2.Christopher Jon Beeson — Cross/Redirect/Recross (Part 2)
145 linesCROSS-EXAMINATION BY MR. DRATEL:
MR. DRATEL: Good morning, Mr. Beeson.
CHRISTOPHER JON BEESON: Good morning.
MR. DRATEL: I just want to go back to something I showed you last week Thursday and show you a different version. This will be Defendant's H and ask if you recognize that.
CHRISTOPHER JON BEESON: I do recognize it as one of the pictures I took.
MR. DRATEL: Of the laptop while you were working with it?
CHRISTOPHER JON BEESON: Yes, this is a screen shot.
MR. DRATEL: OK. I move it into evidence, your Honor.
MR. TURNER: I have no objection.
THE COURT: Received; Defendant's Exhibit H.
MR. DRATEL: Thank you.
MR. TURNER: So looking at "H" we can get it published.
(Pause)
MR. DRATEL: And looking at "H" you see on the top of that line across and that's a bitcoin client program operating right where it says the Colbert report?
CHRISTOPHER JON BEESON: Unfortunately, I don't know for sure what it is. I can see that it says the Colbert report but I don't know what kind of application it is.
MR. DRATEL: But if you look at the metadata that's part of this exhibit now which -- did that enable you to recognize it, by the way?
CHRISTOPHER JON BEESON: Yes, it did. Thank you.
MR. DRATEL: So that's the 7:56 p.m. on October 1, 2013?
CHRISTOPHER JON BEESON: That's what it says, yes.
MR. DRATEL: 40 minutes off?
CHRISTOPHER JON BEESON: 40 minutes off.
MR. DRATEL: Which way though?
CHRISTOPHER JON BEESON: It's slow. So we'd have to add 40 minutes to this time making it 8:36.
MR. DRATEL: 8:36 p.m. San Francisco time?
CHRISTOPHER JON BEESON: Yes, sir.
MR. DRATEL: And it says 197 -- no, it says 197 megabites uploaded 26.10 MB, right? Do you see on top of the red line?
CHRISTOPHER JON BEESON: Yes, I do.
MR. DRATEL: Now, you took these photos after you had already imaged the laptop, correct?
CHRISTOPHER JON BEESON: My recollection is that the laptop was in the process of being imaged. In other words, I had started the process and was taking these photographs at that time.
MR. DRATEL: Did you testify Friday that you had already made your copies that you took the photos after you had imaged it?
CHRISTOPHER JON BEESON: I would have to refer to my notes to be sure on the times. A lot of times things are done as I go. You know, once I start something I can start something else. So exact times I can't recall.
MR. DRATEL: I just want to publish for a second Defendant's G which is already in evidence.
(Pause)
MR. DRATEL: And there it says "uploaded 8.35 megabites". Can you see that?
CHRISTOPHER JON BEESON: It's a little blurry on my screen but it looks like it could be 8.35.
MR. DRATEL: OK. An on the one that we just saw that you took it's 26.1 megabites, right?
MR. DRATEL: So, are you not familiar with the program that's running on Defendant's H?
MR. TURNER: Objection; asked and answered, beyond the scope and relevance.
THE COURT: Sustained.
MR. DRATEL: And you didn't generate the MD5 hash value for the laptop until October 3 when you started the RAM capture?
CHRISTOPHER JON BEESON: Correct.
MR. DRATEL: And the RAM capture is essentially the running memory on the laptop?
CHRISTOPHER JON BEESON: Yes. RAM is random access memory, that's correct.
MR. DRATEL: Can you just define that for the jury, please?
CHRISTOPHER JON BEESON: Yeah. So, random access memory is the memory in your laptop or computer that's used by not hard drive storage. It is that instantaneous memory that the basic code for the programs get loaded into RAM and then your computer can use it in there.
MR. DRATEL: And that gives you a window -- it gives you a ability to see what processes are running on a computer, right, RAM?
CHRISTOPHER JON BEESON: Whether it gives you what processes are running -- everything get's loaded into RAM. So all the binary codes, all the codes that the computer needs to run is loaded into RAM. That could be the active process. That could be the operating system and so forth.
MR. DRATEL: So on October 3 which is two days after you received the laptop you began to do the RAM memory capture?
CHRISTOPHER JON BEESON: That's correct. One of my associates and I just to be clear.
MR. DRATEL: And you weren't quite sure how to do that RAM capture, correct?
CHRISTOPHER JON BEESON: The RAM capture was nontrivial.
MR. DRATEL: Right. But you weren't quite sure how to do it. You asked for assistance, in fact?
CHRISTOPHER JON BEESON: I did.
MR. DRATEL: You asked whether there was a RAM capture tool that you could use for it?
CHRISTOPHER JON BEESON: That's correct.
MR. DRATEL: And this is a relatively new field in computer forensics, RAM capture?
CHRISTOPHER JON BEESON: No. I wouldn't say it's a new field.
MR. DRATEL: Well, one of the things that is part of the RAM capture is encryption keys and passwords and other things that are stored in the memory, right?
CHRISTOPHER JON BEESON: That's correct.
MR. TURNER: Objection.
THE COURT: Overruled.
MR. DRATEL: And the processes that the computer -- the process of the computer programs that are running on the computer is something else that RAM can tell you, RAM memory capture would be able to reserve for you?
CHRISTOPHER JON BEESON: That information can be in RAM.
MR. DRATEL: And the active network connections at the time that the capture occurred would be something else?
CHRISTOPHER JON BEESON: It can be. It doesn't necessarily mean that it is.
MR. DRATEL: And it could also determine whether there were malware or viruses or other programs running on the system, correct?
CHRISTOPHER JON BEESON: It could be, yes.
MR. DRATEL: Now, you've used a piece of software called FMEM, F-M-E-M, to try to acquire the RAM memory?
CHRISTOPHER JON BEESON: That's correct.
MR. DRATEL: And system memory is broken down into registers called ranges; s is that right?
CHRISTOPHER JON BEESON: That's correct.
MR. DRATEL: And for FMEM you have to specifically point the program at the registers that you want the system that you'd rather that you want to capture, right?
CHRISTOPHER JON BEESON: That's correct. The RAM is divided into chunks, into groups, so to speak. Some are more protected than others.
MR. DRATEL: OK. And so -- and if you don't direct the capture process at the right registers of RAM they will go to something called uncachable, U-N-C-A-C-H-A-B-L-E?
CHRISTOPHER JON BEESON: I believe so.
MR. DRATEL: And you weren't sure at the time about this, is that fair to say?
CHRISTOPHER JON BEESON: Well, this is why I obtained the help from one of my associates.
MR. DRATEL: But in fact, the FMEM capture did not work entirely, correct?
CHRISTOPHER JON BEESON: Upon capturing what I believe was the third register or third section of the memory FMEM crashed the computer.
MR. DRATEL: And when it crashed the computer you were no longer able to get any of the RAM capture that you had not gotten initially, correct?
CHRISTOPHER JON BEESON: We were able to continue with the capture after the computer was restarted.
MR. DRATEL: Now, you in doing your RAM capture you consulted the manuals on the computer in an attempt to find out how to proceed, right?
CHRISTOPHER JON BEESON: I don't recall consulting any manuals on the computer.
MR. DRATEL: Did you keep a running roster of commands that you issued the computer during your work?
CHRISTOPHER JON BEESON: Yes, we did.
MR. DRATEL: I am going to show you what's marked Defendant's I for identification -- "K", I am sorry. Call it Defendant's K for identification. And ask you to look at page two of this document. I ask you if that refreshes your recollection that you consulted the manuals on the computer?
CHRISTOPHER JON BEESON: These are not the manuals for the computer. These are manuals for the applications MEMDUM and FMEM that may or may not have been on the computer.
MR. DRATEL: Right, but you were looking for them?
MR. DRATEL: And did you find one for MEMDUM?
CHRISTOPHER JON BEESON: I don't recall whether one came up or not.
MR. DRATEL: Well, there's no such file for that on a Lenox system, is there?
CHRISTOPHER JON BEESON: There could be. Depends on the Lenox system. Most likely there was not but I don't remember for certain. Chances are since I then checked for a manual for tool FMEM that there was no tool for MEMDUM on the system.
MR. DRATEL: And so you never got a full RAM memory capture, correct?
CHRISTOPHER JON BEESON: Can you define a full RAM memory capture, please?
MR. DRATEL: Well, why don't you.
CHRISTOPHER JON BEESON: Well, the difficulty in RAM capture is that it's live, so it's ever changing and it's ever active. When we captured what I believed was the third register or third group of memory from the RAM, the system crashed which is not that uncommon in RAM captures. And so after we were able to restart we restarted with our own version and move onto the next and we continued to capture the other registers that were still there.
MR. DRATEL: But when you had the capture open before it crashed it has all the operations going, correct?
MR. DRATEL: And so once it crashes and then you reboot it, you've lost all of that information that's included that went live before it crashed, right?
CHRISTOPHER JON BEESON: You do not lose all of the information.
MR. DRATEL: But you lose information?
CHRISTOPHER JON BEESON: Do you lose information.
MR. DRATEL: And you don't know what information you lost?
CHRISTOPHER JON BEESON: You do not know.
MR. DRATEL: And that information is lost to us forever, essentially?
CHRISTOPHER JON BEESON: It is.
MR. DRATEL: Nothing further, your Honor.
THE COURT: All right. Thank you.
Mr. Turner, anything further from the government?
MR. TURNER: One moment, your Honor.
(Pause)
MR. TURNER: Briefly, your Honor.
REDIRECT EXAMINATION BY MR. TURNER:
MR. TURNER: Agent Beeson, I talked to you about how when you are doing a live capture, things are changing. Could you explain a little bit more what that means if you type something on a keyboard just a single press of a keyboard does that change --
CHRISTOPHER JON BEESON: Yeah. So in performing a live capture of basically capturing data from a running computer whether it be from the hard drive or from the RAM, everything that we do is to some degree altering information. And so our goal is to minimize that alteration to the maximum we can but we do have to use the computer in order to capture this information.
MR. TURNER: So the sort of alterations you are talking about thought, does that involve --
CHRISTOPHER JON BEESON: Absolutely, not. It's very minimal footprint. We were trying our very best to not alter anything to the extent we can.
MR. TURNER: You talked about some errors you ran into or crashes. Any of those prevent you from making a full and complete copy of the Lenox half of the computer that we talked about on direct?
CHRISTOPHER JON BEESON: No, it isn't.
MR. TURNER: And those errors, could any of those errors have resulted in the generation of thousands of pages of TOR check logs on the computer that weren't there before?
CHRISTOPHER JON BEESON: Absolutely, not.
MR. TURNER: No further questions.
MR. DRATEL: Briefly, your Honor.
THE COURT: All right.
RECROSS EXAMINATION BY MR. DRATEL:
MR. DRATEL: But the RAM capture, we lost the ability to see what the computer was doing at that time, correct, in the full range of it, correct?
MR. DRATEL: Including connections to the internet, correct, in connection with what was going on with the internet?
CHRISTOPHER JON BEESON: I supposed. That's define as anything it's part of the group of things that could be in there.
MR. DRATEL: And the questions of malware and viruses and whatever else might have been on there we'll also never know, right?
CHRISTOPHER JON BEESON: Potentially.
MR. DRATEL: Nothing further. Thank you.
THE COURT: All right. Thank you.
MR. TURNER: Excuse me. One more question, your Honor.
THE COURT: One.
REDIRECT EXAMINATION BY MR. TURNER:
MR. TURNER: The RAM capture didn't prevent from you seeing what historically had been on the computer from years before?
MR. DRATEL: Objection as to form.
THE COURT: Overruled.
RECROSS EXAMINATION BY MR. DRATEL:
MR. DRATEL: You have no idea when anything was put on that computer, right?
CHRISTOPHER JON BEESON: I did not conduct the forensic exam on that computer, so.
THE COURT: All right. Thank you. You may step down, sir.
Would the government like to call its next witness, please.