7.Christopher Jon Beeson — Direct/Cross (Part 1)
397 linesMR. TURNER: Your Honor, the government calls FBI Special Agent Forensic Examiner Christopher Beeson to the stand.
THE COURT: All right. Mr. Beeson.
COURT CLERK: Please raise your right hand.
CHRISTOPHER JON BEESON, called as a witness by the government, having been duly sworn, testified as follows:
COURT CLERK: Please state your full name and spell your last name for the record.
CHRISTOPHER JON BEESON: It's Christopher Jon Beeson, C-h-r-i-s-t-o-p-h-e-r J-o-n B-e-e-s-o-n.
THE COURT: Mr. Beeson, please be seated. And it will be important for you to pull your chair up so you can speak clearly and directly into the mic, sir.
CHRISTOPHER JON BEESON: Very good. Thank you.
THE COURT: All right. Mr. Turner.
DIRECT EXAMINATION BY MR. TURNER:
MR. TURNER: Agent Beeson, who do you work for?
CHRISTOPHER JON BEESON: I work for the Federal Bureau of Investigation.
MR. TURNER: How long have you worked for FBI?
CHRISTOPHER JON BEESON: I've worked for the FBI for 28 years, the last 20 as a special agent.
MR. TURNER: What FBI office are you assigned to?
CHRISTOPHER JON BEESON: I am assigned to the San Francisco office of the FBI.
MR. TURNER: And what are your duties at that office?
CHRISTOPHER JON BEESON: I'm assigned to the Silicon Valley Regional Computer Forensic Laboratory, where I am a Special Agent Forensic Examiner.
MR. TURNER: And as part of your role as a Special Agent Forensic Examiner -- I should say, by "forensic examiner," are you talking about computer forensics or another type of forensics?
CHRISTOPHER JON BEESON: Computer forensics.
MR. TURNER: As part of your role as a Special Agent Forensic Examiner, are you ever called in to help with seizures of digital evidence for investigations by FBI offices outside San Francisco?
CHRISTOPHER JON BEESON: Yes, I am.
MR. TURNER: What typically is your role in those situations?
CHRISTOPHER JON BEESON: Typically when we are involved in collection of digital evidence for other FBI offices, our role is simply that, to collect and preserve digital evidence. So identify particular computer devices, what's going to be seized, etc., and then it will be forwarded on to the other FBI office for analysis.
MR. TURNER: On October 1, 2013, were you called upon to help in connection with an arrest of a target of the FBI New York field office?
CHRISTOPHER JON BEESON: I wasn't called upon to assist with the arrest but, rather, the search of computer evidence.
MR. TURNER: OK. The recovery of that evidence?
MR. TURNER: Whose arrest was it?
CHRISTOPHER JON BEESON: It was the arrest of Ross Ulbricht.
MR. TURNER: Where were you called upon to go that day?
CHRISTOPHER JON BEESON: We were told to respond to 235 Monterey Boulevard in San Francisco.
MR. TURNER: Do you know whose residence that was?
CHRISTOPHER JON BEESON: I was told it was the residence of Ross, Mr. Ulbricht.
MR. TURNER: Was this before or after Mr. Ulbricht had been arrested?
CHRISTOPHER JON BEESON: I'm sorry, counsel, one more time.
MR. TURNER: Was this before or after Mr. Ulbricht had been arrested?
CHRISTOPHER JON BEESON: I was called just following his arrest.
MR. TURNER: So approximately what time of day did you arrive at the residence?
CHRISTOPHER JON BEESON: I arrived about 5:30 p.m.
MR. TURNER: Anyone come to assist you?
CHRISTOPHER JON BEESON: Yes. One of our Task Force officers, Sergeant Brian Rodriguez, with the San Francisco police.
MR. TURNER: Were any law enforcement personnel already there by the time you arrived?
CHRISTOPHER JON BEESON: Yes. There were several FBI agents already on the scene.
MR. TURNER: Did that include Thomas Kiernan from the New York field office?
CHRISTOPHER JON BEESON: Yes, Mr. Kiernan was there.
MR. TURNER: What was Mr. Kiernan doing when you arrived?
CHRISTOPHER JON BEESON: He was accessing a laptop inside the residence in one of the bedrooms.
MR. TURNER: I'm showing you what's already been marked as Government Exhibit 200 and admitted into evidence.
When you have a chance to look at it, can you tell me, do you recognize this exhibit?
MR. TURNER: And how does this laptop compare to the one you saw Mr. Kiernan working on?
CHRISTOPHER JON BEESON: It's the same laptop.
MR. TURNER: How can you tell?
CHRISTOPHER JON BEESON: Looking at the markings on the back of the laptop, I can see from previously reviewing pictures that it has markings and stickers on the back that indicate it is the same.
MR. TURNER: Those pictures you took?
CHRISTOPHER JON BEESON: Yes, they are.
MR. TURNER: So what were you there to do exactly with the laptop?
CHRISTOPHER JON BEESON: So my role in this instance was to assist in the collection of the data that's on the laptop; basically, copy the data off of it.
MR. TURNER: And who did you understand would be responsible later for actually reviewing the contents of that data?
CHRISTOPHER JON BEESON: I didn't know a particular individual was going to be responsible, but I know that it was going to go to the New York FBI office.
MR. TURNER: In the ideal situation, what procedure do you use to copy the contents of a computer when you observe it?
CHRISTOPHER JON BEESON: So typically when we respond to a site and we're going to collect a computer or digital evidence, what we're going to do is we're going to start from a computer that's powered off. Right? We aren't going to typically use one that's powered on. We're going to power it down. And we're going to frequently remove the hard drive, and we're going to copy all the data that is on the hard drive off to one of our own hard drives or some other form of storage.
MR. TURNER: Why does it help to turn the computer off like that?
CHRISTOPHER JON BEESON: Well, when file systems are live and up and running, the data can change as things are going on. And so what we do is by powering it down, all that data is isolated on the hard drive. It can't be altered in any way.
MR. TURNER: Now, could you do that here?
CHRISTOPHER JON BEESON: We couldn't do that here.
MR. TURNER: Why not?
CHRISTOPHER JON BEESON: Well, once I responded to the scene and spoke with Mr. Kiernan, he advised that the laptop was encrypted. It was using a form of encryption. And so when encryption is deployed on a computer, frequently if we don't have the password there is nothing that we can do with that data if it is encrypted. Right? We would have to break that encryption.
So in this instance we had to capture the data while the computer was still running.
MR. TURNER: So walk us through what you were able to do with this laptop.
CHRISTOPHER JON BEESON: So once we took possession of the laptop from Mr. Kiernan, what I did is I started off by copying data that we believe would be most useful. And we did that in the form of what is called a Tarball. Similar to, for a Windows user, it would be like a zip file. A lot of people have seen zip files. It is just a way to containerize files.
And we started by creating those Tar images of groups of data which we believe would be of most value. You see, in this instance, we didn't have enough time to know how long we were going to have access to this laptop.
MR. TURNER: So when you got it, you said it was encrypted but do you mean it was actually encrypted or there was just a danger of it becoming encrypted?
CHRISTOPHER JON BEESON: So the data is encrypted on the laptop, but the operating system, like Windows -- this particular laptop was using Ubuntu Linux -- the operating system was interfacing between that encryption and allowing that data to be seen and viewed and copied.
MR. TURNER: So just in layman's terms, was the computer on?
CHRISTOPHER JON BEESON: Yes, the computer was on.
MR. TURNER: And was it logged in?
CHRISTOPHER JON BEESON: Yes, it was logged in.
MR. TURNER: So you had access to the account that was logged in?
CHRISTOPHER JON BEESON: Yes. It would be just as if any of us logged into our normal computer at work. It was sitting there waiting for what would you like us to do.
MR. TURNER: OK. So while the computer was in this live state, were you able to determine whether you had access to all of the data on the hard drive or only some of it?
CHRISTOPHER JON BEESON: Well, so what we determined was that the computer was set up in such a way that it could either run Windows or Ubuntu Linux.
MR. TURNER: So it had a Linux half and a Windows half?
CHRISTOPHER JON BEESON: Essentially, yes.
MR. TURNER: What part of it did you have access to?
CHRISTOPHER JON BEESON: At that time it was running Ubuntu Linux.
MR. TURNER: It can't operate both at the same time?
CHRISTOPHER JON BEESON: Not at the same time.
MR. TURNER: So what did you do while you were logged into the Linux side of the computer?
CHRISTOPHER JON BEESON: Could you be more specific?
MR. TURNER: So you had access to the Linux side of the computer.
CHRISTOPHER JON BEESON: Mm-hmm.
MR. TURNER: What did you do to recover data?
CHRISTOPHER JON BEESON: Like I said, initially what I did was I started looking at the home directory. For example, on Linux that would be like the "my documents" folder in your Windows computer. Right? And I started by containerizing all the files that were in that folder on the laptop, and then I did a series of other folders. OK?
And once I completed that and we still had access to the laptop, we decided that we wanted to make an image, which is a complete copy, of the unencrypted version of the whole volume or partition that was running Linux. The hard drive is divided into multiple segments, and one of those segments was fully accessible at that moment for us and so I wanted to create an image of that.
MR. TURNER: And by "partition" you are referring to the Linux half of the computer?
CHRISTOPHER JON BEESON: Yes. Exactly.
MR. TURNER: OK. So were you able to make a complete copy of that Linux partition?
CHRISTOPHER JON BEESON: I was.
MR. TURNER: And where did you copy the data onto?
CHRISTOPHER JON BEESON: I copied the data onto an FBI-owned hard drive.
MR. TURNER: I'm showing you what's been marked as Government Exhibit 500.
(Pause)
MR. TURNER: Do you recognize this exhibit?
MR. TURNER: How do you recognize it?
CHRISTOPHER JON BEESON: It is a hard drive which contains consolidated data from our search.
MR. TURNER: And among the data on the hard drive, did you include the data from the Linux half of the computer, the Linux half of the laptop?
CHRISTOPHER JON BEESON: Yes, I did.
MR. TURNER: Did you give that data a filename on that hard drive?
CHRISTOPHER JON BEESON: Yes, I did.
MR. TURNER: What was that file name?
CHRISTOPHER JON BEESON: That file name was sda_crypt.dd.
MR. TURNER: Is it sda or sda4_crypt?
CHRISTOPHER JON BEESON: I have to refer to my notes. I thought it was sda4_crypt. Is that right? Did I say sda?
MR. TURNER: You said "sda" originally. So which is right?
CHRISTOPHER JON BEESON: Sda4. Thank you.
MR. TURNER: Besides the laptop, were there any other digital devices that you helped preserve as part of Mr. Ulbricht's arrest?
CHRISTOPHER JON BEESON: Yes, we did.
MR. TURNER: Showing you what's been marked, already been admitted into evidence, as Government Exhibit 502.
MR. TURNER: Do you recognize this exhibit?
CHRISTOPHER JON BEESON: Yes, I do.
MR. TURNER: How do you recognize it?
CHRISTOPHER JON BEESON: This exhibit is marked with a yellow sticker. It's also a 16 gig SanDisk USB thumb drive.
MR. TURNER: And there is another thumb drive in there as well?
CHRISTOPHER JON BEESON: That is correct. There is also a 4 gigabyte USB thumb drive. Looks identical, almost.
MR. TURNER: So what did you do with these thumb drives?
CHRISTOPHER JON BEESON: So these thumb drives were brought to me later and I imaged them in their entirety.
MR. TURNER: And what did you do with that copy of the data?
CHRISTOPHER JON BEESON: That data was also consolidated onto this disc, Government Exhibit 500.
MR. TURNER: And what did you do with the -- I'm sorry.
The thumb drives, what is the exhibit number you see in front of you?
CHRISTOPHER JON BEESON: I see 502A.
MR. TURNER: OK. I think I misspoke and I said 502. So let the record reflect that 502A is in front of the witness.
So once you loaded all this data onto the hard drive, what did you do with the hard drive?
CHRISTOPHER JON BEESON: So once we consolidated everything onto this drive here, this hard drive was shipped to the FBI New York Field Office.
MR. TURNER: Before you sent the hard drive to the New York Field Office, did you hash the various files that you put onto the drive?
CHRISTOPHER JON BEESON: Yes, I did.
MR. TURNER: Including the sda4_crypt file?
CHRISTOPHER JON BEESON: Yes, sir, I did.
MR. TURNER: And the files from the thumb drives?
MR. TURNER: And can you explain what it means to hash a file and why that is done?
CHRISTOPHER JON BEESON: Sure. So a hash is a way to generate a digital fingerprint of data. OK? And it's unique to that group of data. It's a way that we can authenticate a file to make sure it hasn't changed.
MR. TURNER: OK. So if you take the sda4_crypt file, how do you hash it?
CHRISTOPHER JON BEESON: How do I hash it?
MR. TURNER: Yes.
CHRISTOPHER JON BEESON: So what I'm going to do is I'm going to use a tool, computer tool application, and I'm going to run -- I'm going to tell the application to read this file in, and the application will take all the data, the data stream in that file, and will generate a hash value.
MR. TURNER: Is that like a long string of numbers?
CHRISTOPHER JON BEESON: It is. It is a 32-character hexadecimal string, so it is numbers and letters.
MR. TURNER: And if you have one file that is just a tiny bit different than another, what is the difference between the hashes?
CHRISTOPHER JON BEESON: It is substantially different. So when you look at two hashes, if the file is changed in only the smallest way -- a period is deleted from a text file, for example -- the hash will result in an entirely different appearing value.
MR. TURNER: So the hash values that you calculated, did you record them anywhere?
CHRISTOPHER JON BEESON: I did.
MR. TURNER: Would you take a look at what's been placed in front of you, the binder of exhibits, there is an Exhibit there 500A.
Do you recognize this document?
MR. TURNER: What is it?
CHRISTOPHER JON BEESON: It is a -- this is a file -- a printed file that I created that has the hash value and file name of every file that we provided on this hard disc to the FBI in New York.
MR. TURNER: The government offers Exhibit 500A into evidence.
MR. DRATEL: No objection.
THE COURT: Received.
(Government's Exhibit 500A received in evidence)
MR. TURNER: Publish 500A, please, and go to the middle of page 2 and zoom in at sda4_crypt.
MR. TURNER: Mr. Beeson, can you help me find it?
CHRISTOPHER JON BEESON: Yes. It is in the center of the page. I lost the laser pointer that somebody gave me. There we go.
MR. TURNER: So maybe we can zoom in right there.
Is that the hash value you calculated?
CHRISTOPHER JON BEESON: Yes. It is the hash value that starts with "1e610e." There we go.
MR. TURNER: And could you take a look at Government Exhibit 502A -- sorry, is it 205A?
(Pause)
CHRISTOPHER JON BEESON: I believe it's 502.
MR. TURNER: It's 205A. We've already actually gotten it into evidence.
MR. TURNER: Could we put it on the screen, Mr. Evert?
CHRISTOPHER JON BEESON: My apologies.
MR. TURNER: That is not it.
MR. TURNER: 502. Sorry about that.
Do you see 502 in your binder?
CHRISTOPHER JON BEESON: I do, sir.
MR. TURNER: OK. Did you create that document?
CHRISTOPHER JON BEESON: I did.
MR. TURNER: What is it?
CHRISTOPHER JON BEESON: This is a printed log from one of the tools that we use to create forensic images of media, whether it be thumb drives, hard drives.
MR. TURNER: And so what does it reflect?
CHRISTOPHER JON BEESON: It is a summary of information from a log -- 16-gigabyte hard drive, Government Exhibit 502A.
MR. TURNER: Does it include a hash value for the data from the 16-gigabyte thumb drive that you referenced earlier?
CHRISTOPHER JON BEESON: It does.
MR. TURNER: Where is that hash value reflected?
CHRISTOPHER JON BEESON: It is actually reflected in two places on that document. One is where it said "computed hashes" about the middle of the page, "md5 checksum." Yes. And then again at the bottom where it was re-verified that it was the same.
So the first hash was when we copied the data, and then we copied it to all of those files that are listed there, USB Sandisk 801, 802. And then the lower hash value indicates that it again checked and the fingerprint was the same in both instances.
MR. TURNER: So you had fingerprinted the data. You sent it to the New York field office. And then what can the New York field office do with those fingerprints?
CHRISTOPHER JON BEESON: So they can also hash this data and make sure that the data didn't change or get damaged at any time during shipping or during access.
MR. TURNER: Did you take any pictures while you were working on the laptop?
CHRISTOPHER JON BEESON: I did.
MR. TURNER: Can you take a look at 501A, B, C and D in your binder and tell me if you recognize those.
(Pause)
CHRISTOPHER JON BEESON: Yes, I recognize them.
MR. TURNER: And what are they?
CHRISTOPHER JON BEESON: These are screenshots that I took of the laptop when -- well, a while after we had imaged it. We had already made our copies. And I took these screenshots there of open Windows applications that were running on the laptop when I first encountered it.
(Continued on next page)
BY MR. TURNER:
MR. TURNER: What did you take those shots with?
CHRISTOPHER JON BEESON: My FBI-issued camera.
MR. TURNER: And does the exhibit reflect the time that the camera shots were taken?
CHRISTOPHER JON BEESON: The metadata from each picture is here, yes.
MR. TURNER: Does the metadata accurately reflect the time that the shots were taken?
CHRISTOPHER JON BEESON: Yes. So it turns out that my camera was about 40 minutes slow at the time I took these pictures. So all the times reflected in the metadata for the picture is 40 minutes slow.
MR. TURNER: Okay.
MR. TURNER: The government offers these Exhibits 501A, B, C and D into evidence, your Honor.
MR. DRATEL: No objection.
THE COURT: Received.
(Government's Exhibits 501A-501D received in evidence)
MR. TURNER: Can we look at 501A. Please. What does this depict?
CHRISTOPHER JON BEESON: 501A is a picture of an open Tor browser session.
MR. TURNER: And 501B?
CHRISTOPHER JON BEESON: This is the lower half of the same browser window.
MR. TURNER: 501C?
CHRISTOPHER JON BEESON: This is a photograph of an open chat session.
MR. TURNER: And 501D?
CHRISTOPHER JON BEESON: This is a picture I took of some commands that I was issuing in trying to copy the laptop early on, and I wanted to record it for -- mostly for my note-keeping, my recordkeeping.
MR. TURNER: At the bottom, there's a line that says frosty@frosty. Can you explain what that reflects.
CHRISTOPHER JON BEESON: Sure. Frosty@frosty in Linux or in Unix, the host name for the system and the user in this system show up here in these terminal windows. So what this indicates is that the user Frosty is currently logged into the host or the computer named Frosty.
MR. TURNER: Can you just break that down a little bit.
When you have a computer, let's say in Windows, what's a default host name for a computer in Windows?
CHRISTOPHER JON BEESON: Oftentimes in Windows, it's just "My Computer".
MR. TURNER: And can the user rename the computer?
CHRISTOPHER JON BEESON: They could. They could name it Chris' computer.
MR. TURNER: Can you do the same thing in Linux?
CHRISTOPHER JON BEESON: Absolutely. You can use any host name you'd like.
MR. TURNER: What does it indicate the computer name of this computer was?
CHRISTOPHER JON BEESON: The computer name was Frosty.
MR. TURNER: And on that computer, the user can create accounts on the computer, right?
CHRISTOPHER JON BEESON: That's correct.
MR. TURNER: So what accounts was logged into this computer at the time?
CHRISTOPHER JON BEESON: According to this terminal window, Frosty.
MR. TURNER: No further questions.
THE COURT: Mr. Dratel.
MR. DRATEL: Thank you, your Honor.
CROSS-EXAMINATION BY MR. DRATEL:
MR. DRATEL: You just mentioned that you took some photographs of the laptop?
CHRISTOPHER JON BEESON: Yes, sir, I did.
MR. DRATEL: And the ones that you put in evidence were not the only photographs, correct? You took additional photographs?
CHRISTOPHER JON BEESON: That's correct.
MR. DRATEL: Let me show you what's marked as Defendant's H --
CHRISTOPHER JON BEESON: Thank you.
MR. DRATEL: -- and just ask you if you recognize that.
CHRISTOPHER JON BEESON: I can't say that I do recognize this as one of the photos I took. I may have. I took numerous photos of open screenshots. I would have to see the file information or the metadata relating to this photo to confirm it.
MR. DRATEL: Okay. I'll go --
CHRISTOPHER JON BEESON: Because I did take several shots.
MR. DRATEL: Yeah. And several shots of the laptop, right?
CHRISTOPHER JON BEESON: That's correct.
MR. DRATEL: I'll move on. We'll find them. So, in terms of trying to capture what was on the laptop, the use of the tar command, correct, T-A-R?
CHRISTOPHER JON BEESON: That's right.
MR. DRATEL: That's to archive the files that you tell it to copy, right?
CHRISTOPHER JON BEESON: That's correct.
MR. DRATEL: The command is really just essentially like any other command on a computer, just telling the computer what to do with a keystroke or series of keystrokes, right?
CHRISTOPHER JON BEESON: Yes, sir.
MR. DRATEL: Essentially, it reads those files and then places them in an archive, the tar command, right?
CHRISTOPHER JON BEESON: That's correct, much like a zip file, sir.
MR. DRATEL: And but by doing this, you change all the access times for all those files that you're tar'ing to the time when you tar, right?
CHRISTOPHER JON BEESON: The access times can be changed; yes.
MR. DRATEL: Isn't that what happened here, that the access times were all changed by that tar'ing command?
CHRISTOPHER JON BEESON: Because I'm not the forensic analyst on this case, I don't know exactly whether or not those were changed.
MR. DRATEL: Well, there's a way to tar without changing access dates, right?
CHRISTOPHER JON BEESON: I am not familiar with the way for sure.
MR. DRATEL: But if the access files are changed, then they only reflect the time that you tar'ed it, right, and not the access files that existed on the laptop itself?
CHRISTOPHER JON BEESON: If, in fact, the access times were changed as part of the archiving process, then, yes, they would have been changed to the current time when the archive was created.
MR. DRATEL: Now, you're familiar with the Guidelines for Evidence Collection and Archiving issued in 2002?
CHRISTOPHER JON BEESON: Not specifically, sir.
MR. DRATEL: Are you familiar with a section that says don't run programs that modify the access times of all files on the system, e.g., tar or X copy?
CHRISTOPHER JON BEESON: If I'm not familiar with the section, I wouldn't be familiar with that specific --
MR. DRATEL: Now, while you were running the tar command on the Frosty directory -- and by the way, Frosty is the main directory on the computer?
CHRISTOPHER JON BEESON: It's the home directory.
MR. DRATEL: The home directory.
So you received an error message, correct?
CHRISTOPHER JON BEESON: While I'm tar'ing?
MR. DRATEL: Yes.
CHRISTOPHER JON BEESON: I may have.
MR. DRATEL: Do you recall?
CHRISTOPHER JON BEESON: I don't recall for certain.
MR. DRATEL: Let me show you what's part of 3512-1. 3512-1 -- and I'll give you the entirety of it so that you can look at it. Just ask you to look at page three, this is double-sided, and that second paragraph.
CHRISTOPHER JON BEESON: Sure. May I ask you for clarification. I just want to make sure I'm at the right photograph. It starts "Frosty user folder"?
MR. DRATEL: Yes.
CHRISTOPHER JON BEESON: I'm ready.
MR. DRATEL: Does that refresh your recollection that you received an error message during the tar process?
CHRISTOPHER JON BEESON: Yes, it does. These are my notes.
MR. DRATEL: Yes. I'm saying that refreshes your recollection. I have to ask a question a certain way for evidentiary purposes.
CHRISTOPHER JON BEESON: Yes, it does, sir.
MR. DRATEL: Okay. Thank you.
And the error message was "File changed as we read it exiting with failure status due to previous errors." Right?
CHRISTOPHER JON BEESON: That's correct.
MR. DRATEL: And at that point, you weren't sure whether you had properly copied all of the files -- whether the tar process had been completed at the point that you got that error message, correct?
CHRISTOPHER JON BEESON: That's correct.
MR. DRATEL: And there are a number of possible reasons for that kind of error message, right?
MR. DRATEL: And one is that while the -- as you mentioned -- withdrawn.
Just go back a bit. You talked about live capture versus the machine being off, correct?
MR. DRATEL: So if the device is off, then you're not worried about changing files, right, but while it's on, files can be changing while you're tar'ing, right?
CHRISTOPHER JON BEESON: That's correct. It's a live file system, so things are happening constantly.
MR. DRATEL: Right. And that's one of the possible reasons for an error message, correct?
CHRISTOPHER JON BEESON: It's a likely explanation for this error message.
MR. DRATEL: You didn't know precisely, though, right, and you don't know even today what the precise reason for that error message was?
CHRISTOPHER JON BEESON: I don't, nor do I know the file that caused the message.
MR. DRATEL: And when you created the disk image of Mr. Ulbricht's laptop, you didn't use any proprietary computer forensic software, right?
CHRISTOPHER JON BEESON: I did not.
MR. DRATEL: And that's -- some of that software can automate the process of capturing a hard drive image?
CHRISTOPHER JON BEESON: In a live capture scenario, sir?
MR. DRATEL: Well, is that different?
CHRISTOPHER JON BEESON: It is.
MR. DRATEL: All right. So you used a piece of software called DD, right?
MR. DRATEL: And that's built into many Linux-based operating systems?
MR. DRATEL: And that's a delicate program, right?
CHRISTOPHER JON BEESON: It's a powerful program.
MR. DRATEL: In the computer world, doesn't DD have a widely-accepted meaning in the forensics community for disk destroyer?
CHRISTOPHER JON BEESON: I'm not familiar with that. I've -- I've heard it or read it, but it's not what it means.
MR. DRATEL: But it can have disastrous consequences for imaging if a mistake is made, correct?
CHRISTOPHER JON BEESON: Yes. As I said, it's a powerful tool.
MR. DRATEL: And so at 7:42 p.m. that evening, the first of October, you attempted to generate an MD5 Hash value of the device mapper of on the drive on the computer, right?
CHRISTOPHER JON BEESON: Of the folder depth mapper.
MR. DRATEL: What did you attempt to get an MD5 Hash for?
CHRISTOPHER JON BEESON: Well, I attempted several MD5s, so I just want to make sure I'm answering.
MR. DRATEL: At 7:42.
CHRISTOPHER JON BEESON: One moment. Okay. Could you repeat that question for me, sir.
MR. DRATEL: Sure. Yes. At 7:42 p.m., 1942 hours essentially, you attempted to get -- to generate an MD5 Hash value, right?
CHRISTOPHER JON BEESON: Actually, what I was attempting to do was to DD the disk, to make a copy or an image of the disk; and at the same time, take that data stream as I read it and pipe it into MD5 sum which would generate my digital fingerprint of the disk at the same time.
MR. DRATEL: Right. And that failed, right?
CHRISTOPHER JON BEESON: It did.
MR. DRATEL: Permission was denied?
CHRISTOPHER JON BEESON: That's correct.
MR. DRATEL: So, then you re-performed the command, though, but without doing an MD5 Hash value at the same time, correct?
CHRISTOPHER JON BEESON: That's correct.
THE COURT: You have just a couple of minutes left on today's session, Mr. Dratel.
MR. DRATEL: I don't know that I'll finish, your Honor.
THE COURT: Just to let you know that we'll end at 5:00.
MR. DRATEL: Okay. Thank you.
MR. DRATEL: Now, the live capture environment, because you're not sure what -- you're not capturing an inactive image, that the image is active, it's called slurring; is that right?
CHRISTOPHER JON BEESON: I'm not familiar with the term slurring.
MR. DRATEL: Well, you knew that the DD file that you created was not a replica in exact terms of computer forensic terms of the hard drive because of the active file system at the time, right?
CHRISTOPHER JON BEESON: It was a replica at the instantaneous point in time when it was made.
MR. DRATEL: But it wouldn't match the DD file you created even a second later?
CHRISTOPHER JON BEESON: It would never match because every time I typed something into the keyboard, parts of the file system would change again.
MR. DRATEL: And you didn't generate the MD5 Hash until a couple days later, correct, October 3?
CHRISTOPHER JON BEESON: That's correct.
MR. DRATEL: And that was when you had started the random access memory - what we call RAM - capture of the laptop, correct?
CHRISTOPHER JON BEESON: That's correct.
MR. DRATEL: And are you familiar with the term "order of volatility" in terms of computer forensics?
MR. DRATEL: So you attempt to capture the most volatile parts of the system first, which is the memory, correct?
CHRISTOPHER JON BEESON: I think in this instance it's arguable.
MR. DRATEL: But that's the general principle, right?
CHRISTOPHER JON BEESON: The general principle is, yes.
MR. DRATEL: But you didn't try to capture the memory until you'd already done two other processes, correct?
CHRISTOPHER JON BEESON: That order was very carefully selected; yes.
MR. DRATEL: I'm kind of going into a different area, Judge.
THE COURT: How much more do you have?
MR. DRATEL: I probably have about ten to 12 minutes left.
THE COURT: Ladies and gentlemen, we will break for today and come back on Monday. And I want to remind you not to talk to each other or anybody else about this case. I also want you to make sure that if you run into any media or news articles about this case, that you avert your eyes and that you don't update your Facebook account or do any tweeting about this case of any kind.
We'll pick up on Monday at 9:30, and I'll see you then. Thanks very much. Have a good weekend.
(Jury excused)
(Continued on next page)
(In open court; jury not present)
THE COURT: You can step down, sir. Thank you.
(Witness temporarily excused)
THE COURT: Let's all be seated.
Mr. Turner, I know your witness has been hung over the weekend, but it's important that people not feel too rushed if they have got additional examination.
MR. TURNER: We try.
THE COURT: So we gave it a go and it will be what it will be, so we'll pick up with Mr. Beeson then on Monday morning.
At this point in time, does the government have much redirect?
MR. TURNER: No.
THE COURT: So who is going to be the next witness then after him?
MR. TURNER: The next agent would be Special Agent Gary Alford from the IRS.
THE COURT: And then after Mr. Alford?
MR. TURNER: Then HSI Special Agent Dylan Critten.
THE COURT: Those are the next two on my sheet.
MR. TURNER: We are going to make some relatively minor additions to our witness list. We're going to be calling one document custodian, I believe, and we're also going to have one additional agent testify. It shouldn't be more than 20 minutes or so of testimony.
THE COURT: All right. In terms of the document custodian, is there any -- have you folks discussed whether it's the kind of thing that there can be a stipulation as to so we can eliminate the need for the custodian?
MR. TURNER: We can discuss it. But I think it's the sort of thing that a document custodian from the company will be able to explain. We were originally going to have an agent testify about it, but as we thought about it, we thought it would be easier to explain it to the jury.
THE COURT: Whatever you choose to do. Sometimes document custodians can be eliminated through stipulation. If they can't be, then they can't be.
MR. TURNER: Of course.
THE COURT: In terms of any other additions, I assume you'll confer with Mr. Dratel first to see whether or not there is any objection to that or if you can talk about the reason on that so there's no need for any kind of court intervention with that.
MR. TURNER: Yes, your Honor.
THE COURT: Have you previewed each other about that already?
MR. TURNER: About five minutes ago.
THE COURT: Confer first and then write me a letter if I need to look at anything in advance or we can deal with it Monday morning, but if it's helpful for me to get up to speed in advance -- if it's a response for certain testimony and you want to preview that, you can do that.
Would the government also go through the witness list and adjust whatever times now that you see how things are going and what you may want to do or not do in terms of what your projections are.
MR. TURNER: We'll submit a revised witness list over the weekend.
THE COURT: Terrific. Based on what you said, and I have no idea what the cross-examination would be, it strikes me that we would be likely to get to the -- for the government to rest on around February 2, which would be about a week from Monday.
Does that seem about right or do you think in your gut it's going to go faster or slower or do you just not know?
MR. TURNER: I think that sounds about right, your Honor.
THE COURT: Then, Mr. Dratel, is there any adjustment to what we had talked about that first day that you know of now? We talked about how long you thought you would take. I'm trying to get a sense frankly. We have juror number ten who will have some timing issues at some point, which I'll try to resolve, but I may not need to or they may not need to be resolved if we're going to end before the middle of the month.
MR. DRATEL: I don't know that it's any different in the sense of certainly in terms of commitment, but we do have a better crystallization of what we are going to want to do in that context. But I'll try by the end of tomorrow, certainly by the end of Sunday, to have something prepared.
We'll be getting our notices to the government. I think we're in a position now to provide -- in other words, to commit to certain things at least on a level of what we wanted to. We have gone far enough that I can make certain decisions in that regard.
THE COURT: I would say, if it turns out from the government's review of its witness list and going through the timing again, if it still looks like the government might rest on a week from Monday, thereabouts, about Tuesday/Wednesday, I'll start asking you, Mr. Dratel, for a better estimate and whether or not you for sure know one way or the other whether the defendant is likely to testify. You don't have to make a final decision, of course, until the moment you call him, but just to get a sense of timing.
MR. DRATEL: Sure. Your Honor, I just wanted to say that obviously I've just learned about the new witnesses, but I also learned about a witness the government is not intending to call anymore.
MR. TURNER: I think it's subject to discussion.
MR. DRATEL: Okay.
THE COURT: All right. Then I'll get the new witness list. Let me see. Those are the new estimates.
Yesterday the government had mentioned that it wanted to request a jury instruction or instruction to the jury. I did then give the instruction that we discussed.
Was there anything else that the government believed was necessary? Do you remember this?
MR. TURNER: Yes.
THE COURT: Do you think it's taken care of?
MR. TURNER: Yes.
THE COURT: I didn't know if there were two instructions you were thinking of in terms of that that were going to be separate, one for the AA, one for the other pieces.
MR. TURNER: No, I think your Honor's instruction was sufficient, combined obviously with the direct testimony.
THE COURT: I have little notes of things that are open. You'll get the jury instructions, your first draft, tomorrow. My practice is to iterate. Depending upon how much time we have, my goal would be to get comments from you folks Monday evening, hopefully in Word form, just in comments and the text, and we start a charging conference on Tuesday at 9:00.
What I'll do is, we'll start with whatever page people have comments on first and you'll both give me your comments. If you've got language changes, you'll give me language changes as opposed to sort of, you know, 'I don't really like the way this is.'
So if you have issues, be as specific as possible and if you disagree with an instruction, come prepared with a case cite or whatever it is you think supports your view.
And can I get a copy of GX 226, Government Exhibit 226. It's the chat that you read, Mr. Howard, just before Mr. Beeson was called.
MR. TURNER: I believe it's 226D.
THE COURT: Maybe I just had written it down wrong and that was why I didn't see it in my book. I've got 226D. Fine.
Is there anything that you folks would like to raise?
MR. TURNER: No, your Honor.
THE COURT: Mr. Dratel.
MR. DRATEL: No. Thank you, your Honor.
THE COURT: Then we'll pick up Monday morning at 9:00 with us and I'll receive over the weekend from the government, or whenever it is, the revised witness list. You folks will talk. You'll let me know if there are things that you know of in advance that you want to raise by letter, and you'll get a copy of the draft jury instructions tomorrow.
Thanks. We're adjourned.
COURT CLERK: All rise.
(Adjourned to January 26, 2015 at 9:00 a.m.)
* * *