|
Kirk Stockham
Witness for the People: Guilt Phase August 2 & 3, 2004
Direct Examination by David Harris HARRIS: Mr. Stockham, did you used to work for the Modesto Police Department? STOCKHAM: Yes. HARRIS: And did you retire from them at some point in time? STOCKHAM: Yes. HARRIS: Approximately when did you retire? STOCKHAM: Retired on May 1st of 03. HARRIS: Prior to that, prior to your retirement, were you working in a particular assignment at the Modesto Police Department at the end of 2002 up until you retired? STOCKHAM: Yes. HARRIS: What is your assignment? STOCKHAM: I was titled a Computer Forensic Investigator. HARRIS: And what does a Computer Forensic Investigator to? STOCKHAM: Just like a law enforcement oriented computer technician. We find data for field officers who come across computers that may be involved in cases. HARRIS: As part of your assignment, do you have to receive any specialized training or education to be this computer forensic person? STOCKHAM: Yes. HARRIS: Could you tell us briefly about your background in computers? STOCKHAM: I have been a computer hobbyist since 1989. My first case in computer forensics was 1994. My base education is two-year degree in police science, a Bachelors Degree in sociology, and some post-graduate work where I received a Masters Certificate in Computer Forensics. I am POST Certified by the state of California as a computer crimes examiner, which required several hours of classroom work over many months. I have taken many law enforcement courses, including investigating of internet crimes, exploitation of children, the search and seizure of computers that have taken place, use of the software that I will be testifying about today. And I have taught on similar subjects as an instructor. HARRIS: Have you also testified as an expert in court? STOCKHAM: Yes. HARRIS: In the area of computer forensics? STOCKHAM: Yes. HARRIS: With that background in mind, I'm going to take you back to December 26th. JUDGE: Do you have any voir dire as to his qualifications? GERAGOS: Mr. Stockham, you have testified, qualified as an expert how many times? STOCKHAM: Three times, and once on this case at the prelim. GERAGOS: Three times. We talked at the preliminary hearing, correct? STOCKHAM: Right. The Erica Frazier case in 99, Al Peacock case in 01 and 03, and the Stark case in Sacramento County Superior Court in 03, and this case in 03. So four total. GERAGOS: Four total. Once including the preliminary hearing? STOCKHAM: Yes. GERAGOS: Once including the preliminary hearing? STOCKHAM: Three times. Four including the preliminary hearing, yes. GERAGOS: And your area of expertise is on forensic computers? STOCKHAM: Forensic computers. Taking a look at computers, deciding what's on them, and when it was opened, setting up the computer for examination, doing so correctly. And we have had some data losses, so try to prevent that. GERAGOS: And, in this case, is that what you did? STOCKHAM: Yes. I help seize the computers, set them up for processing, and then look for data that might be relevant in the case. GERAGOS: Thank you. I have nothing further. JUDGE: Court will accept Mr. Stockham as a computer expert in computer forensics. HARRIS: Thank you. Sir, taking you back to December 26th of 2002. Did you assist the Modesto Police Department while they served a search warrant in the area of collecting computers? STOCKHAM: Yes. HARRIS: The next day, did you also assist on December 27th of 2002 in seizing some additional computers? STOCKHAM: Yes. HARRIS: Like to have marked some photographs that have been shown to counsel. JUDGE: Okay. HARRIS: It would be a series of, appears to be eight photographs. JUDGE: 174. How many have you got there? HARRIS: Eight. JUDGE: Eight. A through H. HARRIS: I'm going to show you what's marked 174-A through H, have you take a look at these, see if you recognize what's depicted in the photographs. STOCKHAM: Exhibit 174-A looks like the two laptop computers in the Peterson home. The Compaq Armada and the Dell Latitude laptops. HARRIS: 174-B. STOCKHAM: 174-B is a repeat picture of those, two different angle. HARRIS: 174-C? STOCKHAM: 174-C is a closeup of the Compaq laptop in those pictures with the lid opened up. HARRIS: All right. 174-D? STOCKHAM: 174-D is a photograph of the Emerald Peterson workplace. That's a picture of the IBM Thinkpad laptop and a Dell PC. HARRIS: All right. 174-E? STOCKHAM: 174-E is a closeup of the IBM Thinkpad that was on that desk, that work location. HARRIS: 174-F? STOCKHAM: 174 F is the IBM Thinkpad with the lid opened up. HARRIS: 174-G? STOCKHAM: 174-G is a closeup picture of the Dell PC under the desk at that workplace. HARRIS: And 174-H? STOCKHAM: 174-H is an another picture the Dell PC, closer up. HARRIS: Do you recognize all of these items that are depicted in the photographs? STOCKHAM: Yes. HARRIS: Do those items, as they appear in the photographs, appear to be true and accurate depictions? STOCKHAM: Yes. HARRIS: I want to put up on the screen 174-A. I'm going to go through, you are talking about certain things. 174-A is this, does this depict the computers that you found on 12-26? STOCKHAM: Yes. HARRIS: There were two laptops there? STOCKHAM: Yes. HARRIS: Now, you were describing them somewhat different. Were they different brands? STOCKHAM: Yes. HARRIS: When you, from your point of view computer forensics when you collect a computer, do you do something to identify it? STOCKHAM: Well, I do several things. I go brand names, and the photographs of course. I look at them, how they are connected. There is not much more except to look at the details of the actual case, label, serial numbers. Turn over and look at what's on the bottom, what's on top, what's on the sides. HARRIS: When you do this examination, do you document this and transfer it at some point in time to something that you work on? STOCKHAM: Well, there was a, we had a scribe who is writing things down as I talked about these things and the photographs were taken. HARRIS: Well, let me just kind of skip forward a little bit. Do you make copies the hard drives of these computers? STOCKHAM: Yes. HARRIS: And without getting, we'll come back to that. But without getting too much into the details of how that's done, do you identify the copies of the hard drives in some particular fashion? STOCKHAM: I see, when I use forensic software to look at the data on these PC's, I do file names, and I do a naming standard that helps me remember which laptop was which. HARRIS: In this particular case were there ultimately five laptops that, computers that were recovered? STOCKHAM: Yes. HARRIS: And did you go through that file naming standard that you are referring to? STOCKHAM: Yes. HARRIS: Now, looking at these two computers in 174-A, what was the naming standard, as you went through this process, starting with these two particular computers? STOCKHAM: One with the "Spain" sticker on it that was labeled in an abbreviated form "Compaq Laptop Home". And the other one was labeled "Dell Laptop Home". HARRIS: And if anybody were to look at these hard drives, would that particular file information be kind of burned into a hard drive so you can tell which computer it came from? STOCKHAM: It wouldn't be burned into a hard drive. But the copied files that I create would have those file names, and so another examiner could work with my work and do it very easily, and know what he's working with because of these file names. HARRIS: Now, go back where we're at with necessary particular computers. You were telling us as you went along, you document kind of how they are. Looking at 174-B, is this the Dell laptop? STOCKHAM: Yes. HARRIS: You can also see a little bit up here in the upper corner, that other the Compaq laptop? STOCKHAM: Yes, correct. HARRIS: 174-C, does this depict the Compaq laptop that's now been opened? STOCKHAM: Yes. HARRIS: You are describing at the office at the warehouse that there were, actual term you used was workplace. 174-D, does this depict that office workplace as you first observed it? STOCKHAM: Yes. HARRIS: And you describe down here on the floor, this would be where the PC was at? STOCKHAM: Yes. HARRIS: And the item right here behind that piece of paper, that is the laptop? STOCKHAM: Yes. HARRIS: Showing you 174-E. And this, again, is that laptop with the paperwork cleared away? STOCKHAM: Yes. HARRIS: You describe this as the IBM Thinkpad? STOCKHAM: Yes. HARRIS: Was that assigned an evidence number as well? STOCKHAM: Probably, but I'm not sure. I wasn't doing that. HARRIS: Do you see at the top of the photograph placards? STOCKHAM: Yeah. The yellow placards, the tents that were propped, that could be evidence. HARRIS: This was given a placard of 103, at least in that photograph? STOCKHAM: Yes. HARRIS: Looking at 174-F, before the placard is there, this is, again, the IBM Thinkpad in an open condition? STOCKHAM: Yes. HARRIS: 174-G, how did you describe this again? STOCKHAM: The Dell Work PC. HARRIS: And is there an, in terms of your examination, is there a difference between desktop or computer like this, and a notebook or laptop? STOCKHAM: In what respect? On what I have to do? HARRIS: Yes. Is there any difference? STOCKHAM: Yes. The hard drives are usually different sizes. The one in the PC is usually larger than the mini hard drives in the laptop. HARRIS: Looking at 174-H, is that same computer with placards there now? STOCKHAM: Yes. HARRIS: Now, to go back to this naming convention. So that we're clear about this, there were two laptops that were found at the house? STOCKHAM: Correct. HARRIS: How did you describe each of those? STOCKHAM: The Compaq Laptop Home. I better check my report on that one. HARRIS: Did you write a report? STOCKHAM: Yes. HARRIS: And if you were to look at your report, would that help you recall specifically what you said? STOCKHAM: Yes. HARRIS: Please do. Having looked at your report now, can you go through and walk us through how you named each of these computers? STOCKHAM: It's the same as before. It's an abbreviated form, where you can easily tell from the file name that "Dell Laptop Home" is the Dell laptop. And the "Compaq Laptop Home", number two, is the one with the Spanish banner sticker on it. HARRIS: Now, so you collect these computers from where you find them at the, with the search warrant, what do you then do? STOCKHAM: I take them to the Modesto Police Department and use my computer forensics lab to start the process of seeing what's on the computers. HARRIS: Walk us through that. What do you do? STOCKHAM: Okay. With three laptops, I examined the laptops. I take more photographs of what I'm doing. And I find out where the hard drives are, remove them from the laptops. HARRIS: Hold on. You say you take the hard drives out of the laptops? STOCKHAM: Yes. Most laptops allow you to do a fairly harmless disassembly of that part of the computer. The hard drive slips or slides in, depending how it's fastened to the circuitry. These were fairly easy. Once they were out of their cases, I had to take off the framing for the cartridge and expose the actual laptop and the pin connectors. Then I would hook that up to my computer forensic machines and make forensic copies of the laptop hard drives. HARRIS: What's the forensic copy? STOCKHAM: A forensic copy is a, like a bitstream copy where no data is lost. It's actually a very good clone of a hard drive. If done with forensic software, it catches the first byte of the hard drive, the last byte, and copies everything in between. HARRIS: Let me they just back up. You are using a bunch of different terms. What is a bitstream? STOCKHAM: Well, computer data is zeroes and ones on bits of data. You can copy a hard drive without affecting the original drive. You can actually do a copy that is so perfect of the original that you can do your examination on the copy and leave the original intact so there is no damage done. Because we never know if these hard drives are in good repair or not. So the first hurdle to protect the original drive is to copy it as a perfectly forensic copy. And once that's done, we can put the original hard drive aside for the defense experts later, or for recopying, and we can kind of do a free-for-all examination of the copied drives what malfunction or mistakes wouldn't affect the original hard drive. It's the first hurdle we like to get over. HARRIS: Why is it that you actually go in and take these hard drives out of the computer? STOCKHAM: Well, to make sure they work, they are in good condition, they are not cracked, dented. To make sure we can hear them when they turn on, to see if they overheat or not. Just a total examination process to make sure those things are working properly for that copy. HARRIS: You mentioned something about forensic software. What is that? STOCKHAM: We, in this case we used a forensic software program called EnCase by Guidance Software. And I also useda copying program called SnapBack by Columbia Data Products. And with that software, they are designed to forensically copy where there is no alteration of the original drive and still give you a good copy. And it's been tested by me, and backed up by the manufacturers. HARRIS: So you make the these forensic copies or, I think the term you also used is a clone? STOCKHAM: That's another term. HARRIS: When you use the software, you make these copies, do you do something to identify the clone copy so that you can always tell which computer or which hard drive it's a copy of? STOCKHAM: Yes. The EnCase software allows you to file naming standards or labels, as I have testified previously. And once you do that, the EnCase copy files can be stored on my hard drives, and I can sift through the data and see what those computers have. HARRIS: When you go through, let's look the process, do it in reverse, since we have in photograph up there. 174-H, the Dell PC. You have the H. Did you do the same thing with the laptop, do with the laptops, did you do the same thing you do with the PC? STOCKHAM: PCs are easier, because they have a larger hard drive with a standard ribbon cable connected. We simply take off the cover or backing, whatever we need in this case. We took off the cover, and I searched the frame area for the hard drive unit. I disconnected it. This is all with power off, of course. And I have to undo some screws. I take the hard drive out and connect it to my forensic PCs in my lab and make that forensic copy of that PC hard drive. HARRIS: You keep talking about a forensic PC in your lab. Again, tell us what that means. STOCKHAM: These are computers that have features that we like to make forensic software work properly. And they are computers that allow us to hook up other hard drives and other devices to them so we can get the lab work to get these copies done and the data reviewed. We actually use these machines where we put the forensic copies to actually look for data from these copied hard drives. HARRIS: Going back to starting to talk about how you use that file naming forensic copying with this particular computer 104, and in photograph 174-H. This is the Dell PC. What was the name you that gave it? STOCKHAM: Okay. That file name on those copy files was "Dell Work PC 4". HARRIS: And that's something that stayed with that cloned hard drive after you created it? STOCKHAM: Yes. The EnCase software allows the streamlining of this process, allows this file naming standard that keeps things straight on whatever computer we are calling it. It sure helps. HARRIS: Going back through the other computer at the warehouse, in 174-E, that was evidence 103, IBM Thinkpad. Was the file naming standard that was given as part of that clone copy? STOCKHAM: Okay. I called that copy file process the "IBM Laptop Work 3". HARRIS: And you talked about that if somebody else looks at it they can tell where it's coming from. Not being a computer kind of person, when you put this up on your computer, can you see actually a label, or some type of file name there that tells you which hard drive this is from? STOCKHAM: Yes. The actual forensic copied files have that name that I assigned to it. So there is, I just don't lose track of what file goes with what PC that is seized out in the field. HARRIS: Going back to the house. Do it with this 174-C, the Compaq laptop from the house. STOCKHAM: Yes. HARRIS: What was the file name standard that you applied to this particular computer? STOCKHAM: Okay. That's "Compaq Laptop Home 2". HARRIS: Again that's on always on that copy? STOCKHAM: Yes, it will stick with that file for the duration of the examination, yes. HARRIS: And the Dell laptop at the house? STOCKHAM: That would be "Dell Laptop Home 1". HARRIS: Were you also given a computer, SOTEC computer by Detective Kipp Loving? STOCKHAM: Yes. Yes, I went to the Turlock office of the Task Force on about February 24th of 03, and he had that laptop. HARRIS: Did you go through the same process and make a forensic copy of that laptop hard drive? STOCKHAM: Yes. We did some other steps for the convenience of the defendant. But that was the same thing. JUDGE: How many computers were there? STOCKHAM: Five total, sir. JUDGE: Five total computers. Okay where were they indicated? STOCKHAM: Two in the Peterson home? JUDGE: Three in the warehouse. STOCKHAM: Two. Two in the warehouse, and the fifth one I didn't. Some other detective did, and I got it from him. JUDGE: Okay. All right. Just want to make sure. HARRIS: All five of the computers, did you use this naming standard and make forensic copies of the hard drive? STOCKHAM: Yes. The fifth computer had a brand name that was kind of unusual, SOTEK, S-O-T-E-K, so I used that as the file naming standard for that image. HARRIS: Now, we already, we're talking about at some point in time, you retired. When you retired, did the work that you were doing on this particular case, was that transferred to another detective? STOCKHAM: Yes. HARRIS: Was that detective Lydell Wall? STOCKHAM: Yes. HARRIS: He is also a member of the High-Tech Task Force? STOCKHAM: Yes. HARRIS: And as part of transitioning, did you make sure that he knew which particular hard drives he was looking at? STOCKHAM: Yes. I explained the file naming system that I used to identify these four laptops, yes. HARRIS: So he would be able, from your explanation and what was on those copies, he would be able to look at it say which computer it came from? STOCKHAM: Right. He's been one of my students, and he knows the EnCase software. He could actually take my work which I gave to him on one large hard drive and see in those file names, he would know this data came from the Dell Laptop Home, or the ones from work, just by using the EnCase software with that file naming standard. HARRIS: Now, after you do all that, maybe it's not after. At some point in time, besides doing what you were doing with the hard drives in this particular case, did either a Community Service Officer or an ID Technician talk to you about having a problem recovering some photographs? STOCKHAM: Yes. HARRIS: And was this some type of flash drive that they wanted you to look at? STOCKHAM: It was a Sony Memory Stick. HARRIS: And what is that? STOCKHAM: Can I show you one? HARRIS: If you have one with you. STOCKHAM: Yes. A Sony Memory Stick. This goes into some very high resolution cameras that our Modesto Police ID Technician use. It's a Sony Cyber Shot with a very long lens on it. A 5.1 megabyte camera. They store the pictures digitally, electronically, on these Memory Sticks. Plug into the camera, and they put them in and out as they record pictures, and put them into a server network for safekeeping. HARRIS: Did they indicate something that happened to one of those particular disks and ask you to look at it? STOCKHAM: Yes. Technician, first name is Joy. I'm at a loss on her last name. The tall, blonde-haired technician. HARRIS: Could that be Joy Smith? STOCKHAM: That's it. That's, I haven't seen her in many, many months. HARRIS: Did, after you talked to technician Joy Smith, did you start, or did you look at that Memory Stick? STOCKHAM: Well, as part of my help calls service with the Modesto Police Department, I was also the network manager. And a lot of the MPD users used me as the go-to person on computer problems. This was no exception. Joy called me to try to fix her problem. She told me that she couldn't find the pictures that should be recorded on the Memory Stick. It was a hundred twenty-eight megabyte Memory Stick. And after questioning her and getting a description of what may have happened, I looked at it, looked at the camera, asked some more questions, and just decided to do a forensic analysis on the Memory Stick in my lab. HARRIS: How do you do a forensic analysis of the Memory Stick? STOCKHAM: Well, I borrowed Joy's card reading device, and that's a slotted device that you plug them into on her computer. Comes the pictures that she took. That didn't happen with her, so I borrowed that device, took the actual Memory Stick into my lab, and used the EnCase software again, as in this case, to look at the data that is resting on the stick. And there it was. I saw the data. But there had been some corruption. The photos, some of them seemed to still be there as I viewed the Memory Stick, but there seemed to be a loss of the index data that tells the computer where these pictures are on the Memory Stick. Once these are lost, the computer acts like they are not there. HARRIS: Maybe I need to go back to just real basics. Does the computer, either the disk, or the laptops, or the PCs, do they need an operating system to work? STOCKHAM: Well, they need a low level or high level formatting, but not necessarily always an operating system. HARRIS: You are talking about an index was missing, or was corrupted? STOCKHAM: Right. HARRIS: What does that mean? STOCKHAM: In this case, well, in all cases, computers need to find computer files that use many, some kind of indexing, something put there by software, some kind of an operating system by a manufacturer. And that is data just like the digital picture data. And if that indexing or table of contents is gone or corrupted, the computer looks for it to find the pictures. And if it's not there, it simply tells the user it's not there with some kind of a warning message, some kind of an error message. HARRIS: Now, is it actually gone, is it just that the computer can't find it? STOCKHAM: Well, if the table of contents or the indexing numbers are gone, and that corruption didn't go far enough in the Memory Stick, I could be able to see the photos if they are still there, unerased, or not overwritten, depending what kind of damage was done by Joy. JUDGE: At this point I think we should call it a day. HARRIS: All right. <evening recess>
August 3, 2004 Cross Examination by Mark Geragos GERAGOS: Mr. Stockham, while the jury took the break, we were discussing whether a lot of these things, subsequent analysis, I guess, was done by you. You retired some time in May; is that correct? STOCKHAM: May 1st of 19 -- 2003. Excuse me. The information or the investigation that you did in connection with this case took place basically that first week of December, correct? I mean the last week of December, 28th, 29th, somewhere around there? STOCKHAM: Well, it trailed very close to my retirement date. I would have to -- I'm trying to get the time period. You started -- got the computers some time on the 28th of December? STOCKHAM: Sure. 26th and 27th of December. GERAGOS: Once you got the computers, that you were doing some of the things you talked about, correct? STOCKHAM: Correct. GERAGOS: Then you continued to work on the computers or on the imaged files through May? STOCKHAM: Well, through -- off and on through April. Then I retired the first of May. GERAGOS: Okay. Now, is it a fair statement that at some point in February you then received this Sotec laptop? STOCKHAM: Yes. GERAGOS: That was given to you by who? STOCKHAM: Detective Kipp Loving, Turlock Police Department. GERAGOS: Okay. And did you go through the same process to image the item? STOCKHAM: Yes. GERAGOS: And once you did that, did you return or let go of the original, so to speak, gave it back to -- returned the item? STOCKHAM: Yes. The original laptop was returned with a copied hard drive. GERAGOS: Okay. Now, the -- specifically the -- is there a way to tell from the -- when you go back into the computer and you print up items, for instance, what was marked as D5K, which I made a copy of, you got it in front of you. Is there a way to tell by looking at that how long that item was looked at, or was up on the screen, so to speak? STOCKHAM: A duration of time for the viewing? GERAGOS: Duration of time. STOCKHAM: No, I don't think so. GERAGOS: Okay. Do you know if there is a way for you to determine if there was a print copy made? STOCKHAM: By the user who might have originally brought this up? GERAGOS: Right. STOCKHAM: If a file exists called a print spool file, or a temporary file, if you find those on the hard drive, depending on the folder structure and the labels, you could say, if the file is there, that it was printed. GERAGOS: And that's -- did you ever do that to see whether or not there was a print copy made of D5K? STOCKHAM: No, I didn't get that far. GERAGOS: Okay. Is it a fair statement that while this item, four G, was found and had been printed, which is the USA Fishing website that was found at the location, nobody, best of your knowledge ever found D5K in print form. STOCKHAM: Correct. GERAGOS: Okay. D5K was something that was found as having, I guess, when you -- when somebody surfing the internet can go to a location, you click on various locations, correct? STOCKHAM: Yes. GERAGOS: Then part of what you do as a forensic computer examiner, or what you did before you retired was, that you can look and see where somebody was, or where they went, and went to -- the next place they went by looking at the list of -- or the computer code, correct? STOCKHAM: Look at the files? GERAGOS: Yes. STOCKHAM: Of course the files have the code. You can look even deeper into the files. GERAGOS: So when you look at the codes, what you are doing is seeing the trail of where the person is using the computer to surf on the internet? STOCKHAM: It's like digital bread crumbs, yes. GERAGOS: Now, there is a load of material in the discovery that looks like -- just show you my -- for ease, show you what has been marked as 4286. I believe this is stuff that you had, you produced; is that correct? STOCKHAM: Yes. Looks like one of my first stacks of printouts. GERAGOS: Now, the specific item that I'm referring to, 4286 had, has times on it, doesn't it? STOCKHAM: Yes. GERAGOS: Okay. What do those times stand for? STOCKHAM: When a file was created, when a file was accessed, when a file was modified. GERAGOS: Are we able -- are we able to -- once again, we would have to, I guess, assume that the BIOS or the CMOS the internal clock is correct. But even if the internal clock is not correct on that particular take, at least internally the amount of time that is spanned would be okay; isn't that correct? Within the computer itself? STOCKHAM: Correct. They would record in sequence, and they would get the date and time stamps from that clock. GERAGOS: Whether it was the 8th at this particular time, or some other day, forget about that issue. At least the amount of time that's spent on the computer and the site, if it's been gone to, or the image that's on the screen would be reflected in that kind of computer printout that you got there? STOCKHAM: Yes. That could be an a reasonable assumption on a duration of time. But still have those gaps. GERAGOS: Right. Now, are you able to -- and correct me if I'm wrong. It looks like on certain items here -- I hate to do it in your face, but I can't see it otherwise. Looks like you can point to certain times, for instance here, and that's a file, right cb16, whatever that is? STOCKHAM: Yes. GERAGOS: Now, if I take a look at that item there -- that'scb16, cb as in boy. Then I show you this item here. Does that correspond? STOCKHAM: Yes. GERAGOS: Okay. If I could mark these. JUDGE: Jury would like to look -- Rick Distaso: I just want to lay a foundation for it. JUDGE: Yes. GERAGOS: Would you take a look at this and see if this looks like this, the zoom in that? I'll mark all of these and identify it for the record in a second. JUDGE: Okay. GERAGOS: Then I guess what you would have to do is take a look at yet again the computer printout. STOCKHAM: Yes. That looks very close, yes. GERAGOS: I'm going to mark three pages here. JUDGE: D5L-1, 2, and 3. STOCKHAM: On the bottom you have some text differences, but the picture looks the same. GERAGOS: Let me just have the clerk mark a copy. What I was requesting to try and show, as soon as they get -- I'll do it so the jury can see, you can see. But what I'm attempting at least to demonstrate is the work that you -- if I understand correctly, you have got a list of locations when you go into the computer and do -- you have got this EnCase type software, correct? STOCKHAM: Yes. GERAGOS: EnCase software will search the computer for the files, right? STOCKHAM: It will search across these four hard drives, yes. GERAGOS: So searches across the hard drives, then it will produce a kind of a laundry list of locations? STOCKHAM: Or, in this case, I copy the files of interest that I found, I copy them out to my work hard drive, and I generated this list from those files of interest. GERAGOS: Okay. STOCKHAM: But those are still listed in the EnCase software. GERAGOS: So that the product that you have got that's produced by the EnCase software, will list the times, at least on the internal clock, when somebody went to a specific location, when they are on the internet, correct? STOCKHAM: Okay. It will show you files, their date and time, stamped by the computer clock. GERAGOS: And what I'm getting to is, can you -- and is there an amount of time that you have to factor in for how long it takes to download a graphic? For instance, if you have got on, one of these spots, a time which it's marking, says 9:54. I'm going to be referring to time. What does that time mean when it says 9:54 on it, and so many seconds? Take a look, at least, see if we can demonstrate it. This item which is D5L-2 corresponds to what entry on D5L-3. STOCKHAM: Cb16 right there. GERAGOS: Okay. Let me put that up on the board, so you have got -- this is what we were talking about this EnCase produces; is that correct? STOCKHAM: No. This is my file listing that I produced. GERAGOS: Okay. STOCKHAM: EnCase shows me a bunch of pictures. The ones of interest I copy. I make a file listing of those, and that's the list. GERAGOS: Right here we have got something looks like says Captain Hook. Would that be December -- or do you know if that's related to the item that was marked as four G? STOCKHAM: I don't know, sir. GERAGOS: Anybody -- do you know if anybody ever asked you to try to determine if that was the case? STOCKHAM: No. GERAGOS: Then the item that is -- that's cb. You see it up there? STOCKHAM: Cb16 underscore 16 bracket 1 dot gif. GERAGOS: What's the time on it? STOCKHAM: We have a 12/8/02 and 9:54. GERAGOS: Right there? STOCKHAM: Yeah. GERAGOS: And so that entry there, does that seem to correspond to DSL-2 (sic) right here? STOCKHAM: That's the file name. GERAGOS: That's the file name. And the reason that you can figure that out is because of these numbers right down here? STOCKHAM: Correct. GERAGOS: For that cb16, and then the other numbers with the g-i-f right there, that corresponds -- for the record, I should indicate, judge, I don't think I did, D5 -- DSL dash 2 is a map that shows the Southampton Shoals. And I assume this "boatcom" is just those -- you were saying putting two images on the same page? STOCKHAM: Yes. GERAGOS: Would we be able to find the "boatcom"? STOCKHAM: There it is. HARRIS: What is the exhibit number again? JUDGE: It's defendant's 5L-2. GERAGOS: I said S. It should be D5L. Where would it be on here? STOCKHAM: I think I see it toward the middle, boatcom, brackets, 1, brackets 1 dot j-p-g. GERAGOS: Right there; is that correct? STOCKHAM: Yes. GERAGOS: So we have got -- we have got one that says Captain Hook, which would be this four G, right? Where I'm assuming -- I'm assuming. Is that a pretty good assumption? If it's -- we have got something that says "Captain Hook Sportfishing," then we have got an item that says "Capthook" there? STOCKHAM: That's a pretty good assumption. GERAGOS: Then the next one we have got is this boatcom, which is the picture of the boat? STOCKHAM: Yes. GERAGOS: Okay. That would be the top right this picture right here, right? STOCKHAM: Yes. GERAGOS: Okay. Then the next that we have got on there, after the boatcom, we have got the map here which is cb16, right? STOCKHAM: Yes. GERAGOS: Okay. And then it looks like D5L-1 is just a zoom of the Southampton Shoal, and the map; is that right? STOCKHAM: Yes, that's almost exact. GERAGOS: Okay. When you say almost exact, so I can show it to the jury, you are saying that if somebody had clicked on or zoomed from this Southampton Shoal to this, that's what you would produce as an enlarged version? STOCKHAM: That's possible. That's possible. GERAGOS: That look like what happened there? STOCKHAM: Yeah. That could be a hotlink picture. It's possible. I'd have to check it out further. GERAGOS: And that appears, at least to your eyes -- before I publish it again, that looks like somebody is focusing on the Southampton Shoal area? STOCKHAM: Sure, yes. GERAGOS: And you would notice that by the fact here, you have got a larger area by the boat dot com, and then there is some Southampton Shoal, which is over on the left, and then when it zoomed in, you are zooming in on Southampton Shoal, correct? STOCKHAM: Yes. GERAGOS: Okay. Now, the other entries that are here, have -- did you print out, for instance, says -- where it says "sportfishregs"? Did you print that out? STOCKHAM: I don't remember. It might be in the stack. GERAGOS: Okay. "Find great fares", things like that? STOCKHAM: It could be. I don't remember exactly. GERAGOS: And then we have got down here the Suisun Bay and the map image, all those. Did you print those out? STOCKHAM: Probably, but I'd have to check that stack of paper to make sure. GERAGOS: Okay. When you are referring to the stack of paper, what you did is you printed out a number of items? STOCKHAM: A bunch of them, yes. GERAGOS: And you have a bunch of items more than this book that I have got right here, correct? STOCKHAM: Oh, it looked about like that. GERAGOS: Is this yours? STOCKHAM: That's mine, thanks. GERAGOS: Now, the -- some of the other items that I was asking you about were your impression or understanding that Officer Lydell did that, Lydell Wall? STOCKHAM: Did what, the CD? GERAGOS: Yeah. STOCKHAM: Yes, I think he produced that. GERAGOS: Now, the -- I think, if I understood correctly, you were saying that this EnCase software goes across the four hard drives, correct? STOCKHAM: Yes. GERAGOS: Now, the items that I was just showing you, that was in D5L-3, what hard drives were those off of? STOCKHAM: I didn't identify it for which hard drive these files came from on this listing. GERAGOS: Do you know -- are you able to identify home or warehouse? STOCKHAM: Yes. If I see my work drive, I would bring up the software, find this file, it would tell me exactly which computer it came from. GERAGOS: Have you done that? Do you have that information handy here? STOCKHAM: No. GERAGOS: Now, the -- you talked about this -- one of the other areas was the Memory Stick that was given you? STOCKHAM: Yes, the Sony Memory Stick. GERAGOS: And the one that you had yesterday was not that particular Memory Stick? STOCKHAM: Correct. GERAGOS: Okay. That was by way of example as to what it looked like? STOCKHAM: Yes. GERAGOS: And these were photos that were -- I think you used the term yesterday the stick was corrupted? STOCKHAM: Part of the data was, yes, corrupted, or overwritten. GERAGOS: And how much data was overwritten, do you know? STOCKHAM: Okay, I didn't do the actual megabyte sizing on that. I just found the pictures, copied them off. GERAGOS: Okay. And the when you say you didn't do the megabyte sizing, what does that mean? STOCKHAM: I didn't give up actual statistics of how much the data took up of the Memory Stick space. GERAGOS: Now, the specifically on the sea if I got it. One chart did I leave it up there that had the list of the times on it? STOCKHAM: This one? GERAGOS: Yeah. Now, can I -- or can you take a look right here for the various images, for instance, for the map, can you tell me when it came up, approximately how long it was on the screen, the cb16? STOCKHAM: No, I don't think you are going to be able to do that. Nothing really happens too much when an image is up on the screen. You may have some automated things that go on a computer in the background, but I don't think there is any kind of a normal user software product that says how something -- how long something is staying up on the screen. GERAGOS: Is it a fair statement that if the item has a time, for instance at 9:53, here, and 54 seconds, that if somebody is on a different -- at a different location at 9:59 and 46 seconds, that they are no longer looking at the boat? STOCKHAM: No, not necessarily. Because the operating system on these computers was Windows, and that allows a user to put up multiple instances of an internet search. GERAGOS: Just have simultaneous -- STOCKHAM: We can have one window, three, four, five windows. GERAGOS: Is EnCase able to distinguish between the two? STOCKHAM: No, you won't find that kind of data to show that. GERAGOS: You have also got on D5L-3 two different date and times, or two columns. Can you tell me what that's for? STOCKHAM: Well, we have a file accessed, file modified, and file created dates. I'm not sure which column is which. It's been so long since I have seen this one. Again, it's recorded on my hard drives for precise question and answering on those things. GERAGOS: Do you have -- JUDGE: Can I ask him just one question? GERAGOS: Sure. JUDGE: Computers have where it says file deleted, history deleted, does that erase all this stuff that was -- could it have been erased, if it says -- where it says file deleted, history deleted, would that affect your ability to bring this stuff up? STOCKHAM: Okay. If someone has the picture on their screen, and they click sometimes a button that says make it go away, delete -- JUDGE: It says file deleted and history deleted, by cookies, they have cookies, you know. STOCKHAM: Okay. JUDGE: If you click file deleted, history deleted, would that have erased this information off of this hard drive? STOCKHAM: It would tell the computer to mark that disk area as available. But the data could still be there. But the next computer session would find that there is some deleted file that you ordered with a click, and you can use it a to overwrite new data. So the data can still exist until it's overwritten. JUDGE: Even if you click it off, it still can be on the hard drive? STOCKHAM: You could still find the deleted file itself, or a file fragment, or temporary file that is just sitting there on the hard drive. GERAGOS: Follow up on the judge's question. If you had wanted to hide this information, a lay person would click delete, click the history, thinking that the space is now available, correct? STOCKHAM: Yes. GERAGOS: Okay. What ends up happening is then, you may -- the computer itself may fill that space by writing over it, correct? STOCKHAM: Yes. GERAGOS: But there is software -- I don't know if EnCase is one of them. I know there is other software that can basically separate out and still find that information that was attempted to be deleted, correct? STOCKHAM: Right. But are you asking can data that's been overwritten be found again? GERAGOS: Yes. STOCKHAM: That's really digging deep into the magnetic surface of those hard drive platters. I think the feds might be able to do that. GERAGOS: I have had experience with the FBI, where the FBI can go in, and when it's deleted information, go into the hard drive and retrieve that. And I assume you have heard that they can do that? STOCKHAM: With much better equipment, they can go keeper and closer into the drive platters and get data fragments out. GERAGOS: In this case there is no indication that any of these items were -- or searches were attempted to be deleted, correct? STOCKHAM: No, I didn't see that kind of behavior there. GERAGOS: You didn't see anything where it was trying to be hidden or separated out in any way? STOCKHAM: No, sir. GERAGOS: Okay. Once again, you weren't -- if I understand correct, you have the ability technologically to determine if something is printed, correct? STOCKHAM: Yes. If that trail is left behind in the temporary files, print spool files. GERAGOS: If I understand correctly, the reason for that, when you send the command to print, that there is a -- the computer actually will leave a trail that you can retrieve that shows that that process was done? STOCKHAM: Yes. Sometimes, yes. GERAGOS: If I could leave that for a second. Obviously going to ask you when I'm done today, if I don't get everything I need out of Sheriff Wall, that I was going to asking to go back and review the hard drive, some of these other questions you can answer. STOCKHAM: Well, not really there is so much of it, we're talking about billions and billions and billions of bytes of data. To ask you to go review and testify about it, billions and billions of bytes of data GERAGOS: I don't think he would let you do it either. But if I specifically gave you the areas, could you go back and take a look at the hard drives, come back with the information? STOCKHAM: Yes, if you gave me targeted stuff to look for, yes, sir. GERAGOS: Back to the photos. You wrote a report on that information, correct? STOCKHAM: On -- what was the first part, the Memory Stick? GERAGOS: On the Memory Stick. STOCKHAM: Yes. GERAGOS: And that was -- there was a -- what you indicated is that these photos were taken by an Evidence Tech? STOCKHAM: Yes. GERAGOS: And that was under 27th of December -- on the 27th of December? STOCKHAM: December. I'm not sure when she took the photos. The ones that I recovered, looks like they were the ones that were from the warehouse, that looked like they would have been from the 27th. I'm just going by what she told me. GERAGOS: I'll ask you to just take a look at the first paragraph of the report, see if that refreshes your recollection. STOCKHAM: Oh, yeah, that's my interaction with Joy Smith. GERAGOS: Okay. So Joy Smith is the one who gave you the Memory Stick? STOCKHAM: Yes. GERAGOS: And on that Memory Stick, you indicated already it had corrupted data that you tried to recover, correct? STOCKHAM: Yes. GERAGOS: You were able to get 93 photos off the stick, correct? STOCKHAM: Yes. GERAGOS: But as you sit here today, you have no idea how many photos were lost? STOCKHAM: No. GERAGOS: And you don't know how many were taken? STOCKHAM: No. GERAGOS: Do you know how many that photo that Memory Stick can retain? STOCKHAM: No, because I don't know the resolution that she used on the camera GERAGOS: Is it fair to say that 250 would not be out of the ordinary on a Memory Stick? STOCKHAM: Well, Sony Cybershots they use are big megapixel cameras to take photos at high resolution. Takes up a lot of file space. So 250 I think is stretching it. But I have never tested how many they can squeeze onto a Memory Stick on those cameras. That would have to be a test. GERAGOS: You were employed obviously on December 28th of 2002, correct? STOCKHAM: Yes. GERAGOS: Okay. I'm going to show you Bates number 37 -- looks like 37100, 37109. Can you take a look at that? I'm going to show you the documents that I previously had marked as D5L-3, the Captain Hook's Fishing, the two images in Suisun Bay, and the cb16. Now, based upon this report, I assume that you were the one who is supervising the work that was being done at that point? STOCKHAM: No, I wasn't. I wasn't supervising. GERAGOS: I mean when I say the work, were you in charge of the computers at that point? STOCKHAM: No, I was just in charge of my computer forensics lab. And I'm not sure what you mean. GERAGOS: I was going to ask. It looks like there is various locations here for some of these items; is that correct? STOCKHAM: Right. GERAGOS: Of which computer. And I was asking you before, do you know where those specific items were found on which computer? STOCKHAM: Okay. This would have been when Detective Lydell Wall was given a hard drive with those computer images, the forensic copies. And looks like he did some work. And thanks to my naming standard for the computers, he was able to check on some of these image files and tell you where they came from. This is his report reflecting that. GERAGOS: So I'll ask him as to the specific locations. You don't know? STOCKHAM: Right. Because I didn't go that far. GERAGOS: But I'll ask you, when you say the specific naming, the name that's on here -- STOCKHAM: Dell Laptop Home, that's where that pays off. GERAGOS: Okay. Can I just publish this with the idea that I'm going to show it to Wall. But I want to make sure. JUDGE: Foundation hasn't been laid. GERAGOS: Just foundation so merely he can identify his naming. JUDGE: You don't want to give it to the jury, just want to show it to him? GERAGOS: Just want to show it so that he can identify that as one of his naming -- JUDGE: Go ahead. HARRIS: Counsel needs to show just ask the witness. That's what the witness said. GERAGOS: I want to show it on the report so that you can see that the abbreviations -- JUDGE: Go ahead. GERAGOS: This right here, that's Dell Laptop -- H-M is for Home -- 1? STOCKHAM: Right. That's my abbreviation. GERAGOS: Okay. And so if these abbreviations are all -- that's all the same abbreviation, just one computer, correct? STOCKHAM: Yes. It's like that. Officer Lydell Wall was right on track using my work product and expanding on that. GERAGOS: I'd ask this -- just mark this by reference right now. I'll show it. JUDGE: Be D-L defense 5M. Defense 5M. Does that have a title, Mr. Geragos? Does that document have atitle? What do they call -- GERAGOS: Just call it a list of items from -- recovered from specific computer. And, Mr. Stockham, is the last time that you reviewed the evidence in this case back in September of 03? STOCKHAM: I just looked at the evidence in a box, and I did look at my work drives. I'm not sure of the dates, but it was prior to that prelim. GERAGOS: Prior? STOCKHAM: Prior to the Preliminary Hearing. GERAGOS: Prior to the Preliminary Hearing was the -- September sound right? Just show you one item and see if this refreshes your recollection. It's yellow highlighted. Some time in early September? September 2nd, does that refresh your recollection? Still doesn't? STOCKHAM: That's probably the date. But I went to the Turlock High-Tech Crimes Task Force office with an appointment to look at the evidence. GERAGOS: I have no further questions.
Redirect Examination by David Harris HARRIS: Mr. Stockham, I want to talk about this particular item. Mr. Geragos was asking you in your first looking at that, for you to assume something. And the assumption was that particular day 12-5, 2002, headline if that was updated on a regular basis. Going back to that particular area what he's asking you about that. Now, there is another date that he showed you on the bottom. You see the 12/9 date down there? STOCKHAM: Yes. HARRIS: Now, on the left side lower portion of this particular -- the USA Fishing website, what is that, the HTTP? STOCKHAM: Well, that's Hypertext Transfer Protocol. That's what that means, colon, forward slash. And then we have a domain name usafishing dot com, and then a forward slash SFBay dot HTML, Hypertext Markup language. That could be the file structure of a server that's generating those web pages for users, and it's sending it via that domain name. HARRIS: Let me back up through that, and we'll go back to -- what does that mean? STOCKHAM: That means, if I if I was at that company's offices, and I knew the computers that were serving up those web pages, I could probably find a file called SFBay dot HTML on that web serving computer, and it's giving you that file name. HARRIS: So when you go online, you are on the internet, you find a document, you want to print it, hit the button that says print on there, does your computer, when it prints it out, add something to the bottom of that document that says where it's coming from? STOCKHAM: In that case, yes. That's a file name, yes. HARRIS: So looking at this particular document, this document when it's printed tells us it's coming from this internet site? STOCKHAM: Yes. HARRIS: Looking to the far right, when you print, this document has been -- it's stamped on the bottom of the document when your printer is doing it, so it gives you the location it's coming from. Does it also give you the date? STOCKHAM: Yes. HARRIS: So, now, looking at this particular document, since we know that it, from looking at that, that it's coming from this website on that particular date -- GERAGOS: There is an objection. That misstates the evidence. Coming from the website, and it's based on the internal clock. It's not on that particular date. JUDGE: Do you want to clean that up? HARRIS: The date that's being printed, is that coming from the computer, or from the within site? STOCKHAM: It's probably in the computer, but you can, just by seeing this copy -- I am making some assumptions. If we have the actual file name, if we have that HTML, we can do what's called view source, and you will see the code behind that. And you could tell exactly what the web page is doing. Asking me to make these conclusions from just a black and white printout, it's an educational guess, but, you know, I need to go further to give you as good solid answer. It's there on the computer file. HARRIS: Without going through assumptions, let's talk about what's on this particular document in terms of facts. What's printed at the bottom, that's something that's generated by the printer saying this is the location where this document comes from? STOCKHAM: Yes, like a footer. HARRIS: So the time that's attached to that footer, as you were describing earlier, that is the time of the clock that that computer thinks that it's printing? GERAGOS: I think he is misstating. The date. The date, not the time. JUDGE: Doesn't have time. Has the date. HARRIS: I'm sorry. JUDGE: 12/9. Doesn't have a time on it. At least I don't see one. HARRIS: The date? STOCKHAM: Once again, if you have the file, and you look at the code and you do not find 12/9/2002. That has the text. Not that text. That had to be generated by the user's PC, not the website. HARRIS: Again, what we are looking at from this particular exhibit, we have the date from the PC, and the location where it's being printed from, or where the information is coming from, and that shows us on the bottom of that document it's 12/9/2002? STOCKHAM: Correct. HARRIS: So up higher in the document where it's saying Today's Headline, Thursday, December 5th, you were asked to assume that that was correct. Would it also be a fair assumption to say that that's just -- website has not updated that headline yet? GERAGOS: Objection. That calls for speculation. He can't answer that. JUDGE: Well, he wants to know if it's a fair assumption. You can cross him on it. STOCKHAM: Once again, it could be a fair assumption. But the code will tell you if you look at that file. HARRIS: And you were asked about that in terms of that particular USA Fishing, the Captain Hook banner goes to that particular document. That's D5L-3. So I'm going to point out right there, where it says "BANNERCapthook". STOCKHAM: Yes. HARRIS: You were describing for us the dates that this particular data was created to the computer, the date created access modified, right? STOCKHAM: Yes. HARRIS: What are the dates and times that that particular banner for Captain Hook was created on that computer? STOCKHAM: We have a date of 12-8 of 02. HARRIS: What time? STOCKHAM: 8:19 a.m. with two seconds difference. On 8:19 -- JUDGE: It's not 19. STOCKHAM: I'm not sure what the columns are labeled without going back to the computer data HARRIS: You were asked about these this -- other gif that was up there, cb16 -- STOCKHAM: Cb16, underscore, bracket, 1, dot, g-i-f. HARRIS: You were asked on here -- on here some place? STOCKHAM: Yes. HARRIS: On -- do you see that up there someplace? STOCKHAM: Yes. The upper middle. HARRIS: Right there? STOCKHAM: Yes. HARRIS: What's the date and time that that was accessed on that computer? STOCKHAM: 12-8 at 9:54 and 9:53. HARRIS: Is that a.m. or p.m.? STOCKHAM: P.m. HARRIS: So what would that be thirteen hours later? STOCKHAM: Thirteen hours later from what? HARRIS: From the earlier one, the Captain Hook in the a.m. STOCKHAM: Yes. HARRIS: Now, I know computers do things at different speeds if you have got a dial up modem, if you got cable internet. But is it normal to take thirteen hours for a graphic to load? STOCKHAM: No, not one of those. HARRIS: Now, in terms of the times on the clock, you actually checked these particular clocks on these computers? STOCKHAM: Yes. HARRIS: And you compared these clocks on these computers to the atomic clock? STOCKHAM: Yes. HARRIS: And did you testify they were within two to three minutes of each other? STOCKHAM: Yes. HARRIS: So in your assessment, were the clocks in these computers pretty accurate? STOCKHAM: Yes. HARRIS: I have no other questions.
Recross Examination by Mark Geragos GERAGOS: This one says 12/8. Do we have anything there that says "usafishing" on there with that same HTML that you just testified about? STOCKHAM: You are asking to look at a lot of files. GERAGOS: Well, the one -- STOCKHAM: That's that big list on that piece of paper? GERAGOS: Yeah. The one that he's pointing to right here that I pointed to, Captain Hook, right? And then what he just asked you about, this item here. That doesn't show up here, right? STOCKHAM: No, not -- correct. Not on that page. GERAGOS: Right. It's not on that page. So when obviously something is out of whack, because we have got 12/9 here, correct? STOCKHAM: Yes. GERAGOS: And we have got 12/8 here, right? STOCKHAM: Yes. GERAGOS: And then we have got 12/5 here, correct? STOCKHAM: Yes. GERAGOS: Okay. So there is something out of whack there, right? STOCKHAM: Well, not out of whack. GERAGOS: There is something that's -- is there yet a third possibility, that this item -- where was this recovered? STOCKHAM: Well, you said that came from the desk. GERAGOS: At the warehouse? STOCKHAM: Right. GERAGOS: And Mr. Wall is going to testify that these items came from the house? STOCKHAM: From the -- yes. GERAGOS: From the laptop at the house that you named as the Dell Laptop at the house? STOCKHAM: Yes. GERAGOS: Okay. Is there the third possibility, that it was -- that this item was printed at the warehouse the following day? STOCKHAM: Well, I don't know. I didn't do any printer tests. GERAGOS: So we don't -- just don't know? STOCKHAM: That's correct. GERAGOS: Okay. Well, you don't know at this point because you didn't do a printer test? STOCKHAM: Right. GERAGOS: Printer test would tell us? STOCKHAM: Well, not necessarily. Depends on the printer. And if I can match a printout from that printer. GERAGOS: And the other question that Mr. Harris was asking you was the file times here on D5L-3. All of this is the internal clock, right? STOCKHAM: Yes. Those would have been time stamps by the computer that had those files. GERAGOS: Okay. And as you indicated before, much of the accuracy of that depends on the internal clock itself, correct? STOCKHAM: Yes. And the user. GERAGOS: And the user? STOCKHAM: Yes. GERAGOS: Thank you. I have no further questions. HARRIS: No additional questions. JUDGE: Okay, Mr. Stockham. Thank you very much. |