Christopher Jon Beeson

Christopher Jon Beeson testified for the prosecution as the FBI forensic examiner who collected data from Ulbricht's laptop after his arrest. On Day 6, he explained that encryption required keeping the laptop running. He first copied selected folders, then made an unencrypted image of the Linux partition. He also imaged two thumb drives, consolidated the data for shipment to the FBI's New York office, and calculated hashes for later integrity checks. The court admitted his filename-and-hash list and four laptop photographs without objection.

Cross-examination focused on whether collection preserved the computer's earlier state. Beeson acknowledged that archiving could change access times, without knowing whether it had done so here. After consulting his notes, he recalled a copying error but could not identify its precise cause or affected file. He also confirmed that simultaneous imaging and hashing failed with a permission error; he repeated the imaging command without simultaneous hashing and generated the hash on October 3. He defended the decision to capture memory after other collection processes.

On Day 7, Beeson acknowledged that RAM capture began two days after receipt of the laptop. A crash during capture permanently lost some information whose contents he could not identify, although he denied that everything was lost and said collection continued after restart. Dratel also challenged his photograph chronology. Beeson said exact timing required his notes and confirmed that the camera clock was about 40 minutes slow.

On redirect, Beeson explained that collecting from a running computer necessarily changes some information, with the aim of minimizing those changes. He denied that collection errors prevented a complete copy or generated the logs Turner described. Recross established that the RAM capture could not show the full range of computer activity, with qualified answers about internet connections and possible malware. Further redirect distinguished that limitation from access to historical content. Asked on further recross when material had been placed on the computer, Beeson clarified that he had not conducted its forensic examination.