|
Lydell Wall
Witness for the People: Guilt Phase August 3, 4, 26 & 30, 2004
Direct Examination by David Harris HARRIS: Sir, can you tell is what your occupation is? WALL: Yes. I'm a detective with the Stanislaus County Sheriff's Department. And I'm assigned to the Sacramento Valley High-Tech Crimes Task Force. HARRIS: What is your assignment with the High-Tech Crimes Task Force? WALL: I'm a computer examiner. HARRIS: And to be a computer examiner, do you have any background, education, and training? WALL: Yes. I have an approximately 640 hours of training pertaining to high technology investigations and computer examinations. HARRIS: And this training, what kind of training is that? WALL: Basically how to investigate technology-related crimes and methodology in how to extract data from computer systems that are seized as evidence. HARRIS: Now, when you are talking about training, just to flesh this out a little bit more, is it something that you go to a class about, or is it something you just read about? How does that work? WALL: Yes. Training is actually sanctioned by the California Commission of Peace Officers Standards and Training. And also attended training by the Search Group, the FBI, and specific software vendors. So it's Guidance Software and Access Data where I received certifications from those of completion of their courses. HARRIS: Those last couple of courses, you are talking about software vendors. Are these products that you use as part your computer examinations? WALL: Yes, it is. HARRIS: Is it also referred to as forensic software? WALL: Yes, it is. HARRIS: And to use this, you actually go to the company, they provide you training and then certify you? WALL: Yes, they do. HARRIS: Now, have you also testified as an expert before? WALL: Yes, I have. I have testified on three different occasions regarding technology crimes and computer examinations. And I have also been assigned as an Assistant Special Master by the Honorable Judge Humphreys of the Kern County Superior Court. HARRIS: I'm going to direct your attention specifically in the case that you are here for. Were you asked by the Modesto Police Department to assist them in a forensic examination of some computers that have been seized from the defendant? WALL: Yes, I was. JUDGE: Are you going to offer him as an expert now? HARRIS: Yes. JUDGE: Do you want any voir dire? GERAGOS: Is it detective? WALL: Yes, it is. GERAGOS: Did you say that you testified three times? WALL: Yes. GERAGOS: And in what courts? WALL: In Stanislaus Superior Court. And I have testified in the Kern County Superior Court. GERAGOS: And at all three occasions did you testify as an expert on forensic computers or computing forensics? WALL: One of the cases was regarding a technology-related crime that did not involve computer forensics. GERAGOS: Okay. When you say technology related crime, something that had to do with, what, an identity theft, or something like that? WALL: It was a sexual predator that we arrested. GERAGOS: So you were talking about, I guess, how you deal with an on-line situation? WALL: Yes. GERAGOS: Okay. And your expertise did not involve computer forensics in that case, correct? WALL: That’s correct. GERAGOS: The other two times was that one from Kern County? WALL: No. GERAGOS: That one was in Stanislaus? WALL: That’s correct. GERAGOS: And then the Kern County was on computer forensics? WALL: Yes, it was. GERAGOS: Was that in extracting the information from the computer? WALL: Yes. I was assigned as an Assistant to the Special Master to deal strictly with the computers. GERAGOS: Okay. Not one of those situations where a search is done, and then they image the computer, and then Special Master is supposed to take a look at it with you there? WALL: Well, in this case it was not with the Special Master there. The judge gave me some leeway in that case, and I was able to examine the hard drives without the Special Master there. GERAGOS: Okay. Did you end up testifying in that case? WALL: The case is ongoing. GERAGOS: So you have not testified? WALL: I have testified regarding that case, but it's basically pretrial issues. GERAGOS: Okay. So in terms of the actual issues of computer forensics, you haven't qualified as an expert and testified in a trial setting in that, on that case? WALL: Not yet. GERAGOS: Okay. So those are those two cases. There is yet a third case. Was that Stanislaus back again? WALL: Yes. GERAGOS: And did you testify in that case? WALL: Yes. GERAGOS: And was the testimony surrounding extracting information from a computer? WALL: Yes. I had to deal with deleted files and assorted issues regarding computer forensics. GERAGOS: Okay. And the testimony there, were you deemed to be an expert? WALL: I don't think anyone specifically said that I was considered an expert. They stipulated to my knowledge regarding the computer use. GERAGOS: Okay. And was that for a specific discrete issue in terms of deleted files, or something of that nature? WALL: Yes. GERAGOS: Okay. And so that basically in these three situations you haven't qualified as an expert in any of those three; is that correct? WALL: Well, no one specifically said we're qualifying you as an expert. GERAGOS: You didn't do what Mr. Harris is doing, ask you the questions, offer you as an expert, have the judge find you to be an expert? WALL: The judge did not say anything about me being an expert, no. GERAGOS: I believe there is an insufficient foundation. JUDGE: I think that's for the judge to decide. All right, based on his qualifications, I'm satisfied that he's a qualified has an expert in computer forensics, qualified to give an opinion. Go ahead. HARRIS: Thank you. HARRIS: Detective Stockham (sic), just to go back through this a little bit. Counsel was asking you about the other case dealing with this predator case. GERAGOS: Could I just interrupt for a second? I think you misspoke. I think this is Wall, Detective Wall. HARRIS: I'm sorry. Detective Wall, the predator that you were being asked about on line, is that basically referring to the internet? WALL: Yes, it is. HARRIS: As part of your background and experience, and in doing the High-Tech Crime Task Force, do you also learn how the internet works? WALL: Yes. HARRIS: And in that particular case, that was specifically the issue that you were dealing with? WALL: That’s correct. Integral part of it goes hand-in-hand with computers. HARRIS: Now, in this particular case, the investigation that you were asked to do, or the review you were asked to do by the Modesto Police Department, did it also cause you to look at certain internet usage? WALL: Yes, it did. HARRIS: And so that previous experience and background, that came to play when you did this examination? WALL: Yes. HARRIS: I want to go back through this. You were also asked about something else Mr. Geragos said about deleted information, or discrete areas of the computer. In that particular case, let me back up, just go to something the judge had asked of another witness. For a computer, if a person deletes something from their computer, so you are using the operating system, and hit delete, what happens to that information on the computer? WALL: Well, in most cases that information never really goes away. The analogy I like to draw for people to clearly understand is, if you took the numbers off of your house, the house is still there, it's just the address is gone. Makes it more difficult to locate. So the data is still presently there, unless it is being overwritten by other data that's being allocated to that space. Most of the files, especially in large hard drives, are still going to be there. HARRIS: Counsel was asking you about recovery of deleted information. Can you explain to us that process, what it is that you do forensically in one of your examinations to try and recover data that's been deleted? JUDGE: Can I just ask one, this also applies to files, which is, you know, delete files, delete history? WALL: There is several ways that operating systems can delete files. You can manually delete something by selecting that file and selecting the delete key. JUDGE: And click it? WALL: Yes. It goes into the recycle bin, we can delete from. There is, also the operating system can also delete things on its own, depending on the settings that you have through your Internet Browser. JUDGE: Supposing you get, select options, the top of your computer, and you get delete file, delete history. Does that actually eliminate the website you were looking at? WALL: No. JUDGE: Is it still in the computer? WALL: In most cases it is still there, your Honor. JUDGE: Still retrievable? WALL: Yes, sir. JUDGE: Go ahead. HARRIS: Detective, let's go back through this a little bit more. The, can you, I guess for look of a better term, can you give us a breakdown in lay person's terms, how does a computer actually work? WALL: Well, computers are basically complex electronic filing cabinets, is the easiest term that I could come up with for that. They are large capacity storage systems consisting of a processor, memory, a hard drive, or storage device, and input and output device, such as a keyboard and a mouse. And through a series of key strokes or other input methods, files are created and can be stored on computers; and, in the same way, they can be deleted as well. HARRIS: We have heard the term being used, operating system. What is, in fact, an operating system? WALL: Well, typically most people are familiar with the Windows operating system. Windows 95, Windows 98, more currently Windows XP. HARRIS: And, again, what really are those things? WALL: They are software devices that allow us to easily use our computers and interface with them so we can use them as that massive filing cabinet. HARRIS: Now, you are talking about the address example. The analogy of when something is deleted from the computer. When you are using the operating system, to go back to what the judge was asking you, say, for example, you go on line on the internet, is that using this operating system? WALL: Yes. HARRIS: Now, so you are on the internet, and you go to a particular website, and you close down your computer, or leave the browser, what happens? WALL: Well, a lot of things happen. When you go to a website, all of that information that's from that website actually gets put into a temporary internet file or a cache file. What happened is, the text and the images basically get separated. They are all there in that same filing area, but they don't stay together like you would typically see them in a web page, or if you printed them out. So the data is all there, and can be recovered. HARRIS: When you say the data is there and can be recovered, can you explain that process to us? WALL: Well, the websites are there and can be recovered. When we use our forensic software to view this information, it's very similar to using your own Windows operating system. But, let's say, for example Windows Explorer if, you are familiar with that process, it is a graphical user interface that allows you to see files and folders on your computer, much in the same way that a normal user would see it in Windows. So our software allows us to view those files in the same way, except for the fact that files that are hidden by the operating system, we can see. The normal user can't, doesn't normally see those. Things that are in unallocated space we can access. So the normal user doesn't normally access the unallocated space of a computer. HARRIS: What is unallocated space? WALL: Well, there is basically two forms of space on a computer: Allocated space, which would be the space that you would normally access when you are using your computer, and then unallocated space. That's the things that get deleted. And when you fill your recycle bin, they go to unallocated space. When you select your Internet Browser to delete Temporary Internet Files, they get deleted in a different way, and go to the same area, unallocated space in the computer. HARRIS: I want to go back to what you were talking about with that the address on your house. So just using that analogy, if we have the address for the house, that's the equivalent of a file. That means there is something, some address in the computer so you can find that house? WALL: Actually the address of a house would be the equivalent of the name that, the file name. And that file name gets removed and is modified by the operating system. And, from there, we're able to shape our data mining, so to speak, to go after specific areas that are in unallocated space, that have been things that have been deleted, files that have been deleted. HARRIS: Now, when you, if you take the address off of the house, or you change the name, or delete the name of this particular file, that's when it's assigned to this unallocated space? WALL: That’s correct. HARRIS: Is it still there, though? WALL: Yes, it is. But it's available. The operating system recognizes that unallocated space as area that can then be written over with new data in allocated space. HARRIS: You have used that term a couple of times about overwriting. What is that process? WALL: Well, basically the computer decides what area, as new files are being created, decides what area that the new data is being written to. And it's data, as new files are being created, that information expands on the hard drive, that area of allocated space expands, and it starts taking up the unallocated space. It's a constant back and forth shifting of data that's occurring. HARRIS: Again, kind of putting it in lay person's terms, the more you delete off of your computer, the more space that you have? WALL: Available, that's correct. HARRIS: Now, the data that you are deleting, though, is still there until it's overwritten? WALL: That’s correct, because new files would then occupy that space. HARRIS: To go back to what we were talking about in terms of the internet, you were saying that certain things happen when you go to the internet net. Does, unless you go in and delete this, does that internet information stay on your computer? WALL: Yes, it does. HARRIS: The judge asked, I think the term he used is, if you clear out, or hit your, delete your history, does the computer keep track of things that we do while we're on the computer? WALL: Absolutely. It keeps track of almost everything that you do. HARRIS: And how is that? WALL: Well, every time that you access something like, let's say, for example, on the internet there are actually files that are created. If you view an image on a web page, that web page and its corresponding image that you are seeing gets cached or placed into the Temporary Internet Files, and a record of that is kept there until such time that that information from the Temporary Internet Files is either deleted or is, through the normal process, depending on settings of the Internet Browser, it rolls off into unallocated space. HARRIS: And that's area where it can be reused by the computer? WALL: That’s correct. HARRIS: Now, if you are doing things in the computer, say, not the internet, does the computer keep track of that? WALL: Yes, it does. Everything that the computer does, there is usually some type of a report or a log of it being that those transactions being conducted. HARRIS: In the mechanical process of doing this, how the computer is doing this, can you explain to us what the computer does? WALL: Well, there is, it's a pretty complex process, and I don't understand every aspect of the operating system that was designed, let's say, for example, by, in this case Windows. I don't know every little file that's created, or every issue that's created by the operating system. But there is a process that does occur where those files are saved and stored. HARRIS: When you are talking about that, when these files are created and stored, does the computer name those files? WALL: Yes. There is usually some type of naming convention that's associated with each file. HARRIS: And does it give you some kind of indication as to either date and time as well? WALL: That’s correct, it does. HARRIS: So is that the process that you can go back, and when you do the forensic examinations, and try and figure out certain things that have been on the computer? WALL: Yes. Specifically according to the date that it was either created or modified. HARRIS: Now, in this particular case, the items that you were asked to look at by the Modesto Police Department, did you also deal with Detective Kirk Stockham? WALL: Yes, I did. HARRIS: And did he provide you with, for lack of a better term, it's been called either a cloned, or a mirrored, or forensic copies of hard drives? WALL: Yes, he did. HARRIS: And how many hard drives where you ultimately provided? WALL: I started off with four, but a fifth one was added. HARRIS: And these four, were they named by Detective Stockham? WALL: Yes, they were. HARRIS: And did he have what, I think you used the term earlier, some type of naming convention for those? WALL: Yes, he did. HARRIS: Do you recall what the naming conventions for these hard drives were? WALL: Yes. One of them was "Dell Laptop Home 1". There was another, and I would have to refer to my report to make sure that I'm getting them all correct. HARRIS: Let me ask you that. As part of the process of doing this for the Modesto Police Department, did you write a report? WALL: Yes, I did. HARRIS: And if you were to look at your report, would that help you refresh your memory as to the specifics? WALL: Yes, it would. HARRIS: All right. WALL: Okay. Compaq Laptop Home 2; Dell Work PC 4; IBM Laptop Work 3; and Dell Laptop Home 1. HARRIS: You indicated that there was an additional one that came in later. What was that one named? WALL: That one was labeled Sotec Laptop. HARRIS: When you received these particular hard drives for examination, these were forensic copies, so they are kind of duplicate copies of the originals? WALL: That’s correct. HARRIS: And did you start to go through this process, let me back up for a second. When we're talking about they are hard drives, what does that really mean? WALL: Well, basically it's the storage device for a computer which, most people are familiar with the terminology of a hard drive. What Detective, or Officer Stockham did was create a set of image files using EnCase forensic software. And those were the set of files that he gave to me. Each one of those that were labeled by their naming convention were given to me on a hard drive. For me to be able to analyze it requires for me to use a hard drive with those bitstream image copies, the image files on them, to be able to conduct the analysis with the software that we use. HARRIS: Now, as you said, most people are kind of familiar with hard drives at this point in time. When we're talking about hard drives, did these hard drives have a particular size? WALL: Yes. I don't remember the exact size, but there was a total of, I think it was a little over 84 gigabytes total between all five hard drives. HARRIS: What does that mean? WALL: Well, the storage space that's available is measured in a lot of different formats. First came out in megabytes, you know, smaller, the older computers was smaller, the drive space was. Now we're into hard drive sizes that exceed 250 gigabytes of storage space. It's a lot of space. HARRIS: When we are talking around, you said 80 gigabytes? WALL: Yeah. Approximately 84 was the HARRIS: In terms of data storage, or what you have to look at, is that a lot or a little? WALL: That's a lot. HARRIS: Can you give us some idea or estimate of how big that is? WALL: Well, a typical floppy disk, most people would be familiar with that. Quite a few document files can be contained on one floppy disk. That's 1.44 megabytes of space. I don't know the exact number, and it would depend greatly on the size of the document. But if you multiply that times what is available on 84 gigabytes, which is, a gigabyte is a thousand megabytes, you have the potential for a lot of data storage on one of those, on a single hard drive. HARRIS: Now, as you were talking about this being part of EnCase software and the use. What is EnCase software? WALL: EnCase Forensic Software is actually a software product that was developed by Guidance Software that would enable examiners, like myself, to be able to safely view the files and operating system and the folder structure on the computers that we're examining. So basically we're able to look at that data without changing any of the evidence files. So everything remains exactly the same as when the file was, when the image files were created, when bitstream copy was made. HARRIS: Let's just go back, make sure I understand that. So you start with this kind of cloned copy. It's a duplicate of the original? WALL: That’s correct. HARRIS: When you examine it, does your examination change anything? WALL: Absolutely not. HARRIS: So when you find something on this cloned or mirrored copy, forensic copy, you get to look and see what was on the original computer kind of in the pristine state? WALL: That’s correct. That is also fully duplicateable as well. HARRIS: You were talking about, with the EnCase software, say you go into the forensic copy, you find something in the unallocated, or something that's been deleted, how do you go through and recover that? WALL: Well, there is several processes that the software allows us to do. There is specific scripts that we can run that are provided by the company, that we can say recover all web page documents. And it will automatically run a script, and it will go through the computer, through the unallocated space and extract all that data out for us. So it's pretty much an automated process. HARRIS: And did you go through that process in this particular case? WALL: Yes, I did. HARRIS: What kind of these automated processes did you do? WALL: There is quite a few of them. You can do them for key words, for searching anything in a computer for specific, key words, which is probably one of the most common processes. You can extract image files, you can shape your search to go after just about any type of, any type of data that's on the computer. HARRIS: Let back up to the second one you mentioned about searching for image files. What is the process of doing that? WALL: Well, it's the same. In the allocated space, we can see them freely, just like the user would. So we can go through files and folders and look where image files are contained. We can also sort specific data and say I want to see a specific type of image file format. Let's say, for example, a JPEG image, which is a very common image file. It's, the file extension is dot J-P-G. I can then sort every file using forensic software to let me see only the file extension that shows those image files. And then I can sort by date and organize them, and be able to see exactly where they are resident on the computer. HARRIS: When you run these searches, do you just do this one hard drive at a time? WALL: No. It can be done one hard drive at a time. But, in this case, I loaded all four hard drives, that was with the exception of the Sotec laptop. I ran this process on them simultaneously. HARRIS: Does that speed up the process? WALL: Yes, it does. HARRIS: We now, so you run this across the four hard drives that you have, other than the Sotec. What do you get? WALL: Well, depending on what data you ask for, you can get web pages, images, document files. Just whatever you are particularly looking for. E-mail. Just depends on what you ask for. HARRIS: What I'm basically getting to, what, you kind of get a large amount of data? WALL: Yes. You do get a large amount of files that are extracted. HARRIS: Now, let's go through that again. Since we're talking computer stuff here, when we are talking about data or file, is that terms that are interchangeable? WALL: Yes. HARRIS: Now, if you have data that is out there in the unallocated space, it's been deleted, do you have to name that to recover it? WALL: Actually, depending on the process, well, the short question is, no, you don't have to name it. HARRIS: If you wanted to recover that, how do you do that? WALL: You ask it to search for a specific file extension. So if you are looking for web page documents, you would ask it for HTM, or HTML documents. It would extract all the document data A lot of these files don't have file names, because most of them are deleted from the drive. So the file naming convention doesn't stay with that file and web page documents. So the software assigns a numerical file name to it so it has some way of bringing it out to your computer so you can see it. HARRIS: As part of the process of doing this investigation, were you actively involved in what the Modesto Police Department was doing, or were you assisting them as they asked? WALL: They would ask me for a specific task to be done, and I would do it. I wasn't privy to their investigation information. And I was pretty much working in the background. HARRIS: So as part of this process, I want to talk about that. Would they give you certain information to look for to see if you could find it on the computers? WALL: Yes. They were interested in specific dates. And they were also interested in specific keywords to be looked at to see if they could be associated with any files that might have been created. HARRIS: Were you asked to also go through and see if you could, if there were any e-mails on these computers? WALL: Yes, I was. HARRIS: And did you, were you asked to see if you could go through and find out if there had been any internet usage besides e-mails? WALL: Yes. HARRIS: Basic things of that nature, is that what they were asking you to do? WALL: Yes. And specific dates. HARRIS: You mentioned dates. I want to go through this process, and then have some documents that we're going to need to have marked, judge. And they are quite a few of them. So JUDGE: Okay. Next one is 177. HARRIS: I don't need to have this marked at this point in time. Since we're getting close to the end, I don't know if, I'll ask a few more questions, then, JUDGE: Why don't you ask an few more questions, then we'll take the recess, then we'll mark these things tomorrow morning. HARRIS: All right. And at some point in time, did the Modesto Police Department, as part of your search looking at these four computers, ask to see if you came across anything that dealt with going to either the San Francisco Bay, or to bay charts, or things of that nature? WALL: Yes, it did. HARRIS: And did you search across these computers? WALL: Yes, I did. HARRIS: What, if anything, did you find? WALL: Well, I found specific information relating to fishing sites, maps, and charts. I also located information on boat want ads, and variety of information associated with fishing. HARRIS: Now, this information about fishing, or boats, or the Bay, boats or the Bay, you did this kind of search that you are talking about, you put in the search all four computers? WALL: That’s correct. HARRIS: They would search for the active, or the files that you can see, and then the unallocated files that you couldn't see? WALL: That’s correct. HARRIS: When was the first time, or what file date did you find for these particular searches? WALL: The first instance that I found was an allocated space, conducting the searches, was on December the 7th. HARRIS: You say unallocated space? WALL: In allocated space. JUDGE: Allocated. HARRIS: This is something that was still there, still visible on the computer? WALL: That’s correct. That was December 7th, 2002. HARRIS: Did you look to find out what that particular document was? WALL: Yes. HARRIS: What document was that? WALL: That was a want ad pertaining to boat sales. HARRIS: So the first time you found anything dealing with fishing, or boating, or the Bay, was on December 7th, of these want ads? WALL: That’s correct. HARRIS: Judge, we are going to have a number of things marked. I don't know. It's going to take some time. <evening recess>
August 4, 2004 JUDGE: Do you remember where you left off, Mr. Harris? HARRIS: Yes. JUDGE: Go ahead. HARRIS: Detective, we were about to start marking some exhibits yesterday, and before we do that, I want to ask a couple different and additional questions. How long have you been a police officer? WALL: For approximately 26 years. 24 years with the sheriff's department, and I was with another agency prior to that. HARRIS: And how long have you been assigned to the high tech task force? WALL: Since 1999. HARRIS: You were describing for us yesterday the EnCase software that you were using to do this forensic examination, and did you print out a screen print of what it looks like when you're doing one of these EnCase reviews? WALL: Yes, I did. HARRIS: I'd like to have that marked People's next in order. JUDGE: All right. That will be 177. And what's the official title of that? HARRIS: A screen print of the EnCase software. JUDGE: A screen print of the Intake (sic) software. HARRIS: Yes. Detective, let me show you what's been just marked as 177. Do you recognize that? WALL: Yes, I do. HARRIS: Is that the screen print that we're talking about? WALL: Yes, it is. HARRIS: All right. The People will go ahead and project this up there so we can see what it is that we're talking about. Now, putting up on the screen 177, I know it's kind of hard to read, can you describe for us what this is. WALL: Yeah. This is the graphical user interface of the software product known as EnCase, manufactured by Guidance Software. And this one particular instance it shows clearly what I see when I conduct a forensic examination on a computer. The left pane shows the typical file structure that you would see in a Windows environment. You can see the folder structure, and on the right is the individual files that would be associated with the folder that is chosen. HARRIS: So I know it's, it's kind of fuzzy from across the room, but the software pretty much takes all the data that's on a computer and puts it into a file structure format much like a regular operating system? WALL: Exactly. It's like a database. HARRIS: I don't think we can get this focused any more, but I'll try. That's about as good as it's going to get. And there's a highlighted portion up here. Are you looking at a particular file with that highlighted portion? WALL: Yes. HARRIS: And what does it indicate that it is? WALL: Well, I'm having trouble seeing it from here. HARRIS: Let me present it to you. WALL: Thank you. The file is called boats bracket one dot htm. HARRIS: So when you were doing this examination, you were describing for us yesterday how it pulls up data, you can actually go in and kind of click on the individual file and see what it is? WALL: That’s correct. HARRIS: All right. Now, you described for us yesterday that you started looking at stuff and you were finding stuff related to fishing or boating or the Bay, and the first thing you found was on December 7th of oh two? WALL: That’s correct. HARRIS: And that was some kind of want ads or classifieds? WALL: Yes. HARRIS: If I could have marked as People's next in order. JUDGE: 178. HARRIS: This would be five documents, which counsel has already seen and been provided. JUDGE: Five documents. A through E. HARRIS: I'll try and see if this focuses. HARRIS: Detective, showing you 178 A through D, do you recognize these as being documents that you printed off of the forensic copies or the forensic files? WALL: Yes, they are. WALL: And with these particular documents, give counsel a second to write this down HARRIS: While he's doing that, let me ask you some other questions. There's some writing that appears on these documents. Did you put that writing on there? WALL: Yes, I did. That writing is the date that the file was created and the time that the file was created on the computer. GERAGOS: Thank you. JUDGE: The original date and time? The original date and time? WALL: That's correct. HARRIS: Let me go ahead and put up 178A. Now, looking at the top of this document, does it indicate where or what this is related to? WALL: I'm going to have to find a frame of reference because it is difficult for me to see as well. HARRIS: Give you back the original. Does that indicate ModBee dot com at the top? WALL: Yes, it does. HARRIS: And is that some type of acronym or something from a web site? WALL: Yes. That is the known URL for the Modesto Bee. HARRIS: What is a URL? WALL: It's a Uniform Resource Locater. It's the way that the Modesto Bee allows people to go into their web site. So if you would enter in WWW dot ModBee dot com, you would go to the Modesto Bee's web site. HARRIS: Now, looking at this particular document, if you need to look at them in your hand, let me know. There are some boxes at the top of this document with little squares and red Xs. What does that indicate? WALL: Those would have been where banner ads or images would have been located on the original document as it appeared on the web site. HARRIS: All right. And as you were describing for us, at the bottom of the document there's the handwriting. Can you see that from where you're at? WALL: Yes, I can. HARRIS: And that's your handwriting? WALL: Yes, it is. HARRIS: So this particular file, as it resided on the computer, the defendant's computer, was that created, accessed, that three terms that you're using, on December 7th of 02? WALL: That’s correct. HARRIS: And the time for this particular document? WALL: It looks to me like 9:44:20, if I'm reading it correctly, a.m. HARRIS: All right. Showing you 178B. Again, is this a printout from the Modesto Bee? WALL: Yes, that's what it appears that it is. HARRIS: And the bottom it has, again, times there? WALL: Yes. The date of December 7th 02, and the time that it was created. HARRIS: And the time for that, this one is? WALL: I'm having a hard time seeing it. I'm sorry. GERAGOS: I can see that it says 4:41. If you want I'll just stipulate that's what you wrote on there. Is that your handwriting on the lower right? WALL: Yes, my handwriting appears on all of these documents. GERAGOS: Okay. HARRIS: So at the bottom right of the document where it says 4:41:32 p.m. that would be your handwriting? WALL: That’s correct. HARRIS: Does that represent the time of the original file? WALL: That it was created on the computer, that's correct. HARRIS: The next one, 178C, this is another printout for the Modesto Bee? WALL: Yes. HARRIS: Can you see that at the top? WALL: Yes. HARRIS: And this is the, basically their electronic classified ads? WALL: That’s correct. HARRIS: The time for this particular document 178C is December 7 at 4:41 and 52 seconds p.m.? WALL: That’s correct. HARRIS: 178D, is this going further into the classified ads? WALL: Yes, it is. HARRIS: The time for this one is December 7th 02 at 4:42 and 12 seconds p.m.? WALL: That’s correct. HARRIS: And the last one, 178E, is this, again, more ads for the Modesto Bee? WALL: That, that would be more specific where selections have been made to get to that specific area where boat ads appear. HARRIS: And the time for this particular document is December 7th, oh two, at 4:42 and 50 seconds p.m.? WALL: That’s correct. HARRIS: Now, to take you through this, or take us through this particular process, if you're on the Internet, and so you're looking for something or you want to search something on a web site, give us the basic rundown how this works in terms of what we're looking at with these documents. WALL: Well, basically you would start at a specific starting point, in this case ModBee dot com classifieds. And from there you can navigate or select a hyperlink, which takes you to the next page. And so you can narrow your search and get to the specific area that you're interested in. HARRIS: So as we go through the file times here, would this indicate that somebody started at that kind of outside and moved into the ads that we see here for boat ads? WALL: Yes, that's correct. HARRIS: And the second ad up there, that's for a 14 foot aluminum boat and trailer? WALL: Yes. HARRIS: Now, after you find that particular information, do you pass that along to the police detectives from the Modesto Police Department? WALL: Yes. HARRIS: Do you continue looking to see if there's other searches in terms of what's going on, either water, boating, fishing, bays, maps, charts, something along those lines? WALL: Yes, I did. HARRIS: Were those specific things that you were asked to look for by the police department? WALL: Yes, they were. HARRIS: And you indicated that this was the first thing that you found on December 7th? WALL: That’s correct. HARRIS: And that was across the four laptops that you originally had? WALL: Actually across the four hard drives. I wasn't working with any of the actual physical hardware. The laptops or the computers. I didn't have any of those. HARRIS: So as you searched across the hard drives, this was the first time that any kind of boating, fishing any information comes up? WALL: Yes. HARRIS: As you move forward in time, do you also check out December 8th? WALL: Yes, I did. HARRIS: Did you find more activity related to boating, fishing, bays, charts, anything on December 8? WALL: Yes, I did. HARRIS: Was there a lot of documents from the files of the computers, all four of the computers at that time? WALL: No, they were primarily on one computer that was identified as DELL laptop Home 1. HARRIS: And that was the, again, that's the naming convention that came from Detective Stockham? WALL: That’s correct. HARRIS: I'd like to have marked People's next in order. JUDGE: 179. HARRIS: And subparts. It's a binder, we previously marked the pages inside A through U. JUDGE: Okay. HARRIS: What we've done is on each separate document written in red in the lower right a letter, to make it easier for the clerk. GERAGOS: Is that 179? HARRIS: Yes. JUDGE: Yes. 179 binder and contents, A through U. GERAGOS: Just going to do it binder and contents? JUDGE: Right. HARRIS: Detective, let me show you 179. And do you recognize the contents of this, this binder? WALL: Yes, I do. HARRIS: And are these printouts that you were aware of or had some involvement with? WALL: Yes. These are documents that I created as a result of the analysis of the computer systems that I did. HARRIS: Now, each one of these documents, does it have a handwritten letter in the lower right hand corner? WALL: Yes it does. HARRIS: And do you know how they got there? WALL: Yes, I placed them there. HARRIS: And also on the bottom of the documents, does it have dates and times, like we've looked at in the previous exhibits? WALL: Yes, they do. HARRIS: Who placed those there? WALL: I placed those dates and times as well. HARRIS: Did you also write on the back of these documents? WALL: Yes, I did. HARRIS: So for these documents, as you find them on the computer with that EnCase software that we were looking at, it tells you the date and time that this information was obtained on that computer? WALL: That’s correct. HARRIS: And so you have now printed that out, and that's what this, these documents represent? WALL: Yes. You can even see by the print document at the base that it was conducted by me, my network name, WALLLYD, is at the bottom of each of the documents as well. HARRIS: Okay. We have one, we'll take this from you and we'll put this up there, but we have one up on the screen right now that we're looking at, the previous exhibit, 178 E. Let's go back through that. You're saying that your information is at the bottom of these documents? WALL: That’s correct. Whenever a document is printed, the file that's created grabs the information, your network information, in my case where I'm connected to a network, and adds that to the document, as well as the date on the right-hand side that the document was printed. HARRIS: So we're looking at 178E right now. Let me just highlight this with a laser pointer. So you're saying this is your information right there? WALL: Yes. That's my network access name. HARRIS: And then to the far right there's another date, and that date is different from what you've written, you've handwritten on the documents. What is it in that one, 178E, the 8/1/2004 date? WALL: That is the date that the document was printed by my printer. And computer. HARRIS: All right. So, again, the handwritten information of these documents is your, your examination of all the files and that specific information related to those documents? WALL: That’s correct. Written in my hand. HARRIS: And then the printed information is just the information that goes to the printer? WALL: That’s correct. HARRIS: Now, going through this binder 179. Now, looking at this particular item, this is 179A, can you describe for us what we're looking at here? WALL: I would have to take your word for it because I'm having trouble seeing it. I apologize. HARRIS: All right. We, tell you what. Let me just kind of help you out here. Looking at the top of this document, does this indicate Fresno Bee? WALL: Yes, it does. HARRIS: So this is from Fresno Bee's dot com, and it indicates in the middle that it's a classified ad? WALL: Yes. HARRIS: Now, at the bottom of this particular ad, this printout, again we see the date and time information that you've written down? WALL: Yes. HARRIS: And so, on December 8th, this computer was kind of pinging this web site looking for, appears to be boats? WALL: Yes. HARRIS: And that was at 12/8/02 at 7:52 and 48 seconds? WALL: Yes. And that was from the DELL laptop Home 1 computer as well. HARRIS: Going to the next item, which is B, does this appear to be some type of search that's being conducted? WALL: Would it be all right if I got closer to that? Is that possible? JUDGE: You know, I tell you what, why don't you go stand right by there, and we'll give you, Detective Wall, take that pointer. We'll ask you to keep your voice up so everybody can hear you. WALL: Sure. HARRIS: Try not to look into the light. WALL: Okay. JUDGE: Does that help if you stand close? That close? WALL: Yeah. JUDGE: Okay. HARRIS: All right, Detective, looking at this particular document, B, do we see the same basic information down at the bottom, 12/8/02 at 7:57:58 a.m.? WALL: That’s correct. Right here at the bottom where I printed it. Where I wrote it on this document. HARRIS: Now, looking at the top, this indicates that it's a search results. Are there words that are actually typed in to be searched? WALL: Yes. HARRIS: And this is the first time that you saw there was some kind of boat or bay or any of these things that was being inputted for a search? WALL: Yes. There was a number of these documents that contained specific words that were entered in. In this case boat, ramp, pacific. You can see the entry block here, and these are the results of those. HARRIS: So the first some kind of search, other than somebody going to a web site and clicking to get to a particular thing, where somebody goes to, let me back this up. This appears to be, I don't know if you can see it up there. Up in the upper left corner, does that appear to be where a graphic for Yahoo would be? WALL: Yes, it does. HARRIS: So this, what is Yahoo WALL: Yahoo is a web search engine. In this case where they operate web pages where you can enter in key words and it will search out those key words for you and return specific results on the web pages that you're interested in. HARRIS: So the first search by somebody using this computer, that you found, looking across those four hard drives that you were describing, for anything dealing with boats or fishing or bays, or any of that, is this boat, ramp, pacific at 7:57:58 a.m. on December 8th? WALL: That’s correct. HARRIS: Now, you described for us before that up here at the top, there's a box up there that indicates the graphics is not there. Can you explain to us why when you print these out it doesn't look like the regular standard print that we would get from a computer? WALL: Sure. And I explained that yesterday. What happens when you access a web page, it goes into the cache files, or the temporary Internet folder. At that the documents and the images are separated. They're stored in the same folder but they're separated. So when I'm accessing these documents, all I'm asking for is this specific document. I can refer to images, as well, that were created within that, you know, close in proximity to that time frame, but the way computers work with different access methods, like dial-up or high speed, graphics may load up in front of or behind the actual document file. HARRIS: All right. Turning to the next particular item, C, can you tell us what you this is? WALL: This is another Yahoo search results web page. And you can see here at the top boat, ramps, and it says Watsonville. HARRIS: And what date and time was this done? WALL: This was created on December 8th, 2002, at eight and 20 seconds a.m. HARRIS: Now, this particular binder that we're looking at, all of the exhibits in here, these are all from December 8th? WALL: That’s correct. HARRIS: And these were all from roughly the morning of December 8th? WALL: In this particular binder, yes. HARRIS: Was there another binder prepared for December 8th in the p.m.? WALL: Yes, there was. HARRIS: Let's go, finish going through this one. Looking at D. Can you tell us what this document is WALL: Yeah, this document was created on December 8th, 2002 at 8:01, 8:01:26 a.m. and it is a web page that deals with specific areas or maps of lakes within, I believe it's California HARRIS: Now, this particular document, it, you can't see it. Let me move it a little bit. At the top does it indicate one of 34 pages? WALL: Yes. HARRIS: And so this document has 34 pages of, of lakes in Northern California? WALL: Yes. It would be text content on those 34 pages. HARRIS: Not including any of the graphics, as you previously described? WALL: That’s correct. HARRIS: And this also includes maps or lakes in the area of Modesto? WALL: Yes, I believe it does. HARRIS: Looking at E. If you can tell us what this is. WALL: Yeah. This is another Yahoo search results page that was created on December the 8th, 2002 at 8:02:48 a.m. and in this case the results are for boat, ramps, Watsonville, and pacific. So you can see that the search is being expanded. HARRIS: Turning to F. If you can tell us what this document is? WALL: Likewise created on December the 8th at 8:02:56 a.m. Similar Yahoo search results page where, again, the search is being expanded boat, ramps, Watsonville, pacific, and ocean was added. I might add the return of these, you can see this in blue, and the text describes, the text describes the web page, and it gives the user the ability to then go to these individual web sites to conduct additional research. HARRIS: And the next document, G? WALL: Again created on December 8th 2002 at 8:04:16 a.m. HARRIS: And there seems to be a lot of blank space at the top, top of this document. WALL: Yes. HARRIS: Is that, again, because the graphics are not recovered or printed out at the same time? WALL: That’s correct. If I can take a look at it on there? HARRIS: All right. WALL: Okay. Yeah, basically shows that, right here says map of California. Would have been embedded on the original web site as a normal user would have seen it on the, on the web page. HARRIS: And this, again, does this have, this particular document in the upper right corner, does it indicate it's page one of 30? WALL: Yes, it does. HARRIS: And all 30 pages are here? WALL: Yes, they are. HARRIS: And this information is about, well, the document speaks for itself. WALL: Yeah. On this page it says Antioch Dunes National Wildlife Preserve, that information. Bear Valley is another one. HARRIS: So just going through this, this gives the basic information that was there: Lakes, water areas, habitat? WALL: That’s correct. HARRIS: All right. Going to H. WALL: This document was created on December 8th, oh two, at 8:06:06 a.m. And this is a search results for eBay, and in this case it was 679 items found for this key word search of dragon shirt. And the results, you can see the prices and the information about each one of those listings on eBay. HARRIS: Turning to I. WALL: This is another eBay search results web page created on December 8th, 2002 at 8:06:54 a.m. And the category that was requested was for embroidered shirts, and it looks like 1302 items were found on EBay concerning that search request. HARRIS: And J. WALL: Another eBay search request results created on December 8th 2002, 8:07:32 a.m. And it's for an Asian embroidered shirt. HARRIS: And all of these document that we're talking about in this binder, they came from a that same DELL laptop you're describing? HARRIS: All of these document were from the DELL laptop Home 1 computer. Going to the next item. WALL: Again an eBay search results request. 21 items found for dress embroidered shirt. And that was created on December 8th, 2002, at 8:07:56 a.m. HARRIS: Going to L. WALL: This is a document, a web page document that appeared on December 8th, 2002, at 8:11:22. And it, and the first page it shows Coyote Reservoir, and it gives some description of that region and fishing type information. HARRIS: And at the top of this document does it indicate San Francisco Bay area fishing? WALL: Yes, it does. HARRIS: And is that one of five? WALL: Yes. It's actually Ishi dot com was the web site. I don't know if you can see that at the very top. HARRIS: Turning to M. WALL: Again, created, this document was created on 12/8/02 at 8:12:32 a.m. And it is a web site describing the Central San Francisco Bay. HARRIS: N? WALL: Another document created on 12/8/02 at 8:13:48 a.m. describing trailering to San Francisco Bay, and it gives a description of information pertaining to that topic. HARRIS: Now, looking at the top of this, up here, this information, I don't know if you can see that or if you need to come look at the actual document, but is that boat U.S. dot com? WALL: Yes. That is the name of the web site is boat U.S. dot com. HARRIS: And this is a document that talks about navigating a boat and trailer near San Francisco or around San Francisco? WALL: I scanned it briefly, and I believe that it has that type of documentation in it. HARRIS: The next document, O. WALL: This is another document created on December 8th, oh two, at 8:15:52 a.m. It's a Yahoo search results page requesting search, results for San Francisco Bay, boat, ramp. HARRIS: And P? WALL: This is a specific web page called OCSC, San Francisco Bay. It is, it was created on December the 8th, 2002, at 8:15:02 a.m. And I believe it is information about the Berkeley Marina. HARRIS: I'm going to have you look, do you see the big bold up there where it says Maps? WALL: Right here? Yes, it says Maps right here. HARRIS: Yeah. Looking two lines down below that, what does that say here? WALL: It says: Click here for map of Berkeley Marina and OCSC. HARRIS: And this document was found to exist on the computer with the creation date or time that it was there of WALL: Created on December 8th, 2002, at 8:17:02 a.m. HARRIS: Now, again you described those boxes for us up there. Would that have loaded the graphics file when this web page was pulled up? WALL: Yes. The graphics would have been loaded within a close proximity of time of the document being created on the computer. HARRIS: As you did your examination, did you find the graphics for this particular web page? WALL: Yes. There were graphics that were available that showed maps of the parking area of the Berkeley Marina HARRIS: Turning to the next one. WALL: This is a web page called USAfishing dot com. It's a San Francisco Bay Report, is what it's titled. It was created on December the 8th, 2002, at 8:19:10 a.m. And it has specific information about that web site. HARRIS: Now, this particular document, it says at the top the USAfishing San Francisco Bay Report, and towards the middle left side of this document says Today's Headline is Thursday, December 5th? WALL: That’s correct. HARRIS: But the time that you find it coming on to the computer is December 8th at 8:19? WALL: That’s correct. HARRIS: And just for clarity, in terms of sequence, the previous document that we were looking at, the one that dealt with the, I think it was the OCSC, this document, P, with the map for the Berkeley Marina, that was, the Berkeley Marina one is prior to the USAfishing one? WALL: Well, I believe the previous one was at 8:17; is that correct? HARRIS: 8:17:02. WALL: And this is 8:19 a.m. HARRIS: Going to R. WALL: This is, again, the OCSC San Francisco Bay web site page created on December 8th, 2002, at 8:19:52 a.m. HARRIS: Going to S. WALL: This one was created on December 8th, 2002, at 8:21:42 a.m. And it's a Yahoo search page showing the results for Suisun Bay map, and the results corresponding to that request. HARRIS: T. WALL: This is a nautical chart for Suisun Bay web page created on December 8th, 2002, at 8:22 I believe oh six a.m. If I can take a closer look. HARRIS: All right. WALL: Actually it's 16. 8:22:16 a.m. HARRIS: And U? WALL: This is a web page showing the National Defense Reserve Fleet Suisun Bay, California. It was created on December 8th, 2002, at 8:23:04 a.m. And there's a place here for a graphic, as well, in the middle of the page. HARRIS: You can go ahead and resume your seat. Now, you had mentioned, before we go into the second binder that you did for the p.m., you were talking about how you recovered the, or you found the, the graphics with some of those particular web sites that we were looking at. If I could have marked as next in order three documents. JUDGE: 180. Three? HARRIS: Yes. JUDGE: A through C. GERAGOS: As one total document, 180? HARRIS: If we could do this A, B and C. JUDGE: Right. GERAGOS: 180 A, B and C? JUDGE: Correct. HARRIS: Detective, I'm going to present to you 180 A, B and C. Have you look at these. Do you recognize those? WALL: Yes, I do. HARRIS: And what are these documents? WALL: These are map images that were obtained off of the DELL laptop Home 1 computer. HARRIS: And put up 180A. Can you describe for us what this is? JUDGE: What number is that? HARRIS: 180A. JUDGE: 180A? HARRIS: Yes. WALL: This, this image is an image of the OCSC Berkeley Marina area that was created on December 8th, 2002, at 8:17:32 a.m. HARRIS: Now, on the top of this document there's printing up there. Is this printing of the location and the information that you included in your report about these particular files? WALL: Yes. This, the very top of the page shows the name of the actual graphics. It's called marina map bracket one dot gif. Gif is the file extension that shows this is a graphic image. This report was actually created from EnCase software. When we view an image, we're able to actually isolate that image on it's own specific page and show specific information about that image and where it's resident on the computer. HARRIS: And down towards the bottom on the printed information it says: Evidence file and full path. Is that how you identify that this particular file came from DELL laptop home? WALL: Yes. It says DELL laptop Home 1. That's the naming convention that was given to this computer by Officer Stockham of the Modesto Police Department. It was under the C, or the root directory, under Windows, temporary Internet files under the content folder that had the Internet Explorer, IE 5 is the version, and then it gives the specific folder name, where that folder was at. This is the name of the folder under that Internet Explorer, and then it gives the name of the file, marina map bracket one dot gif. HARRIS: Now, this particular, the marina map, this is one of the those graphics that would have been embedded in the folder we were just looking at, 179 I believe it was P, where you were describing that as the OCSC? WALL: Yes. And if you'll pay attention to the times, it would probably coincide very closely with the document file, the document portion of the web page. HARRIS: When you say they would correspond closely, what do you mean by that? WALL: Well, depending on the type of connection that a computer has, whether it's a dial-up or high speed access, it depends greatly on how files are loaded onto that person's computer. If the graphics are large, it may take a little bit longer. The document may load first. If the graphics aren't as large, the graphics may load before the document does. So it just depends on how the computer handles it depending on the speed and the access to the web site. HARRIS: So if a graphic is loaded, you click on the web page, and we all kind of experienced that when we're waiting for the page to come up, WALL: That’s correct. HARRIS: the computer is accessing all of this stuff off of the Internet, off of the networks where it resides? WALL: Yes. Sometimes you can actually see that process with a slow connection. If you waited before for a web page to load, you'll see it's slowly starting to appear. It does the same thing as those files are being created onto the computer. HARRIS: And as part of the file is completed, it's kind of given this date, name, stamp that says when it was loaded? WALL: That’s correct. HARRIS: Looking at 180B. What is 180B? WALL: 180 B shows a map of the designated parking area. The OS, I'm sorry, the OCSC marina area. And that was, that file was labeled: Parking bracket 1 dot gif. And you'll see the same information applies as to where that file resides. HARRIS: Let me see if I can zoom in a little bit. In this red area, see if we can get this focused. Just won't focus that closely. If you want to come look at this. WALL: Sure. HARRIS: The red area that we're talking about, what does that say? WALL: There's actually two red areas. The one on the left says "boat yard," and the one on the right, larger red area more towards the middle says "boat trailer parking." HARRIS: Right. If you could go and point that out for us so we know which one you're talking about. WALL: This is the one that says "boat yard." And "boat trailer parking." HARRIS: And again, the time that this file appears on the computer is 12/8, 8:7:17? Basically in the morning? WALL: Yes. HARRIS: Moving to the next one, 180C. What is that? WALL: This is a map of looks like the East Bay area. I can't really tell. HARRIS: If you want to come look at the original. It gets washed out up on the screen. WALL: Yeah. This map's file name is called Suisun Bay bracket one dot gif. HARRIS: Is there a little kind of box on that map? WALL: Yes. There's a box, if this is the one you're referring to, right here, and it says National Defense Reserve Fleet – HARRIS: And this is? WALL: with an arrow pointing to this box. HARRIS: This particular map would have been one of the graphics from one of those last exhibits on 179 where you were talking about where the reserve fleet was at? WALL: That’s correct. That would have been the graphic associated with that web page. HARRIS: And the date and time for this particular file? WALL: This one the file was created on December 8th, 2002, at 8:23:06 a.m. HARRIS: You can go ahead and resume your seat again. Now, as part of the, actually, to save my knees from bending down there, instead of going through the p.m. binder, we'll come back to that a little bit later. Were you also asked to look to see whether there was any e-mail activity on these four computers? WALL: Yes, I was. HARRIS: And did you, did you find any? WALL: Yes. A substantial amount of e-mail. HARRIS: Now, going through, through the process of this, when you're looking at e-mail on the computer, tell us how that works. WALL: Well, it can happen in a variety of ways, depending on the software that I use. I can shape a search and carve the data out based on key words that I'm looking for, and then find the surrounding text of that key word that's isolated by the forensic software. Or I can actually use other software products that allow me to view the e-mail, similar to how the person would, would view it, but more in a forensic format, where I can see more data that's associated with that e-mail. HARRIS: Now, what, again, for anybody who uses e-mail, you get an e-mail in, you're done with it, you delete it or send it to the trash. Does e-mail work the same way that you were talking yesterday about the files and data that's still on the hard drive, even though it's been deleted? WALL: Yes. It's still there. HARRIS: In this particular case did you find e-mails that had been deleted? WALL: Yes, I did. HARRIS: So you were able to recover that information? WALL: Yes, I was. HARRIS: Were you asked to search specifically for e-mails from a person by the name of Shawn Sibley? WALL: Yes. HARRIS: Or information about certain information or where her e-mail address was from? WALL: Yes. HARRIS: If I can have marked next in order. JUDGE: 181. HARRIS: A four page document. JUDGE: This is 181, Mr. Geragos. GERAGOS: Right. I believe part of 181 has already been marked as a defense exhibit. JUDGE: As a defense exhibit? GERAGOS: Yeah. I, it was used on the cross-examination of Shawn Sibley. HARRIS: With Ms. Sibley. JUDGE: So that goes way back when. GERAGOS: That's four pages? One document? HARRIS: What I'm going to do is it's paper clipped together, and what I ask is if the clerk can staple it together so it doesn't come apart. HARRIS: Detective, let me show you what's been marked as 181, ask if you recognize that? WALL: Yes, I do. HARRIS: And what is this and how do you recognize it? JUDGE: It's double U, Mr. Geragos. Mr. Geragos, it's UU. GERAGOS: UU? Thank you, your Honor. WALL: This is a document that I created while conducting a computer analysis, where I recovered e-mail from the unallocated space of the computer, of DELL laptop Home 1, DELL work PC 4. Those two. HARRIS: All right. And the, this particular document is a printout of what you actually recovered from the computer? WALL: That’s correct. HARRIS: Start with page one of 181. Now, at the top of this particular document, actually, let me just back up. There's some parts that are highlighted. What are the highlighted portions? WALL: Those pertain to the actual text of the document, and it would be the time, the date and time that the message was either received or sent. HARRIS: And above, at the top, very top it says Thursday, 14 November 2002, and has a time. Before that you, there's some information that, it has that naming thing that you were describing, the file naming system? WALL: That’s correct. It says one, and there's a paren there. It says DELL laptop or LPTP Home 1. When I refer to DELL laptop Home 1, I'm just saying it from the abbreviation that was given by Officer Stockham. And it comes from the C drive, the logical C drive, unallocated clusters. That would be the unallocated space of the hard drive of that computer. HARRIS: So this was a basically, basically it's a deleted e-mail? WALL: That’s correct. HARRIS: And this particular e-mail there, looking at the second highlighted portion, does it indicate who it's going to? Looking right here? WALL: Yes. HARRIS: What is it? WALL: Says from bior@theworks dot com to Scott Peterson, slp, I'll just spell it out, slpete1@email.msn.com. HARRIS: And that particular account, the slpete1@email.msn.com dot msn dot com, did you find the e-mail account on this computer? WALL: Yes, I did. HARRIS: And this particular one, does it indicate in the text of the message that it's to Scotty? WALL: Yes, it does. HARRIS: And at the bottom: See ya later H.B.? WALL: Yes, it does, at the very bottom of the highlighted text. HARRIS: Now, looking to the right side of the highlighted text, there's some of these characters over there. Can you explain what's going on there? WALL: Yeah. A lot of those characters that you see are formatting characters that appear in the e-mail program, the document that's created. So if it was seen in its natural format, it would appear naturally, and those characters wouldn't necessarily be there. It's a formatting issue that the software creates. HARRIS: All right. Going to the second item on page one of 181, can you tell, can you read for us from there? If you need to come look at it, that's okay. WALL: This portion right here? HARRIS: No, I'm talking about number two. WALL: Oh, I'm sorry. Down here. This is from, says bracket 2 DELL work PC 4. It comes from the logical C drive, the unallocated cluster, that unallocated space from the hard drive. It says Thursday 5 December 2002, 11:11:57, and then there's a minus 800 (sic) beside it. HARRIS: Now, this one indicates that it's from that same address, and it seems to be to the same address as the previous e-mail; is that correct? WALL: That’s correct. From bior@theworks.com and it's from slpete1@email.msn.com. HARRIS: So you found e-mail for that account, the slpete1@email, on two separate computers? WALL: That’s correct. HARRIS: So this one that's from Mr. Sibley, it was on the work PC? WALL: DELL work PC 4, as Officer Stockham named that computer. HARRIS: And the previous one was on the DELL home laptop? WALL: Laptop Home 1, yes. HARRIS: Going to page three, this particular item here? WALL: Yes. HARRIS: Which particular computer was this e-mail found on? WALL: This one is number 3, it was from the DELL work PC 4, came from an unallocated space. HARRIS: So, again, that means that it's been deleted? WALL: That’s correct. HARRIS: It continues on to the next page. And, again, there's all this character information in there that you're talking about? WALL: Yes. The formatting information from the software. HARRIS: Go ahead and resume your seat, if you would. To go back through this just a little bit, so we, you do the forensic examination of the computer and you find these deleted e-mails on two separate computers, the ones that we've been looking at. This is for an account for the defendant? Or for Scott Peterson? WALL: Yes, it is. HARRIS: And it's an MSN account? WALL: Yes. HARRIS: Can you explain to us a little bit about what an MSN account is? WALL: Yes. Microsoft offers e-mail in a free format. You can sign up for a Hotmail account or MSN, they call it a passport account. There's a variety of different names, depending on how you choose to sign up for it. But it's basically a free e-mail service that allows you to send and receive e-mails through their server system to your computer. HARRIS: Now, when you say to your computer, since you're going out to this place to, to get your e-mails, is it much like going to a web page? WALL: That would be the starting point. You would go to a specific log-in page for either Hotmail or the MSN passport account. You would log in with your e-mail name and a specific password. Then it would then allow you to access your mailbox folders and settings, where you can then see all the e-mail that you've received and where you can manage those folders and that e-mail. So you can save it on the server or delete it, if you wish. HARRIS: And is this particular type of account something that you can access from any computer? WALL: Yes. HARRIS: But it's password protected? WALL: Yes. Specific to the user. HARRIS: So the user creates a password and that's how they get into their own account? WALL: That’s correct. HARRIS: The, I want to go, going to start going through the binder, but I think that will take a while. <morning recess> HARRIS: Detective, where we stopped at, I was about to take you back to December 8th. You said that there was a second binder of these searches that you were looking at of December 8th for the p.m. session. Did you print those out as well? WALL: Yes, I did. HARRIS: And put them in another binder like the previous binder we have seen? WALL: Yes, exactly in the same way. HARRIS: If I can have that marked next in order. JUDGE: 182. And how many pages? HARRIS: We have GERAGOS: Binder contains HARRIS: Binder contents, we have marked it A through EE. JUDGE: A through EE. [People's 182 not available at this time] HARRIS: Yes. Binder and Contents Detective, let me show you 182, have you look at this binder see if you recognize it. WALL: Yes, I do. HARRIS: In this particular binder, there is a number of separate documents that appear to be printed out in there. Do each one of those bear, in the lower right corner, red letters again? WALL: Yes, they do. HARRIS: And did you write those on there? WALL: Yes. I did. HARRIS: Then above that, does it have the same date and time information as you had done in the previous binder? WALL: That’s correct. The date that the file was created, and the time that the file was created. HARRIS: This is the printouts from looking in this general period, that 12/8 p.m. session? WALL: That’s correct. HARRIS: All right. I'm going to start by showing you 182A. If you need to go back up there and look, can you describe for us what that is? WALL: Yes. This is a document created on December 8th, 2002, at 9:41:10 p.m. And the website is USA Fishing San Francisco Bay, Fishing Reports Dot Com. HARRIS: Now, in the previous binder there was USA Fishing San Francisco Bay report. There was another document. Was this the same website? WALL: Yes, it was. HARRIS: And so this is later in the day, same website. This page appeared to be different than the previous one. WALL: Yes. This is a portion of a larger website that has quite a few pages to it. HARRIS: And this one indicates, it has a headline. What's the headline, looking up here, what's the headline? WALL: Says "Today's Headlines, Sunday, December 8th, 2002". HARRIS: The other one said December 5th, 2002. Can you explain how that occurs? WALL: That’s correct. The one that said December 5th, this is actually the document that's created by the author, and they are obviously including the day of the headline that that date is created. So everything on this document is controlled by the author of this web page, not an individual user that's accessing that website. So the one that we saw previously in the a.m. that had today's headline, although it was created on the computer Dell Laptop Home 1 on December the 8th, similar to this one, it had not been updated like this one had. HARRIS: So if you go to a website in the morning, and the website hasn't changed any date, or updated something, you might get an old date? WALL: Absolutely. HARRIS: If you go back later in the day, the website updates it, is that why it might change? WALL: Yes, it would. HARRIS: Looking at B. Can you describe for us what this is? WALL: Yes. This is another Yahoo Search Results page. Created on December 8th, 2002, at 9:46:42 p.m. Keywords were entered into the computer, and these are the results of that keyword request. That said "San Francisco Bay Fishing Report", and then the corresponding document associated with those keyword requests. HARRIS: When you say keywords are put into the computer, does the computer do this? WALL: No, it's, these are the words that are entered into a box by the user saying this is the information that I'm requesting. So they type in the specific text that you see appear here, "San Francisco Bay Fishing Report". HARRIS: And the date and time of this document? WALL: December 8th, 2002, at 9:46:42 p.m. HARRIS: C? WALL: This is an Ebay web page that shows that an item has been relisted, and saying to review and submit the listing. So it's probably been finalized for the content of the user, whoever created this web page listing a placing diamond bezel ladies watch, Croton to the topic. Then, of course, here on the bottom edge would be a larger image and two smaller images. HARRIS: Did you actually find, recover from the computer the, those gifs, or those image files? WALL: Yes, I did. HARRIS: There is a text box underneath right here. Is this something that has to be input by the person? Is that, again, something the computer fills out? WALL: Are you referring to the, this description box? HARRIS: No. Just beneath there where there is this text language. WALL: Oh, yes. I can see the text that's in there. It's a description of the item that was listed. So the creator of this web page listing this item would have entered this text into that document. HARRIS: When you say creator of this web page, if this is somebody selling something on Ebay, they go into Ebay and they type in the description of the item and supply the pictures to Ebay? WALL: Yes. Although I have seen a lot of Ebay listings, I have never participated in any Ebay listings myself. So I don't have any personal experience about Ebay listings of documents. GERAGOS: There would be a motion to strike as no foundation. Have an Ebay witness on for today. JUDGE: You have no firsthand knowledge of Ebay, Detective Wall? WALL: My knowledge of Ebay is by seeing numerous Ebay websites on forensic analysis. But I have never created one myself. JUDGE: So to the extent that you have seen them, that can come in. Anything about he created it, how it's done, can be, the jury can ignore it. May be stricken. Go ahead. HARRIS: In particular page that we are looking at here, this is the top, it says "Sell Your Item 5 of 5 Verification"? WALL: That’s correct. HARRIS: Then it talks in the header, "Relist Your Item, Review and Submit Listing"? WALL: That’s correct. HARRIS: And this was found on which computer? WALL: Dell Laptop Home 1. HARRIS: What's the date and time for this one? WALL: Created on December 8th, 2002, at 9:46:54 p.m. HARRIS: Going to D, actually, let me back up for a second. Part of this particular C, in terms of the second page, some of these web pages we're looking at we have seen before. They are 1 of 30, 1 of 34. This one appears to be 3, looks like Page 3 for C. Does this indicate information about this? WALL: Yes, it does. HARRIS: This is, again, what was found on the computer? WALL: Yes. HARRIS: Does it indicate where payments are supposed to go to? WALL: Yes. Payment address and information is filled out. Scott Lee Peterson, 523 Covena Avenue, Modesto California, 95354. There is a space, and says USA HARRIS: Looking at page three of three. Just continues on this particular document, how it would be on the screen? WALL: Yes. That would be the last page of the document that was printed out. HARRIS: Now, attached to that is this particular file. Do you recognize this file? WALL: Yes, I do. HARRIS: And what is that? WALL: This is a gif image, gif page of the Croton watch. HARRIS: That would have been on that previous page? WALL: That’s correct. HARRIS: That would – WALL: That would have been the larger box image. JUDGE: That's D, or is that Page 3? HARRIS: Part of C. JUDGE: Okay. HARRIS: Turning to the next page. WALL: There is two other boxes on that first page. It showed graphic spaces for the two smaller images. This is the first of the smaller images. HARRIS: And the next page? WALL: This would be the second of the smaller images, showing the watch and the dark background. HARRIS: So these particular images would have been coupled with that previous Ebay page that you found on the computer? WALL: That's right. HARRIS: Turning to D. Can you tell us what this is? WALL: Again, this is an Ebay web page that's titled, "Sell Your Items. Congratulations." It says, "You have successfully listed your item." And the title of it is, "Amazing Diamond Bezel Ladies Croton Watch." Gives the actual listing number, Ebay listing number. HARRIS: And again at the bottom of this particular document it has your writing with the 12/8/02 at 9:47 and six seconds p.m. date, time. WALL: That’s correct. I wrote that on there. HARRIS: Turning to the next document, E. WALL: This is a web page entitled "Steve's SFBay Fishing Page." That was created on December 8th, 2002, at 9:49:42 p.m. HARRIS: And F? WALL: F is another Yahoo search results page showing the corresponding search results for the keywords "Map", "San Francisco Bay", and "Chart". HARRIS: So at this point in time somebody is doing a Yahoo search where they typed in those words, "Map", "San Francisco Bay", "Chart". WALL: That’s correct. HARRIS: And what's the date and time for this? WALL: That was created on December 8th, 2002 at 9:51:54 p.m. HARRIS: Did this pull up results for maps and charts of the San Francisco Bay? WALL: Yes. There are many results specifically for the listing of those keywords that were added. HARRIS: Going to G. WALL: This is a web page for the State of California Department of Fish and Game. It's the Licensing and Revenue Branch. Providing specific information for the Department of Fish and Game. It was created on December 8th, 2002, at 9:52:20 p.m. JUDGE: Mr. Geragos, do you want to put your microphone down? We can hear the conversation. GERAGOS: I don't mind turning it off all together. JUDGE: Why don't you do that. Go ahead. HARRIS: Going to the next one. WALL: This is an additional Department of Fish and Game Licensing Revenue Branch. And it lists the types of licenses that are available through the State of California. It was created on December 8th, 2002, at 9:53:04 p.m. This is the Near Real Time Current Velocity Map. SF Ports. SF Ports is the title of a web page that directs you to that location. It was created on December the 8th, 2002, at 9:53:20 p.m. And right here in this area would be a graphic that's called Central Bay Current Velocity map. HARRIS: Did you also search in the computers for whether the graphics were there for this particular website? WALL: Yes, I did. HARRIS: And did you document and find those particular graphics? WALL: Yes, I did. HARRIS: And mark them as part of your EnCase software process? WALL: Yes. HARRIS: We'll come back to that on I. Looking at the second page. WALL: This is the graphic associated with that web page. You can see here the graphic was created on December the 8th, 2002. And here, December the 8th, 2002, 9:52:54 p.m., is when it was created on the computer. HARRIS: The user in this particular computer has now pulled up this particular website that has what is going on for the San Francisco Bay in terms of its current? WALL: That’s correct. This graphic is associated with that previous page that you just showed. HARRIS: That's on December 8th? WALL: That’s correct. HARRIS: Next page. WALL: Here we're back to the State of California Laws and Regulation, Department of Fish and Game, I believe it is, website. Created on December 8th, 2002, at 9:54:58 p.m. HARRIS: That's J? WALL: That would be item J, correct. HARRIS: Going to K. WALL: This is another web page titled "San Francisco Bay Safe Boating Hints." Bottom title called San Francisco Bay, which would have a graphic image embedded here on the original web page. This was created on December 8th, 2002, at 9:55:34 p.m. HARRIS: Going to L. WALL: This is the State of California website, and it gives the specific listing for California Fish and Game Code. And this document is one of seven pages that lists each of the Fish and Game Codes. That was created on December 8th, 2002, at 9:55, and I believe it's 50, p.m. Let me take a closer look at that. HARRIS: All right. WALL: Yes, 9:55:50 p.m. HARRIS: Going to M. WALL: This is a 2002 Ocean Sport Fishing Regulations web page. Again, associated with State of California Department of Fish and Game website. Created December 8th, 2002, at 9:57:26 p.m. HARRIS: Looking at N. WALL: Again, the California Department of Fish and Game Sport Fishing Regulations web page. It talks specifically about a geographic location, 40 degree, I think it's 10 minute line to Point Conception, and does show a graphic here in this box. And it talks about what's open during that time period in that geographical location, along with the State of California for December 8. It was created December 8, 2002, at 9:57:38 p.m. HARRIS: Going to O. WALL: This is, again, State of California web page. Talks about Marine Sport Fish Identification. It's bolded here. Talks about Green Sturgeon. Would show an image here. And that document was created on December 8th, 2002, at 9:59:04 p.m. HARRIS: This particular document at the upper right, does it indicate 1 of 27? WALL: 1 of 27 pages. HARRIS: Did this have a number of fish that are listed? WALL: Yes. It talks about specific types of fish. HARRIS: And those particular fish, each one have a graphic associated with them that you found in the computer? WALL: There was also images showing pictures of the fish as well. HARRIS: Going to P. WALL: P is the San Francisco Bay and San Pablo Bay area. It is actually a map page where you can go to order specific maps. It was created on December 8, 2002, at 9:59:44 p.m. HARRIS: Q. WALL: This is another Yahoo Search Results page for the, requested was Maps, San Francisco Bay Chart. That was created on December 8th, 2002, at 10 and 50 seconds p.m. HARRIS: Is that 10:00 o'clock or 10:10? WALL: Let me take a closer look. It's 10:00:50 p.m. HARRIS: Looking at R. WALL: This would be, again, Marine Sport Fish Identification web page. And this one is titled Striped Bass on this, one of six different pages. Gives a description, history of the striped bass. This one was created on December 8th, 2002, at 10:01:18 p.m. HARRIS: S. WALL: We're back again to the 2002 Ocean Sport Fishing Regulations, California Department of Fish and Game, I believe. December 8th, 2002, at 10:03:14 p.m. HARRIS: T. WALL: This is another Yahoo Search Page results for map, San Francisco Bay chart. And it was created December 8th, 2002, at 10:03:32 p.m. HARRIS: And this indicates that it's a page one of three, right here? WALL: That’s correct. HARRIS: So there were three pages of hits or returns that came on this? WALL: That’s correct. HARRIS: U? WALL: U is a map collection web page, CPNWS map catalog. I have no idea what that stands for. Created on the computer, 12/8/02, at 10:04:54 p.m. HARRIS: Pointing out to you, one, here, towards the bottom of this, which says a description on this particular document. What does it indicate that is? WALL: Where it says comments? Oh, descriptions. I see what you are talking about. Right here it says, "Description, navigation chart shows soundings in San Francisco Bay area." HARRIS: These are, looks like, look at the dates up there. These appear to be old? WALL: I'm not sure where you are talking about dates. HARRIS: Right here where it says creator, date published. Do you see that? WALL: S. Stuart, then it has a forward slash, and says 1850? HARRIS: Which would represent the year 1850? WALL: One could assume that, yes. HARRIS: V. WALL: This is a web page entitled "Map Masters Online". It's titled nautical charts of California. And I think it says, have to look closer. And Mexico Waterways. That was created on December 8, 2002, at 10:06:04 p.m. HARRIS: And looking at this particular one, item number 52, is that for the San Francisco Bay? Right here, what you are seeing 52? Yes? WALL: San Francisco Bay, covers the entire Bay Area from Vallejo, San Pablo Bay, south to Redwood City and, Redwood City and Palo Alto. Covers all of the main ship channel to the Suisun Bay detailed below. HARRIS: W. WALL: This is another Yahoo Search results page. The keywords entered were "sturgeon", "fishing", "tackle". And it gives the results for those keywords, where the keyword would appear in these documents. And it was created on December 8th, 2002, at 10:07:42 p.m. HARRIS: X. WALL: This is another Yahoo Search results page. That is "Sturgeon", "Fishing", "Tackle" is what was entered in to obtain the results. Created on 12/8/02 at 10:08:14 p.m. HARRIS: Y. WALL: Y is a dated archived fishing report that dates from December of 2000 to February of 2001. And it talks about specific information. That was created on December 8th, 2002, at 10:07:56 p.m. JUDGE: What happened to X? You went from W to Y. Unless I'm missing something. HARRIS: I believe X was the sturgeon fishing. GERAGOS: Hold on. Go one before. Just want to show him something. W, sturgeon fishing tackle is t-a-c-k-e-l on W. And then if you turn on X, it's t-a-c-k-l-e. JUDGE: Okay. Corrected the spelling. GERAGOS: Right. JUDGE: All right. Now I'm straightened out. Go ahead. HARRIS: Going to Z. WALL: This is another Yahoo Search page with the keywords "Sturgeon", "Fishing", "Tackle", "San" Francisco". That is created on December 8th, 2002, at 10:08:36 p.m. HARRIS: Double A. WALL: I believe this is a portion of that USA Fishing Reports website. This is the daily fishing reports, "Hi's Tackle Box Presents." And it has a graphic image that would have been here in the middle. This document was created on 12/8/02 at 10:09:00 p.m. HARRIS: BB. WALL: This is another portion of that Daily Fishing Report page, "Hi's Tackle Box Presents", "Ten Tips For Better Sturgeon Fishing." created 12/8/02 at 10:09, and I believe, I'll have to look closer. Looks like 10:09:28 p.m. HARRIS: CC. WALL: This is, again, part of that same fishing highlights. This one titled "Moss Landing Daily Fishing Reports." Says "Today's Headlines, Monday, December 2nd, 2002." Talks about Dabs and Crabs. On December 8th, 2002, at 10:19:34 p.m. is when it was created on the computer. HARRIS: DD. WALL: This is a Yahoo maps page. Address of Moss Landing was requested. Moss Landing, California. And in this area would have been a map the Moss Landing vicinity. That was created on 12/08/2002 at 10:20:08 p.m. HARRIS: All right. Go ahead have you resume your seat. Now, detective, you were talking about, in that particular binder that there was that graphic file, you showed it to us a little bit in terms of what was connected with that website for the USGS. Did you also go actually out on the internet yourself, go to that web site to see what the whole thing would look like? WALL: Yes, I did. I authenticated it. HARRIS: If I can have this marked next in order. JUDGE: 183. HARRIS: Two photographs, two documents. JUDGE: A and B. Documents Marked as Exhibit 183A&B for identification. HARRIS: Show you what was marked as 183A and B. Have you take a look at GERAGOS: Mark them has A and B? JUDGE: Right 183A and B. GERAGOS: A is the smaller? HARRIS: Yes. GERAGOS: Thanks. HARRIS: Do you recognize these? WALL: Yes, I do. HARRIS: And are these the documents that you were just describing? WALL: Yes, they are. HARRIS: All right. Go ahead and use these. Now, you showed us before what the document looked like without the graphics, and then you were also showing us the graphic. So let me just go back and orient 183A. Is this that particular graphic that you were describing? WALL: Yes, it is. From the U.S. Geological Survey website. Was created on 12/8/02 and 9:52:54 p.m. HARRIS: And it has a same evidence file path? WALL: Yes. Where the file resides on the computer. And the file name is cb, bracket, 1, dot, g-i-f. HARRIS: Now, looking at this particular picture that was found on the computer, does it actually have on the picture itself the date and time that it's being looked at? WALL: Yes. It's embedded right here in the image itself says 2200, 12/8, and then a forward slash, 2002. HARRIS: You said you went to the website to authenticate it. So you went to go see what it really looks like on the website? WALL: That’s correct. Using the web page as a resource from the computer, with my computer connected to the internet, I activated that web page, which took my computer to it. And I believe that's the next image that you are going to show. HARRIS: Put up 183B. And describe for us what we see here. WALL: This is the Near Real Time Velocity, or Current Velocity Map that I looked at on June 28th, 2004. It was updated 1500 hours, or 3:00 p.m. This is what the web page looks like with the graphic attached to it. HARRIS: To the upper right portion the graphic, we can see better in this particular print, does it have something that indicates velocity? WALL: I'm not sure what you are talking HARRIS: Looking at the graphic itself. WALL: Yes, I do. It shows the word "velocity" with an arrow pointing this way. And then it has some numbers that I would imagine says what the velocity is. GERAGOS: Objection. Calls for speculation. JUDGE: Sustained. GERAGOS: Motion to strike. JUDGE: Answer may be stricken. Go ahead. HARRIS: Do you see where it says, "4, parentheses, k-t-s, parentheses"? WALL: Yes, I do. HARRIS: And is "knots" somewhat of a nautical term? WALL: Yes, it is. HARRIS: And then to the right of that there is, I can't quite make out that symbol, but appears to be like an approximate 2, parentheses, M, slash, S? WALL: Yes, it does. GERAGOS: Objection. Calls for speculation. No foundation. JUDGE: Overruled. WALL: Yes, looks like there is a squigglyline sideways, 2, paren, M, slash, S, paren. HARRIS: Does M slash S stand for miles per second? WALL: Yes, it does. HARRIS: Go ahead, resume your seat. After you had gone through and found this particular information, so that the, if I understand you correctly, let's put the binder down. Prior to December 7 when we see those want ads, classified, for looking for a boat, that's the first time you see anything on those computers that you are looking at forensically, boats, charts, bay, anything along that line? WALL: That’s correct. HARRIS: And then there seems to be a lot of activity on the 8th involving that information. WALL: That’s correct. Both in the a.m. and the p.m. HARRIS: And do you provide that information to the Modesto Police Department? WALL: Yes, I did. HARRIS: You had described for us earlier about some of the e-mails that you found. And we are looking at the Shawn Sibley e-mails. Did you also find an e-mail from Eric Olsen? WALL: Yes, I did. HARRIS: And which account was that to? WALL: I believe it was to the S-L-P-e-t-e-1 at email dot MSN dot com. HARRIS: When you went through and looked at these four computers, did you find if Laci Peterson had an e-mail account? WALL: Yes, I did. HARRIS: And did she? WALL: Yes. HARRIS: What was her e-mail account? WALL: I think, I'd have to look to make sure. HARRIS: To be accurate, go ahead and look at your report. If I were to refer you to page 28. WALL: That would help. HARRIS: Bates stamp 37088. WALL: Okay, I'm with you. HARRIS: Do you see her e-mail address there now? WALL: Yes. It's Laci Peterson, L-a-c-i-P-e-t-e-r-s-o-n at MSN dot com. HARRIS: That would be a separate MSN account other than that SLPete1? WALL: That’s correct. HARRIS: This is one that requires that the user have a password to get into it? WALL: That’s correct. HARRIS: Like to have this marked next in order. JUDGE: 184. Printout of a HARRIS: Printout of an e-mail. HARRIS: Showing you 184. Going back to where we were with Mr. Olsen. Do you recognize what this is? WALL: Yes. This is a document that was recovered from a computer, that was to Scott from Eric Olsen. HARRIS: And does this indicate that Mr. Olsen is resigning? WALL: Yes, it does. GERAGOS: Objection. Calls for speculation. The document speaks for itself. JUDGE: What does the document say? Comes under the Evidence Code 1552, I believe. What does it say? GERAGOS: We have had Olsen here. He would have been the person to ask. JUDGE: He's conducting the direct examination, not you. Go ahead. What does it say? WALL: The document states, Scott, and then comma, new line, I have accepted job opportunity with another company. Period. I'm resigning my position as District Sales Manager for TradeCorp. Period. I will work with you in order to get the contact information on the customers that I have been working with. Period. Space. Space. Space. Eric Olsen. HARRIS: This particular document, when does it show its existence on the computer? WALL: This document was created December 26th, 2002, at 11:37:58 a.m. HARRIS: I want to talk about this a little bit when we're talking about e-mails. You are saying that the computer existence date, so to speak, is at 12/26, 11:37. If somebody sends you an e-mail, does your computer, or let me try this again. If I'm sending you an e-mail, does my computer say what time it is that I'm sending it? WALL: If you are sending me an e-mail, it's going to have the time that you sent it to me. When it is accessed on my computer it will then have the time that it was created, or when that document was created to view that e-mail. HARRIS: Now, when you look at those forensically, so you are looking at the date and time that it shows up on the computer. That creates a date that we're talking about. Does that match that e-mail time that it is sent? WALL: Not always. HARRIS: Why is that? WALL: Well, the sender may be in a different time zone and may not match. It may have been looked at one time, closed, and opened again. Depends on where we found it on the computer. It could also vary depending on the type of e-mail program that's used. If an e-mail program such as Outlook was used to access the e-mail, or if it was accessed through a web page, which MSN accounts give you that flexibility, where you can use Outlook as your e-mail client, or your e-mail program, to use, see your e-mail; or if you are not at your computer, you can access the MSN web page and look at it in a web interface or a web document format. HARRIS: So if you have a printout of an e-mail, and the time that you have written down in the lower right portion doesn't correspond to the time, that's the explanation that it is just coming from a different computer? GERAGOS: Objection. Calls for speculation. There is no foundation. JUDGE: I think he can answer that. Can you answer that? WALL: Yes. JUDGE: Go ahead. WALL: The times that I write on the bottom of these documents is consistently the time that that file is created on the computer, and doesn't necessarily reflect the time that the e-mail would have been sent. HARRIS: May we have this marked next in order? JUDGE: 185. Document Marked as Exhibit 185 for identification. HARRIS: Let me present this up to you, 185, have you look at that, see if you recognize it. WALL: Yes, I do. HARRIS: And what I want to do is kind of move forward in time. As part of the process did the Modesto Police Department, part of your forensic process, did they ask you to look for specific dates, or look to see if there was computer activity on specific dates? WALL: Yes, they did. HARRIS: Moving forward to December 23rd. We have been talking about the 8th most of the morning. Did you look at December 23rd to see if there was computer activity? WALL: Yes, I did. HARRIS: And was there? WALL: Yes, there was. HARRIS: Now, the document that you have in front of you, is that a document that you found from December 23rd? WALL: Yes, it is. HARRIS: What is that document? WALL: This is a faxed document with the name of Scott Peterson, Company TradeCorp, that has voice numbers and fax numbers and addresses associated at the top of the page. It also has the date that the fax was created, the number of pages, and the subject that he states, Address change for TradeCorp. HARRIS: Now, this particular document, you are saying it's a fax, it's got fax information on there? WALL: That’s correct. HARRIS: Is this a document you found on the computer? WALL: Yes, it is. HARRIS: I want to go through this. Can you send faxes through computers? WALL: Yes, you can. HARRIS: And so you can use your computer, and you go in and do whatever you do, just like typing something up, and then the computer will send it as a fax? WALL: Yes. There is many fax programs that you can have installed on your computer. I use one in particular called E-Fax, where I can send and receive fax transmissions directly through a number that comes to my e-mail. HARRIS: Now, this particular fax, would it have the information from whatever a person types in to create it, or would it have some type of internal time from the computer? WALL: I believe this document came from a temporary file that was created when the document was created, and from there it could be handled in a variety of different ways, depending. If there is a fax program on the computer, it could be faxed that way. Or it could be printed out and faxed over a standard fax machine. HARRIS: And this particular document appeared to be work related from TradeCorp? WALL: Yes. HARRIS: And which computer did this come from? WALL: It came from the Dell Work PC 4, that was titled by Officer Stockham. HARRIS: And it indicates that TradeCorp has got a new mailbox? WALL: Yes. It's a note to Elenor. Says, Elenor, comma, and then new space, TradeCorp has established a postal box for future security of our mail. Period. There is a space. The next line says, please send all mail to, and then there is a space, and it says TradeCorp, P, as in Paul, M as in Mary, B, as in Boy, pound sign, 290, 1801 H Street, Suite B5, Modesto, California. 95354. And it ends by saying, well, it's misspelled. T-h-n-a-k you, comma, Scott. And then it says 209-505-0337. HARRIS: This document was sent on December 23rd? WALL: This document was created on December 23rd, 2002, at 1:26:36 p.m. And there is a fax receipt that states that it was sent Monday, December 23rd, 2002, 1:26 p.m. to Elenor, A slash P, from Scott Peterson, comma, the number 209 dash 578 dash 0344. And it's page one of one. This actual document was created on 12-23-02 on the Dell Work PC 4 at 1:26:36 p.m. HARRIS: Now, you, as part of the looking at this, and moving forward in time, did you find if there was Ebay activity on the computer, or computers, I should say? WALL: Yes, there was a substantial amount of Ebay activity on the computers. HARRIS: When you say substantial, can you define that for us? WALL: There was searches for clothing, golf clubs, jewelry. HARRIS: You say WALL: Tools. HARRIS: searches for. Did it appear that anyone using these particular computers, the four that you were looking at forensically, were selling items as well? WALL: Yes. HARRIS: Did it appear there they were selling a lot of items? GERAGOS: Objection. Speculation. JUDGE: Sustained. HARRIS: Were they selling more than one item? WALL: Yes, there was appearance of more than one item being sold. HARRIS: You were describing for us earlier in one of the binders that Amazing Diamond Bezel Ladies Watch. I'll show you what's been marked previously as People's Number 4. Does this appear to be an Ebay item for that same watch? WALL: Yes, it does have the same appearance. HARRIS: And if you turn to the second page, do you see the same graphics that you found on the computer? WALL: Yes, I do. HARRIS: Does this appear to be the first page of that particular item? WALL: Yes. HARRIS: And does this indicate that there was a, do you need to go up and look at it? JUDGE: Would you mark that, or is that, HARRIS: This has previously been marked as People's Number 4. JUDGE: This is 4. Okay. I don't see it on there. I'll take your word for it. It's on the back. Go ahead. HARRIS: And does this indicate what day this particular auction ends? WALL: Ends December 15th, hyphen, 02, at 21:45:32. HARRIS: That would be p.m.? WALL: That would be 9:45:32 p.m. HARRIS: Like you to look at Page 2, People's Number 4. Does this show how it looked on the actual Ebay page? WALL: I was not able to see the actual Ebay listing page. All I observed was what was residual on the computer. HARRIS: At the time that the document was created that had these three gif images, or these pictures of the watch associated with the web page, in the same time proximity there as you previously showed us, had this information without the graphics? WALL: That’s correct. HARRIS: You can go ahead and resume your seat. We talked about the 23rd. WALL: Mr. Harris, do you want this one back? HARRIS: Yes. Thank you. Talked about the 23rd. Without going through and marking all the content of what was occurring on the 23rd, was there activity on that work PC on the 23rd? WALL: Yes, there was. HARRIS: Moving to the 24th, December 24th, did you look to see if there was any computer activity or usage across those four computers on the 24th? WALL: Yes, I did. HARRIS: Starting with the Home PC, that, call it Dell Laptop? WALL: Home 1. HARRIS: Home 1. Was there, back up for a second. Now, if it's a laptop, does that mean that it's portable? WALL: In most cases, yes, it can be moved to any location to be used. HARRIS: So when it was described as being Home Laptop 1, or Laptop Home 1, does that mean that it was only used at that particular location? GERAGOS: There is an objection. It's vague and, JUDGE: I think that was just a designation. HARRIS: Let me ask that. When it's described as Home Laptop 1, is that just the designation where it was found? Does that mean that was kind of anchored to that particular house? WALL: Just where it was found. HARRIS: When we're talking about Work PC, the Work PC, that is, from your understanding, a desktop? WALL: Found at the place of work. HARRIS: Desktop a little bit more difficult to take with you? WALL: Yes. HARRIS: Why is that? WALL: They are bulky. They are heavy. You would have to take not only the actual computer, you would have to take the monitor, which is a separate piece, keyboard, mouse. Just isn't feasible to move them around a lot. Most people leave them stationary. HARRIS: Do most desktops also have to be plugged in? WALL: Yes, they do. HARRIS: So to run it, you would have to take the cord with you and find someplace to plug it in? WALL: That’s correct. Along with the monitor. HARRIS: And a laptop, do they have batteries? WALL: Yes. HARRIS: Did you find any computer activity on the 24th? WALL: Yes. It was found on Dell Laptop Home 1. And Work, Dell Work PC 4. HARRIS: Let's go through that. What was the earliest activity that you found? WALL: Earliest activity was on Dell Laptop Home 1 as it was accessed at 8:40 a.m. HARRIS: And how long did whoever it was stay on the computer? WALL: The last access was at 8:45 a.m. HARRIS: Five minutes? WALL: Yes. HARRIS: And was there something that would indicate to you, or did you have something that would indicate to you, based on looking at the files, what was being accessed from that particular laptop at that time? WALL: Yes. We're able to see each of the files that were accessed. HARRIS: If I can have marked next in order. JUDGE: 186. HARRIS: Detective, let me show you what's been marked as 186 now and ask you if you recognize it. WALL: Yes, I do. HARRIS: And what is this? WALL: This is an e-mail document that was created from a temp file from the Dell Laptop Home 1 computer on December 24th, 2002, at 8:45:50 a.m. HARRIS: And what does this appear to be? WALL: It's an e-mail from, or between Scott Peterson and a person by the name, I believe it's is the e-mail address of jschockley. HARRIS: And this particular e-mail, is it dealing with some type of Ebay transaction? WALL: Yes. They are talking about a bag. HARRIS: And this particular item, does it have the date and time, or does this correspond to being the last file from the Dell Laptop Home that morning? WALL: Yes, it does. HARRIS: So this is 12/24 at 8:45 and what seconds? WALL: 50 seconds. HARRIS: Was there any additional computer usage on the Dell Home that day? WALL: Not after 8:45 a.m. HARRIS: Was there other computer activity? WALL: Yes, there was. HARRIS: What computer was that? WALL: That would be on the Dell Work PC 4. That computer activity started at approximately 10:30 a.m., and ended at 10:56 a.m. HARRIS: Did you look to see what kind of files, or what type of activity that was? WALL: Yes, I did. HARRIS: And did it appear that websites were accessed? WALL: I don't recall at this point exactly what was accessed. I could refer to documentation to see what that was. HARRIS: If I was to just point you in the direction, was there something about a Delta tool? WALL: Yes, I do recall that. HARRIS: What was the last entry on that particular computer? WALL: At 10:56 a.m. HARRIS: And how many seconds? WALL: I don't know the seconds. HARRIS: So between, basically it was 10:30 though 10:56 at the Work PC? WALL: That’s correct. HARRIS: I'm now going to the mark a couple more exhibits. I don't know if the Court wants to JUDGE: Do you want to take the recess now? HARRIS: Yeah. JUDGE: All right. Going to mark some more exhibits. <noon recess> DISTASO: Detective Wall. JUDGE: Detective Wall, where are you? HARRIS: Should be outside. JUDGE: Okay. JUDGE: Do you remember where you left off? HARRIS: I believe so. Detective, I'll give you another second to get set up there. All good to go now? WALL: I'm ready. HARRIS: Okay. We were starting to have some documents marked. We were starting in the area talking about eBay activity. And before we mark those documents, I want to go back to this exhibit we were looking at earlier, which is People's number 4. I don't know if you can see it, actually, let me show it to you. Kind of trained to go up and look at the screen now. Looking at this one right now, number 4, do you see to the center of that document where it says something in red, something next to the price? Do you see what it says there? WALL: Yes. It says: Reserved, not yet met, in red. HARRIS: And from your experience in looking at eBay auctions, not participating in it, but does that mean that, GERAGOS: Be an objection. It's leading. There's no foundation. We do have the eBay person here. JUDGE: Sustained. HARRIS: As part of your review in looking at the eBay material, did you find any e-mails related to eBay activity on the computer? WALL: Yes, I did. HARRIS: I'd like to have marked next in order three documents. JUDGE: 187 A through C. HARRIS: Detective, let me present what's been marked to you as 187 A, B and C. See if you recognize these. WALL: Yes, I do. HARRIS: And what are these documents? WALL: These are e-mails that involve the e-mail address of slpete1@email.msn.com. HARRIS: All right. Now, referring to these particular documents, did these appear to be about eBay transactions? WALL: Yes, they do. HARRIS: And these were e-mails that were going to someone? Or were they going from someone? WALL: Well, I didn't look at them quite that closely, but they are to three different people from the e-mail address of slpete1@email.msn.com. HARRIS: And is there a text that indicates who is sending it or a name that says who is sending it? WALL: Yes. Each one of them either have the name of Scott or Scott Peterson associated with each individual e-mail. HARRIS: Now, going through these, the first one, 187A, just put them up on the screen. Maybe we can get the lights dimmed a little bit so you can see them. And if you want to go up there. In 187A we see at the bottom there's a print date. Is that when this document was printed out? WALL: Yes. This date on the bottom of 7/24/2004, that is the date that my computer assigned to that file when it was printed. HARRIS: Now, I notice that there's no handwriting on this particular document as to when the file was recovered from the computer. Why is that? WALL: Because there's no create date that's associated with the file in the computer system. HARRIS: And why, why is that so with these items? WALL: Because this e-mail was received through an e-mail client. That means it's an e-mail software program that relies just on the date that the e-mail was sent. HARRIS: Now, when we talk about the date that the e-mail was sent, again with this particular slight difference that you're describing for us in the computer, how does that particular date and time get assigned to this particular document? WALL: The e-mail software, the e-mail client, assigns the date to it. HARRIS: And that's based, GERAGOS: Be an objection as to relevance. This is a June 20, JUDGE: Well, I think he's trying, I think he's trying to clear that up, because we've got 7/24/04, GERAGOS: 7/24 is just the day that he printed it, if I understand correctly. HARRIS: Right. JUDGE: Well, I think this is what he's trying to clear up. GERAGOS: Right, but this is 352 and irrelevant. This body of this, JUDGE: I don't know if it is or not. GERAGOS: Okay. JUDGE: So I'm going to overrule the objection. I don't know if it is or not. If it is, the jury can take that into consideration. I don't know if it is or not. I don't know what he's driving at. I mean, it may turn out to be relevant. You have a leg up on me because you know what the evidence is that's coming in and I don't. GERAGOS: I do not believe there's any relevance. JUDGE: Is there any relevance to this e-mail? HARRIS: Yes. JUDGE: He says there is, so let's find out. GERAGOS: Surprise, surprise. JUDGE: Yeah. Okay. HARRIS: Detective, going back to, does this indicate at the top of the date that this was sent, and that's by the computer? WALL: That’s correct. HARRIS: Now, does this e-mail indicate that this was a transaction that could not be completed through eBay and that they were going to do the sale kind of on a secondary basis? GERAGOS: Objection. The documents speaks for itself. JUDGE: Well, I think he can explain it. Overruled. Go ahead. GERAGOS: He can explain, just so I've got it correct. He's going to explain what the body of the document is? JUDGE: He can read it to the jury. GERAGOS: As can the jury, and the state of the law is that the document speaks for itself. JUDGE: I know, but you can read it if you want. Go ahead. WALL: It says in the, in the text the document is legal: Yes, it is legal to sell the magazine. No problem there. Just wanted to ask about the shipping. USPS Priority Mail is only $3.50 cents, comma. Is $28.50 cents okay with you, question mark. Please let me know and I will get a check in the mail to you and provide my address. Thanks, Barrett. And then there's a p.s. listed below: Just in case you didn't know, e-Bay does not allow sales of high capacity magazines, and that's the reason your auction was removed. No problem for private sales. HARRIS: All right. Then at the top this is, there was a response from a Scott Peterson, from Scott Peterson to this individual? WALL: That’s correct. From Scott Peterson to Harold R Bray, and it states: Sure, send it to me. And then it has Scott Peterson, 509 13th Street, Suite #2, Modesto, California 95354. HARRIS: So this was an e-mail that was sent from the defendant's computer involving a transaction that couldn't take place on eBay? WALL: That’s correct. HARRIS: Looking at 187B, what is this? WALL: This is another e-mail similar to the last one. It's dated Monday, 16th December 2002. At 18:42:52 minus 0500 hours. And the body of the message states: Which watch? And then it's, below it says: Scott. And then again it has original message, who it's from. roddyr@earthlink dot net to slpete1@email.msn.com. The date sent is Monday, December 16th, 2000 and 2 at 6:58 p.m. Subject: Question from eBay member. HARRIS: And this particular date, again at the top, that's Monday, December 16th, and that's the date and time assigned by the computer, would be the defendant's computer in this case? WALL: That’s correct. HARRIS: And is this the date after People's number 4, that eBay watch we were looking at? Which was, have you look at that one. Showing you People's number 4, does that appear that that particular auction ended on December 15th? WALL: Yes, did it. December 15th at 21:45:32, or 9:45:32 p.m. HARRIS: All right. Looking at 187 C. Can you tell us what this is? WALL: Yes, this is another such e-mail from the e-mail software. The date is Tuesday, 17th December 2002 at 06:41:46 a.m. It's to Chrissy0424@aol dot com. The message body text states: It is a solid gold, it is a solid gold, comma, rope chain, comma, very high quality, period. There's a space. The next text says: Sorry can't go less on the price, period. Scott. HARRIS: And, again, this would be an e-mail that is being sent from the defendant's computer? WALL: Yes. HARRIS: You can go ahead and resume your seat. Now, at some point in time did the Modesto Police Department ask you to basically look or see if there was anything involving Amber Frey on any of these, the computers that you were looking at? WALL: Yes. HARRIS: And were you provided with information about a particular gift and to try and look for that gift? WALL: I wasn't provided information about a gift, no. HARRIS: Not, not a gif but a gift? WALL: G-I-F-T. Is that what I understood you to say? HARRIS: Yes. So you were not provided with that information? WALL: No. HARRIS: Did you come cross such a gift when you were looking for something on the computer? WALL: I didn't come across a gift, but I found reference in an e-mail to a gift. HARRIS: And in that information, did you obtain that in the same process of doing this examination of the computer? WALL: Yes, I did. HARRIS: If I could have this marked next in order. JUDGE: 188. HARRIS: Showing you 188, do you recognize this? WALL: Yes, I do. HARRIS: And what is it? WALL: This is an e-mail that was recovered from the unallocated space of DELL laptop Home 1, and it was a purchase confirmation e-mail that was sent to the e-mail address of slpete1@email.msn.com on Friday, 20th of December 2002 at 11:39:20. HARRIS: Now, let me go through this a little bit. You said it's from unallocated space. Does that mean that it's been deleted? WALL: That’s correct. HARRIS: And this was, this e-mail, was it from a person or from a business? WALL: It was from a person by the name of Martha Tead from Checkmate dot com. HARRIS: And what was this e-mail about? WALL: This was a order, or a purchase confirmation that a Star Theater II product had been purchased and shipped to Amber Frey. HARRIS: Now, we were talking earlier about all of these, the different Bay charts and the graphics, and you were showing us that one, the kind of blue image, let's see if I can find that real quick. JUDGE: 183. HARRIS: Looking at 183. Now, with regards to this particular image in the Bay, you can just stay there for a minute. We're going to have something for you to mark. You were talking about how this was part of a web site, and we also marked the, kind of the whole web site page. If you were, if you were to click on this map on the web site, what would happen? WALL: Well, when I authenticated this web site, that means when I went to the web site myself to check it, I actually clicked on that map and it gave me a zoomed-in version of the area that I clicked on. So what happens is when you put your cursor on any portion of this map, depending on what portion of the map you put your cursor on, it will then give you a zoomed-in area on the next web page. HARRIS: Did you look to see if that had been done by the person who was pulling up this particular web page? WALL: Yes, I did. HARRIS: And did you see if that person, if that zoom-in process had occurred? WALL: Yes, I did. HARRIS: And did you find those documents on the computer and print them out and bring them with you? WALL: Yes, I did. HARRIS: If I could have two documents marked. Do this as A and B. JUDGE: 189 A and B. HARRIS: Detective, let me show you these now which have been marked 189 A and 189 B. Do you recognize those? WALL: Yes, I do. HARRIS: Are these the documents that we were talking about? WALL: Yes, they are. HARRIS: Start with 189. So what you were describing for us is you would click on that gif, that graphic. So we're looking at 189 A. And explain to us what we're looking at here. WALL: This is a web page for the San Francisco Bay currents from December 8th, 2002, and the file name is called files backslash zoom underscore cb bracket one, and then it has another set of numbers 204383 in brackets dot htm. This is the zoom page that I was explaining when you click, put your cursor over the previous image that's titled cb bracket one dot gif, if you put your cursor on any portion of that map and then do a left mouse click, it will zoom in on that portion that you select. And this is the web page that represents that zoom feature, and this is where the graphic would typically lay on that document. HARRIS: And looking at this particular document, it appears to have handwriting on it. Is this, again, your handwriting of December 8th, 9:53 and 52 seconds p.m. of when this file was created on the computer? WALL: That’s correct. HARRIS: Looking at 189B, can you describe for us what this is? WALL: Yes. This is the image as a result of that zoom function. It tells you where the file is on DELL laptop Home 1, the temporary Internet files, Internet Explorer 5 and it's titled cb 16 underscore 16 bracket one dot gif. And the date it was created was 12/8/02 at 9:53:54 p.m. HARRIS: I'll zoom in. I don't know if you can read it from there, but is this the Central San Francisco Bay? WALL: Yes. I recognize it as being the, the Bay area HARRIS: And over here to the, maybe you need to come up and look at the actual one, but is this the Southampton Shoal over here? WALL: Yes, that's called the Southampton Shoal, the area you're pointing to. HARRIS: And it's difficult to read here, but what is that portion in the upper right? WALL: That marking is called Point Potrero Reach, and it's also got another portion that says Channel. And I can't read this portion of it right here, but right here it says Channel. Point Potrero Reach, and then that says Channel. HARRIS: And looking at this portion here, does that appear to be the tip of Brooks Island? WALL: I recognize that area from, from a map, as a matter of fact, that I see right here in the courtroom. HARRIS: You're looking at a map over here that would be People's 109? WALL: Yes. HARRIS: Does that appear to be Brooks Island? WALL: Yes. That area that you described as being right in here. HARRIS: You can resume your seat. WALL: Thank you. HARRIS: The People have no other questions.
Cross Examination by Mark Geragos JUDGE: Mr. Geragos. GERAGOS: Does it look to you, good afternoon. WALL: Good afternoon. GERAGOS: Does it look to you like, I apologize, I shouldn't have just started off asking you questions. Does it look to you like the zoom feature was used to get a particular area of the map? WALL: That, that was the, the only zoom that I observed on the computer. GERAGOS: Yesterday I marked two documents D 5 L 2 and D 5 L 1. Take a look at those two. Do those look like the black and white copies of the, what's been marked as 189 B? WALL: They appear to be similar, yes. GERAGOS: Okay. So the jury can understand, I assume the first one I showed you is how the map looked, and then the second is the zoom; is that right? WALL: Well, without seeing, yes, it has the same file name, and one is zoomed in, correct. GERAGOS: Okay. Could you identify for the record which one of these is zoomed? WALL: Well, this one obviously looks bigger than this one. GERAGOS: Okay. That would be D 5 L 1; is that correct? WALL: Yes. GERAGOS: So it looks like there's, you first get a, up comes this location, correct? WALL: That's correct. GERAGOS: And then there was a zoom, and that's on D 5 L 2. And then there's a zoom, which would be this right here, correct? WALL: Correct. GERAGOS: Okay. Does it appear to you that Brooks Island had been all, all of Brooks Island has been zoomed in? Or does it appear that the Southampton Shoal has been zoomed in? WALL: It's a general area. I don't know what the intent of the zoom was GERAGOS: Okay. WALL: when it was designed. GERAGOS: Well, you indicated before that you recognize from the map that you had, this one, that you recognized it on one of the maps you saw here? WALL: That's correct. GERAGOS: Doesn't appear to me, you tell me, does it appear to you that all of Brooks Island is there? WALL: No. GERAGOS: Okay. Does it appear that all of the Southampton Shoal is there? WALL: Not being familiar with all of the Southampton Shoal... GERAGOS: Well, how about being familiar with a portion of the map that's got the line drawn around it, like this, that says Southampton Shoal? Does that kind of look to you like maybe that's all there? WALL: Yes, it does. GERAGOS: Okay. Now, the item that you have here, this, which is marked as 180, 187 A, what, this is not how it was when the user goes to the computer, correct? WALL: Well, I don't specifically understand what you're saying, "when the user goes to the computer." GERAGOS: Well, when he goes, when there's a computer screen, it does not look like what we have right here, correct? WALL: It does not look like this document, no. This is individually the gif image by itself. GERAGOS: Okay. So that I understand, do you have the page where this image, which you call the gif image, which if I understand correctly, is going to be, the gif image is this right here, this square, actually probably a little wider. Right around there, correct? WALL: That's correct. GERAGOS: Okay. Now, it doesn't come up just on a blank piece of paper, right? WALL: No, it does not. It's associated with a web page document. GERAGOS: Okay. Do you have that web page document that it's associated with this? So we know what it is we're talking about? WALL: Yeah. It was introduced as an item of evidence in one of the books. GERAGOS: Okay. Was it in one of the binders? WALL: I believe so. HARRIS: Well, is counsel referring to the, the witness testified he went to it to verify. We marked a more current one with the whole page. He also testified as part of the binder that there's the one without the graphics in there that's in the binder. GERAGOS: Right. I want the one without the binder, If I understand correct, this one, which is 183B, this also has nothing to do with the, what was on the computer because you just went to the web site on June whatever that is, 26 or 28th, of this year, correct? WALL: That's correct. GERAGOS: Okay. And you just clicked on this USGS real-time current velocity map at that web site and came up with this and then printed it, right? WALL: That's correct. GERAGOS: Okay. Now, this was not on the computer; you produced this, 183 B? WALL: The, the image was not on the computer, that's correct. GERAGOS: Okay. And then what I had previously marked as D 5 K, right here, this is what you're saying was on the computer; is that right? WALL: I would have to get a closer look. GERAGOS: Sure. HARRIS: I'd refer counsel to the p.m. binder. I believe it's Exhibit I. JUDGE: 182 I? WALL: I need to get the date on that. GERAGOS: Okay. Looks like it's the 8th. Okay. Do you see, do you see that? Can you take a look at that? WALL: Sure. GERAGOS: And is that the same item? WALL: That is the, that is the gif image that was created on December the 8th of 2002. GERAGOS: Okay. That gif image, once again, on this, is also not the way that the person saw it who was using the computer, correct? WALL: That's correct. It would have been associated with the web page document. Those two get separated when they're stored on the computer. GERAGOS: Okay. Now, the web page document, I'm going to take Mr. Harris' word, is I. Is this the web page document? WALL: Yes, it is. GERAGOS: Okay. And where would the picture have been on this document? WALL: It would have been right here where it says Central Bay Current Velocity Map, and there's a little red X. Says: Click here to print this chart. GERAGOS: So this, if you put this here, you're talking about WALL: Something slipped in on the computer there. GERAGOS: So what you're talking about is when you go there, right there is where you call this gif image would be when you pull it up on the computer, right? This image here would actually be on there, correct? WALL: It would be right in this area. So it would take up more space, so all this would actually move down on the document. GERAGOS: Okay. Is there any way to put this – JUDGE: Does anybody know how to fix the computer to get that out of there? GERAGOS: If I can get the notebook back together first. JUDGE: There you go. GERAGOS: Now, the, if I understand correct, you've got some times here as well, right? WALL: That's correct. GERAGOS: Okay. And it looks like the times are, starting on the first page, which would be the, when the web site pops up, it's right here, the time is 9:53 and 20 seconds? WALL: That's correct. On December the 8th, 2002. GERAGOS: Okay. Then it's clicked and it says 9:52 and 54 seconds; is that right? WALL: I can't see it, but, now I can, yes. 9:52 and 54 seconds. GERAGOS: Okay. How is it that the gif image is earlier? Is that what that, that explanation you gave before, that the image loads first? WALL: Sometimes they load first, sometimes they load after. GERAGOS: Okay. So when, I'm assuming that somebody clicks on to the web site, and this item, the, the content, if you will, loads, and the graphic loads, right? WALL: Correct. GERAGOS: Okay. So sometime prior to 9:52 and 54 seconds, the user clicks on the web site, right? WALL: Yes. GERAGOS: Okay. Take a couple of seconds before the web site comes up? WALL: It can take longer than that, depending on the speed of the connection. GERAGOS: Okay. Do you know what the speed of the connection was on the computer that this image was taken from? WALL: No, I do not. GERAGOS: Did you, is there a way to test that? WALL: I was told that it was a dial-up modem connection, but I don't know what the speed was, and I know of no one way to test it. GERAGOS: Okay. If you were told that it was a dial-up modem, do I understand correctly that that's about as slow as you can currently get? WALL: Yeah, it sure is. GERAGOS: Okay. Is it a safe bet that somebody would have had to dial-up at least at 9:52 for the graphic to come up at 9:52 and 54 seconds? WALL: It would have had to be prior to that time, yes. GERAGOS: Okay. And the entire web site, meaning the content and the picture, would not have come up on the screen until 9:53 and 20 seconds; is that right? WALL: That's when this file was created. GERAGOS: Okay. Now, is there any place that you showed in the computer where this web site was saved? JUDGE: Was what? GERAGOS: Saved. JUDGE: Saved. GERAGOS: S-A-V-E-D. You can save, if I go to a site, if I like the site, I want to refer to the site, I can do one of two things to preserve that. I can preserve it virtually by saving the location, true? WALL: You can bookmark them. GERAGOS: Right. WALL: And you can bookmark it for off-line viewing so it saves the web page. GERAGOS: Right. Now, when you say bookmark for off-line viewing, you've got a web page that's updated on a daily basis, for instance, and if you want to save that web page so that the information that I'm looking at, if I go on to it this morning, for instance, on one of those, USAfishing, and I want to save Today's Headlines, I can bookmark that so I can off-line view it, correct? WALL: That's correct. GERAGOS: Okay. I can also save it as a favorite so that I can return to that same web site, correct? WALL: That's correct. GERAGOS: Okay. Was either of those things done, let's just start with the favorites. Was this saved as a favorite? WALL: I do not know that. GERAGOS: Did you ever check that? WALL: No, I did not. GERAGOS: Okay. You found it, however, I believe, in a temporary Internet file; is that correct? WALL: That's correct. GERAGOS: Now, I've got this back here on D 5 K. It looks like there's some writing here. It looks like it's a path; is that right? So this would have been the DELL computer, if I understand correct, right? WALL: Yeah. DELL laptop Home 1. GERAGOS: Okay. So presumably this was the DELL that was, the DELL computer that was seized from the house, right? That's what you were told? WALL: That's what I was told. GERAGOS: Okay. And then you go into Windows and it's temporary Internet files, correct? WALL: That's correct. GERAGOS: Temporary Internet files means what? WALL: It means it's a, a folder, directory structure; a folder that's created by the Internet Explorer program that is a place for temporary Internet files that are accessed by the user to store them and, for future reference. GERAGOS: Okay. The computer stores it, correct? WALL: That's correct. Automatically. GERAGOS: Automatically. The user, in this case we've got absolutely no indication anywhere that the user stored this, correct? WALL: That's correct. GERAGOS: Okay. We have absolutely no indication, what was, by the way, what was the next, the very next thing that happened after this site was visited? Do you need to take a look at your documents to check that out? WALL: I could. GERAGOS: Okay. JUDGE: Mr. Geragos, maybe this would be a good time GERAGOS: Sure. <recess> GERAGOS: Thank you, Judge. Good afternoon. Did you have a chance to take a look at the times on the work that you did in terms of pulling these up? WALL: Yes, I have them prepared to review in time sequence. And I might add that this software that I'm looking at is a product of another forensic software suite that I use to analyze the data. It's known as Access Data Forensic Toolkit that created this report. GERAGOS: So what I'm going to try to do, if we could, is to go through the binders that we have. Looks like you have, at least when you called up the information, you have done in the binders themselves, put one up, for instance, looks like the back – HARRIS: They are on the front too. GERAGOS: You have done it in the two different spots. You have put the timing on the bottom, right there, that 8:01:26, correct? WALL: That's correct. GERAGOS: You have also put on the back. Harder to see, right there, in pencil. WALL: Correct. That's correct. GERAGOS: You have got in order how these things were; is that right? WALL: I don't know if they are in specific time-created sequence order or not. GERAGOS: Okay. What's easier for us to with the, I want to start with the a.m. or p.m. one you have up on your computer. WALL: You told me you wanted to starts with the cb, bracket, one, gif. GERAGOS: The cb, bracket, one, gif, which is, which was the, make sure we're talking the same language here. Okay. Now we have got, that's 187A. That was brought up at what time? WALL: 12/8/2002 at 9:52:54 the file was created. GERAGOS: As we went through before the break, the gif is just a picture, and the specific content that was connected to it came up at what time? WALL: I have that logged on the computer as December 8, 2002 9:53:20 p.m. GERAGOS: And see if I can pull out that particular item, pull out the contents out here. That's the, so at 9:53 and 20 seconds, at that point then you would have had, the web page would have been up, correct? WALL: Yes. GERAGOS: Picture and end content? WALL: Whatever has the last or the latest time. GERAGOS: Is what it's up? WALL: Is where it would be at. GERAGOS: In actuality what we know is that this item here, what you call a gif? WALL: Cb, bracket, one, dot, gif, that's correct. GERAGOS: In this particular case, this came in first into the computer. Then the content came, and then the page comes up at 9:53 and 20 seconds, or shortly thereafter; is that correct? WALL: That's correct. GERAGOS: Is there some kind of time lag when this information comes into the computer before it actually pops up on to the monitor? WALL: It depends. Varies with each individual case. I'm sure most people have seen how web pages load. Sometimes the text comes up. Just depends on how the connection speed is. GERAGOS: Okay. And we have already established this is a, were you told it was a dial-up modem? You don't have anything, any information that would lead you to believe that it's not a dial-up modem, correct? WALL: That’s correct. GERAGOS: And that would be the slowest in terms of the loading into the computer, correct? WALL: That’s correct. GERAGOS: Now, some time after 9:53 and 20 seconds, this website comes up. Then what is the next time that comes in? WALL: The next time that I have logged is 9:53 and 46 seconds, p.m. GERAGOS: Do you know what that is? WALL: Name of the file is Sport Fishing, bracket, 1, and then it has the number sequence 20. The document is titled Sport Fishing, bracket 1, bracket, 233789 dot HTM. GERAGOS: Now, do you know if that, did you pull that up in the Sport Fishing and print it out? Do you know what I'm talking about? WALL: I'm looking at it here. But we could check. It's the Department of Fish and Game Licensing and Revenue Branch web page. GERAGOS: Let's see if see if you can pull that up here. WALL: A.m. book. GERAGOS: I have got it here. What time did you say that was? WALL: It's 9:53:46 p.m. JUDGE: Maybe it's M. N as in nun. GERAGOS: N like in Nancy. JUDGE: There is a bunch of California Fish and Game, GERAGOS: I'm sorry, it says on the back, maybe. That's not G? WALL: That's a different one. GERAGOS: 9:53:04. JUDGE: Which one are you referring to, Mr. Geragos? CLERK: H. GERAGOS: Looks like G. Is that right? WALL: Yes. JUDGE: Licenses available? WALL: That's what you are pointing to is G. GERAGOS: Pointing to G. Is this the next item after 9:53:20? What's the next item that comes up? WALL: 9:53:46 is what I show here. GERAGOS: 9:53:46 is not going to be G. WALL: It's not in here. GERAGOS: So we don't even have, well, I do have what looks like here, we have got 9:53:20 is that correct? WALL: I have 9:53:20. GERAGOS: Now, it looks like, correct me if I'm wrong, but it looks like the Fish and Game Regulations came up already at 9:53:04, before we even got ten. Am I wrong there? WALL: No, that's correct. GERAGOS: Okay. WALL: It was logged into the computer at 9:53:04. GERAGOS: Does that mean that before this website was even completely downloaded into the computer, that the person who was operating it had already moved on to the Fish and Game one? WALL: That's entirely possible. GERAGOS: So somebody could click on the, looks like they clicked on this current thing, what you call a gif file, and that loads into the computer. And we know that, I assume that the content wouldn't have come up until 9:53:20, but the picture starts to come up, it appeared what happened was, as soon as he saw that picture, whoever it was that was the operator of this computer, that he already skipped over, left the current, and went right into the Fish and Game, right? WALL: There would be no way of me knowing that based on the connection speed and how it loaded. I wouldn't have any idea GERAGOS: We know for a fact that the person didn't stay on that, on the, this is where, the one that I'm pointing to, which is I, which would be the Real Time Current Velocity Map with the other, we know the whole thing didn't come in until 9:53. And looks like that before the whole thing even came in, the person already, when the, the operator had already clicked on to the Fish and Game. So they left these, the tides, or the current, whatever it was, as soon as, even before it even practically all fully downloaded, they were on Fish and Game already, correct? HARRIS: I'm sorry, but counsel is saying that 9:53:04 is after 9:53:20? GERAGOS: No counsel is saying that, unlike what I was led to believe I, guess that the currents that are right here, that came in at 9:52:54, which loads, as your expert says, prior to the content which loaded at 9:53:20. Means that whoever the operator was had already gone on, because he didn't care about it, to the Department of Fish and Game. Isn't that what that means? He clicked on, as soon as he got to, before that thing is fully loaded, he already clicked on to Fish and Game, right? WALL: That’s correct. GERAGOS: Okay. What was the next thing he clicked on to? WALL: The Sport Fishing Fees website at 9:53:04. GERAGOS: I have got a 9:54:58. Is that the next thing? WALL: You have to give me a frame of reference, what the last time was that you are looking at. GERAGOS: Right here. We have got Fish and Game Regulations. So this, would this be the first page? WALL: That's, does that say 9:53:04 on it? GERAGOS: Yes. WALL: The very next thing is 9:53:20, which is the Near Real Time Current Velocity Maps is created on the computer, how it's viewed. JUDGE: That's I, right? GERAGOS: Yes, right. GERAGOS: Now, the next spot that the person goes to WALL: Would be 9:53:46. GERAGOS: Do you know what it was? WALL: Yes. It's the Department of Fish and Game. GERAGOS: Okay. WALL: I'm just going in sequence here, how the files are created. GERAGOS: Okay. So the person then goes to Department of Fish and Game, and then does the person then go to, I have got, what I got here is J, 9:54 and 58 seconds? WALL: No. The next file that loads is another gif image, a g-i-f. GERAGOS: Okay. WALL: That is called Rows 1, brackets 1, bracket 205018, dot, gif. And it's created at 9:53:52. That's the next file created. GERAGOS: Okay. The next, and we didn't, you didn't print that up to put it into the binder? WALL: The binder selection was made by Mr. Harris. GERAGOS: Okay. So you have printed out everything that was actually seen, but what, everything that was actually seen has not been included in this binder? WALL: No, I didn't print everything out because everything won't print out. Some of them are buttons, and GERAGOS: The next thing I show in the binder, well, you tell me. What's the next thing that went? You said there was a g-i-f image. Does that mean the person has clicked on to another website similar to what happened with the velocity, that first, the picture comes into the computer before the content? WALL: It varies. GERAGOS: Okay. I show at 9:54 and 58 seconds, some time after which would have been about a minute and 54 seconds after the Fish and Game, I show Laws and Regulations. WALL: Actually there is several files before that. GERAGOS: Okay. What's before that? WALL: The next file after the Rows 1, brackets 1, file, the gif file was created at 9:53:52 p.m., and it is entitled, Zoom, underscore, c-b, bracket, 1, bracket 204383, dot HTM. GERAGOS: Did you print that up? WALL: Yes. GERAGOS: And is that included in here? WALL: This was the item that was presented by Mr. Harris after the break, I believe, the Zoom website. GERAGOS: The one that I said looks like the entire shoal area? JUDGE: I think it's 189. GERAGOS: 189? WALL: That’s correct. That's the same one. GERAGOS: That's the gif. And then that's at what time? WALL: That's at 9:53:22, bottom. GERAGOS: 9:53:52. The next thing? WALL: The file, cb16, underscore, 16, bracket 1, bracket 2045631, dot, g-i-f. GERAGOS: It's another picture? WALL: Yes. GERAGOS: That shows the same, shows the area, that Southampton Shoals, that I showed you before? WALL: That’s correct. GERAGOS: We have got, all of that is done within with less than a minute before the Law and Regulations come up at 9:54 and 58 seconds? WALL: The next time I have is another gif image at 9:53:54. GERAGOS: Okay. So this has been another already, how many seconds have elapsed between those last two gif images? WALL: Well, the previous file, the cb16, underscore, 16, gif was at 9:53:54. And the very next file has the exact same date and time stamp of 9:53:54. And it's titled, b-e-c,underscore, k-e-y, bracket, 1, bracket, 205634, dot, g-i-f. Do you want to see that? GERAGOS: Is that the another gif picture? WALL: Yes, it is. GERAGOS: Okay. And that does not show up, correct? Just shows, Just shows some arrows, and showing some knots, numbers in knots. WALL: Numbers within knots as to speed. GERAGOS: Well, it has, let's say, for example, that is a very small arrow. And it has a 1.0 with a line under it. Then the next one is a little bit larger arrow, different color. It goes to an orange. And there is a little, the next number is 2.0 with a line under it. Then the next portion of that image is an orange, darker orange, reddish orange arrow with a 3.0 with a line under, then a larger red arrow with 4.0 knots, with a line under it. Now, is it, is that item that you just described to the jury, is that something that would have been connected to one of the previous websites that had been clicked on to? WALL: That's possible. But without being able to actually authenticate that website, I wouldn't know for comparison. GERAGOS: It does not look like that that's something that, it's a website in itself. What you just pulled up? WALL: That’s correct. That the image that's embedded into a website. GERAGOS: So your best, I don't want to say your best guess, but your best analysis what that is, is that he's clicked on to a website, that content is coming, but these gif files, which are the pictures, are coming, either one of them, two of them, are simultaneous? WALL: That’s correct. GERAGOS: And then you have got, one kind of trails behind it? WALL: That's right. GERAGOS: And with this kind of low speed internet it's loading into, it looks like very quickly the user is moving to another website; is that correct? WALL: Well, not necessarily moving to another website; but looks like those images are loading in a sequence to a specific website within close proximity of one another. The one we talked about was Zoom cb. That's the website. And then it's going to have some gif images associated with it. That might potentially be the cb16 gif and having the underscore, bracket, 1, gif. GERAGOS: Similarly to what I go to a web site, sometimes I go do it on my phone, which loads pretty slowly, I will see where content will come up, and then pictures on the phone itself will download rather slowly. And then if I hit the address location, go to WWW something else, and immediately hit that, takes a little bit for the computer to catch up and then go to the next one? WALL: I can only assume that would be the case. I have never been able to use a telephone that has internet access. GERAGOS: Okay. If you were to do it from a computer that was slow, and I assume you have done that? WALL: Absolutely. GERAGOS: Okay. If you do from it a computer that's slow, is it your analysis as to what's going on here, because we're dealing with a fairly short period of time; is that correct? WALL: Slow connection speeds typically a smaller image is going to load faster than a larger image. GERAGOS: Is it a fair statement that somebody clicks, they are going from link-to-link, most probably, correct? WALL: From one website, then the images are loaded on to it so it can be displayed to the user. GERAGOS: Okay. And at a certain point, what we have got is is that within a minute and 54 seconds here, we have got how many different things coming into that computer? From H to J? H is what we previously identified as this Department of Fish and Game, and J is what was previously identified as the Law and Regs that came in at 9:54; is that right? WALL: After that, there is two more gif images, and then there is another web page document that loads at 9:54:58. GERAGOS: Okay. So we have got apparently, right, four, separate items that have come in within that one minute and 50 second span? WALL: Yes. GERAGOS: Is it a fair statement that if the Laws and Regulations, the content, loaded at 9:54 and 58 seconds, that the person who hit on this site, or this link, and maybe I'll ask you. Is there a link between Department of Fish and Game and what's called Laws and Regulations? WALL: What's the time on the Laws and Regulations? GERAGOS: Time on Laws and Regulations is 9:54:58. WALL: Yes, there is other links there. GERAGOS: Okay. So is it a fair statement that the user goes to this current, is only on there for a very brief period of time, and then goes to the Department of Fish and Game, then he goes to Laws and Regulation? WALL: Well, there is enough time in between there where that, you got to remember that internet file where the Zoom occurred, that brought up that. Southampton Shoals is a portion of the map that occurred in between that time as well. GERAGOS: So person goes on, they press, they go on to Southampton Shoals, and then they exit, go to another, either link or another website, and all of that takes place in the span of roughly a minute? WALL: Times are very clear when those files are created. So one could draw the conclusion of how much time is spent on each one of those, yes. GERAGOS: The conclusion would be less than a minute; isn't that correct? WALL: Well, it would be hard for me to say less than a minute, because there is two other web links that are redirecting the user to another website that you haven't discussed yet. GERAGOS: Okay. We know that there is, it's less than two minutes, right, don't we? WALL: Yes. GERAGOS: Okay. It's clearly less than two minutes. And that's if you don't account for how slow it is loading, and gifs coming in, correct? WALL: That’s correct. GERAGOS: So the maximum that it is a minute and high change, less than two minutes. And then you said there was two other links? WALL: Yes at 9:54:28. GERAGOS: Which would have been 30 seconds before J. What happens then? WALL: That's another website. It says the times of that web page is, states, I just lost it. The regulations page is now located at WWW dot DFG dot CA dot Gov, forward slash, FG, underscore, c-o-m-m, forward slash, regs, r-e-g-s, period, dot HTML. It's saying it goes to another website. Typically what happens in those cases, you can see an example of it here in the computer is, if you don't click on that link within a certain period of time, it will automatically take to you that next web page that it describes, and that's what happened here. GERAGOS: And so does that mean that the person, I would assume that that has now taken us down even to a lesser period of time that the person would have been on the gif that we identified before as I? WALL: Okay. Tell me again time of what you are talking about on that gif again. GERAGOS: I is 9:52 with the gif. 9:53 and 22 seconds and the WALL: We're now at 9:54 and 36 with that last. GERAGOS: We have already, we already know the Department of Fish and Game is up at 9:53:04, correct? WALL: Yes. GERAGOS: That's H. We already know that 9:54. And I don't have, you didn't print it out. We know in between the 9:53:04 and the 9:54:58 that there were four other things that were done, correct? WALL: Yes, there is a lot going on. GERAGOS: There is a lot going on, which means somebody is literally surfing the net at that point, correct? WALL: I don't know what they would be doing surfing. GERAGOS: We know they have left the, what's been marked as I, correct? WALL: Yes. And another web page has been activated, yes. Another web document. GERAGOS: So, and as far as you know, there is nowhere, at least you haven't done, if I understand correctly, you haven't done the analysis on it, but there isn't anything that you have seen that indicates that it was either saved as a bookmark, correct? WALL: That’s correct. GERAGOS:, or that it was, other term cached? WALL: It was cached, because that's what we are looking at. GERAGOS: Not, no, but the user? WALL: It's done automatically by the operating system by the Internet Explorer. GERAGOS: That's, there is nothing that indicates that it is user-saved, that picture, for, obviously, what period of time that we have gone through, correct? WALL: That’s correct. GERAGOS: And there is nothing to indicate, that indicates the user printed out any of this material; isn't that correct? WALL: I have no indications that, the only thing that we know is that cursor activity occurred for a Zoom to occur, for the next stage of the Shoals area that showed up. GERAGOS: So somebody has got the, they are using the mouse, presumably. Was there a mouse attached to this particular computer? WALL: I was told that there was typical input-output devices that were attached. GERAGOS: So somebody is clicking on this, they click onto the picture, the picture comes up, and it looks like, as you said, a lot was going on after that, very shortly, correct? WALL: That’s correct. GERAGOS: There is no indication that there was any printing of any of the things that you know of? WALL: That’s correct. GERAGOS: So no indication they were bookmarked or saved so somebody could come back it to later on and view it, as you said, on line, correct? WALL: That’s correct. GERAGOS: Okay. The entire book that we have, that was produced, do you have any indication in what was marked as 182, which of these documents in 182, which would be A through double D, which of these were printed? WALL: Yes. I believe there was a document that was printed that was discovered at the shop. GERAGOS: Okay. And that would be, I believe I got that handy. USA Fishing document? Did I give it to you? JUDGE: I think it's quadruple G. GERAGOS: The only indication of anything that was printed during this period of time would be what's previously marked as, Judge is right again, four G; is that right? WALL: I don't see any evidence markings on this piece of paper. GERAGOS: You can pick it up. Just turn it over. It should be a green piece of paper on the back. WALL: Okay. GERAGOS: Okay. Now, is this, as far as you know, the only item during any of this, detective, was it about an hour, how long is this session in the WALL: Now, I don't know this document was created on December the 8th, if I'm not mistaken. And I could check real quick in the book. GERAGOS: Sure. WALL: To see what time that was created. At least make sure we're the same page here. GERAGOS: Literally. WALL: That was the same document that we're referring to. GERAGOS: Looks like USA Fishing SFBay Report, correct? WALL: That’s correct. GERAGOS: Okay. WALL: Got the day's headline, December. GERAGOS: We're referring to item Q; is that correct? WALL: Yes. GERAGOS: Okay. WALL: It looks like that has the same content. It has the same day's headlines, Thursday, December 5th, 2002. And I have a created time of December 8th, 2002, at 8:19:10 a.m. GERAGOS: Now, is that, does that mean that the document itself would have been created in the morning, somebody would have gone to this website, USA Fishing, and then by, marked as Q, in the morning, the 8th, at 8:19 a.m.; is that correct? Is that right? WALL: That's right. GERAGOS: And then it would have been printed presumably some time after that, right? WALL: Yes. GERAGOS: It was 12/9? WALL: That’s correct. GERAGOS: And still got today's headlines there as the 5th. Does that mean that it could have been saved on line? WALL: That's very possible. Is this a representation of the documents that was seized in the warehouse? GERAGOS: This is a copy of the document that was seized in the warehouse. By that, we're referring to 4G. WALL: Yes. My experience is that this date of 12/9/2002 that's printed at the bottom right hand corner right here, this is a result of the page being printed when a print request was made to the printer from a specific computer. And if you look at some of my documents that I have created, you will see that same date on the bottom right hand corner as well. When I created the documents, this one in particular, it says July, or 7/29/2004. That's done basically by the operating system. When a file print request is sent to the operating system, a file is created, actually two files are created at first, for the printer to be able to handle it, be able to handle that print job. Now, we have a lot of different printers that are manufactured, and lot different computers, so we have to have a standardized format that these pages can be printed, where they are all don't look like this, but they have the content, the images associated with them as well. And that process, sending that job to a print spool file actually creates what we call an Enhanced Metafile. That's a type of file that every computer system and every printer understands, to be able to take that document and send it directly to the printer. GERAGOS: Now, does, and that's also something that, if you wanted to, you could go take a look at the printer and use the software to show you if there was some orders that were given by the user to see if there was a print job? WALL: Actually, that wouldn't be the case. You wouldn't really use the printer to do that. GERAGOS: If I said printer, I misspoke. The software that you have, you have the ability, one of the versions of the software you have has the ability to determine whether a print job was done, correct? WALL: Yes. That's possible to be able to go and look in the unallocated space for that enhanced metafile. GERAGOS: Now, I'm going to ask you if I could return to, do you have your computer still up? As to the, in terms of the timing. WALL: Yes. GERAGOS: Okay. And the times, let's see the next – WALL: Excuse me? GERAGOS: Sure. The next thing that was done after this, that's when, last one we talked about was the Laws and Regulations, correct? WALL: What time are we at? GERAGOS: 9:54 and 58 seconds? WALL: I can get there. There is no, there is other files that occur prior to that. GERAGOS: Okay. See what we got. Are they all, right now are we all in, fishing? Basically? WALL: Yes. GERAGOS: Okay. WALL: As an example, there is another website that was accessed at 9:54:48 that's called Site Map, brackets 1, brackets 203793 dot HTM. And that web page is titled Marine Regions Research Lab. GERAGOS: Okay. And that is at what time? WALL: That is at 9:54:48 p.m. GERAGOS: And that would be approximately ten seconds before we get to the Laws and Regulations, which was 9:54 and 58 second? WALL: Yes. 9:54 and 58 seconds is the California Department of Fish and Game Marine Region Laws and Regulations web site. GERAGOS: And then do we get to 9:55 and 50 seconds, or is there something in between? WALL: There are some image files, gif images, JPEG images, that are associated with the websites in question. GERAGOS: Would it be a logical conclusion, or would it be logical to assume that the gif files that are coming in after 9:54 and 58 were related to these areas right here that I have my pen on? WALL: Yes, that's entirely possible. They would be associated with that website. GERAGOS: Okay. What's the next website that we go to? WALL: Give me the time reference again. GERAGOS: I've got the next thing that I have in the binder is 9:55 and 50 seconds. WALL: What was the last file, last one? GERAGOS: Last file that we had was 9:54 and 58 seconds, which was Laws and Regulations. And then I believe you said there was some gif files? WALL: Yes. That follow that. GERAGOS: Okay. Okay. Then the next thing that I have is California Fish and Game Code. WALL: Let me see. JUDGE: Well, was there San Francisco Bay Safe Boating Hints in between those two? WALL: Yes, the next one, you are correct, is the Safe Boating Hints for San Francisco Bay. GERAGOS: What file is that? WALL: That one is created at 9:55:34 p.m. GERAGOS: Okay. So the person goes from Laws and Regs to Safe Boating Hints for San Francisco Bay; is that correct? WALL: That’s correct. GERAGOS: And is that a link from the California Department of Fish and Game? WALL: I don't know. GERAGOS: If we were to go to, you see in the left hand column here of Laws and Regs? WALL: I have to go back to it. Okay, I'm on the Laws and Regulations web page. GERAGOS: Same as what I'm looking at right here? WALL: Yes. GERAGOS: Okay. WALL: You can come check if you like. GERAGOS: Sure. Just tell me, do you know if that links up to what's been marked as K? WALL: That's the Safe Boating Hints. I didn't see anything for Safe Boating Hints. GERAGOS: Okay. How about Fish and Game Code? WALL: Yes, there is a link from California Fish and Game Code. GERAGOS: So presumably Laws and Regs is pulled up at 9:54:58,and then the user clicks on to at some point, we don't know, Fish and Game Code at some point. We don't know how they got to Safe Boating Hints at this point, correct? WALL: Yes. The San Francisco Bay Safe Boating Hints would have been the next web page that was viewed. GERAGOS: Okay. Is it possible that it's in one of these Information and Publications, or Fishing, or News, or – WALL: It could have been from one of the Yahoo Search pages. GERAGOS: Okay. Then we get to Fish and Game, and then, 9:55 and 50 seconds; that's correct? WALL: 9:55 and 50 seconds, yes. GERAGOS: Okay. WALL: That's the very next web page that loads. GERAGOS: What's the next page after that? WALL: It's called California Department of Fish and Game Marine Region, California Ocean Fishing Regulations Map. And that occurs at 9:57:26. GERAGOS: Now, when I looked here on what was marked as J, you see on J, the left, that I have talked about before? WALL: I have to go back there. GERAGOS: Okay. WALL: That's the Regulations fishing page. GERAGOS: Yeah, Laws and Regulations. See how it has the, looks to be blue, and what I would call links on the left side? WALL: If you would give me the time on the bottom of that page, makes it easier for me to sort it by file. GERAGOS: Sure. 9:54:58. WALL: Okay. GERAGOS: Okay. Now, I'm going to show you, you said the next one was California Ocean Fishing Regulations Map; is that right, at 9:57:26? WALL: After the California Fish and Game Code. GERAGOS: Right. Just going to show you this. I have got you have got, though, that printed up at 9:57:26. Assuming this 9:57:26 is also laws and regulations at 9:54:58, looks like to me, like you have got the same links right here, all the way across. WALL: Looks like it's a portion of that State of California Department of Fish and Game web page. GERAGOS: Okay. So looks, is it a fair assumption what's going on here is the person is in the State of California website, going through it, and clicking links on there? WALL: That's very possible, yes. GERAGOS: Okay. The next one that you have got 9:57 and 48 – WALL: California Department of Fish and Marine, that's the one that says the 40 degree, 10 degree line to Point Conception. GERAGOS: Once again it's got those blue things on the left; is that right? WALL: Yes, it does. It's part of that State of California web page, 9:57 and 38. GERAGOS: Then does it appear that the next, by the way, this particular web page then has regulations here on this page, right? Second page of three? WALL: It's all one large page. Computer has to manage it some way for the 11 inch paper. Different colors for species. GERAGOS: And it will be, does that indicate anything, two of three. Does that indicate – WALL: If necessary, have to look closely. GERAGOS: Tell me WALL: It's in black. Black Surf Perch and Striped Surf Perch are in black. They are not blue. So you probably have to check with the author of the website to determine why it's in black and not in blue. This blue is, typically it's a hyperlink that would take you to another web site, or another portion of that website. GERAGOS: Does it also, sometimes if I go to, if I use one of the links, that when you return to look at it, it's a different color so that you can tell that you have already been there. WALL: It doesn't necessarily mean that, no. GERAGOS: But is that one of the explanations for what could be? WALL: One the default settings is that when you activate a link it will turn a different color. But I don't know what the default setting would be. And – GERAGOS: Let me just ask you a question. If somebody were to hit on Black Surf Perch, or Striped Surf Perch, and they had a default setting, and when you hit on the link it then turns the color, would that be saved such that when you print it out, we would see the changed color default setting? WALL: I couldn't answer that without testing that theory. There is no way for me to know that the default setting would be black. GERAGOS: Okay. And you haven't tested that in this case? WALL: No, I have not. GERAGOS: That's something that can be done? WALL: It's possible. GERAGOS: Okay. Now, I'm going to show you the next one, which is identified as O. And this says Green Sturgeon. Looks like 9:59:04; is that correct? WALL: That’s correct. 9:59:04 p.m. GERAGOS: Does that appear to be a link, or can you tell if that's a link to the Fish and Game website? WALL: Does appear to be a link from the Fish and Game website. GERAGOS: Yes. Does that appear to be something that came, that was accessed via the Fish and Game website? WALL: Okay. What is the time on that one again? GERAGOS: 9:59 and four seconds. 9:59 and four seconds. WALL: I have no way of knowing if it's a link from a specific site. We could go back to that site that you are wondering if it's linked to and take a look at it very closely, see if there is anything that would resemble that. GERAGOS: Now, when it says Page 1 of 27 on here WALL: Yes. GERAGOS: Now, does that mean, I think you just alluded to it to the jury. When you access the information that's in the computer, it is not paginated, correct? WALL: That’s correct. GERAGOS: So when we have Page 1 of 27, that does not mean that somebody clicked on to this particular website, or this link, and scrolled through 27 pages; is that correct? WALL: That’s correct. GERAGOS: What it means is that the information, when that website loads into the computer, that 27 pages of information doesn't come in as 27 pages, but the total volume of information comes in in the computer, correct? WALL: That's right. And it takes 27 pages, with page breaks, to be able to print that entire website out. GERAGOS: Okay. Is there a way to determine if, for instance here, we have got Page 1 of 27, and we start off with Green Sturgeon, and then if you go into some of the other pages, you will see that there is Salmon, and very just different kinds. Grunion. Is there a way to determine if somebody, if this is a link, for instance, that somebody went specifically to look for Sturgeon, and that's why, that's the first thing that comes up in this block that went into the computer? Make that clear? WALL: No, not really. GERAGOS: Say, if there is a link, and you wanted to pick the previous, for instance, if you had a list here. WALL: If it was a link, it still had to be clicked on to be on the computer to be viewed. So whether it's a link GERAGOS: What if you had this link, it says other species here, okay? I'm referring to specifically N. WALL: Yes. GERAGOS: And what if you hit on Sturgeon. And I'm assuming that these are links? WALL: Yes. Typically when you see something in blue, that means it's a hyperlink to that website. So – GERAGOS: So is it? WALL: Based on your previous theory, that if you click upon a link, and that was a link to the Green Sturgeon, that would change color, then that wouldn't necessarily hold true. GERAGOS: But would it, if it didn't change color from a default, and you clicked on Sturgeon, would it necessarily go to Sturgeon in the body of all the information that you have on the species? Have you tested that? WALL: No, I have not. And I don't know. GERAGOS: Okay. Now, the after the WALL: Do you want me to GERAGOS: I'm going to give you some more exercise. WALL: Okay. JUDGE: Tell you what, Mr. Geragos, I think we're going to exercise the jury, let them go home now. All right?
August 26, 2004 JUDGE: We're all ready for you, Mr. Geragos. GERAGOS: Okay. JUDGE: Now, when Detective Wall was here last time on August the 5th, you remember where you left off? Do you have your notes? GERAGOS: Green sturgeon. WALL: Green sturgeon, yes, sir. GERAGOS: Do you want to call that up? If I move this to where you were, WALL: I don't know what exhibit number it is. GERAGOS: You are not connected up? Doesn't hook it up. I'll just use the exhibit, make it simple. JUDGE: Wall starts with probably 182. GERAGOS: 182 and 179. JUDGE: 182A through EE. GERAGOS: Where you left off Detective Wall, this left side exhibit, this was the page that had been clicked on to? WALL: Yes, that's correct. GERAGOS: Okay. And if I remember correctly, that you have got a, looks like 9:59 what's marked in the right, correct? WALL: Yes. GERAGOS: And that would be the time at night that that was done? WALL: Yes, that's correct. GERAGOS: And then how long was this page viewed for? WALL: There is no way to tell how long that page was viewed by the user. GERAGOS: What was the next site that came up? I have got the next one in the exhibit book. I have got the 9:59 and 44 seconds. Is that the next one? Or is that just the next one you put in the exhibit book? WALL: I'm checking right now. GERAGOS: Okay. WALL: Yes. 9:59 and 44 seconds. GERAGOS: Depending on whether or not, how long it takes, we went through ad nauseam, I think, before the fact that sometimes the pictures come first, sometimes the pictures come second, text comes first, depending on whatever that may be. And there is no way to know that, correct? WALL: That's correct. Most people are familiar how a web page is viewed, how they load what with a dialup connection. And usually the images, you know, slowly appear. GERAGOS: Okay. Is it a safe bet that potentially the next thing that comes up is this web page, which is the San Francisco and San Pablo Bays, right? WALL: Yes, sir. That's the one that I have. GERAGOS: Okay. And safe bet that comes up some time after the Green Sturgeon? WALL: Yes, in time sequence. It would be after that, after that one. GERAGOS: So when you are saying time sequence, the first place that they come, first place that whoever is operating the computer comes to is this particular website that's got Green Sturgeon, correct? WALL: That's correct. JUDGE: Mr. Geragos, can I just have the witness sort of orient the jury as to where we are now, where these items came from? These, remember these are the items, GERAGOS: I can lead it. It's been a while. This is, you made a copy or an image of the four computers that were seized on the 26th and the 27th, correct? WALL: That's correct. GERAGOS: And the images that you made of the four computers, you labeled them. I don't know if you did. The other gentleman did who testified here. And they were labeled as Home and Work, correct? WALL: Yes. There were four different designations that were made by Officer Stockham. GERAGOS: Right. Kirk Stockham? WALL: Yes. GERAGOS: Now retired? WALL: That's correct. GERAGOS: Now retired? WALL: Yes. GERAGOS: There was a fifth come computer that was seized in February, correct? WALL: Yes. GERAGOS: We're not talking about that now? WALL: No. GERAGOS: We're talking about the computer that was seized from the second bedroom of the house on the 26th or 27th of December, correct? WALL: I don't know where it was geographically located. All I know is the designation is "Dell Laptop Home 1" is what we are referring to in these documents. GERAGOS: Dell Laptop Home 1. And what we did last time you were here is started at approximately, at least Exhibit A, started at approximately 9:30, correct? WALL: That's correct. GERAGOS: And we were going through what these exhibits were, and the time that people were, whoever the viewer was was spending on it, correct? WALL: That's correct. GERAGOS: Now, have you checked to see whether this Green Sturgeon website, if that has a link to the San Francisco or San Pablo Bay website? WALL: I could look at it right now. There does not appear to be any links to the next web page. However, without being able to authenticate it while it's live on line, I wouldn't know for certain. GERAGOS: Okay. And when you say live on line, indicating, if you were to go to that location right now, that site right now, the sturgeon one, call it up, you had all the boxes where it says "Click Me", so you could see all of that, and then know whether or not there is some kind of a link that goes from Green Sturgeon, or one of these pages that are connected to the website, whether that takes you quickly to San Francisco, San Pablo Bay? WALL: That would be one way, yes. GERAGOS: Now, after that San Francisco and San Pablo Bay, which is P, came up, the next search is a search, is it Yahoo? WALL: If you could show me which one you are referring to. GERAGOS: Sure. WALL: If you could give me a frame of reference time wise. GERAGOS: And I apologize. I can't read whether that's 10:10 or 10:18. WALL: If I could come take a look. GERAGOS: Sure. Any time you need to, just tell me. WALL: 10:00:50. I think I may have said 10:10. GERAGOS: It's actually 10:00:50; is that correct? If you could just write it on there. It's a little bit easier to tell. WALL: That's 10:00:50. GERAGOS: So this Q looks like went back to, whoever is on the computer is on the, popped up this bay listing at 9:59 and 44 seconds. And then the next thing that pops up is this, which is 10:00 o'clock and 50 seconds, correct? WALL: Well, this just doesn't pop up. This is in response to a request made by the user, where the user enters in the words "Map San Francisco Bay Chart". And these are the results of that search request. GERAGOS: Right there? WALL: That's correct. GERAGOS: All right. So let me get one of the, one website that you just saw comes up with the Bay, somebody types in another search, done fairly quickly; is that correct? Within fifteen or sixteen seconds of the last one? WALL: Well, the issue may be very simply that there are multiple windows open. GERAGOS: Correct. WALL: Most people that do internet searching, and I have done this myself, are where I have a search page that's open, where I have asked for my research, or my search materials that I'm looking for, that I have on one page, and I can simply activate another e-mail, or, I'm sorry, an internet browser, so I can have another window open. Or when I click that specific link on the search page, say if you took anyone of those links, you can have your browser set to where it will open another page separate of this one. So you can actually to go back and forth to your original search page, and then to your research page based on the link that you choose. GERAGOS: And whatever it is you are looking for? WALL: Exactly. GERAGOS: All right. So, and we have seen repeatedly that the user comes back and modifies the search to get some other item, correct? WALL: Yes. It's being something more specific. GERAGOS: All right. So this is the search that comes up at 10:00 o'clock. Then the very, I assume the very next thing it says 10:01 and 18 seconds, is R, which is the Striped Bass, correct? WALL: Yes. GERAGOS: He doesn't go, user does not go from the San Francisco Bay chart. Didn't put in tides, or currents, or anything like that, did he? He put in tides or current? WALL: No. It's very specific what it says at the top. GERAGOS: And then the next thing that we have is this Striped Bass website or web page, correct? WALL: That's correct. GERAGOS: Now, the Striped Bass web page bears a pretty close resemblance to what's been marked as O; isn't that correct? I'll walk it up and show it to you before I publish it to the jury, just to ask you. These two look like, these two look like whoever did these web pages seem to have the same format, and seem to be the same web page? WALL: Yes. GERAGOS: Okay. So the first thing that pops up that he's looking at, if I have got it right, he's got, he goes to read sturgeon, Green Sturgeon at 9:59, goes back to the search results, depending on, we're guessing because, I wouldn't say guessing. We're surmising, I guess, because you don't have any way of detecting whether or not he's got more than one window open, correct? WALL: That's correct. But that would be a reasonable assumption. GERAGOS: Based upon how quick these things are coming up, correct? WALL: That's correct. GERAGOS: And so Green Sturgeon goes back, and then we have got Striped Bass right there. That basically what happens? WALL: Yes. That's the next one in sequence that he created on the computer. GERAGOS: Okay. And then next thing that pops up, and I know you indicated before that some of the sites you didn't put on, or some of the things you clicked on you didn't put on. But like some of these other witnesses, you have culled out what you thought was important? WALL: They were chosen specifically by Mr. Harris. GERAGOS: Now, the next thing that you chose to put in the Striped Bass area at 10:01 and 18, the next thing that pops up is S. And this is at 10:03, correct? WALL: 10:03:14. GERAGOS: And that's an, does that appear to be a, back to this California Department of Fish and Game website? WALL: If you will give me just a moment. JUDGE: Go ahead. He is trying to research your answer. GERAGOS: Thank you. You are researching him whispering in my ear? WALL: That's the 2002 Sport Fishing Regulation. Be part of the Department of Fish and Game. GERAGOS: And without, I don't know if the jury remembers. This has been a while. Do you remember that one of the websites that he had hit on prior the Department of Fish and Game? WALL: There is quite a few that were actually viewed. GERAGOS: So to be specific, I think it was G. Which is G, right here? At about 9:52? WALL: Is that 9:52 p.m.? GERAGOS: Says 9:52 and 20 seconds. WALL: That would have been prior to that. It's possibly just a different, I don't know if it's the same one exactly. GERAGOS: Are you able to tell? WALL: Well, if I could see that one more closely. GERAGOS: Sure. WALL: No. They are different pages. GERAGOS: Different pages. They look to be the same website. WALL: From the same website, yes. GERAGOS: So appear, at least there are one or two explanations. Either there is a window open which holds up Department of Fish and Game, then somebody goes, finds the kind of fish they are looking for, either sturgeon or bass, and then comes back and finds what the regulations are. Is that a reasonable assumption of what happened? WALL: That's very possible. You can have as many windows open as your computer memory will handle. GERAGOS: Is there any way to determine when you are doing this forensically, which is you take an image of the computer, and now you are kind of looking at it retrospectively, is there any way to determine how many windows he had open at a time? WALL: It might be possible, but it's not something that I specifically analyzed. GERAGOS: It wasn't done in this case? WALL: No. No. GERAGOS: But a reasonable assumption of what happened here is that first he opens up Department of Fish and Game, then he goes to the other location, finds this fish, and then the information about these two fish, sturgeon and striped bass, then goes back and gets the Ocean Sport Fish Regulation? WALL: It's very possible. As long as it's in that sequence. GERAGOS: As long as it's in the sequence. That's the sequence I have. I mean the sequence that the jury has been shown is the sequence by which you withdrew or pulled these things out of the computer, correct? WALL: By the time that they were created, that's correct. GERAGOS: Okay. And when you say by the time they are created chronologically, this is where you were going through the image on this particular date, and, WALL: Yes. GERAGOS: And were you pulling them off one after another after another, correct? WALL: That's correct. GERAGOS: Okay. Now, the other thing I noticed on this one particular exhibit that's up there, you see near the top where it says web matches? WALL: You are back to the search results one? GERAGOS: Yes. The search results one, exactly. Where it says web matches. WALL: Yes. GERAGOS: Now, is there anything, explain to me what, see where it says 41 of 60? WALL: Yes. GERAGOS: And then first page, Previous 20 and Next 20. Can you explain what that means? WALL: Yes. The first page is going to basically say there is 41 through 60 of those matches. So as the search is being conducted, the first request is going to have one through like twenty. The next one will be 21 through 40, or whatever the case may be, and in sequence. GERAGOS: Okay. So is it, as you are doing the search, you can go, and when you say first page, Previous 20, Next 20? WALL: You can skip around. GERAGOS: You can skip around. If somebody wanted to, they could just click on to the first page. That would presumably give 1 through 20. Then click on this, or this, that will take you either forward or backward? WALL: Forward or backward. GERAGOS: Okay. WALL: Do you want me to stay here? GERAGOS: I'll let you sit there. Give you some exercise. WALL: Thanks. GERAGOS: Now, this comes in at 10:03:32, correct? Now, the next two that come up are, would be the first one, U and V. First one is a map of, navigation map. JUDGE: Skip, did you skip T, Mr. Geragos? GERAGOS: Which one, judge? JUDGE: T. GERAGOS: I don't see it here. JUDGE: San Francisco Bay Chart. HARRIS: T is on the screen. JUDGE: That is T there. GERAGOS: That's JUDGE: There it is. Okay. That's T. Okay. Now, we are going to U? GERAGOS: Yeah. JUDGE: All right. GERAGOS: U is here. That's a 10:04 and 54 seconds? WALL: 10:04:54? GERAGOS: Yes. And then the next is V, which is 10:06:04, correct? As long as you are here. Next then we go back to 10:07:42. And now I'll walk you up here if I could. You have got a different search this time, correct? What is this search that's done now? WALL: The results are for "Sturgeon Fishing Tackel (sic)". T-a-c-k-e-l. GERAGOS: The web matches, if somebody wants to, they click on to one of these things; is that correct? WALL: Shows one of sixteen. GERAGOS: Then it shows the, time for that one, that search, is 10:07:42, right? WALL: That's correct. GERAGOS: Within fourteen seconds we get to a place called, looks like "Archive Fishing Report", 10:07:56? WALL: Yes. GERAGOS: Does that look to you to be connected to this somewhere? WALL: Fishing report? GERAGOS: Yes. WALL: There is only nine of them showing here. So, GERAGOS: Your best guess that somebody clicked on that from a web page? WALL: From, GERAGOS: From that web page. WALL: No. That wouldn't be a guess I would want to make. I could look at it here real quick to make sure we're in the, what is the search time reference again? GERAGOS: The search time is 10:07:42. WALL: Okay. What is the next. I'm there. So if you tell me what the next page. GERAGOS: Says "Archived Fishing Report". WALL: Archived Fishing Report. And what is the time on that one? GERAGOS: 10:07:56. Looks like it's about 14 seconds later. JUDGE: This might be a good time for the reporter. We'll take a 20 minute recess until 3:00 o'clock, pick up where we left off. <RECESS> GERAGOS: Now, this Y, which is this archived report, Detective Wall, this looks like that this is somebody who is now searching for old fishing reports in February and January and late December. Like here we've got Wednesday, December 27, 2000: Ahoy, my fishing friends, the sturgeon are here, the sturgeon are here, and talking about, here it is, the December 18th report. Talking about sturgeon fishing still being swell on the 18th and on the 14th. Is this, it says archived, but I assume that one of these fishing sites, you can go back and right here select where it's blue on the, some particular time period to check in previous years what, what the fishing's like? WALL: Yes. These, these areas that are here in blue are typically considered hyperlinks, and they're associated with an additional web page. So if you click on one of these areas and the blue is the default that is selected by the computer, that color is a hyperlink, and it will take you to a specific web page associated with the site tag to this text. GERAGOS: So it looks like, what, the fifth one down, December 2000 to February 2001 archived report, somebody specifically went to that particular archived fishing reports and, lo and behold, there are people talking about sturgeon fishing? WALL: Well, I believe this is the stapled document. There are multiple pages on here. GERAGOS: Right. WALL: So if you look, it's the same document, just listed again in, on that page that you were on with the hyperlinks. GERAGOS: The one right, WALL: Just showing a list of this specific document. GERAGOS: Okay. WALL: What you're referring to is the December 2000, February 2001, now, if you go back to the first page, so it's exactly the same, showing a list of all the archived reports. But if you, the question you had before the break was is this web site, did it have any relevance to the search page that you showed previously. GERAGOS: Right. Does it? WALL: Yeah. If you pull that web page up and if look at this, the December 2000 GERAGOS: Okay. WALL: February 2001 archived fishing report, and if you look up, I'm sorry, if you would go back one more real quick. GERAGOS: I'm sorry, I thought I saw it there. WALL: And look at this link here to show that it's the same. And then if you look at the very first one, December 2000, February 2001 fish report from rapid transit. So that matches that this, one could assume that this link was activated to get to this page, because this was the search page that was previous in time to this document. GERAGOS: So if I've got, I've got it right, what happens is at 10:07 the person, or sometime shortly before that types in sturgeon, fishing and misspells tackle, right? WALL: Yes. GERAGOS: Okay. They get the report, and then the top one right here is December 2000, February 2000 fishing report from rapid transit; is that right? WALL: Okay. GERAGOS: And the sturgeon fishing is definitely picking up so, if you do...and then, WALL: Okay. Gives a brief synopsis. GERAGOS: Right. Brief synopsis of what it is. And then if you look at the very top, and this is Y, at 10:07:56, which is 14 seconds later, so one is assuming that, I would assume that what the person does, clicks on the blue, right? And you go to here, and you've got your December 2000, February 2001 archived fishing report; is that correct? WALL: Yes. GERAGOS: Okay. Then the next one is Z, and it looks like at this point, this is 10:08:36, there in the corner? WALL: Uh-huh. GERAGOS: And this is Z. And it looks like at this point, you need to go back to take a look? WALL: Well, just to make sure. Okay. Did we go to the 10:08, what was the time again? GERAGOS: It looks like 10:08 either 36 or 56. I think it's 36. WALL: There's one at 10:08:14 as well. GERAGOS: I don't show that one here. Maybe you didn't, maybe that wasn't selected by Mr. Harris. Is that another fishing site? WALL: It's another search results page where tackle is spelled correctly. GERAGOS: Okay. So it punches in one of these searches, again for sturgeon, fishing, tackle, San Francisco, and then the next thing that we get, I believe, is, from Z, is double A, right? WALL: And what time is that one? GERAGOS: That one is 10:09, I'll show it to you. Is that, looks like 10:09 exactly? JUDGE: 12/8, 10:09 p.m. I have. WALL: There's another search that's at 10:08:36 where sturgeon, fishing, tackle, San Francisco, is entered. GERAGOS: Okay. Is it possible that, instead of windows popping up, that somebody is, I notice on your computer, it's the same thing on mine and I think everybody else's, you have this back arrow that you could, that what could be happening here is that the person does a search, does the Yahoo search, presses, like you get here, go back one, go, you do your search, you get this, the top one, then you press that and you go to this December archived report, okay? Then is it possible that the next thing that happens, if it's a different search term, that you press back on your computer, the back arrow. WALL: And go back to the search page. GERAGOS: Go back to the search, change the search, and then, boom, you get some more results? WALL: Absolutely. That is possible. GERAGOS: Is that possible what's going on here? WALL: Yes. GERAGOS: Okay. That's a reasonable explanation for what's happening here WALL: Yes. GERAGOS: in terms of the times and everything else? WALL: Yes. GERAGOS: Okay. So we go from Y to Z, and now we're at sturgeon, fishing, tackle, and San Francisco? Okay. Now, my question is, WALL: What time is that one? GERAGOS: That one is the 10:08:36. That's the one I gave you just a minute ago. WALL: Okay. Okay. GERAGOS: Okay. Then did you, did I understand you correctly the next thing that happened is that then there's a search again? Go back to the, WALL: At 10:08:36 there's a search. GERAGOS: Okay. So that would be consistent with what we were just hypothesizing, that somebody's gone to this, seen this, the, search result, then goes back, does another search, correct? WALL: Yes. GERAGOS: Okay. The next thing that comes up is this double A, the 10:09 exactly, as the judge just indicated? WALL: Yeah, that's Hi's Tackle Box Presents. GERAGOS: Okay. Is this something that is, are you able to tell, this is a daily fishing report, correct? WALL: Yes. GERAGOS: Okay. Is there a way to tell if this USA School of Fish is something that related right in number three? See where I've got, what I've done is I've laid double A, the top of double A. USAfishing School of Fish over number three on the search results, which is USAfishing School of Fish. Does it appear that what happened here is the person went back, looked at the, did the search, and then clicked on number three? WALL: Yes, that's very possible. GERAGOS: Okay. Is that a reasonable explanation of what's going on? WALL: Yes. GERAGOS: Okay. Then the next would be this double B, which is 10:09 and I think it's 28 seconds, correct? WALL: Yes. GERAGOS: And Ten Tips for Better Sturgeon Fishing? WALL: Yes. GERAGOS: Okay. Once again, that's sturgeon fishing right up here. Is that something that one would, I put double C up there, okay. Is it possible that from USAfishing, you've got the search results, USAfishing, then you go USA School of Fish? WALL: Yes. GERAGOS: And then is it likely that what happened is that somewhere on this USAfishing School of Fish that you press on sturgeon fishing and up comes this thing? WALL: Well, that's entirely possible. Without being able to analyze any of the hyperlinks that are on this web site to get you to this one, and without being able to authenticate it, I couldn't answer that correct. GERAGOS: Okay. So you would need to what, go online to check that out? WALL: Well, that's one of the ways that we do it is authenticate it by activating the links that are online. We can also look at the time sequence and, you know, other factors associated with the web page. You can look at the web site itself, see if it has any actual reference to that page. But I know that web site is a very extensive web site. GERAGOS: The USAfishing? WALL: Yes. GERAGOS: Okay. When you say very extensive, it seems to have quite a few, WALL: A lot of information out. GERAGOS: A lot of information. I'll show you. Looks like there are daily fishing reports, which is B. Got, it lists all the local fishing areas, correct? WALL: Yes. GERAGOS: And, WALL: These would be hyperlinks that would take you to specific areas. GERAGOS: Okay. Now, it would, one of the hyperlinks that it could take you to would be this Moss Landing; is that correct? Is there a Moss Landing there that you can, WALL: Yeah. Says Monterey Bay. Moss Landing is on there. GERAGOS: Okay. The next one that we've got, which is CC, which is at 10, what is it, 19:34? WALL: 10:19:34. GERAGOS: Okay. So looks like the daily fishing report has at least been up there for ten minutes, Ten Tips for Better Sturgeon Fishing, before somebody clicks on, presumably from USAfishing School of Fish, to sturgeon fishing, and then on the sturgeon fishing, when you said Moss Landing, that was right here, correct? WALL: Yes. That would have been one way to get to it. GERAGOS: Okay. So if I've got it right, you go, boom, hit there, you get on to this USAfishing School of Fish, hit sturgeon fishing, hit Moss Landing and you get to today's headlines, Monday, December 2nd. So we're assuming, if this was done on the 8th, and if you're assuming that the internal clock is correct, that either they haven't updated this, or, that's one likely explanation, correct? WALL: Yeah. We covered that in my last testimony where this is just created by the author of the web page, and it's information that was the last time that this web page was updated. This is what, this date is, only changes if the author changes that date with an update. GERAGOS: Okay. Once again, we've got that same situation where the pictures haven't been pulled up, correct? WALL: Yeah. The pictures get separated from the web page, and they go into potentially different folders that are created through the access of the Internet, the Internet Explorer web browser, so the pictures aren't associated with the web page as I see them. GERAGOS: Now, this is at 10:19, and we're at the Moss Landing report, correct? WALL: Yes. GERAGOS: Okay. And the very next one that was pulled out looks like 10:20:08, on the same date, and that's double D. And it appears that what happened here is that somebody's done a Yahoo maps, correct? Or there's a link, one or the other. Either they've got to Yahoo and done a map, or there's a link somewhere on this Moss Landing which takes you to the map, correct? WALL: That's very possible, yes. GERAGOS: And the only way you would know that is to get onto that web site, actually, they've got what looks like right there; is that possible it's in there? WALL: What is the time on that one? 10:19:34. GERAGOS: 10:19:34, right. Which is double D, this Yahoo map which looks like 10:20:08. WALL: Okay. This, if we could go back to that Moss Landing web site. GERAGOS: Okay. WALL: These right here, in looking at my computer, these are hyperlinks that will take you to, it says zoomable driving maps, and one of them, it says right here, Moss Landing. GERAGOS: So let me just zoom that in, if I can. WALL: And that's 10:19:34 on that page. GERAGOS: Okay. Want to do that one more time? WALL: Here's Moss Landing right here. GERAGOS: Okay. WALL: And these are all links. GERAGOS: Hyperlinks. Okay. So it looks like what happened was, if you go the Moss Landing, once again, this looks like a reasonable explanation of what's going on, is somebody has done the search, hit the USAfishing, hit sturgeon fishing, Ten Tips for Better, Moss Landing, this is the Moss Landing, they hit the hyperlink, and they go to what is marked as double D, which comes up at 10:20:08, which is fairly quick from the double C, which is 10:19:34. So that would seem to be consistent with the idea that they hit a hyperlink, correct? WALL: That's possible, yes. GERAGOS: Okay. Is that reasonable? WALL: Yes. GERAGOS: Okay. And then the last thing that was marked by the district attorney is this item, and that's the Yahoo map of Moss Landing? WALL: That would have been the map that was embedded on that previous web site. GERAGOS: So the, you have this space right here? WALL: Yes. GERAGOS: Okay. So, once again, we've been talking about this is the text that we got, which is double D, and then here's the picture that follows up that would naturally go right in there; is that correct? WALL: Yes. GERAGOS: Okay. Now, I'm going to, if I could, I'll show you the, the other binder. Can I have just one moment? JUDGE: Yeah. GERAGOS: Before I start another one. Now, I've got one, very interesting, you know, Judge, I've got it as 197, but I assume it's 179. CLERK: Dyslexic. GERAGOS: Sorry, Marilyn. I owe you one. JUDGE: Yeah. 197 in my notes is envelope and contents. HARRIS: It should be 179. JUDGE: Should be 179. GERAGOS: Okay. GERAGOS: The, do you have your computer set up? JUDGE: Yeah. 179 binder A through U with contents. WALL: What is the time frame on this? GERAGOS: Looks like started 7:52 a.m. WALL: Takes a second. GERAGOS: Sure. WALL: 7:52 and how many seconds? GERAGOS: 7:52 and 48 seconds. WALL: Okay. GERAGOS: Okay. Now, you pulled out, is this the same situation as we had with the other search whereby the DA picked out what he wanted to mark as exhibits and it's not everything you searched for? WALL: That's correct. GERAGOS: Okay. Now, A, the first item, this is the one that was 7:52, correct? WALL: Yes. Classified ads. GERAGOS: Okay. Now, there is a number of boats for this classified ad that are listed there; is that correct? WALL: Yes, that's correct. GERAGOS: Okay. And your experience is online, when somebody posts the classifieds, they also put the prices here? 3800, generally, 800, this is an expensive, 895. That's a house. We've got 3800. Twenty-one five. So somebody's doing a search for boats. We have 800 or best offer. The, the next, or the second page of the search also lists boats as well? Basically there isn't really a second page, you explained that to me before. This is, when the web page comes up on your screen, you just scroll down. It's only on pages when you print, right? WALL: That's correct. GERAGOS: Okay. And so these three, all of these came up; is that correct? It would have WALL: Yes. GERAGOS: would have, would have been accessible to whoever was doing the search, right? WALL: That's correct. GERAGOS: There's another 800 dollar boat, right? WALL: Aluminum 14 foot boat, motor an accessories, 800? GERAGOS: Yeah. WALL: Yeah. Second to the last one? GERAGOS: Right. WALL: Yep, it's there. GERAGOS: Okay. Now, from there, and I think we, I think you covered this on direct, but it appears that that's an online Fresno Bee classified ad; is that right? WALL: Yes. GERAGOS: Now, the B, this says action canceled up there. What does that mean? Right here? WALL: I don't know. GERAGOS: Okay. WALL: I really don't know. GERAGOS: The, somebody does a search for boat, for ramps, Pacific, right? WALL: Okay. You know, I can probably give you an explanation for that. Typically that top header area where it says "action canceled," that's an area for ad banners typically associated with a web site. That's how they get paid, so that might be a web banner that is, GERAGOS: Didn't make it, WALL: they make allowance for it to be there, but when I print it out it's not going to show because I'm not connected to the Internet to be able to print it out. GERAGOS: Okay. It looks like here, when you enter in boat, ramps, Pacific, you get, what, eight, over eight thousand hits? WALL: Yeah, it says one of 20 of 8010 hits. GERAGOS: Okay. Now, then C looks like it refines that search; is that correct? And this one was at 8:00 o'clock is that right? 12/8/02? WALL: Yeah. The previous one said boat, ramps, Pacific. GERAGOS: Uh-huh. WALL: This one says boat, ramps, Watsonville. So it narrowed the number of searches to the area specifically to Watsonville, and there's only 87. GERAGOS: Okay. The next one would have been D. Looks like somebody does a, goes to a site that says FishersNet Fishin' Maps? WALL: Yes. GERAGOS: Okay. Do you know if that FishersNet Fishin' Maps on C appears to be number 18 right there? Does that line up. I'm putting the top of, WALL: Yeah. I, GERAGOS: D with number 18 from C. WALL: It's possible that that is what it is. Without being authenticated. It's very reasonable that that's the hyperlink to this web page. GERAGOS: Right. That somebody went on the search, saw the Fisher, FishersNet Fishin' Maps, came out onto this and got this Northern Region of fishing maps, correct? WALL: Yes. Because if I'm not mistaken, this is quite a few pages in printout form. GERAGOS: Yeah, it looks like 34 pages. So, WALL: It shows a lot of, a lot of different areas within that web site. GERAGOS: Right. WALL: Yeah, it shows local lakes. GERAGOS: Okay. Now, the next that comes up is after D, E, looks like, now, using that same premise that we had before for C, boat, ramps, Watsonville, and this was C, and then assuming that somebody went from C and number 18 to FishersNet Fishin' Maps, then if they press and went back to a search results, and they then pull the boat, ramps, Watsonville, Pacific, that would give them a more refined search; is that correct? WALL: Well, that, what time is on that one? GERAGOS: This one is 8:02:48. WALL: Yeah. So basically what this one would mean is ne 21 that the user entered in, you know, those specific key words, or added them to the list boat, ramps, Watsonville, and added Pacific. GERAGOS: And by doing that, WALL: You get different results. GERAGOS: Right. WALL: Some of them may be the same. GERAGOS: Right. But it refines it. Instead of having 87 results, we now have got 41 results, even though the first 20, for all you know, they could be all overlapped, could be a portion, whatever? WALL: Exactly. GERAGOS: Okay. Then from E, the next one that's pulled out is F. And F looks like somebody has now added a search, another search word, which is ocean, correct? WALL: That's correct. GERAGOS: Okay. And then, once again, now we've refined the search from 87 to 41 to 31, correct? WALL: That's correct. GERAGOS: Okay. And that's a reasonable explanation of what's going on here? WALL: Yes. GERAGOS: Now, the, is G the next because there's a substantial amount of time. It looks like 8:02:56, and I've got G as 8:04. Can you take a look and tell me if 8:04:16? WALL: Okay. Was 802, 8:02 and how many seconds? GERAGOS: 8:02:56 is F? WALL: Okay. And then the next? GERAGOS: The next one I've got is 8:04:16. WALL: No, there's some other web pages that were accessed during that time. GERAGOS: Okay. Now, the... WALL: (Inaudible) GERAGOS: Another commercial fishing site? WALL: Yes. GERAGOS: What's the next one? WALL: They (inaudible) htm. REPORTER: I'm sorry, I can't WALL: They will have an htm. JUDGE: Mr. Geragos, you're having a tete-a-tete. The court reporter can't hear it. GERAGOS: Yeah. He said they would have an htm. REPORTER: Thank you. GERAGOS: You're welcome. WALL: Next one is Antioch Dunes National Wildlife Reserve. GERAGOS: Is that the one at 8:04:16? WALL: Yes. GERAGOS: Now, I'm putting that up here. This is it right here? WALL: Yes. GERAGOS: Okay. Now, at the top it's got a header which says California, right? And it appears to me, at least, WALL: It says map of California on the top left. Is that what you were referring to? GERAGOS: No, the header right here. Looks like, I'm looking at the search results from 12/8 at 8:02, and then I'm comparing it with what's here. Does it look like that's a reasonable explanation is that somebody's hit the hyperlink to go from this to this? WALL: No. I don't think so. Because there's no reference on this number four hyperlink. There's no reference in this number four hyperlink here that refers to the National Wildlife Reserve, the Antioch Dunes. So I couldn't say that this number four. GERAGOS: Is necessarily, WALL: pertained to this. GERAGOS: That these two are related? WALL: No, I couldn't say that. Some of them have a pretty clear indication. Four miles west of Watsonville on San Andreas Road, and then, GERAGOS: I'm sorry, I didn't mean to cut you off. WALL: That's all right. And then this next one, where it says map of California right here, this is, this site that you're trying to center up was the Antioch Dunes National Wildlife Reserve site. GERAGOS: Okay. So, as far as you know, this and this, you can't say, as you sit here, are related? WALL: No. I can't. GERAGOS: Okay. WALL: No, I couldn't. GERAGOS: And the next one that pops up I've got, or what you pulled up is H, which is, looks like at 8:06:06; is that right? Now, I don't, I hate to do this to you, but I assume you've got to go back to, WALL: That's all right. I don't mind. GERAGOS: go back to the computer. WALL: 8:06. GERAGOS: 8:06:06. WALL: eBay auction. GERAGOS: Okay. Now, this eBay auction is for, up here where it says items matching dragon shirt, what does that mean? Do you know? WALL: Uh, yes. These are the search results. A search request was made for a dragon shirt, which is indicated here, a basic search was conducted, and eBay returns a list of any auctions that they have that have the word dragon shirt in them. GERAGOS: Okay. And then is there any, all of these that are listed, I guess, on all the pages, there's four pages total? WALL: Yes. That's what it indicates at the top. GERAGOS: Okay. WALL: Four printed pages. GERAGOS: Okay. Now, the next item that's marked after H is I, which also, this one says items matching embroidered shirt. Does this mean there was a different search on eBay? WALL: Yeah. Yes. Because, I'm looking for the part where it says embroidered. GERAGOS: Right there. WALL: Right there. Embroidered shirt was entered, and it gave the results of, the search for any of the eBay auction that had embroidered shirts in them. GERAGOS: Okay. This is a five page list. It just shows somebody who is looking to buy, go on eBay and make some type of, possibly make some type of a purchase? WALL: And we discussed this previously, where I only know this because I see these in the analysis that I conduct, because I'm not a eBay user. GERAGOS: Okay. Now, the, did you find any, how did he get from the search results for the boats and ramps over to eBay? WALL: How did he? GERAGOS: On the computer? I mean were you able to detect how that happened? WALL: All you have to do is open another Internet Explorer browser and ask it what you want to search for. You could pull up eBay, or whatever you want to do, and ask for that specific search. GERAGOS: Okay. The next that you have got is J, which looks to be at 8:07:32; is that right? That's another eBay Asian embroidered, looks like the "shirt" was cut off; is that right? WALL: Yes. GERAGOS: Okay. So the, I guess the two terms that had previously been searched had been combined at this point? You had the dragon shirt and embroidered shirt, and now somebody's gone and put Asian embroidered shirt on there? WALL: Yeah. That would have been a specific search request separate from the other two. GERAGOS: Okay. Then after that, the next, the next search is a San Francisco Bay Area Fishing? Is that right? WALL: What, what is the time, because there are other searches that are done on eBay. GERAGOS: Okay. WALL: But may not necessarily, GERAGOS: This time is 8:11:22? WALL: Okay. 8:11:22. That's where I'm at. GERAGOS: Okay. That's for San Francisco Bay Area Fishing? WALL: Well, what I show is a date of 12/5/2002. It says Coyote Reservoir. GERAGOS: Okay. Do you have where that up here where it says San Francisco Bay Area Fishing? WALL: Yeah it says ICHTHY dot com, San Francisco Bay Area Fishing at the top. GERAGOS: Okay. That was one of these within five minutes of the Embroidered shirt on eBay? WALL: You still have that Asian embroidered shirt? GERAGOS: Yeah. Yeah. The Asian embroidered shirt is J at 8:07, looks like I skipped K. K comes in at 8:07:56. It says dress embroidered shirt. That's also an eBay category? WALL: Yes, it is. GERAGOS: And after that we've got L, where we go up to whatever site this is which includes San Francisco Bay Area Fishing, correct? WALL: Yes. GERAGOS: Now, as they go into that, the, is there a search that's done before this pops up and after eBay? Can you tell me that? A search request like in Yahoo that we saw before? I'll tell you what I'm asking, too. If it speeds things along. On O, marked as O, it looks like that, even though the time is afterwards. WALL: Yeah. 8:15:52 a.m. GERAGOS: Yeah. Here you've got, WALL: You want to put that up there? GERAGOS: 8:11:22. And if you take a look, it looks like the number one search result at 8:15 is what the search was, what shows here as the search of, see what I'm talking about, number one? WALL: Yes. GERAGOS: It's I-C-H-T-H-Y dot com, San Francisco Bay Area Fishing. And that's the header on this search, except what's throwing me off a little bit here is that this one at 8:11, I mean this search at 8:15, is it possible, let me give you a possible explanation. Is it possible that this search here was done prior to accessing this? That whoever did the search hit that, however you want to pronounce it ICHTHY dot com, goes to this, and then goes back here and when, going back to here that the time comes out differently, or is saved differently? WALL: No. Let's, let's pull these times back up so we can see them and match the search with this web page. GERAGOS: Okay. I've got, like that? WALL: This is the search. And it's at 8:15:52, and this is 8:11. So just because it's on that, ICHTHY is on this web page, doesn't mean that this one was activated by this. GERAGOS: It would be an awful coincidence, though, wouldn't it, that four minutes later you do a search and the number one search result comes back as the same web site? WALL: No, not necessarily, because this is based on the number of times that it's been accessed, is how it's going to rank. And, and it could have came from a variety of different places. GERAGOS: Okay. Now, the, could that have come from the previous search for fishing? On the computer? Did you notice, or did you look on the computer for a previous search for fishing? WALL: I can. That, the one that we're talking about, the ICHTHY, is -- GERAGOS: Right? WALL: at 8:11? GERAGOS: Yes. That's at 8:11:22. WALL: There was a search done at 8:02:48, another one that was done at 8:02:56. I would have to check each one of the hyperlinks to see if there was any, GERAGOS: What was, what was the search term, search terms at 8:02? WALL: At 8:02:56 the terms were boat, ramps, Watsonville, Pacific, Ocean. GERAGOS: Okay. And then the other one, that was right after that? WALL: Boat, ramps, Watsonville, Pacific. GERAGOS: Okay. Was there a, did something come back at BoatUS dot com for one of those searches, which is marked as N? WALL: I'd have to look it over. GERAGOS: Want to take a look at that? WALL: I didn't see anything on either of those two previous searches. GERAGOS: Now, the next one, which I just showed you, which was N, is for boat, trailer; is that right? Do you have that up there? WALL: Yes, I have that in my hand. Trailering...San Francisco Bay. GERAGOS: That's at what time? WALL: 8:13:48. GERAGOS: Okay. And then, this is N, and then O is the search that we just talked about, correct? San Francisco, bay, boat, ramp? WALL: Yeah. This is the one that we have that says 8:15:52. GERAGOS: Now, the, once again, even though this one is at 8:13, when you take a look at the header here, BoatUS dot com, Trailering Club Plus! WALL: Uh-huh. GERAGOS: Do you have an explanation as to why, these appear to be the same, correct? WALL: Why is this one after this one? GERAGOS: Yes. I mean now we've got even more of a coincidence, don't we? We've got the ICHTHY dot com, which was our previous exhibit, and we've got this BoatUS dot com Trailering Club Plus!, which would be awfully coincidental for these two to pop up after the fact of the search of the San Francisco, bay, boat, ramp, wouldn't it? WALL: Well, what we're looking at here is results for this set of key words. And this web page doesn't necessarily have anything to do with whether these hyperlinks are activated to get to this web site. GERAGOS: Is there, WALL: So if, if this was the case, if someone would have clicked on from this page to this page, as we have shown in previous examples of one web page to the next, it would have fallen in sequence. Now, at any given time you could enter in a specific address from having written it down, from writing this down and doing it at a later time. There's a lot of plausible explanations as to how that you could occur. A lot of times people will document, write down the web page they want to go to, write it down on a piece of note paper, and then they will activate it by going to the actual web site. It doesn't have to go directly from the search page you are on. Now, in this case, exactly what happened, how this came out I don't know, but I do know that this web page happened at the time it was created, and that the previous page that you were showing happened at the time it was created. GERAGOS: Okay. WALL: Whether it went from that link or not GERAGOS: You don't know. WALL: I don't know. GERAGOS: Okay. WALL: Well, I, I should correct my answer. I do know, because they don't coincide time wise. GERAGOS: Okay. Unless there's some other explanation for why the time is different on the search request. If somebody, if you were to refresh the search request at 8:15, and you had previously done this search at, say, ten minutes after 8:00, would that explain why this appears to be after the fact? If you pressed refresh? WALL: That is possible, but I, without testing that theory, I couldn't say for certain. GERAGOS: Okay. Then you would go from N, we have O, then we've got P. And P looks like San Francisco Bay directions. And that's at 8:17, correct? WALL: Yes. GERAGOS: And once again, from O, we've got a number of these search requests that, viewing the San Francisco Bay, correct? You don't know whether or not somebody had gone and hit this and then received it? Looks to me like number 18, OCSC San Francisco Bay Direction, it would appear, at least, to have been the one there; is that correct? WALL: Yes. GERAGOS: Okay. Then it looks like what is marked as Q, this is Q, right? Today's Headlines: December 5th again. We've got San Francisco Bay Report and this USAfishing S.F. Bay report? WALL: Yes. GERAGOS: Okay. Looks like, once again, if you take a look at O, that on number 14, it would seem to match up there? WALL: Yes. GERAGOS: Okay. And then the, looks like the next is Central San Francisco Bay, and that's at 8, this one says, I'm sorry. Looks like we've got a new search at 8:21 and 42 seconds; is that right? Suisun Bay. WALL: If you could pull it up a little bit. 8:21:42, yes. GERAGOS: Okay. JUDGE: Mr. Geragos, I'm going to interrupt you now because I've got a, to do a few other things before we excuse you today. GERAGOS: Okay. JUDGE: Has the jury had enough for today, you think, about fishing.
August 30, 2004 GERAGOS: We were going through the exhibits in the morning, I guess, that were marked on the binder that's 179; is that your memory of where we left off? WALL: Somewhat. GERAGOS: Okay. WALL: Good morning. GERAGOS: Good morning. How are you? WALL: I'm fine, sir. GERAGOS: Good. The, I think we were up to P. You've got a time there, I think, as well. WALL: On P, yes. It's 8:17:02. GERAGOS: And that's in the morning, correct? WALL: That's correct. GERAGOS: Okay. Now, that, if we could put that up, I guess. We were almost through with this binder on Thursday. This is, got a header up on top, says San Francisco Bay, correct? WALL: Yes. GERAGOS: OCSC, and then at 8:17 a.m.? WALL: That's correct. GERAGOS: Does that appear to be also something that had come from one of those earlier exhibits that was a search? WALL: Yes, it does. GERAGOS: Okay. So if I understand correctly, somebody's got their, their cursor up on the screen, they do a Yahoosearch, and then they press one of the results and, boom, this site comes up? WALL: Yes. GERAGOS: Okay. Now, the, that's 8:17. And the, you have the next one that's right after that? WALL: Yes. 8:19:10 a.m. GERAGOS: Okay. This also has USAfishing San Francisco Bay Report, Today's Headlines, Thursday, December 5th, correct? And then that comes up 8:19? WALL: Yes. 8:19:10 a.m. On December the 8th. GERAGOS: Okay. Now, that is also one of the ones, the USAfishing site is also one of the ones that was listed in the search that we looked at on Thursday? WALL: Yes. It's part of that global web site USAfishing. GERAGOS: Okay. And that's Q. And the next that we have? WALL: 8:19:52 a.m. GERAGOS: Okay. This is marked as R. Once again, you can tell we're still, still in that same search, right, fishing search? WALL: Well, we're, we're back to, back to the OCSC. GERAGOS: Site? WALL: Site. GERAGOS: Right. So somebody could just go -- WALL: Back. GERAGOS: back. Press the little, the little green arrow that's on your computer that says "back" and takes you right back? WALL: That's one way, or the other, the other explanation could be a toggle or a mouse click to minimize one window and go back to the one that was previously loaded. GERAGOS: Okay. Given the times here, looks like somebody, appears to be fairly quick time, given the fact that you have got pictures that have to get called up as well, correct? WALL: Yes. And that may possibly explain why the shift is going on; waiting for the pages to load, look at something else, then go back to what was previously loaded. GERAGOS: Okay. The next one after R? WALL: 8:21:42 a.m. GERAGOS: Okay. Now, this is the, this is S. And then this is a Yahoosearch for this Suisun Bay map. Now, if I'm not mistaken, one of the ones that you showed to the jury earlier was that USAfishing location or web site? Do you remember that, that had the various bays? WALL: Yes. GERAGOS: Okay. WALL: Where we showed a picture of the driving directions, too? GERAGOS: Exactly. WALL: Okay. GERAGOS: Now, this is at what time, 8:21 and 42 seconds, correct? WALL: Correct. GERAGOS: Okay. And then the next exhibit right after this? WALL: The next one you handed me is 8:22:16. GERAGOS: Okay. WALL: It's a nautical chart for Suisun Bay. GERAGOS: Does this appear to be from the, from the search? WALL: Yes. Number seven may be in direct correlation to that web page. GERAGOS: Right here? WALL: Actually being loaded. Yes. GERAGOS: Okay. So if you take a look there, you see number seven is a nautical chart. And then you go here and match it up and you've got a nautical chart for Suisun Bay, correct? WALL: Yes. It was a link that would most likely be associated with that web page. GERAGOS: What's the next one? WALL: 8:23:04 a.m. This is a National Defense Reserve Fleet. GERAGOS: Okay. And this has, looks like it's a picture that's here. Would that picture have gone right in here? WALL: Yes. That's where that image is embedded is in this block, wherever the red X is indicated. GERAGOS: Okay. So it's a map which shows that area up in the San Francisco/San Pablo Bay area? WALL: Yeah. The reference is to the National Defense Reserve Fleet. GERAGOS: Okay. Does the, I guess I could ask you to sit back down. Does that appear to be all of the exhibits that were marked by the prosecution that you were asked to kind of pull up? WALL: Of the ones that you showed me, yes. GERAGOS: Okay. Now, do you show when the, by the way, this, which computer was the searches that are 179, which would have been December 8th from 7:52 until what we just saw, about 8:23, which computer was that off of? WALL: That was the designation DELL laptop home 1. GERAGOS: Okay. The, do you have the start time and end time on that particular day? WALL: I have it, but it's difficult to attain without going through a multitude of pages. It would take some time. GERAGOS: Okay. Did you ever, did anybody ever ask you to go through and determine on a particular day which computer was on and the times that it was on? WALL: On certain days I was asked to show that computer activity for those days, but to actually chronicle the times, no. GERAGOS: Okay. How about on the, were you ever asked to do it for the 24th? WALL: Yes, on the 24th. GERAGOS: Okay. WALL: There was a start time and an end time. GERAGOS: Do you have that information handy? WALL: Yes, I do. I'd have to refer to my report. GERAGOS: Okay. Sure. Tell me, I'll take a look. WALL: We're on page 14 of my narrative. GERAGOS: Okay. You don't have a Bates stamp on yours. Okay. And does that refresh your recollection as to the time? WALL: Yes, it does. GERAGOS: Okay. What was the time? WALL: The DELL laptop home computer was first accessed at 8:40 a.m. and ended at 8:45 a.m. Computer activity was also observed with the first file created with the DELL work PC at 10:30 a.m. and ended with the last file being created at 10:56 a.m. I do not have the seconds. GERAGOS: Okay. Let me start with the first. So it appears from 8:40 in the morning to 8:45 a.m.; is that, is the time that you're basing that on, is that the internal clock of the home computer? WALL: Of DELL laptop home 1. That was the recorded times that were documented from the computer. GERAGOS: Okay. Now, the, do you have the sites that were visited at that time? WALL: I have the 24th GERAGOS: Okay. WALL: on that one, yes. GERAGOS: Do you have that up? WALL: Yes. It's a Microsoft Network Site. MSN home page. GERAGOS: Okay. WALL: I also have a Yahooweb site. Do you wish me to go on? GERAGOS: Sure. What else do you have? WALL: Weather site from Yahoo! GERAGOS: Weather site? WALL: Yes. GERAGOS: It shows specifically where? WALL: No, it's, it's the start page to enter in the zip code. GERAGOS: What's the zip code? WALL: There's, there's no zip code entered on that page. GERAGOS: Okay. What's the next thing you show? WALL: There's a Yahooshopping site that was accessed where a digital weather station and a garden weather vane are listed. GERAGOS: And a digital what? Weather vane? WALL: That's correct. GERAGOS: Does it show what kind of a digital weather vane that is? WALL: I'm sorry, it says a, there's a digital weather station and a garden weather vane, and a list of prices. GERAGOS: Okay. And does it have, are you able to determine on the 23rd between 8, let's see, it's 8:40 is when it's first accessed, correct? WALL: We're on the 24th. You said the 23rd. GERAGOS: I'm sorry, the 24th. I stand corrected. The 24th, 8:40 from the DELL laptop home. And are you able to determine what, who was the user who accessed it? WALL: That's possible. GERAGOS: Okay. And the way you would do that, I assume, explain to the jury how you would do that. WALL: Yeah. What we would do is look at corresponding files that are accessed during that same period of time, such as e-mail files, because typically most people, when they would go on the Internet, they would look at e-mails, they would potentially create files, like a temporary file, or they would do specific individual web surfing. So we look at those issues in correlation with the actual times that the computer was accessed. e 5 And as we go through these files on the 24th, during the a.m. hours, it progresses through specific web pages. There's another Yahooweather page. GERAGOS: All right. And does this show where the weather is the person's looking for? WALL: Yes. This is at 8:44:16 a.m. GERAGOS: Uh-huh. WALL: And this is for San Jose Today is what it's called. GERAGOS: Okay. WALL: And it gives a five day forecast. GERAGOS: And it also gives a local forecast? WALL: Yes. Current weather conditions. The wind, the barometer, humidity, the predictions of weather pattern, whether it's going to rain or not. GERAGOS: Okay. And where is the next site that's checked? WALL: The next one goes back to a, a Yahooshopping site where two items were listed, one is a GAP pro fleece scarf, and one is a sunflower motif umbrella stand. GERAGOS: Okay. Now, the sunflower motif umbrella stand, what is that, do you have a, let's see if I can...you're not hooked up to be able to -- WALL: No. GERAGOS: project this so that the jury could see this, right? WALL: No. The 8:42:32 DELL laptop home 1, this is a temp file that was created for the Yahooshopping web site, and it lists the two items. GERAGOS: Okay. When you click on, can you click on the two items? Will that show you, WALL: No. They're not active. When I copy those files to my computer, the links are deactivated. GERAGOS: Okay. So that I understand, if I wanted to show the jury physically what it was that the person who was on the computer between 8:40 and 8:45 was looking at, if I, if I understand correct, just let me kind of follow through this, you copy the computer, the hard drive, correct? WALL: That's correct. GERAGOS: Okay. When you copy the computer hard drive, it will show the link that the person went to, but you can't access that because you've taken it kind of out of its real time? WALL: We've taken it away from its own environment, and we're accessing those files now from our view, that, that Graphical User Interface that I explained, that we are able to look at each individual file and folder from. It displays the web page, and if we are connected to the Internet, it will allow us to authenticate that web site, but it's typically something that we don't do because it's going to potentially change the image that we see. Now, in some cases we have to do that, but when we're looking at the actual document that's created, we don't want any changes to occur. So when we create the report, we do it not connected to the Internet. GERAGOS: So the, so the most that I could, you can tell the jury right now, based upon the fact that you, you imaged the computer and took it out, is that whoever accessed that computer at home at 8:40 went to a weather site, correct? WALL: That's correct. GERAGOS: Then went, WALL: For San Jose. GERAGOS: Okay. Then went to a Yahooshopping site for a fleece scarf, GAP fleece scarf? WALL: Says GAP pro fleece scarf, six dollars and ninety-nine cents. GERAGOS: Okay. WALL: And sunflower hyphen motif umbrella stand, twenty-nine dollars and ninety-nine cents. GERAGOS: Okay. And then what's the next access on the computer? WALL: A temporary file is created at 8:45:34 seconds of a e-mail in exchange from Scott Peterson and a Mr. J Shockley. GERAGOS: Okay. Now, that take place at approximately what time? WALL: That file is created at 8:45:34 on DELL laptop home 1. GERAGOS: Okay. Now, was there an access that took place before the e-mail? Somebody have to log in to the e-mail? WALL: Yes. GERAGOS: Okay. That was done after the shopping site to check the e-mail; is that correct? WALL: Yes. You would have accessed it to potentially see that for the temp file to be created. And we know it can be done in several different ways, as I testified before, through either the e-mail client or through the web version. GERAGOS: Right. When you say before, as you're describing, somebody gets on their computer, they can either go directly to their e-mail, or they can go to the Internet and then get in in that fashion? WALL: Exactly. If they were not at their own computer, they don't have to use the Outlook Express or Outlook Client, e-mail client. They can just go to the web page view. GERAGOS: Okay. Now, the, did you, were you ever asked to determine that question that I referred to a couple of minutes ago, who was the person who logged on at 8:40? WALL: No. GERAGOS: Okay. Nobody ever asked you to do that? WALL: No. GERAGOS: Now, the next thing that you did, you said it went from 8:40 to 8:45, and then the next computer that you looked at was, on the DELL work PC; is that correct? WALL: Yes. It's designated as Dell work PC 4. GERAGOS: Okay. Now, and, once again, the designation, because it's been a while since you testified on direct, the designation of DELL PC work 4 means that Mr. Stockham, during a search warrant, labeled these computers, the four computers that were seized, and connected them to the locations that they were seized from, correct? WALL: That's correct. GERAGOS: Okay. So when we talk about DELL laptop home, that was a computer that you were told, at least, is seized from the house? WALL: And by the numbering sequence, I could reasonably assume that it was the first computer that was seized. DELL laptop home 1 would be the first computer seized. GERAGOS: Okay. Now, DELL laptop work PC 4, you checked and the first file created, I know that's going to take you a minute to get over there, but that was at 10:30, correct? WALL: Yes. 10:30. GERAGOS: Okay. Now, that 10:30 file, do you have that up there so we can just lead you through it? WALL: Yes. There's some temporary files that are created that were listed, but they did not export into this report. GERAGOS: And what was, what was the reason for that? WALL: I have no idea. GERAGOS: Okay. The, I think you had mentioned before on direct that there was a time when somebody went on that computer to a, for directions or instructions for a mortiser, how to assemble a mortiser? WALL: That's correct. GERAGOS: What time was that? WALL: The first instance of that occurring there was a Yahoosearch that was conducted, and that search was conducted at 10:44:34 from the DELL work PC 4. GERAGOS: Okay. Is it, do I understand correctly that that computer is logged on, at least internally, according to the internal clock, at 10:30 and there was continuous activity that goes through until 10:56, correct? WALL: Yes. GERAGOS: Okay. And during that time, the 10:30 to the 10:56, without having you, I'm sure the jury would be very disappointed, but I'm not going to have you print out every single web site and go through every single one, but is it a fair statement that whoever is on that computer is going from web site to web site or doing searches or doing e-mails continuously throughout that 36 minutes? WALL: Yes. GERAGOS: Okay. The specific search that was done was, on this mortiser, what preceded that? WALL: Well, as I was explaining, there was a search results that was conducted for Delta machinery help. GERAGOS: Delta machinery? WALL: Yeah. Where the key words were entered, similar to the ones in the past on the Yahoosearch pages, Delta, machinery, help. GERAGOS: So if we had that up here on the screen it would show the jury, like we saw before, boat or ramp or ocean, the same thing, except it's being done with Delta, machinery, help. Somebody trying to get, you would surmise, at least, I assume, that somebody is trying to figure out or get the instructions on how to assemble the mortiser? WALL: That's very possible, yes, sir. There's one of 20 hits, and it lists different links on the search page pertaining to that search request. GERAGOS: Okay. When they, when they hit, they get to 20 hits, the same thing that we were watching before? Do we go onto one of those sites as the kind of the next sequence in order? Does that make sense to you? You get a Yahoo search page that comes up after you put in Delta, help, and machinery, then you get a list, then one of those items on the list is where they went to? WALL: Not directly. And I was looking for that because in between there there's some other web sites that are selected. GERAGOS: Okay. Do they, does the person get there or hit that mortiser instruction pamphlet, so to speak, at a certain time? WALL: There is a web site that's called News One, the web site is hit one time, and it talks about a Delta Unveils Universal Miter Saw Stand. GERAGOS: What, what time do you get to the, do you have another Delta related or mortiser related item? WALL: Well, I see a Delta logo, so it appears that that web site was reached, but there are literally hundreds of files that are created on a computer, and going through them is difficult. If you had a frame of reference that I could point to, if you already know that, that would be beneficial. GERAGOS: Well, of the 10, roughly the 10:49 to 10:50s period of time? WALL: There's a lot of files that are created even during that time. Gif images and a lot of things that are associated. For example, GERAGOS: You just called up the one, delta? WALL: Exactly. GERAGOS: The Delta site. So you printed up something sometime after 10:44, and there was at least, so far you've hit on two of these Delta sites, correct? WALL: Right. And there are specific gif images that are links that are copied out to the computer. GERAGOS: When you say gif images, it looks like they were pictures, pictures that were loaded on a screen? WALL: Yes. A lot of times the gif image on a web site is the little button that says "go to" or "home" or "e-mail," so people are pretty familiar with those on a web site. And some web sites have quite a few of those, and they all load onto a person's computer. GERAGOS: Okay. Now, this, and to make sure that we've got this correctly, whoever is on this computer is on this computer continuously and virtually non stop from 10:30 to 10:56, correct? WALL: Well, files are being created non stop, but that doesn't mean that the user is doing something non stop. GERAGOS: Is there any, what's the most time that somebody could be away from that computer during that period of time? WALL: There's no way to tell. You can load a page and walk away from it very easily. So if you looked at, let's say, for example, a sequence, if you went from, when one htm document, a web page, known as, has a file extension of htm, if you went from that one document and it loaded and looked at all the files between there, that would be the gif images or jpg images, or the document that is actually created as a part of that web page, and then go to the very next web page in succession, you could then get an idea of the times from one HTML document to the other. That would be one web page time created to the next web page. In between you're going to have an enormous amount of files, depending on how many images are associated with that web site. GERAGOS: Now, specifically the, in this case you had a, I won't exaggerate it, but there are a number of web sites that are visited between 10:30 and 10:56; is that correct? WALL: There there's a number of files that are created during that time. As far as web pages, I haven't counted the actual number of web pages that were visited. GERAGOS: Okay. Does it look to you like somebody was continuously on that computer between those, for that 26 minute period of time? WALL: I can't tell if they're sitting behind the keyboard continuously during that period of time, no. GERAGOS: Okay. Nobody ever asked you, I take it, to go through and chronicle what time a certain web page is hit, what time the next web page is hit so you can do that? WALL: No. To specifically analyze a time line or a time frame, no. GERAGOS: Now, the, specifically some of the things that you were asked to do is to do some searches on the computer; is that correct? WALL: That's correct. GERAGOS: Okay. One of the searches you were asked to do, and this was, this was some time in September, the district attorney's office made a request that you do a search? WALL: Yes. GERAGOS: And that was, they gave you three words and asked you to search through, seeing if you can find those key words? WALL: Yes. JUDGE: September 2003? GERAGOS: Excuse me? JUDGE: September 2003? GERAGOS: September 2nd of 2003. GERAGOS: Correct? WALL: That's correct. GERAGOS: Okay. And they specifically asked you to search for divorce, for silencer and for shooting, correct? WALL: That's correct. GERAGOS: And in reviewing those key words, you had a method by which you did it, correct? WALL: That's correct. GERAGOS: And when I search something I just put control F, but I suppose you've got some more sophisticated way to do it? WALL: It's a little different, yes. GERAGOS: Okay. And you searched and you didn't find anything of any significance under either divorce, shooting or silencer, correct? WALL: No, I did not. GERAGOS: Okay. Now, the, specifically on this computer that was back at the house, the one that we called DELL laptop 1, do you know what the operating system was that it was running? Do you know if it was a Windows 98 or Windows ME? WALL: All of these computers were a Windows 98 operating system. GERAGOS: Okay. And generally the Windows 98 system that you're familiar with, is that, I guess the more recent operating systems you can differentiate between users that log on, correct? WALL: That's correct. GERAGOS: Okay. With Windows 98 you don't have that capability, you'd have to do what you, you, the analysis that you went through to the jury before, correct? WALL: The capability is there, but it's not generally used by most people. GERAGOS: Okay. WALL: You have the option to select your personalized desktop settings and to log on and to secure those with a password, but generally that's not done during that time frame of those, the Windows operating system. GERAGOS: To make that a little bit concrete, if I could, that means that as opposed to, if I had my laptop here, or sitting back at the hotel, and I was logging on under the current system, operating system, I've got to log in where I log in myself. If I had Mr. Naljian log in, he logs in on his own? WALL: That's correct. GERAGOS: Back on the Windows 98 system, two people, both he and I, would normally, the way we would use this is both people would share the computer and you wouldn't have to log on separately, correct? WALL: That's correct. It's not, it was not a requirement to log on separately like it is with the Windows XP operating system now. GERAGOS: Okay. And that's one, and so if I understand correctly, what you've, what you were saying earlier when I asked you to figure out who was the person who maybe logged on at 8:40, I mean, we show an e-mail by Scott at 8:45, but to find out who it was who logged on and looked at the weather and looked at the sunflower item and looked at the, the other, fleece scarf, you would have to analyze certain things that were done on that day, correct? WALL: That's correct. GERAGOS: And compare them historically with that user to try to differentiate between Laci and Scott, correct? WALL: That's correct. GERAGOS: Okay. And I assume that there's computer trails of some kind that you would use in order to do that, correct? WALL: If it's requested, yes. GERAGOS: Okay. And the, that was never requested in this case, if I'm correct? WALL: That's correct. GERAGOS: Okay. The computer trails that you would go to look at that would give you kinds of signposts or indications whether or not it was Laci who signed on or whether it was Scott would be what? Give me some examples of what you would do. WALL: What I would do? GERAGOS: What you would do in order to try to determine that or to make a comparison? WALL: Yes. Like I mentioned earlier, we would look at e-mails that were accessed during that time frame, different web surfing habits. We would, there would just be a variety of files created by an individual user. So there's a lot of different variables that we would potentially look at. GERAGOS: Okay. And then what you would do is compare, if I understand you correctly, you would compare the usage, if somebody goes to weather, you go back and take a look, did Laci do that in the past, correct? WALL: That's correct. How many instances were there in the past where, say, for example, the weather of the South Bay, San Jose area was checked. GERAGOS: Okay. You could also compare, I suppose, the times that the computer is accessed to see if there's a pattern first thing in the morning, or somebody gets up before they go for a walk, they want to check the weather? WALL: That's correct. GERAGOS: You could compare and see if this particular person, if it's Laci, had actually accessed a GAP web site before, they actually made a purchase, correct? WALL: That's correct. GERAGOS: Okay. Now, the, but none of that was done in this case, as far as you know? You weren't asked to do it? WALL: A specific time line, no. GERAGOS: Okay. Now, you were specifically asked to look at some folders; is that correct? Some e-mail folders? WALL: Yes. GERAGOS: Okay. You were also, if I understand correctly, did you do this, let's see. There was a, if I understand, you got these four computers, or the images, and then nobody gave you any specific data pertaining to the internal clock settings, correct? WALL: No. GERAGOS: Okay. And then I guess you used this formula, what you called this EnCase forensic software, on the 27th; is that correct? Or somebody did it on the 27th? WALL: Yes. GERAGOS: And then you say that there were no acquisition, hash values were present in the analysis report. What does that mean? WALL: Basically when, when a acquisition of a hard drive is done, that's the actual copying, it's the bitstreamed image, when that is made, the user who is creating that bitstream image, has the ability of creating a hash file. And, GERAGOS: Let me stop you one second. You say they have ability to create a hash file. What does that mean? WALL: Okay. The hash in this regard is a M D 5. It's a mathematical algorithm that basically determines that one file is identical to the other. And that can be done across this system where it will compare the hash value of the original hard drive and that of the image that's acquired, the image files, to be able to verify those. It's a process that takes more time, and it was conducted by Officer Stockham and he chose not to select that. GERAGOS: Okay. By not doing that, what is the, there's a down side, correct? WALL: No, not really, because there's, GERAGOS: Why would you do it, I guess is a better question? WALL: There's many checks and balances that occur when conducting a bitstream image. There's one that's automatically done by the software called the cyclical redundancy checksum, and I could no more spell that for you, I'm sorry. But, GERAGOS: Or say it five times fast? WALL: Exactly. That process creates a check of the system that's being copied, and in that process, it's like one in four billion, that there's a potential problem. And in this case there were no problems that were reported when creating that image file, set of image files. GERAGOS: Okay. So as far as you know there's, there's no real significance to the fact that they, that that was not done? WALL: None whatsoever. There were no errors reported when copying those files. GERAGOS: Okay. You were then asked to do a key word search at some point, keyword, looks like sometime within the week of getting this, the images; is that correct? You were asked to do some keyword searches? WALL: That's correct. GERAGOS: Okay. One of them was for the keyword LaciBiscuit L-A-C-I-B-I-S-C-U-I-T? WALL: I'll have to refer to my report. GERAGOS: I'm looking at, on your report, page seven. I've got it on, bates stamped, but I don't think yours is Bates stamped. But it's at the top of the page. Does that, is that a keyword search that was done? WALL: Yes, it was. GERAGOS: Okay. Now, the information that was, I guess this term, LaciBiscuit, was a name that appeared in e-mail correspondence between Scott and Laci, correct? WALL: That's correct. GERAGOS: Okay. Now, as you were explaining to the jury before, the e-mail correspondence that took place between Scott and Laci was on a Yahoo Web based system, correct? WALL: Yes. GERAGOS: Okay. And it was also that, this LaciBiscuit was also a keyword that was used as the password; is that, do I understand that correctly? That term was the password for accessing? WALL: Yes. There was a password that appeared to be associated with a user name of B-I-C-U-I-T-L-O-V-E-R, and that was for access to a Travelocity account registered under the name of Scott Peterson. GERAGOS: Okay. Now, the, the e-mails that went back and forth between Scott and Laci, did, were, was one of your tasks to extract those e-mails from the computer? WALL: Yes, it was. GERAGOS: Okay. And did you do that? WALL: Yes. GERAGOS: And did you file, did you compile any kind of a report about the e-mails that went back and forth between e 6 them? WALL: Not an individual analysis of each one, but they were copied. GERAGOS: Okay. And then saved, correct? WALL: Correct. GERAGOS: Okay. Nobody asked you to do any kind of an analysis, that you're aware of, that documented times, for instance, between the two, between the two users, between Scott and Laci? WALL: No. Typically, in a computer analysis, I extract the evidence for the investigators to review, for them to determine what is relevant in their investigation. I don't necessarily get involved in the individual analysis or the, of the importance of those documents that we locate. GERAGOS: Okay. And in this case, who was the investigator that you were dealing with? WALL: I was dealing with, directly as a liaison was Detective Mike Hermosa. GERAGOS: Okay. And Detective Hermosa was the one who was supplying you with these keywords to search for and asking you to take a look at these various tasks? WALL: Yes. For the most part. GERAGOS: Okay. Now, the e-mail folders that you looked at, did you search or were you ever asked to search to look through the e-mails that were sent by Laci Peterson? WALL: What I did was just extract all that I could find on those computers and save them to the report disk. GERAGOS: Okay. Now, you, it appears that one of the other things that you did was take a look on the computer for items that were being sold; is that correct? On eBay? WALL: That's correct. GERAGOS: Now, the, it's, and you actually found some items that were placed on eBay looks like on December 21st; is that right? WALL: If that's what you're telling me, yes. GERAGOS: Okay. I'm looking at page 11 of your report. If you want to take a look. WALL: Okay. I'm there. GERAGOS: Okay. Is that, did I state that accurately, that these were, these were items that were placed on eBay on the 21st? WALL: Yes. This is an e-mail that was sent out of a daily status, I believe is what it is. Or not necessarily an e-mail, but where you can access the web site, and it gives you a daily status in a web format of what you have for sale. There's even so much as you can check on what you're looking for, what you are wanting to bid on. GERAGOS: It shows, shows what the bids are, what current things are, things of that nature? WALL: That's correct. GERAGOS: Okay. Did you ever compare the eBay times with the internal clock times on the computer? WALL: No. I was informed by Officer Stockham that the times, in his opinion, were correct, that were associated with the computer in correlation to real time. GERAGOS: Okay. Have you looked at, and you understand that the eBay times, they generally try to keep track of those because it's an auction site, correct? WALL: That's correct. GERAGOS: Okay. Wouldn't one way to determine whether the internal clock on these computers is accurate is to compare what the internal clock reading was and compare it to the eBay time? WALL: No, that would not be a way that we do it. Typically we would check the computer's internal clock with the United States Naval Observatory master clock at the time that the acquisition was made. GERAGOS: And the, nobody in this case, as far as you know, compared the eBay times with the internal clock times that were showing, correct? WALL: No one, no, I did not do that. GERAGOS: Okay. Now, there was also a, another number of names that were given or words that were given by Adam Christiansen to you; is that correct? WALL: That's correct. GERAGOS: And you understood that these keywords were obtained from a Detective Buehler of the Modesto PD? WALL: That's correct. GERAGOS: Okay. And the keywords were McKenzie; is that right? WALL: If you tell me what page you're on. GERAGOS: Page 13. WALL: I'm there. GERAGOS: Okay. Gave you eight specific keywords to search for, correct? WALL: That's correct. GERAGOS: Mckennnzie, earthlink, pavelek, Campbell, pdcoze, @aol.com, OffShore, dvdbohanan; is that right? WALL: That's correct. GERAGOS: Okay. And they resulted in a number of keywords appearing, correct? WALL: That's correct. GERAGOS: However, in reviewing them no significant information was observed, right? WALL: I did not see any, no. GERAGOS: And then in reviewing this, did you determine on the 23rd, we've gone through the 24th, the two computers that were used, right? You also determined on the 23rd that two, only two of the four computers were accessed; is that right? WALL: That's correct. GERAGOS: Okay. The activity on the 23rd shows that the DELL work top (sic) PC 4 started at about 9:27 a.m. WALL: Yeah. The DELL work PC 4 was 9:27 a.m., that's correct. GERAGOS: Okay. And then you said it went from 9:27 to 9:42; is that correct? WALL: That's correct. GERAGOS: Then it appeared there was about a two hour break? WALL: Yes. GERAGOS: And then computer usage started up again at 11:46, right? WALL: 11:46 a.m. that's correct. GERAGOS: And went through 1:28 p.m.? WALL: That's correct. GERAGOS: Okay. Now, the files that were accessed on December 8th, the ones that we went through ad nauseam here on Thursday, those were all accessed on the DELL laptop home? WALL: DELL laptop home 1. GERAGOS: Home 1. So that would be both the morning files and the evening files were all done at home? WALL: They were done on the DELL laptop home 1 computer, which is a laptop. GERAGOS: That was found at the house? WALL: That's correct. GERAGOS: Okay. And the, on the 23rd, the computer that is marked as the DELL work PC 4, 9:27 to 9:42, two hour break, then 11:46 to 1:28, correct? WALL: That's correct. GERAGOS: Okay. Now, the computer that was marked as DELL laptop home, did you check that on the 22nd of December or the 20th of December to see if it was accessed? WALL: I copied out files at the request of the investigators for December the 20th, but not December 22nd. GERAGOS: Okay. Did you prepare a report as to the 20th? I didn't see it. WALL: Of the files that were created? GERAGOS: Of the files that were created. WALL: No. GERAGOS: Okay. Could I ask you to go to the 20th and tell me what time, this is on the DELL laptop home, correct? WALL: No. DELL work PC 4 started at 6:58:44 a.m. That's on December 20th. GERAGOS: 20th. Do you have anything on the home computer on the 20th? WALL: No. All I have is Dell work PC 4 for that day. GERAGOS: Okay. Going forward, 21st or 22nd, anything for DELL laptop home? WALL: 21st? GERAGOS: Yes. WALL: Yes. There's files there for DELL laptop home 1. GERAGOS: Okay. What time is that accessed? WALL: 8:31:18 on the 21st. GERAGOS: 8:31:18. And what time is it off? WALL: The last file was created 11 and 16 seconds. 11:00 a.m., 16 seconds. That's December 21st. GERAGOS: That's December 21st, correct. The 22nd? WALL: No record of the 22nd. GERAGOS: You have no record because you weren't asked to do it? Or no record because you didn't find anything? WALL: No record because I wasn't asked to do, copy the files out for that day. GERAGOS: Okay. The other, would you also, sorry to jump around. I just forgot one thing. I mean the data that you accessed or looked at for the activity that was taking place between 10:30 and 10:56 on the DELL work 4 computer? WALL: And what day are we on? GERAGOS: December 24th. WALL: December 24th. From the December work PC 4. GERAGOS: DELL work PC 4. Did you, did you prepare a report as to what you found during that 26 minutes? WALL: No, I just exported all the files for review by the investigators. GERAGOS: Okay. Thank you. I have no further questions at this time.
Redirect Examination by David Harris HARRIS: Detective Wall, I'm going to go back and, and start with some of the first questions that you were asked and try and cover that. You were being asked about times on the web sites and being close together, and you've been saying something about having multiple windows open. What do you mean by that? WALL: Basically when, and most people are familiar with this, and you may be as well yourselves, when you are using the Internet, it's very common for one window to be open and start your search, but as you progress through you notice that multiple windows may open on their own from selecting specific web sites, through a search or by whatever process that is taken. The next thing that can happen is the user can individually open as many windows as they want and be able to toggle back and forth. I commonly do it with an alt tab and toggle to, an alt tab keystroke, that is, and toggle through an individual web page that I happen to be previously viewing, or however it lines up. So it's very common for people who do web-based Internet research to switch from one web page to another, and it can be done simply by an alt tab toggling effect keystroke, or you can select the minus bar up at the top right hand corner of that browser, minimize it down to the tool bar at the bottom, and see what was there previously. Another method would be to drag your cursor down to the tool bar, and then move from one web page that's open, along your tool bar, to another. HARRIS: Now, when you were, I guess using a term that I'm aware of, when you hopped between those two, kind of skipped between one and the other, is that a way that you can load more at one time and be looking at the other page while the other is loading? WALL: That's especially a common practice on slow Internet connections. Even sometimes with the faster connection, if you're asking your computer to do a lot of things at once, it may slow the process down. So you can be reading one page while others, or multiple pages, are loading. HARRIS: Now, if you're doing this process, where you've got multiple windows open, can you really tell how long a person is looking at a particular web site, or whether they're even looking at a particular web site, if you're just going by the times of the files being created? WALL: No, not really. HARRIS: Now, when you're talking about a particular file, is there a way that you can tell that they've actually had an interaction with that particular page? WALL: Sometimes there is. If the page is stored or saved, you can bookmark a favorite web page and it would allow you to access that at a later time, or you could print it out and look at the printed version of it. HARRIS: Now, the person, if there's something on a page, such as you've been describing, these hyperlinks or something that they could zoom in on, would that be another way to tell if the person actually interacted with that particular page? WALL: Yes, it would. HARRIS: How is it that you can tell? WALL: Well, one of the issues, specifically in this case on December the 8th, that US Geological Survey site that showed the current velocity map, it may take a while for that page to load. And in this case it was most likely loading and another web page in time sequence was looked at. So the potential for having multiple windows open is a reasonable explanation. At that point we know that that same US Geological Survey site with the current velocity map on it was revisited, because from that web site a zoom had occurred, and that zoom was recorded in that process. So the user placed the cursor over a specific area of that current velocity map, clicked, did a left mouse click, and then the zoom web page appeared, which is a separate web page which was then logged on the computer with its own separate image. HARRIS: Now, you've shown us some examples and talked about some examples of these individual search pages. If you want to go to a particular web site or want to find something, how does this process work? How do you actually find something on the Internet? WALL: The method by which most people use, and I myself use most frequently, is go to a web search engine, like Yahoo or Google, and simply enter the name or the key words that you're wanting to do the research, enter that into the computer, and then look at the corresponding results that return to you on that web site. Similar to those that were listed in the Yahoo searches, where there's multiple web links that are listed on the search results page. HARRIS: Now, you're being asked about some of these web sites, and I want to just take a moment to, to cover this. Now, you were talking, let me back up for a second. You were saying something about a zoom occurring. And I'm looking at 183B. Is this the particular chart that we're talking about, you were saying the Bay currents? WALL: Yes, it is. If I could approach the projector and take a closer look at it. HARRIS: Sure. WALL: I could make a clarification. This is a replica of it, because, as you can see, this is one that was authenticated, with this actual image being created on June 26, 2004. So it's not the actual image that was observed. HARRIS: All right. So then let's go to 189A. So when we're talking about these particular items, what we're seeing here is this is what you recovered from the computer in 189A? WALL: That's correct. HARRIS: And then you went to the web site, and as you described it, the term you used is that you authenticated this? WALL: That's correct. HARRIS: So this is what the actual web site looks like? WALL: Yes, it does. HARRIS: So if you were sitting at the computer, looking at the screen, this is the image that you would see? WALL: That's correct. HARRIS: But what's stored or saved on your computer is this particular information? WALL: That's correct. And that is because the documents get separated from the images. They're two separate files. HARRIS: Now, to go through this as well, we had another example of an actual document that was recovered, and this was defendant's GGGG, 4G, and you were shown that particular document? WALL: Yes, I was. Mr. Geragos showed me that one. HARRIS: Now, when you did your search through the computer, again one moment to find it, I want to show you 179Q. And this is a document that you recovered as part of your search? WALL: Yes, it is. HARRIS: Now, these two particular documents, comparing 179Q and Defendant's 4G, are these the same documents? WALL: If you could place the other one up there again. Yes. And the reason why they, they appear similar is because the Today's Headlines, Thursday, December 5th, 2002, is identical. HARRIS: Now, we can see when we look at 179Q that there's these boxes, as you've described before, with the little red Xs in it? WALL: Yes. These here. HARRIS: And you described for us before when you're pulling up a file, recovering it as part of your forensic analysis, is every document that comes up or every file that comes up use htm or HTML documents? WALL: Not every file, no. The web page is associated with an htm or HTML file extension. That lets us know it is a web page. Other files that are created would be the image files, which are separate from the htm file, and they're logged as separate files, and, as a result, are separated into different areas or different folders under the browser. In this case Internet Explorer browser. HARRIS: Okay. So when Mr. Geragos was asking you in these books, 179, I believe the other one is 180, looking at the a.m. work on December 8th and the p.m. work on December 8th, he was asking you if there were a number of files that were skipped and not included in this, these particular exhibits. The files that were skipped, they include these gifs that are not seen here in these little boxes? WALL: That's correct. Files such as this. HARRIS: And if we compare that to this particular, which is 4, 4 G, we see what those particular gifs or those little graphics files are? WALL: Yes. And those are resident on the computer. HARRIS: So when you say they're resident on the computer, what does that mean? WALL: Those are files, each of those images are files that are on the computer during that same date range. We just didn't print every one of them out. HARRIS: Now, when you, going back to 179Q, you've written, and again we covered this as part of your direct, but just so that it's clear, when Mr. Geragos was asking you about the two different binders and asking you the dates and times, each, each of those documents has an a.m. or a p.m. next to it? WALL: That's correct. Down here, and it's a designation of when they were created on the computer. HARRIS: All right. So looking at this particular document that's up on the screen now, 179Q, that is at 12/8, 8:19 and ten seconds in the morning? WALL: That's correct. HARRIS: Now, when we look at the document that was found as part of the search warrant, this has that December 9th, 2002 print date? WALL: That's correct. HARRIS: And you've told us about how that works, that it works, when it's printed, it takes the printer's time. Can you explain for us the difference between the time on the computer and how this has this other time? WALL: Well -- GERAGOS: Objection. Vague. JUDGE: No, I think he can answer. Go ahead. WALL: This time is the time stamp that's, or date stamp that's associated with the operating system at the time that the printer request is made to print this document. I think is what, what you were looking for. I may not have totally understood your question. GERAGOS: That's why I objected as vague. JUDGE: Very perceptive. You want to rephrase it, because he doesn't get it. I thought he understood it, but I guess he didn't. Go ahead. HARRIS: I'll do my best. HARRIS: Just to go back through that, you're talking about the 12/9 date. That is a date that comes from the computer's operating system? WALL: That's correct. That printed this document. HARRIS: And if this document, we've seen the previous document, the 179Q, that's created on the computer at the 12/8 time that we're talking about, that will, if it's printed right then and there because that's the time of the computer, this could not have been printed at that particular time, could it? WALL: That, no. No. HARRIS: So some, some way this particular document was, how did this document get there then? WALL: Well, in checking the time of Thursday, December the 5th, and knowing when we located that document, and then checking it with this date, the only conclusion one can come to is that this file had to be saved. This web site had to be saved to be printed at a later time, because it corresponds with the document that was created on DELL laptop home 1 on December the 8th at 8:19 and whatever seconds it was. HARRIS: And is there, was there another time during those two particular binders, 179 and 180, where the person that was on the Internet went back to this particular site? WALL: Yes, there was. HARRIS: And what happened when the person went back to that site in the later point in time? WALL: Of course, a new date and time stamp occurs for that file's creation time to show us when it was actually created on the computer. But more importantly, this Today's Headlines we know is changed to December the 8th, indicating that from the time that the original was viewed, the web master, whoever is responsible for the content, updated the web site and changed the date to reflect the current date. HARRIS: So somewhere in the computer, whoever was doing this was saving some information? WALL: That's correct. HARRIS: I want to go to the next area, show you 186. Want you to take a look at this. We may have to resume your seat to look at your report. I believe it's page twelve of your report. WALL: No, it's not twelve. JUDGE: Is this the Peterson/Shockley e-mail he is referring to now? GERAGOS: What's your Bates stamp. HARRIS: 37072. GERAGOS: Thanks. HARRIS: I'll help you out. I'll show you my copy. Now, you were being asked about the 24th, and about the access of the computers on the 24th? WALL: Yes. HARRIS: And you were saying that it was approximately from 8:40 to 8:45 that the DELL laptop home 1 was being used? WALL: That's correct. HARRIS: And the last item on there that you talked about was this previous exhibit that's been marked as 186? WALL: Yes. HARRIS: And this was an e-mail that was accessed by the defendant? WALL: That's correct. HARRIS: I want to go through the process of this. What was the defendant's e-mail address? WALL: It was S-L-P-E-T-E-1 at M-S-N dot com, I believe. HARRIS: And what is MSN dot com? WALL: MSN is the Microsoft Network. Operates, they're an e-mail server system, and it's very similar and I believe a companion to Hotmail. HARRIS: Do you have to sign up or create an account with that particular dot com to use their facilities? WALL: Yes, you do. HARRIS: So when you sign up and do that, do you have to create a user name and a password? WALL: Yes. HARRIS: So for you to use that MSN e-mail address, you have to log into it before you use it? WALL: That's correct. HARRIS: And when you were looking at this, you were describing for us one of the first pages that was looked at on the 24th was an MSN page? WALL: That's correct. HARRIS: Now, prior to that e-mail, was there a login right before that e-mail? WALL: For security purposes, the login doesn't always show. So that residual content could not be, let's say, hacked from a computer. So the login isn't going to necessarily show what, the user name. HARRIS: But for you to get to that particular place, you'd have to go to the MSN web site for you to access it? WALL: That's correct. HARRIS: And when is, at what time is that MSN accessed on the 24th? WALL: There's a access to a reference of MSN at 8:42 a.m. HARRIS: So within two minutes of the computer being, something coming up on that particular computer, whoever it is is going to the MSN page? WALL: It's the very next activity on the computer. HARRIS: And then it doesn't show that there's an account password, that the last activity on that particular day is the defendant checking his e-mail? WALL: That's correct. And the reason why there may not be an account, any account activity in a web based format is because it is accessed through the Outlook Express e-mail client. HARRIS: And again, when we're talking about this activity, we're only talking about from 8:40 to 8:45 that morning? WALL: That's correct. JUDGE:Okay. We better take the recess for the court reporter. HARRIS: All right. <Morning recess> HARRIS: Detective Wall, I'm going to go back to something and just clarify this. On the 24th you were talking about this Yahoo weather search? WALL: That's correct. HARRIS: Now you said that there were two files, two weather files that came up? WALL: Yes, there were. HARRIS: So on this Yahoo page someone had to click on "weather" and the weather page came up? WALL: Yes. HARRIS: And then you were talking about something about a zip code. Can you explain to us what you meant by that? WALL: Yes, on that website page, the process allows the user to enter a specific zip code for the weather that they want. Once that zip code is entered, it directs you to the weather for that region, which the first one was for San Jose weather. HARRIS: So someone put in a zip code for the San Jose region? WALL: That's correct. HARRIS: And did a San Jose weather forecast come up? WALL: Yes, it did. HARRIS: And that is the page file that you saw? WALL: Yes. HARRIS: Now, one last thing, showing you what's previously marked as 174F, what is this particular device right here next to the computer? WALL: This device right here is a Dazzle screen capture device or video capture device as well. HARRIS: What does that mean? WALL: Dazzle makes a variety of products that allow the user to connect a video camera to the device and it interfaces through the computer and allows you to view what's on the video camera through the device on your screen, capture that video or take specific snapshots of what happens to be on that video device. It can be a variety of video devices, by the way. HARRIS: The People have no further questions.
Recross Examination by Mark Geragos GERAGOS: What do you have, Mr. Wall, do you have what looks like the Excel spreadsheet of the, all the searches that were done? WALL: No, I do not. GERAGOS: Can you call that up, and specifically for the 24th. WALL: Are you referring to another disk? GERAGOS: God only knows what I'm referring to. Do you want me to show you what I've got in front of me? WALL: That probably be a good idea. JUDGE: Do you want to go up there, Detective Wall, and see what Mr. Geragos has in his hand. WALL: Yeah, this is a complete different disk. I don't know if I have that. GERAGOS: Are you able to read it off of what I've got here? Do you want to do it that way? What I'm showing you, does that look to you to be a disk, and I'll come around, that you or somebody compiled of what was searched on the 24th? WALL: Yes, this is an Excel spreadsheet that was exported. GERAGOS: Now, on that it looks like starting at 8:40 -- WALL: 8:40. GERAGOS: Somebody goes on, and the first thing that hits is MSN? WALL: That is correct. JUDGE: This is December 24th? GERAGOS: On December 24th. At 8:40, correct? WALL: That's correct. GERAGOS: And, MSN, would that lead you to believe that that's the home page? WALL: What this is is an XMR for an extension that allows for viewing of a specific website page, yes. GERAGOS: Okay. So if I, when I open my computer, it goes automatically to Yahoo? WALL: You don't know -- GERAGOS: I have no idea what's going on in terms of the, in technically within the computer. What I assume is happening on this computer at home is when they open it up, the computer goes to MSN; is that correct? WALL: That's very possible these files are then being created. GERAGOS: Okay. Now, and Laci Peterson's e-mail is also MSN, correct, laci@MSN? WALL: I believe at Hot Mail. It has a different designation, I believe. GERAGOS: And I think your report somewhere had indicated that the two of them share their e-mail as well? WALL: There was some indication that is slpete1@msn was potentially theirs. GERAGOS: Okay. Slpete1, we saw an e-mail at 8:45 or 8:44 that looked like it was Scott's, slpete1, but there are indications that she used that e-mail as well, correct? WALL: From, and that was from a previous or previous dates -- GERAGOS: Okay. WALL: as I recall. GERAGOS: That was the only way you would be able to tell. You have to look in the past, see what she used, and it was apparent to you at least that she, on a number of occasions, more that two or three, had used that e-mail, correct? WALL: Yes, correspond to Scott. GERAGOS: Now, so it goes to MSN, what's the next date, what number of entries here, can you tell the jury what those are. WALL: Well, there's image files that are associated with the site. A lot of them are image files. And then you can see where the weather page is accessed. GERAGOS: Okay. Now the weather page is accessed before or after that umbrella stand and the scarf is looked for? WALL: I have to go back and use this one. GERAGOS: Could you do that. It comes after the weather. Okay. So what does it look like, the first place that somebody goes to it's, the MSN opens up, it opens up to the home page which is MSN; correct? WALL: Yes, and we know there was some navigation that went to Yahoo to look for weather. GERAGOS: Okay. WALL: And the zip code was entered for the San Jose area. GERAGOS: Okay. WALL: And then that page, that resulting website page is viewed. GERAGOS: When you say that are you talking about the weather page; is that correct? WALL: That's correct. GERAGOS: Okay. And after the weather page, somebody looks and sees about a scarf and about an umbrella stand, correct? WALL: Yes. GERAGOS: Okay. WALL: That's a temporary file that's created. GERAGOS: And that was not saved in any fashion, bookmarked or anything else, correct? WALL: Not that I would know of, no. GERAGOS: Okay. So the only way that somebody would have known to look at this or to see this, be able to retrieve this is by you having this EnCase software that does this; is that correct? WALL: That's correct. GERAGOS: And the EnCase software is able to trace these things by whatever internal mechanisms? WALL: Well, the files are there. They never go away. GERAGOS: And this software that you use, law enforcement uses is able to track that, correct? WALL: That's correct. GERAGOS: Okay. So the person signs on at 8:40, goes to the home, it automatically, the computer automatically opens up to MSN, they then check the weather, they then check for a scarf, they check for an umbrella stand, correct? WALL: Yes, that can be as simple as a link on let's say the, some Yahoo's page that was clicked on. GERAGOS: Okay. Then the e-mail is checked; is that correct? WALL: Yes. After that a temporary file is created and an e-mail is checked regarding an E-Bay mail regarding a ping staff bag. JUDGE: Regarding a what? GERAGOS: Ping staff bag. JUDGE: Ping? WALL: P-i-n-g. GERAGOS: GERAGOS: That e-mail is checked, does anybody send an e-mail, is there any e-mail that's sent? WALL: I can't tell by looking at this document. I have to go to -- GERAGOS: Would you be able to, I've got 186. Were you able to tell from that if somebody actually sent an e-mail or if they just, whoever it was, actually just checked to see if there was any e-mail to see if there was any incoming? WALL: Well, in this instance where it appears that Scott Peterson is the last recipient, it's checking e-mail. GERAGOS: Checking e-mail. So whoever received from this document that was created? WALL: Right. GERAGOS: So whoever is using the computer has gone on, has checked the weather, has then, gets a forecast of some kind of, I think you said it was a five-day forecast? WALL: That's correct. GERAGOS: And after they get their five-day forecast, they then check, they get a scarf and umbrella stand. Maybe at that point they check the e-mail that they share with Scott Peterson, is that correct, is that a reasonable possibility as to what happened? HARRIS: Objection, calls for speculation. JUDGE: Sustained. GERAGOS: You have an indication -- JUDGE: Excuse me, he said that they shared the website, but he doesn't know who's using it. GERAGOS: They shared a website. So if she was going to check e-mail, if Laci Peterson was going to check her e-mail or check slpet.1.Com, somebody did check that e-mail; is that correct? WALL: That's correct. GERAGOS: Nobody sent an e-mail at that point, correct? WALL: That would have been in response to an e-mail being sent to that location to that computer where it was viewed. GERAGOS: On the morning of the 24th did anybody send an e-mail that you could tell? WALL: No. GERAGOS: All you could tell is that somebody went through all those steps that I just said, checked the weather forecast, scarf, sunflower action, the umbrella stand, they checked the e-mail and then they're off; is that correct? WALL: That's correct. GERAGOS: Okay. And there's nothing that would indicate who the user was, whether it was Scott or Laci, unless you did the analysis that we talked about before the break, correct? WALL: That's correct. GERAGOS: Okay. And if you did the analysis that we talked about before the break you could make some pretty good educated guesses as to who was actually accessing that computer, correct? WALL: Correct. GERAGOS: Now, the, Mr. Harris went back and was asking you about the USAfishing site, do you remember that? WALL: Yes, I do. GERAGOS: Is that bookmarked, do you know? WALL: On the computer? GERAGOS: On the computer. WALL: I don't. GERAGOS: Is there a way you can look and tell me if this site right here is saved as a bookmark on the computer? WALL: I don't know if it was or not. GERAGOS: If it was saved as a bookmark on the computer would that give you, would that, you indicated I think in response to Mr. Harris' questions that it had been saved. You thought one reasonable explanation is that it could have been saved? WALL: That's correct, it could be saved in a variety of methods other than a bookmark. GERAGOS: One of the methods is that it could have been saved, a reasonable method, is a bookmark? WALL: Yes. GERAGOS: For those of you who don't know much about it, the bookmark is you go to the site and you click on to where it says "favorites" and you just click on to where it says "add on," and that saves that particular site? WALL: Yes, it does. GERAGOS: Okay. And so if somebody went back to that, that bookmark and printed it, would that be an explanation for why today's headlines is December 5th and the print date is December 9th? WALL: Yes, it is. GERAGOS: Okay. And that would seem to explain whatever anomaly that we've been talking about here? WALL: Yes. GERAGOS: Okay. Now, the, Mr. Harris also asked you about this? WALL: Correct. Yes, he did. GERAGOS: Which is 183B, which is you're saying that the way that it would have popped up on the computer was like this as it is right now? WALL: This is how it would appear to the user while on the computer. GERAGOS: Okay. 6/28/2004 is because you did that on the 28th of June 2004? WALL: That's correct. GERAGOS: Okay. And as you sit here, do you, can you tell this jury if in fact that it looked the same way before, and this was from the USAfishing site, correct? WALL: No, this was from the US Geological. GERAGOS: Wasn't there a link between the USA and that? WALL: Not that I recall, no. GERAGOS: Did you bother to check to see if there was a link between USAfishing and US Geological? WALL: I believe I did. I did not find one. GERAGOS: Okay. Now this specific area here that as, I think it's on the top, SF Sports. WALL: Yes. GERAGOS: Okay. Would you see if that was a, one of the searches that we talked about, one of the ocean searches? WALL: That was one of the search results that came up on one of the search results pages, yes. GERAGOS: So doing the same thing we did on Thursday where he's putting in "boat" or "ocean" or whatever else he gets a succession of hits and he goes to one of those and it happens to be this; is that correct? WALL: That's correct. GERAGOS: And as we sit here, do we know how long that actually was up on the screen? WALL: We know it was long enough to be visited on a second occasion from the zoom aspect that occurred, and I know that it occurred on at least two previous occasions that the website was refreshed because when the website is refreshed and a new map is loaded, the old website page gets deleted and sent to unallocated space and there were two references of that file found in unallocated space. GERAGOS: Okay. And do we know what the elapsed time was? WALL: No. GERAGOS: And we don't know as we sit here if it was ever printed? WALL: No. GERAGOS: And we didn't do any, you were never requested to do any analysis as to what was printed and what was not? WALL: No, I was not. GERAGOS: And the only thing we know that was printed, because we found it when it was found and turned into you, was 4G, correct? WALL: That's correct. GERAGOS: 4G was found at the desk next to the computer, correct? WALL: That's correct. GERAGOS: Okay. Now I was going to ask you, you were asked some questions about what this set up was. Could you just tell me one more time what that was? WALL: Yeah, it's a Dazzle. We talked about the Dazzle screen capture device or video, I'm sorry, image capture device that's right here. It allows the user to capture video files or still images from cameras or video recorder from a television even in some cases depending on the model. GERAGOS: Okay. Now specifically that's the, could you point to it one more time which the unit is. WALL: (pointing) GERAGOS: Semi-power. Okay. Now you can return, if you want. The computer itself, or the four computers itself, was there, did you see any attempts whatsoever to try to erase information, delete information? WALL: No, I did not. GERAGOS: Did you see any attempts to try to wipe the hard drive? WALL: No. GERAGOS: Did you see any attempts whatsoever on any of the computers that indicated that they were, somebody had tried to tamper with them? WALL: No. GERAGOS: Is that something that you look for? WALL: There would be obvious indications if that occurred. GERAGOS: Now the computer that is identified as the Dell laptop home and the analysis that you did from 8:40 to -45, was there anything else, and I ask you to just step down so I don't miss anything else. Is there anything else on here that we missed from that period of time? WALL: It's hard to look at it in this format because all you're seeing is the text that is created on the files names. GERAGOS: Safe to say that what I led you through is exactly what happened on the 24th as far as you can tell? WALL: Well, it's safe to say that those are the files that were created on that computer. GERAGOS: Okay. And, basically, without repeating it, what I led you through was what happened on the morning of the 24th as indicated by the computer that was seized from the house? WALL: Yes. GERAGOS: May I have just one moment? Now in your report there appears that you also, you took a look at and found a, it looks like page 12 of the report. Can you tell me what that was you found. It looks like you had imported on to the screen something that you actually found; is that right? WALL: Yes, that's an e-mail that was sent. GERAGOS: And what day was that e-mail sent? WALL: It appears that it was 12/26/02. GERAGOS: Okay. Do I understand correctly, yours is the color version, which is actually more accurate, correct, because I have the, I've got a black and white copy? WALL: Yes. GERAGOS: Could I trade you the color to mark that. I'll give you the black and white copy. WALL: Has that one already been marked? GERAGOS: No, I took it out of my file. For the record, it's Bates stamp 30751. WALL: Do you want to write it on that one? GERAGOS: I think what I'll do is go like this, if I can. I take this and I was going to mark this next in order and have a copy of it made. JUDGE: D 5 U. Is that a copy of the e-mail? GERAGOS: This is, yeah. I think I'll explain it in a second. I just want to make a color copy. Can you get a, get an idea if, I'll mark this next in order. JUDGE: Okay. GERAGOS: Can you explain to the jury what it is you're looking at here. WALL: This is a recovery of an e-mail sent on, I believe it's December 26th, from Guy Davidson. And something happened to the file where the image is what appears to be Laci. GERAGOS: It looks like the top of her head. WALL: It does. Did not completely get compiled in this document that was created. It basically says Laci Peterson. It's a "missing" poster. GERAGOS: Okay. Do you know, was there an e-mail, was that sent as an attachment somewhere? WALL: Yes. GERAGOS: And where was it sent as an attachment? WALL: It was sent from Guy Davidson and I believe it was sent to the slpete1 e-mail. GERAGOS: Okay. Was it then forwarded somewhere that you can tell? WALL: I don't know. GERAGOS: And was there some indication, what page number did I tell that you was again on the Bates stamp? WALL: 30751. GERAGOS: Would it appear that somebody was sending that out or tell me what it was that was actually, I'll just take you through it. It was an inbound e-mail, correct? WALL: Correct. GERAGOS: Okay. And did it look like it was in turn forwarded somewhere else? WALL: I don't know if it was forwarded somewhere else. GERAGOS: Could you tell if this was sent somewhere as an attachment to Spain to the TradeCorp headquarters? WALL: No, I don't know if that happened. GERAGOS: Okay. Could you look to see, did you trace its, the subsequent path that this particular attachment took? WALL: Did I trace it? GERAGOS: Yes. Did you see if in fact it was forwarded somewhere? WALL: No, I don't recall doing that. GERAGOS: Okay. Let's see, this file you bookmarked, correct? WALL: Yes, I did. GERAGOS: Okay. And did you see, hold on just for one second. Okay. On page 14 of your report, by the way, what time did the, the one that we got up there, what time did that come into, what time was it accessed on the 26th? WALL: 8:38 a.m. GERAGOS: 8:38? WALL: Yes. GERAGOS: Then did you find on page 14 of your report, let's see, it looks like the computer use on the 26th was going from 8:27 to 9:37, correct? WALL: Yes. GERAGOS: On the third paragraph. Then it looks like, then you indicated that there was a new file created at 11:37 to 2:09, right? WALL: Yes. GERAGOS: Then you said the next created file, what was that? WALL: I'll spell it. Capital letters, DESAPARECIDA.doc. GERAGOS: Okay. Did that appear to you to be related on a Spanish translation of what was going on on this poster here? WALL: That's very possible. GERAGOS: Okay. And did it look like, and that was on the, if I got it right, the item that we've got up on the board was received on the morning of the 26th, correct? WALL: Yes. GERAGOS: Sometime you said, 8:38? WALL: 8:38. GERAGOS: And then sometime in the afternoon it looks like it's been translated into Spanish; is that right? WALL: It appears that way, yes. GERAGOS: Okay. Now the, did you check to see whether or not that was printed at that point or forwarded? WALL: No, I did not. GERAGOS: Okay. And the -- GERAGOS: Well, thank you. No further questions. JUDGE: Any re-redirect? HARRIS: Yes, just real briefly. JUDGE: Are we going to mark that report as evidence? GERAGOS: I was going to do that at the break, make a copy of it. JUDGE: You already marked it as D 5 U? GERAGOS: Right. You can keep that for your records. JUDGE: Do you want that for your records? WALL: No, I'll keep the copy. GERAGOS: You can keep the copy. If I can get two, one to replace in the book, Marilyn.
2nd redirect Examination by David Harris HARRIS: Detective, looking at page 14 of your report, going through that, what was the Internet usage on the 26th? WALL: Specifically what type of usage was on the 26th? HARRIS: Let me rephrase that. Maybe that was too confusing of what was going to be asked of you. When we're talking about the time that somebody's on the computer, you're not always talking about using the Internet, are we? WALL: That's correct. HARRIS: So when you were asked about that particular information, what is the first time that you have a file created on the 26th? WALL: At 8:27:42 a.m. is the first recorded file on the computer. HARRIS: And which computer is that? WALL: It's Dell laptop home 1. HARRIS: And in your report, looking at page 14 when you're talking about these times again, you're talking about Dell laptop home 1? WALL: Yes. HARRIS: And can you tell us what the time frame was on page 14 of your report that the computer was being used that day? WALL: From 8:27 a.m. through 9:37 a.m. on Dell laptop home 1, then there was a one-hour break and a new file was created at 11:37 a.m. and it was used to 2:09 p.m. The next file that was created was the DESAPARECIDA.Doc file and that was created at 3:10 p.m. HARRIS: Now you were asked about Laci using the slpete address, when you were going through, and counsel was asking you if you had to have a history, what's happening in the present, the information about Laci using that particular account, was that several years old? WALL: I believe so. It was when she was communicating with Scott while he was overseas, I believe in Spain. HARRIS: And did you see any recent usage around December of 2002 that she was using that? WALL: Not that I recall, no. HARRIS: And at that point in time, in December of 2002, did she have her own separate e-mail account? WALL: Yes, she did. HARRIS: Now you were asked about bookmarks and showed that particular graphics and Captain Hook, I want to talk about that. If you bookmark a page from the Internet, does the computer try to take you back to that exact same page? WALL: Yes, it will. HARRIS: And if do you that, if it's a site that updates its information, do you get the updated information? WALL: If it's a bookmark that you've saved, it will give you exactly what you've saved. HARRIS: Now, in this particular case, the Captain Hook Sports Fishing, do we know that that particular site was not bookmarked like you're talking about because we see access of that site with two different pages of information? WALL: It's possible that it was done that way, but it could have also been saved to another form of media, like a floppy disk, and transferred to another computer. HARRIS: And the information that was printed out in the document that you have a hard copy was found during the search, did you find that particular document on any other of the computers other than the Dell laptop home 1 on December 8th? WALL: No. HARRIS: The People have no further questions.
2nd Recross Examination by Mark Geragos GERAGOS: You said that she accessed slpete1 when he was in Spain? WALL: Yes, from the Dell work PC 4. GERAGOS: Do you know, are you aware that he was in Spain in October of 2002? WALL: No, I'm not aware of that. GERAGOS: Okay. When you say that she's using that, she used the MSN account, the fact of the matter is that nobody sent anything on the 24th, correct, you didn't, you didn't see any e-mails being sent? WALL: Not that I recall. GERAGOS: Only saw, I think I showed it to you, I think it was marked, was somebody check the e-mail, correct? WALL: That's correct, but it would be simple just to look. GERAGOS: Would it be as simple to see, to do an analysis as to who's history it was that matched up with accessing on the 24th? WALL: Yes, it's very possible just from viewing. GERAGOS: Okay. Now the other question that Mr. Harris asked about the saving of the site by the, when you save the site, that's what's saved, correct? WALL: That's correct. GERAGOS: What you're looking at? WALL: That's correct. GERAGOS: Okay. And so you, you had indicated when he asked you that question that the other possibility is somebody put it on a disk and then put that disk into some other computer and printed it, correct? WALL: That's correct. It would give it that date stamp of the 9th. GERAGOS: Okay. There was, there were disks that were recovered during the search warrant, right? WALL: Yes, I believe there were. GERAGOS: Did you find that saved to a disk anywhere, that site? WALL: I did not. GERAGOS: Okay. Obviously that would have been something that law enforcement was interested in, isn't it? WALL: Yes. GERAGOS: Okay. And it wasn't there so the possibility he just suggested, there's no evidence for that, is there? WALL: Not that I analyzed. GERAGOS: Okay. The fact is you analyzed it the way that I hypothesized it is the way that you think it's what happened, correct? WALL: It's very possible it was printed out in any number of locations. It could have been at home or at the shop. GERAGOS: Thank you. I have no further, Off of a bookmark, is that correct, or some save? WALL: Correct. GERAGOS: Thank you. I have no further questions. JUDGE: May this witness be excused subject to recall? GERAGOS: Yes. DISTASO: No objection. |