I painfully listened to the testimony about the dubious hard drive and transcribed:
attorney: Let's talk about the work you did on an external drive. And I'm talking about the one that was initially broken
witness: Yes
attorney: Do you remember when you received that?
witness: (witness looks at his records) October 25, 2012, 11:26 a.m.
attorney: what is it that you received?
witness: I received a 2.5 inch internal hard drive, that's the size of a hard drive you would find in a laptop, and a bag of parts from an external enclosure that would be appropriate for use with that hard drive. So it appeared that that hard drive may have been in that enclosure at some point, but its enclosure was provided to me as a bag of parts.
attorney: Did you receive a mirror image ....did you receive something else in November with this external drive...a mirror image? (editorial: defense attorney mischaracterizing it as external drive)
witness: Yes
attorney: When was that received?
(witness hands some piece of paper to defense attorney; defense attorney has something marked and hands it to witness)
attorney: Does that refresh your recollection as to when you received the mirror image?
witness: Yes
attorney: When was that?
witness: That was on November 5, 2012 at approx 4:57 and I can't read if it's a.m. or p.m., and it wasn't received directly by me, it was received by a representative of my office
attorney: What were you asked to do with that mirror image? Well, let me ask you this -- what's a mirror image?
witness: A mirror image is another term that's used for forensic copy..so earlier in our discussion, we talked about me having received a copy of the victim's laptop from the Mesa Police Department in a forensic format. This also is the exact same format, just a different evidence item, a different hard drive
attorney: What were you asked to do?
witness: I was asked ...I don't recall what I was asked to do
attorney: Were you asked to pull photographs, everything you can, off the mirror image?
witness: I was asked to process the hard drive using my standard protocol. I don't recall, without looking at any notes, what specifically I was asked to do. I do remember following the same protocol.
attorney: So, would that standard protocol, would that involve using Ncase?
witness: It wold involve using Ncase. I believe on all the evidence items I had received, I recovered all photographs, messages and internet history. So I would expect that I had done the same with this device as well. However, this particular forensic copy posed a unique challenge.
attorney: What's that?
witness: The copy I received was made from the original hard drive but the original hard drive was not functioning ..it was damaged as it was related to me. And therefore the hard drive had to be sent out from Mesa PD, as I understand it, to a specialty service to try to make the hard drive operational, and then once that was accomplished by this third party they created an Ncase forensic image and returned it to Mesa PD, and then I received a copy from them. So normally, if I receive a forensic copy, and the copy was made from a working computer - a working hard drive, I can easily add it to my forensic tool and I can open it up and it will appear to me as any Windows hard drive -- I will see a file system, I'll see folders and I'll see files. In this case, because the first sectors of the hard drive had been damaged, the master file table that enables or establishes the file system, the folders, file names and all and such, had been damaged. So I had to run some extra special -- or some unique -- scripts and do a little bit of searching to essentially reconstitute the file system. NTF file systems...this is the file system often used by Windows, certainly Windows XP and Windows Version 7, often has a backup, and I was able to search the hard drive and locate the backup file system, and using that I was now able to view the contents on the hard drive. However, I was also aware that the copy I was presented, the portions that had been damaged had in its place of having the normal bits we would expect to see..the service (?) had written "unrecoverable" so I knew those sectors were not usable and did not have any evidentiary value. (mind numbing!)
attorney: ultimately were you able to pull different information from Ncase off this mirror image
witness: Yes
attorney: And was some of that information photos?
witness: Yes
attorney: When you pull photos off, were you always able to get information about when those photos were taken?
witness: not always
attorney: Was that due to the damage on the external hard drive? (again, she mischaracterizes it as an external hard drive, with no correction from the expert)
witness: Some of it, yes. some of it, no.
attorney grabs pics, shows them to prosecutor and asks to approach -- pics not visible from this camera angle. Hands witness exhibits 394 and 393
attorney: Do you recognize those as two photos that were taken off of this mirror image?
witness: Yes
attorney: I see that there's a time stamp on the front of the photos, is that right?
witness: Correct
attorney: Is that something you put on there? (no) Does that come with the photo - that time stamp? (whatever that means)
witness: This is how the photo appeared to me on the evidence item (whatever that means)
attorney: Defense moves ..giggle, I forgot the numbers...defense moves to enter exhibit number..
(attorney approaches witness; witness picks up photos to look at exhibit numbers on the back, showing a view of the pics)
witness: 393 and 394 ...
attorney: 393 and 394
JUAN MARTINEZ, SUPER PROSECUTOR: Objection relevance (asks to take witness on voir dire -- defense tries to stop Juan, but judge allows him to voir dire the witness)
JUAN MARTINEZ, SUPER PROSECUTOR: Sir, with regard to that part of the human body that's there...do you know who it belongs to?
witness: I do not
JUAN MARTINEZ, SUPER PROSECUTOR: That's not your area of expertise, is it?
witness: No, it is not.
JUAN MARTINEZ, SUPER PROSECUTOR: I object on the grounds of relevancy and lack of foundation.
side bar ....
