Digital Signature Witness Made Easy

Digital signature witness

I don't know mr. turbans going to testify today but he proffered his testimony last week he made a statement that Grant has a history of stealing would you say that would be that would be excluded and you can instruct him of that all right other than that are the witness ed the witnesses are present if we could please have them brought into the courtroom who's your first witness okay so have an investigator blye brought in and then you can get the jury good morning everyone hope everyone had a good weekend I and everyone stayed of course away from the news at this point we are going to state still continuing their case so the state may call their next witness investigator blye [Applause] raise your right hand you may proceed good morning good morning can you please introduce yourself to the jury and spell your name for the court reporter good morning my name is Geraldine Bly BL a why how and where do you currently work I am a deputy sheriff at the Seminole County Sheriff's Office and how long have you been at the sheriff's office since April 2014 now can you're a sworn law enforcement officer I am certified yes do you have any education besides the police academy I do can you please tell the jury your background education that's not Police Academy women yes I have a bachelor's degree in general science with minors in mathematics and computer science from the University of Puerto Rico I also have a master's degree in digital forensics from the University of Central Florida and now can you tell us about the training that you had to complete order to come a law enforcement officer yes I attended 770 hours of the law Enforcement Academy at Seminole State College and what are your current assignments at the sheriff's office I am assigned as an investigator in our digital forensics unit were you first assigned to the digital forensics unit September 2016 and you said digital forensics are you a digital forensics examiner I am and what are the duties of a digital forensics examiner so we work we we investigate and analyze different kinds of electronic devices such as cell phones hard drives thumb drives even infotainment systems and cars now can you tell the jury the training that you have to complete in order to handle and examine computer devices yes as far as certifications I am CFC which stands for certified forints certified forensic computer examiner certified computer forensic from my Asus which is means International Association of computer investigative specialists I also have the coffee certification which stands for certified advanced windows forensic examiner also from Asus as far I also have a I am also an ELC which stands for encase certified examiner as far as cell phones I have the seller ID CCO and CCPA which stands for cellebrite certified operator and cellebrite certified physical analyst I am a Birla IV certified examiner for vehicle forensics some of the classes that I have taken are the BCF II basically computer forensic examiner windows forensic examiner and advanced forints advanced Macintosh forensic examiner from iasis from the national computer forensics Institute I have taken advanced forensic tech techniques as far as on any case which is a software that we use I have taken detailed digital forensics 1l to advanced Internet examinations examinations of NTFS file systems incident investigations Macintosh examinations among others it's a lot of training how many hours is that over 500 hours have you coached in the classes related into computer forensics I do and can you tell the jury just briefly what it means to be a coach for the CFC for the certified forensic computer examiner process each student that goes through through the certification is um has to complete four problems for practical problems so each each student gets assigned a coach which is in charge of reviewing their problems making sure they get it perfect and if they are struggling with an area we we coach them we guide them we don't tell them the answer we like teach them a little bit of how do how to get the answer how to put together by themselves I am yes I am a member of the national computer forensic Institute's Technical Advisory Council and I am also a member of Isis International Association of computer investigative specialists have you received any awards or honors with regard to the work you've completed I did um in June 2019 we we received the sheriff's commendation for a case we were working on now how many forensic examinations have you conducted on various devices we have conducted I have conducted over 300 examinations on over a thousand devices and I have have since been in others okay so let's shift gears a little bit I want to ask you some questions about computers okay can you tell the jury basically the components that make up a test well these depends cuz there are different kinds of desktop computers but in general it would be the monitor the box and some peripherals like a keyboard a mouse printer depending on the user also depends but the CPU Ram some non-volatile storage like a hard drive or a solid-state drive some expansion cards like a graphics card can you in very general terms tell the jury how a file is stored on a hard drive okay so he said this could be we could talk about this all day but in general when say you're using a notepad application and you're typing a document that is stored in RAM which is the volatile memory it's stored there so because it's faster to to access when you're done with the document it's it's the operating system then states it to the to the hard drive or solid-state drive I like to compare it with a kitchen for example say I'm I'm going to cook our cook something cook a recipe I get whatever ingredients I need I get it out of the fridge I put them on the countertop the countertop is like Ram it's it's everything they're accessible and like easy to use if it's again but when I'm done I have to put everything back in the fridge so I I mean it would be awesome if I could just leave it on the countertop to to so I don't have to go back to the fish again for I can't because I'm gonna need that space at counter space for my next recipe so that's how I like to compare it maybe the countertop is like okay now do you ever actually work on the particular piece of evidence that's recovered from the crime scene no we do not do you make what do you make in order to conduct an examination our driver phone or whatever so we make an image so a forensic copy okay what's the forensic image it is a bit by bit copy of everything in in the store in the storage in the hard drive or the software or work sorry or the SD stay drive how does thumb drive it includes like deleted store deleted stuff blank spaces so it's an exact digital copy of the original piece of evidence it is yes now how do we know that it's an exact copy well we calculate what's called the hash value of the copy and we compare it to the hash value of the original and if they match it is an exact copy okay and how do you ensure that while you're conducting your examination of this copy that nothing gets written to the original so when we are creating the image we connect it to a write blocker a write blocker I like to think about it write blocker is software that lets you read from the media but it doesn't let you write to the media or make any changes I like to think about it it's like a kind of an old analogy but like when you had the O VHS tapes or the cassette tapes they would have like a plastic tab that you will break off and then you wouldn't be able to write to it so that's what I like to do okay so it's a little more complicated the plastic tab but the idea is the same yes all right now I want to sort of shift gears a little bit and talk about some of the work he did in this particular case all right now you've described the basic steps of what you do you make a copy of it you didn't sure that the copy is an exact copy of the original and then you you have a variety of tools you use is that so yes tell us that some of the tools you use to conduct an exam yes of course we use a use encase backlight axiom physical analyzer and some hardware tools - such as grey key or the you Fed touch - tools that are used in standardizing your particular field of expertise yeah yarn okay now I want a jar like I said your attention to the work of this particular case did you do forensic work on a variety of items in this particular case I did okay I want to show you some photographs for the record I'm showing defense counsel exhibits state's exhibit 8s you recognize what's containing that image I do and what is it that we're looking at it is a picture of the computer set up in Grant's room and items and seven okay item n7 that's your your your speak yeah it is um a computer tower okay I'm also showing you exhibit nine I for identification purposes and recognize this I do and what is this it is a paper printout of a laptop computer that I examine okay and I'm showing you exhibit nine a do you realize that I do and he told what this is it is a paper printout of the thumb drive that one of the thumb drives that I examined these photos nine a nine I and eight s of a fair and accurate depictions of the items that contain their tender these insist any objection alright what's been pre marked for ID as state's Exhibit A s will be moved into evidence as state's Exhibit 2 206 one where are we where's my birth chart okay 231 in evidence it's been pre-marked for ID as state's exhibit 9a will be moved into evidence of state's exhibit 232 and evidence what's been pre marked for ID as state's exhibit nine I will be moved into evidence at state's exhibit 233 you may think you'd apply you have identified these photographs I'm just going to go through them real quick here I'm showing you on the overhead what's been marked into evidence that states 231 so deep now on your screen there there should be a little arrow with a mouse a little pop-out arrow if you click that pop-out arrow I think the judge actually may set you up for that okay great so can you use that little pointer that you have in front of you to show us the compute the actual tower or the box that you worked on in this case right there okay and you said that that was located in Grant's room you said okay I'm showing you exhibit 232 go all the way down to clear press clear okay now if you want to mark again and exhibit 232 is this an item that you examined it is and just real quick what is it we're looking at here it is on a data thumb drive 32 gig thumb drive okay so the Google flash drive here and do you know where that was located yes it was located in a pair of pants I'm showing you exhibit 233 what are we looking at here laptop that I worked on Margaret's work laptop in is it Nancy 6o and double K madness [Applause] okay the record I'm showing you item eight in you recognize this I do it has my handwriting in the front part of the envelope and it also has my signature like my initials and the date on the back of the envelope okay and is that packaging the same or substantially similar condition as it was when you first review the item yes it is and what's contained in that package um the four thumb for the thumb drives that I examine might opening the gumbo just tender exhibit 8 in this case next Friday estates exhibit 8 will be moved into other exit state's exhibit 234 and evidence you may the portable thumb drives that you examine they are and the one on the very top that's the one that was in that photograph we just displayed yes now investigator fly pretty you have visit WK identification purposes yes I do it has my handwriting in the front part of the end of the bed and my on the red tape there's my initials and this is that packaging similar or substantially similar condition as it was when you first it is what's contained in that package the laptop that I worked on Margaret's laptop open in the back we tend to double KS this next as to double K what's been pre marked for ideas state's exhibit - okay well we moved into evidence of state's exhibit 2:35 and evidence an objection will be overruled has been marked for identification purposes as six oh I do are you recognizing it has the my initials and the date on some of the red tape on it and is there the substantially the same condition as it was when you first reviewed it yes and what is contained in this exhibit it is an Apple iPhone we tender 6os States next all right objection overruled as to what's been pre marked for ID state's exhibit six Oh will be moved into evidence and state's exhibit to 36 and evidence forensics examiner did you aid in searching the residence in the surrounding area I didn't and besides the forensic examiner are you also a k-9 handler I am and what kind of canine do you work with I have an electronic detection k9 and how long have you had that k9 C is November 2017 and can you tell the jury we know what a canine is but what's an electronic detection k9 well just like some drugs of some drugs some dogs detect drugs or detect bombs or calibers electronic detection canines are trained to detect the TPP Oh in electronic devices see ppl the PPO stands for triphenylphosphine oxide which is a chemical that is used to coat electronic devices just to help with the cooling so professor I'm overheating yes and how long was the trade-in you had with what's your dog's name Sirius cinnamon bark how long was your training with Siri cinnamon bark she was trained for five to six months and then I went to the handler handler course for two weeks and then there's a way there's like a six-week acclamation getting used to each other period before we start getting deployed and have you gone through any additional training with Siri yes we have to go through training a recertification at least once per calendar year so I was certified in November 2018 and in May 2019 and how often do you train with Siri like some of the some of the dogs that are some of the detection does they work based on toy reward so like if they find something you give him the toy and then that's the reward Siri works based on food reward so what that means is that the only way that she eats is which is training so cheese which is a lab she eats you up as much as every dog or more so we have to train every day twice a day at least twice a day no matter if we have a search or not so 365 days a year seven days a week the dog is getting trained yes she trains how many deployments have you had with Syria over 50 and how about training deployments I practice ballpark well I've had her since November 2017 twice a day at least some nice more I'm not a math magic now no she had the opportunity to deploy the canine Ceri this particular case yes I did can you tell the jury how you deployed series I deployed her around the outside area of the residents and also in the gym area and were you able I could say was serial to locate any other digital devices other than was physically found in the residence no so nothing in the yard no okay now let's begin with grants computer the one you listen was in Grant's room I'm showing defense counsel eight to eight you personal witness showing you for identification purposes what's been Marxist 8c thank you HP W + 8 X you recognize these items I do and what are these items what are they for to be here a computer and a solid-state drive that was found inside the computer you know these photographs that we're taking of that computer in your laboratory yes are they fair and accurate depiction of the items that are contained in them yes we tender 18 through a XS space next any objection no objection what's been pre marked for idea state's exhibit 8 T will be moved into evidence of state's exhibit 237 and evidence what's been pre mark Friday's state's exhibit 8 ye will be moved into evidence of state's exhibit 238 and evidence which been pre marked for ID the state's exhibit 8 these and Victor will be moved into evidence of state's exhibit 239 and evidence and what's been pre marked for idea state's exhibit 8 w well we moved into evidence as state's Exhibit 2 40 and evidence and what's been pre-marked for idea state's exhibit 8 X will be moved into evidence of state's exhibit 241 in evidence with this just to document the condition of it but the record I'm showing you estates exhibit 237 and that's the photograph isn't that a photograph of the computer you located yes 238 what is this the side of the computer 239 that is the main drive were the main drive for the operating system was okay so that side thing pops out each of those pop out and there's a drive in it 240 same but another video of the same drive hard drive solid phaedra 241 the back part of it okay thank you now can you tell the jury the what was done with that particular item yes after we photographed the the computer and it's all of the drives that were in it and we documented the condition of these drives for each of the drives we connected them to the right Walker of the other forensic machine and we used any case which is one of the software that we use to make an image file like an image of the issue of the drives then after image was completed I we calculated the hash values of the image and then compared them to the hash values of the URI you know once they match we put the original away and we also check bias so like the system settings pretty much just to make sure the the time was accurate okay now during the course of your investigation were you able to identify if there were any user accounts on that particular item yes I did present occasion purposes I approach the witness [Applause] remark identification is 8 why do you recognize this I do how do you recognize it it has my initials and the date on the bottom part and what is this document apart to be it is a subsection of my Yankees report showing user accounts it is a fair accurate depiction of that section of your report it is we tender 8y this states that any all right objection overruled what's been pre marked for ideas state's exhibit 8 Y will be moved into evidence of state's exhibit 242 in evidence yes it shows a list of the user accounts that I was found that I was able to find in that computer in the tower that you guys saw picks yourself and the some of the accounts are the default accounts that a computer comes with but then these accounts right here like and that's this is the path the windows from the path where the operating system was installed like that for the user directory a user name on this particular device was light yes okay now aside from identifying the user account on this computer we able to locate any activity on this particular device between January 24th and January 25th yes I did okay and can you tell us what was one of the first things that you okay yes I found that a thumb drive an ad that thumb drive was connected to the computer under the user account light on January 24th on 2019 at 11:32 p.m. and then it was disconnected on January 25th 2019 at 12:27 a.m. and I'm showing you exhibit 232 is that the thumb drive you're talking about yes now there were three other drives in that in state in the state's exhibit with B thumb drives did you conduct examinations on those drives as well I did did you find anything of forensic value on those drives no now how do we know that this particular thumb drive is plugged into that particular box by looking at the windows event laws and at the registry and briefly and simply what our event logs and the windows registry so event logs are a diary like a diary that the computer and some applications use to keep track of important hardware or software events in a computer I'm showing Council 8z for identification purposes thank you a purpose do you recognize this item I do how do you recognize it it has my initials and the date on the bottom left corner what is this item what is this it is a subsection of my report showing event logs for that computer is it a fair an accurate depiction of that section of your report it is with tender 8zi estates next alright objection overruled what's been pre marked for ideas state's exhibit 8c will be moved into evidence the state's exhibit 243 and evidence blind I want to make sure that what you say is backed up by what you saw so is this the report that shows the time that that particular drive that thumb drive was plugged in yes it is it was on January 24th or 19 at 11:30 2:38 p.m. and this was information you pulled off of the logs and registry from windows yes that is correct so nobody can easily get to that information yes that 1/5 m and as far as what it was removed January 25 2019 at 12:27 37 Oh around that time it takes a few seconds to update so to write stuff okay now with regard to additional happening on grants computer did you have the occasion to review whether a particular phone was plugged into that computer I do and can you tell the jury about that yes on January 24 2019 at 11:39 p.m. an iPhone was connected to the computer according to the ASO log that's allowed and that Apple keeps on a window on our computer it wasn't able to they didn't find the lockdown file which means it wasn't able if you have a if you're an iPhone user you have to and you could plug in your phone to a computer you have to trust them by putting your password so it wasn't able to to do that connection and then at 11:42 he was placed in recovery mode and connected to the computer grants computer and set up for recovery mode recovery mode is a way for an iPhone or an iOS device to connect to itunes without having to boot for like pretty much to restore it or to update now were you able to determine what particular iPhone I did and how were you able to determine that while examining the computer one of the computers in Cody's room I found a backup of that same phone and I extracted that backup it was an old backup I extracted that backup and I use physical analyzer to generate a report for that particular phone and I compared the serial number and the you use the idea the unique to fire for for the phone with the one that had been connected to the computer sure you may why do you recognize 14 why I do how do you recognize it it has my initials and of the date on it and what does item 14 Y purport today it is the first page of that report that I made of the backup having an out containing some identifying information for the phone show new state's exhibit 14 Z I do how do you recognize it has my initials and the date on the bottom part of it and what is item 14 Z report today it shows the iPhone connections made on the way to the computer from the Windows registry they pair accurate depictions of those sections of your report they are tender 14 Y a 14 z estates next you may remembers of the jury the state and the defense and I have a few things to go over that we're gonna have to do outside your presence if you could we're gonna take a brief recess you may be seated all right I said first let me ask what date did the defense receive it all right let me know the extraction report document it's the iPhone one the 14z that you were referring to both documents were sent on July 26 July 26 I think that's correct Thursday Thursday that the email of the lesson I opened up was for Thursday taursus 25th that Thursday Lester all right July 25th all right now mr. Leo please tell me as far as the nature and the circumstances of why it was disclosed on July 25th well I and I got an email from investigator Bly saying hey I was going back through everything and I noticed this as well and it shows what it shows what do you think and I said I think it's interesting and relevant and as soon as I got the copies of the extraction report and the printout from her forensic tool I immediately emailed defense counsel the copy of it to both mr. daddy and mr. Shapiro I also did a supplemental pleading I believe on the same date indicating that I had emailed that to them all right was there any offering as far as any type of questioning or speaking with prior to today on Thursday or Friday of last week and it specifically explained to mr. daddy what those documents contain and what evidence I intended to use from those documents he thanked me for being forthright with him and after that there were no further discussions all right I the documents themselves what do you anticipate that she's going to testify to testify to that the unifying number on the extraction report and the unique identifying number on the forensic examining report are the same that that number belongs to Cody Amato cellphone that phone was plugged into grants computer I don't had the paper and friendly for the exact time but same timeframe late in the evening on the 24th and should explain which surety kind of did the reason why someone puts a computer a iphone into recovery mode and plugs it into a computer and I am told mr. Daly pretty much exactly that on last week and any particular reason why it wasn't disclosed beforehand I didn't know it existed and I don't want to speak for miss blye but I don't believe she knew it existed either and of course judged all the digital stuff has been sitting over there and I know they wouldn't refer to evidence viewing a number of might have been a month or so maybe two months ago a month ago and anything obviously the defense want to look at would be made available to them and when you say it was a month ago that they went over there were these documents sitting within that out of these documents selves it exists until Thursday okay and then what was it then you're saying that was available for inspection a month ago the actual hard drives for their expert if they had one to review both roll the logs and registry data on the hard drives which is how she found this was going through line by line by line of all the registry information all right mr. Shapiro Jojo just argued this is late it's past the jury being sworn for prejudice than that we didn't have this information just in case we wanted to go over additional information and jury selection about any possible issue that may have any relationship to this whatsoever our opening statements and additional probe from there I mean I understand we got late stuff from like July 11th which was like the Blake Turpin arrest report that was before jury selection and I understood that that's not a problem this is all after the jury's been sworn after doing area selection and already most of the week into trial as well did you all have an opportunity to examine all the computer hard drives and forensics yourself we did we also had an opportunity to publish investigator Bly which we did so and we had asked her what she performed and when we asked her August she hadn't done this yet so we took the opportunity to ask the lead digital forensics person what she had performed and we didn't have an opportunity to ask about this because she hadn't done it yet and then decided to I guess go back during trial to check it out and that's why we're we were unable to find out this information was it performed the deposition of wine Oh judge I have it in my email Ashley July 9th attend differently about how this all works with regard to when it's plugged into the computer what recovery mode means what that whole action what her interpretation of the report would mean practically speaking that information was provided last week I know mr. ovo didn't describe practically what it means but it was described last week when we got the notice that it existed happy I've made the trust of my opening judge i mr. leo anything else that you want to inform tell the court they certainly can exclusion of the evidence is the most severe penalty judge and I don't believe that given the nature of the disclosure and the facts that surrounded how this information came to be discovered that it's that exclusion is the appropriate remedy I was there any requests to question miss blye before today at all I know mr. Shapiro no I'm not really sure when that would have been possible but maybe we were just assuming the left based upon the circumstances in Richardson I an other case law even after one particularly I believe was joules versus state that I reviewed first of all from what I hadn't gather from the facts the information was obtained or the extraction report an iPhone report was for March 14 Y and 14 Z but specifically the issue is 14 Z was turned over on Thursday there wasn't any request or indication by the defense in order to request for a deposition or otherwise I will state the court has to find that the violation was willful by the state as soon as they ended up finding out about it they ended up disclosing it to the defense even the defense indicated that based upon the circumstances in addition the computer itself and all the information oh I'm so sorry I didn't even know that you weren't here okay well then I have to start all over Peter no problem that was also my fault sir all right the court has to find based upon the discovery violation getting past the first part whether or not it was willful the indication that the court has as this information was discovered on Thursday 414 wine or 14z I'm sorry for the iPhone report I the as soon as it was discovered from both parties it seems to be indicated that the state disclosed what it was what the information was about further the court notes that there was the opportunity for the defense to do their own examination a month ago of the entire computer itself if it chose to whether or not that the report that was initiated was initiated afterwards if they chose to have their own expert or otherwise I examine it they would have the opportunity but the court notes that the examination or the disclosure of this was not something that was not willful or that was willful by the state in fact not willful because of the fact that they immediately disclosed it once it was received also the court notes and reading briefly again some the case law regarding it the aspect for circumstances on whether or not it was that is if there was a discovery violation whether or not it would be prejudicial or not to the defense the court noted the three things that were listed was one in regards to the possible questioning during wadiya however the computer forensic expert had already been disclosed previously there's several issues regarding the computers that's already been noted in this trial whether it be the thumb drive the dad's iPhone the laptop or iPads or things of that nature and none of the specifics were questioned in wadiya because they're prevented from being questioned about in gaudier which also would make this also being prevented from being questioned about in that sense during gaudier so that aspect it does not necessarily make sense to the court the other aspect as far as mentioning at an opening statement opening statements not evidence I do understand that that may have been a possibility but opening statement is not evidence so then it comes down to also the questioning the Court finds that very interest finds the fact that the circumstances on which the defendant and the defense chooses to make any objection or even have this brought to the court's attention is during the witness is testimony rather than on Thursday where the court could have ordered a deposition or questioning or otherwise which is what the case law favors we did have time Friday afternoon as well or even questioning as far as the witness as well in that sense to even in during a case to continue a case for possibly a day for questioning or deposition if it's needed and none of that was done in this instance however I don't even get past the first part to indicate that it was not willful I'm sorry that it was willful and indicates that it wasn't willful it was something that was done and disclosed immediately and that would be the first step to for the Richardson portion of the discovery violation since I do not get past that the rest of it doesn't even go further however the court does comment as to the prejudice of it based upon the three items that were indicated the court wouldn't believe that there would be prejudice either because this could have been questioned or otherwise at the time during the Friday afternoon after we broke when we broke early briefly or otherwise or at least brought to the court's attention prior to the exclusion of evidence is the ultimate ultimate sanction that the courts discourage and also but based upon the circumstances as stated it's not willful and otherwise therefore there would not be a Richardson violation so the courts gonna allow the questioning to move forward if you wish though we can take a brief recess and mr. Shapiro and you can I will have miss Bly come down from the stand you all can the state and the defense can go outside they can question her at this time before she gets back on the stand and the court will allow a brief so-called deposition so to speak for purposes of the defense okay so at this point miss blye you are free to step down from the stand if you all want to you can go into the conference room on or one of those conference rooms I would also ask Peter if you could go out there too so it's also recorded for purposes of the deposition and have a brief deposition by the defense of the expert at this time and we'll take a brief recess let me and just let the deputies know when you're done