|
Kirk Stockham
Preliminary Hearing November 17, 2003
Direct Examination by David Harris HARRIS: Sir, can you tell us what your full name is and spell your last name for the record? STOCKHAM: Kirk Wesley Stockham, S-T-O-C-K-H-A-M. HARRIS: And, do you have some connection with the Modesto Police Department? STOCKHAM: Yes, I'm a computer forensic investigator. HARRIS: And could you tell the Court briefly what your background, education or training is with the Modesto Police Department in that area? STOCKHAM: Okay. I've been a Modesto peace officer since 1977; and in 1994, I started working high-tech cases involving computer seizures and analysis. And later I went to many, many classes for law enforcement, POST-certified by the State of California, and obtained POST certification as a computer investigator. I also have some base education, an AA degree in police science, a bachelor's in sociology, a master's certificate in computer forensics. I'm also an instructor, and I also work for the Sacramento County Sheriff's Office as a computer forensic investigator and instructor. HARRIS: And have you previously testified in court as an expert in the area of computer forensics? STOCKHAM: Yes. HARRIS: As part of your assignment with the Modesto Police Department, were you asked to assist in the service of search warrants at the Scott Peterson's home -- at Scott Peterson's home and his warehouse? STOCKHAM: Yes. HARRIS: And did you assist? STOCKHAM: Yes. HARRIS: As part of your assistance, did you recover some computers from those locations? STOCKHAM: Yes. HARRIS: Were you asked to conduct an analysis of those computers? STOCKHAM: Yes. HARRIS: As part of your analysis, did you look to see if there was any research done on the computers with regards to bodies of water? STOCKHAM: Yes. HARRIS: Can you tell the Court --
Void Dire by Mark Geragos JUDGE: Before he gets into that, who's doing this? Mr. Geragos? GERAGOS: Yes, Your Honor. JUDGE: Do you wish to voir dire on his expertise on the computer area? GERAGOS: I do, Your Honor, if I could. VOIR DIRE EXAMINATION GERAGOS: GERAGOS: I didn't get your rank. Is it Detective? Officer? What do I call you? STOCKHAM: Computer forensics investigator. GERAGOS: Computer forensic investigator. How long you been doing that? STOCKHAM: Since 1994, so roughly nine years. GERAGOS: And what's your training to prepare you for that? STOCKHAM: Okay. I'm a member of IACIS, which is the International Association of Computer Investigator Specialists, and I'm a member of that organization and went through the two-week training and got certifications in that. I finished the Institute of Criminal Investigation Studies and became California POST-certified as a computer investigator. I also have upper-graduate work that resulted in a master's certificate in computer forensic science with the University of New Haven, and I've had hundreds of hours of miscellaneous courses in computer forensics and Internet investigations and computer investigations. GERAGOS: Have you testified previous in the Superior Court of this county? STOCKHAM: Yes, twice. GERAGOS: Twice? STOCKHAM: Is that -- GERAGOS: Have you qualified as an expert both times? STOCKHAM: Yes, I did. And Sacramento County Superior Court. GERAGOS: One occasion? STOCKHAM: Yes, a jury trial. GERAGOS: Jury trial. Were both -- or I should say were all three of those times that you qualified as an expert, was it based upon retrieving something off of the hard drive of the computer? STOCKHAM: Yes, in all cases, it was a criminal case where I seized computers, copied them and analyzed the data and came up with results that were evidence in the case. GERAGOS: When you say "copied them," you mean copied the hard drive and then took something off of the hard drive to do some kind of an analysis for the prosecutor? STOCKHAM: Yes. GERAGOS: Thank you. I have no further questions. JUDGE: I'll allow him to testify as an expert in the area of computer forensics.
Redirect Examination by David Harris, resumed HARRIS: Investigator, I was starting to ask you if you conducted a search of the computers to see if there were any searches or anything on the computers about bodies of water. STOCKHAM: Yes. HARRIS: Did you find any? STOCKHAM: Yes. HARRIS: Could you explain to the Court what you found? STOCKHAM: There were many computer files on the hard drives showing Internet research for bodies of water, descriptions of them, graphics and pictures of them. HARRIS: Now, when you look at these particular files, does it indicate if there's some type of user? STOCKHAM: In some cases. One particular case, yes. HARRIS: And one particular case, did it indicate who was the user? STOCKHAM: There was a file structure pointer to a website where a graphic came from, which was the San Francisco Bay Area, and along with the pointer was the user name of Scott Peterson in actual data. HARRIS: Now, when the computer, someone uses it or goes to a particular site and something comes from that site, does the file keep part of that, or does the computer keep part of that? STOCKHAM: Yes, quite often. HARRIS: And how does that work? STOCKHAM: Well, with the -- with Internet surfing, one sets up their computer to dial in or some other way of connecting to the Internet; and once they enter that huge network, they go to websites, which are computers at various places around the world, and they access another computer and they access computer files. As the computer files are displayed on the screens in graphics or text or animations, those files are deposited on the person's PC in what's called cache folders. And you can often see what a person has been doing recently by just looking at the files that came from the Internet. HARRIS: Now, with regards to the computers that we're talking about and this user of Scott Peterson, was there searches of bodies of water that took place in December of 2002? STOCKHAM: Yes. HARRIS: Can you give the Court examples of some of the bodies of water or how many bodies of water were there? STOCKHAM: Well, I found a -- computer files that were dated in December, and it showed a research for the San Francisco Bay Area bodies of water, Central Valley bodies of water, like reservoirs and lakes. In fact, I printed out many of the actual pieces of data that came off that PC as part of the report. HARRIS: So when you were done doing this examination, did you prepare a report and document all of those files to your report? STOCKHAM: Yes. HARRIS: I'd like to show you what's been marked as People's next in order, Number 141. I had it marked during the break and I'll show it to counsel now. Showing you what's been marked as People's Number 141, do you recognize that? STOCKHAM: Yes. HARRIS: Can you tell the Court what that is? STOCKHAM: That's a graphics from the US Geological Survey website dated 12/8 of '02, showing the central San Francisco Bay. It's a velocity chart of either wind currents or water currents. I'm not sure. HARRIS: But it's something that goes to the US -- STOCKHAM: US Geological Survey website. HARRIS: And this is a chart of the Bay Area? STOCKHAM: Oh, it's definitely the central Bay Area, yes. HARRIS: People have no further questions.
Cross Examination by Mark Geragos GERAGOS: You had a -- what I've marked as -- or what I'd like to mark as Defense next in order. It's a three-page document entitled "USA Fishing." CLERK: JJ. (Defendant's Exhibit JJ was marked for identification.) GERAGOS: JJ. GERAGOS: Is this something that you saw on the computer? STOCKHAM: Yes. The Captain Hook Sportfishing. I saw that. GERAGOS: Captain Hook Sportfishing. Do you know -- did you ever check to see where there's -- on Captain Hook's Sportfishing, the San Francisco Bay Report, that it talks about -- how do you pronounce that? STOCKHAM: Suisun. GERAGOS: Bay? STOCKHAM: Suisun Bay. GERAGOS: And is this the document that's 141, is that Suisun Bay? STOCKHAM: Yes. That's another website graphic that's nicely labeled with the location. GERAGOS: With the location for Suisun Bay? STOCKHAM: Yes. GERAGOS: So the three pages from the USA Captain Hook's Sportfishing site have or mention and talk about for a full half page Suisun Bay and what's happening over there; is that correct? STOCKHAM: Yes. GERAGOS: Okay. Also, on the first page, for Captain Hook's Sportfishing, it says -- talking about fishing's a crap-shoot, but the sturgeon are showing up here and yon; is that correct? STOCKHAM: Yes. GERAGOS: Okay. And these three pages, did you -- were you able to determine if this, what's been marked as People's 141, is a link to the USA Fishing website? STOCKHAM: The USA Fishing website? GERAGOS: The USA Fishing website. STOCKHAM: Oh, the Captain Hook's. GERAGOS: Yeah. The Captain Hook sportfishing, it has links, doesn't it? STOCKHAM: I didn't check to see if there was a link to the US Geological Survey, unless I see one on here. GERAGOS: There are links, however, that go to all the various bays; isn't that correct? STOCKHAM: There are words. Without having this printed out in color, I couldn't tell if they're clickable links. GERAGOS: I'm just giving you what I've got, what was produced to me in discovery, so I don't know if you've got it in color. But you don't know, as you sit here, whether or not he went onto the USA -- what is it? -- Captain Hook's Fisherman website -- STOCKHAM: Captain Hook's sportfishing. GERAGOS: -- and clicked onto that? Right. It talks about -- that came directly off of his computer; correct? STOCKHAM: Yes. GERAGOS: Okay. You don't know, as we sit here today, whether he went to the sportfishing website, looked at it, saw sturgeon were running, read the thing about the Suisun Bay, and then clicked onto another site or link, if you will, that showed a map? STOCKHAM: Okay. So you're asking the sequence, what happened first? GERAGOS: Right. STOCKHAM: I could probably tell that with further analysis by date and time stamps on the files. GERAGOS: As of right now we don't know, do we? STOCKHAM: Well, this does have a date stamp of 12/9/02 and -- GERAGOS: The other's got a date of 12/8. It's a picture of the map for 12/8. It doesn't show -- as it sits there, we don't know what date he clicked on it, do we? STOCKHAM: Well, I've tested the site, and when you click on this graphic, the website actually time stamps the picture on the date you're in the site. GERAGOS: Right here you haven't gone back to take a look at to see whether or not this is linked up to -- when I say "this," 141 is linked up to Captain Hook's Fishing website, have you? STOCKHAM: No, I did not actually look for that kind of linkage. GERAGOS: Okay. You have -- at least I've been given quite a bit of material that you went through; is that correct? STOCKHAM: Yes. GERAGOS: And somebody could do that, could they not, based upon the copy of the hard drive and taking a look at what the -- kind of the date and internal date and time stamp? STOCKHAM: Yes, my entire examination is repeatable by another expert. GERAGOS: Thank you. I have nothing further from this witness. HARRIS: Just briefly -- GERAGOS: Oh, wait. Could I have just one moment? I'm sorry (Whereupon defense counsel conferred off the record.) GERAGOS: I have no further questions. I'm sorry.
Redirect Examination by David Harris HARRIS: Investigator, looking at what's marked as 141, that's the color page up there. STOCKHAM: Yes. HARRIS: Are there two separate files that are printed out on that page? STOCKHAM: Yes. HARRIS: So let's make the record clear about this. The one in the top, the blue chart -- STOCKHAM: Yes. HARRIS: -- is that the San Francisco Bay chart that you're referring to? STOCKHAM: Yes. That's the one that had to have come from the US Geological Survey site, and the SuisunBay.gif, that graphic, I did not try to target where it came from. I'd have to look at it again. HARRIS: So the second -- just so we're clear about this, there are two graphics on that particular page? STOCKHAM: Correct. HARRIS: The top one is the San Francisco Bay chart? STOCKHAM: Correct. HARRIS: The bottom one is a map of Suisun Bay? STOCKHAM: Yes, and the theme of the bottom one is more like a road map and location map, where the top one is more like a water research, what the water and winds do in the Bay. HARRIS: Now, the bottom one, is that also a file date of 12/8, 2002? STOCKHAM: I'd have to look at my report to see the file properties on that one, sir. HARRIS: Okay. Looking -- you do know the one at the top, the blue San Francisco Bay chart that is a 12 -- STOCKHAM: 12/8/02. That was stamped by the site. HARRIS: Now, you were being asked about the defense exhibit in front of you from this sportfishing endeavor, and that has certain notations on it that give you dates? STOCKHAM: Yes, the bottom margin has some website location, directions and a date. HARRIS: And what is the date on that document? STOCKHAM: 12/9/02. HARRIS: People have nothing further.
Recross Examination by Mark Geragos GERAGOS: You said that Suisun Bay has a -- looks like a driving map; right? STOCKHAM: Yes, it has the freeways and the city boundaries. GERAGOS: You see what -- you have your glasses on? STOCKHAM: Yes. GERAGOS: Okay. What does it say right there on the top of Captain Hook's Sportfishing site? STOCKHAM: Okay. If I had that in color, that would probably be a zoomable driving map with some kind of links. GERAGOS: And People's 141 look like a zoomable driving map? STOCKHAM: Well, all graphics are zoomable, but yes, it probably is. GERAGOS: Kind of looks like somebody just clicked right onto the zoomable driving map from Captain Hook's or whatever that is, huh? STOCKHAM: Well, this is not a very big graphic, it's only -- just a little bit smaller than the top one. GERAGOS: Yeah. Kind of looks like that might be the link, doesn't it? STOCKHAM: No, I can't tell you that these two are linked. GERAGOS: You never bothered to look at that, did you? STOCKHAM: No, these two are on the same page simply because in the list of files when I told the computer to print out the files, I think it was alphabetical order. This one just came after this one. There's no significance. GERAGOS: Okay. Have you ever looked to see whether or not the one that's on the bottom there, the Suisun Bay, is linked to the one I just marked? STOCKHAM: Captain Hook Fishing? GERAGOS: Yeah. STOCKHAM: No. GERAGOS: You haven't checked that out? STOCKHAM: As I said before, no, I haven't checked that linkage. GERAGOS: Thank you. I have no further questions. HARRIS: No further questions. |