Adobe has modified their system. They're taking steps to show that, listen, if you manipulate this we're going to show it in some sense. It's very rare that I've found someone has been changing metadata within a photo and that time and date does not change from place to place. It stays embedded in the photo. So, there's no outside constraint that's changing it, from an OS, from an Apple computer to a Dell computer.
So these things stay consistent. Those are prime places I need to look because unless someone is sitting doing that hacking attempt to trying to do that, which I didn't see that with this drive, I would have to assume all those dates are reflected going all the way through. Those are embedded when you take the picture.
I mean, you can go through your cell phone and see the times and dates and geo locations, too. If you try to modify those dates, you'll find you can do it yourself very easily. In that sense, it's very important data here. And, make no mistake, that's the data that I'm after as a forensic examiner. I can rely on that time and date. I can't rely on the date that someone else put on the files.
MS. HAJJAR: What's most reliable in terms of all the metadata that was discussed thus far in your examination on direct and on cross?
BRIAN BOOTH: The EXIF data.
MS. HAJJAR: Okay. Is that better, more reasonable than the created date?
BRIAN BOOTH: It's the most reliable.
MS. HAJJAR: Is it better than -- more reliable than the modified date?
BRIAN BOOTH: Yes.
MS. HAJJAR: Is it more reliable than the access date?
BRIAN BOOTH: Yes.
MS. HAJJAR: Is it more reliable than the thumb DB metadata?
BRIAN BOOTH: Yes.
MS. HAJJAR: Is it more reliable than metadata that might have been imposed based on an OS or operating system?
BRIAN BOOTH: Oh, definitely.
MS. HAJJAR: Every single same type of metadata that was discussed on cross-examination of -- and EXIF data, if you were to determine which of those was the most reliable which, would it be?
BRIAN BOOTH: The serial number of the camera and the time and the date.
MS. HAJJAR: On the EXIF data?
BRIAN BOOTH: Yes.
MS. HAJJAR: Okay. Is it kind of misleading to just talk about -- if you talk about metadata and you don't talk about EXIF data, can that get confusing or misleading?
MR. DEROHANNESIAN: Objection to the form.
THE COURT: Sustained as to form.
BY MS. HAJJAR:
MS. HAJJAR: I want to show you, Examiner Booth, just one of the images and this is -- I'm showing you Government Exhibit 550 in evidence.
(Exhibit published.)
MS. HAJJAR: This is the Studies folder that we were talking about?
BRIAN BOOTH: Yes.
MS. HAJJAR: What -- which -- the Studies folder, which piece of digital evidence is that from; the camera or the hard drive?
BRIAN BOOTH: It's from the hard drive.
MS. HAJJAR: And the hard drive, does that reflect any change in access date or modified date or creation date as of the time it got to the FBI?
BRIAN BOOTH: No.
MS. HAJJAR: So the images that were looked at in the context of this case from the hard drive, they -- no change in any of those -- that metadata --
BRIAN BOOTH: No.
MS. HAJJAR: -- is that right? Okay.
And looking at the first file in the 11-V1010202005 is in here 110205V. That's image 115?
BRIAN BOOTH: Yes.
MS. HAJJAR: Mr. DerOhannesian went through each of these. I'm not going to do every single one, but he went through the creation date, the access date and the modified date for each of these files; right?
BRIAN BOOTH: Correct.
MS. HAJJAR: And he pointed out to you that the creation date was 2003. He pointed out the access date was 2010 and the modified date was 2005; is that right?
BRIAN BOOTH: That's correct.
MS. HAJJAR: But he didn't show you the -- that's for image 150, right?
BRIAN BOOTH: Yes.
MS. HAJJAR: And what's this on top, the corresponding file to image 150?
BRIAN BOOTH: What AD Lab does is it opens up the JPEG file and looks at the EXIF data, extracts it and saves it as an HTML file so you can view it outside in this kind of form.
MS. HAJJAR: What's this? Why is it separate?
BRIAN BOOTH: The information is still there in the JPEG file, but in order for us to show the contents of what's in the JPEG file, besides the picture that you've already seen, we need to extract that EXIF data and save it as, in this case, an HTML file, so when you click on it on the screen you can see contents of that information.
MS. HAJJAR: Showing you Government 504-B. Is this the related EXIF data?
BRIAN BOOTH: Yes, it is.
MS. HAJJAR: And this shows the EXIF photo date time original of November 5, 2005?
BRIAN BOOTH: Correct.
MS. HAJJAR: Now, all of the images in that red binder, all of the images in the V110205, do they have corresponding EXIF data?
BRIAN BOOTH: Corresponding?
MS. HAJJAR: Like, for each of the image files that we looked at that were in the red binder?
BRIAN BOOTH: We had EXIF data.
MS. HAJJAR: They had EXIF data?
BRIAN BOOTH: Yes.
MS. HAJJAR: For each of those did they correspond to November 2nd 2005 or November 24th 2005?
BRIAN BOOTH: Yes, they did.
MS. HAJJAR: Consistently?
BRIAN BOOTH: Consistently.
MS. HAJJAR: Notwithstanding difference in the creation date?
BRIAN BOOTH: No changes in the date.
MS. HAJJAR: And notwithstanding the fact that the modified or the access date may be different than that?
BRIAN BOOTH: No.
MS. HAJJAR: Is there any other corroborating information, in your view, as to the date?
MR. DEROHANNESIAN: Object to the form of the question.
THE COURT: Could you -- could you change the question?
BY MS. HAJJAR:
MS. HAJJAR: Is there any other information that you found significant with respect to the date that was -- the EXIF data date?
BRIAN BOOTH: Well, the fact that there's so many dates that are in the EXIF data. Say I did have a modification software, I would have to change quite a bit of dates. I mean, I would have to go through, you know, a bunch of evidence, number one. But then I have to change -- in EXIF data there are dates all up and down that including zero numbers, models of cameras, things of that nature. So there's quite a bit of data to go through and when you modify a date and time an EXIF date and time in a JPEG, you take the chance of modifying it to where it destroys the JPEG and that's why adobe likes to make a copy when they wind up changing EXIF data in the file because they don't want to take the risk of actually ruining the JPEG file.
So this is one of the reasons why a lot of software don't go in and do a lot of changes to the EXIF data. Even if you wanted to just change the author, you're taking a chance that you can change the data.
MS. HAJJAR: What about the folder names themselves? I know you testify on cross-examination that you're not in the head of the user who had access to these files or who created these folders, but is there any comparison you can make between the EXIF data the filed folders?
BRIAN BOOTH: The EXIF data and the file folder names image.
MS. HAJJAR: The EXIF data for these images are in a folder titled November 24, 2005?
BRIAN BOOTH: Yes.
MS. HAJJAR: And the EXIF data for these images which relate to November 2, 2005 are in a folder with a consistent date and time?
BRIAN BOOTH: Yes.
MS. HAJJAR: And what about the -- I know you don't -- do you have -- are you aware of the significance of this first letter in this folder name?
BRIAN BOOTH: No, no.
MS. HAJJAR: But the -- the numbers that remain, 110205?
BRIAN BOOTH: That reflects the date.
MS. HAJJAR: Is that similar to the rest of the letters and numbers you see up that are within this file structure of the Studies folder?
BRIAN BOOTH: Yes, it looks like someone put the date and time associated with two letters.
MS. HAJJAR: I'm going to direct your attention to the bottom of Government Exhibit 550. The PSA file, did you look at the PSA files associated with each of these images to?
BRIAN BOOTH: Yes, I did.
MS. HAJJAR: Can you talk a little bit about PSA files and what they are?
BRIAN BOOTH: They're Photoshop album files and these are files that are generated by Adobe Elements. I don't know if anyone has ever seen some of the software. It used to come embedded on a lot of Dell software. When you used to get a Dell computer you sometimes would get Adobe Elements would come along with it. But it's a piece of software that can allow you to browse and look at a whole bunch of photos at one time like in Apple and associate music with the album. It's, like, a digital photobomb of sorts, but just opening up some of the image files in Adobe will start to generate a PSA file like this, and what's interesting about PSA files is they hold a lot of information. Some of it is your file structure. What else is in your file structure that's associated with your file itself. When you open it up, it's like an Excel spreadsheet and you can see all of the files that were associated at that date and time in there.
MS. HAJJAR: What about the timing of the PSA files as it relate to the original image?
BRIAN BOOTH: They match. They're the same times and dates.
MS. HAJJAR: So the -- a file created by Adobe matched roughly the EXIF data of the image creation time which, in this case, was 2005 throughout?
BRIAN BOOTH: Yes.
MS. HAJJAR: You were asked a few questions on cross-examination about the number of digital items recovered in this case. Were you the examiner for each of those items?
BRIAN BOOTH: For the ones that were listed, I was -- the ones that were listed on the report were put into the -- they were given to me in my training so all of those items were put in and processed. As far as the ones that we're focused on at this point, it just 1-B-16.
MS. HAJJAR: And the 1-B-16 is this, again, the digital hard drive that contained the -- the Studies folder that we've been talking about?
BRIAN BOOTH: Correct.
MS. HAJJAR: I think you were asked something on cross-examination about significance or evidentiary value of the remainder of the items. Did you -- did you search these other items, these other items of digital evidence, you personally?
BRIAN BOOTH: Not all of them, no.
MS. HAJJAR: Were the case agents involved in the searches for these items?
BRIAN BOOTH: Yes.
MS. HAJJAR: For items probative into the investigation of the case?
BRIAN BOOTH: Yes.
MS. HAJJAR: The notes you were provided with by Mr. DerOhannesian, those are notes by -- who drafted those notes?
BRIAN BOOTH: Virginia Donnelley. She's a special agent that I'm training.
MS. HAJJAR: And she is also a CART examiner?
BRIAN BOOTH: Yes, she's a CART examiner in training.
MS. HAJJAR: And I want to talk a little bit about the camera. I think Stephen Flatley's name came up with regard to the camera and you testified that you examined the camera quite recently; in June of this -- of this year?
BRIAN BOOTH: Yes.
MS. HAJJAR: Did someone -- does another CART examiner examine the camera before you?
BRIAN BOOTH: Yes. Stephen Flatley looked at that camera before me.
MS. HAJJAR: Did the Government ask you to testify here today and create another report instead of Stephen Flatley?
MR. DEROHANNESIAN: Objection.
THE COURT: Overruled, you may answer.
BRIAN BOOTH: Yes.
MS. HAJJAR: Why?
MR. DEROHANNESIAN: Objection.
BRIAN BOOTH: Where --as ITS forensic examiners, we -- as senior examiners we're in demand so we go all over the globe. We're in constant usage, I guess you would say, and right now Stephen Flatley is out on assignment in Ghana. So he's not able to be here because he's on operation.
MS. HAJJAR: Is that why you created another report very recently with respect to the camera?
BRIAN BOOTH: Yes.
MS. HAJJAR: No further questions, Your Honor.
THE COURT: Recross?
RECROSS-EXAMINATION BY MR. DEROHANNESIAN:
MR. DEROHANNESIAN: You agree that any metadata, whether it's EXIF data or other data can be changed and altered; correct?
BRIAN BOOTH: Yes, EXIF data can be altered.
MR. DEROHANNESIAN: And there's a variety of different ways that that can happen; correct?
BRIAN BOOTH: Yes, it can.
MR. DEROHANNESIAN: Companies can remove -- if you send a photo to Facebook, do they take off that data?
BRIAN BOOTH: Yes, they actually strip off the data.
MR. DEROHANNESIAN: So Facebook, Twitter that's what they do?
BRIAN BOOTH: Yes, they do.
MR. DEROHANNESIAN: And then they use that information for their commercial purposes?
BRIAN BOOTH: I wouldn't know.
MR. DEROHANNESIAN: That's another way. There's commercial processes that do that?
BRIAN BOOTH: I would gather.
MR. DEROHANNESIAN: And with respect to Mr. Flatly, I think you said his initials are on here, Exhibit 524 from February 22, 2019; correct?
BRIAN BOOTH: Correct.
MR. DEROHANNESIAN: And that's when he first looked at this Exhibit 524; correct?
BRIAN BOOTH: All I know is that he received it on that date. I have no idea exactly what he's done on the camera.
MR. DEROHANNESIAN: Thank you. I have nothing else.
THE COURT: Anything further?
MS. HAJJAR: Just two questions, Your Honor.
FURTHER REDIRECT EXAMINATION BY MS. HAJJAR:
MS. HAJJAR: Examiner Booth, the images you looked at, do they come from Facebook or another company?
BRIAN BOOTH: No, they did not.
MS. HAJJAR: Where did they come from?
BRIAN BOOTH: They came from a Canon camera.
MS. HAJJAR: Thank you, Your Honor. Nothing further.
THE COURT: Anything further?
MR. DEROHANNESIAN: No, Your Honor, thank you.
THE COURT: All right. The witness may stand down.
You are excused.
(Witness excused.)
THE COURT: All right. The Government may call its next witness.