Witness 33: Daniel Portnoy - APD
Portnoy is going over training for the forensics unit. Portnoy is a certified forensics computer examiner.
Portnoy says as a certified computer examiner, he has to take an exam every 3 years to keep up his certification. He completed the exam in April 2022.
Portnoy says training for the certificate is provided by International Association of Computer Investigative Specialists (IACIS)
Portnoy is discussing Berla. Berla was previously mentioned by Allen, who’s works for the U.S. Secret Service. Berla is a vehicle infotainment forensic company. Portnoy re-certified in Berla in January 2022.
Portnoy say that the digital forensic unit with APD does extractions and examinations on all kinds of digital devices. Portnoy says they’re mostly dealing with cellphones, but also laptops, surveillance DVRs, SD cards
Portnoy says as far as the intake process for a device, they have to seize the property. Portnoy says they inspect the device for any damage, take out the SIM card. Portnoy says to avoid confusion, they assign a case number to the evidence.
Portnoy says ‘extraction’ in simplest term is just getting the data out of the device in a forensic manner, without “stepping on” the evidence or altering it in any way.
Portnoy says that data is always moving around, so every time date is extracted, it may be a little different.
State asks Portnoy based on his training and experience, does it change quality or reliability depending on which extraction method is used. Portnoy explains more about the extraction methods here.
The presentation being shown to jurors alongside Portnoy’s testimony says that ‘extraction is verified by hash validation’ - Portnoy explains a hash validation like a fingerprint
Portnoy is reviewing a spreadsheet. He says it’s a list of various devices examined in the case. They include multiple iPhones (model 11, 13), two MacBook Pros, Uconnect, Lenovo ThinkPad
Five iPhones listed on the spreadsheet. The ‘Uconnect’ is an infotainment system, from a car. People typically think of them as ‘GPS.’ It’s called Uconnect because it’s the name/model of the infotainment system, Portnoy says.
Lenovo ThinkPad is a laptop computer, Portnoy says.
State is going over more of the technical aspects of data extraction and what type of software was used.
State asks if Portnoy was able to extract any data from one of the iPhone 13 Pros. He says limited. Another phone he could not extract any data from.
Portnoy says they attempted “brute force,” but were unsuccessful, leading them to bring in the Secret Service. Portnoy says there isn’t any change in data when a phone is ‘fully encrypted,’ which is what he says the state of the phone was in when he attempted brute force.
Portnoy says to his knowledge the Secret Service was able to extract data from the phone. Earlier in the afternoon, Michael Allen (with the Secret Service) said the same.
One of the phones was ‘factory reset’ which can appear that a phone has been wiped.
Quick jury break.
Prosecution brings up more exhibits, pictures. Portnoy explains the image being shown to the jury as an image of a kit and boxes inside of it, with tools, to facilitate extraction from an infotainment system.
Portnoy says he did preliminary research and determined there was GPS data that they could get, so it was worth seizing the infotainment system. State asks Portnoy noticed anything about it that it was damaged or short-circuited when being removed. Portnoy says no.
More photos of the infotainment system are being displayed. Portnoy explains that this is the documentation of him taking apart the infotainment system (from Armstrong’s car.) He says the whole point is to get to the memory chip.
In another photo, Portnoy explains it to be the board that contains the memory chip. He took a close up photos as well. If this is hard to get a mental picture of, it looks kind of like a computer memory board. Green with some yellow wires.
A document titled ‘vehicle case report’ for a Jeep Grand Cherokee is being displayed on the monitors. It contains information about ‘navigation events.’ Portnoy explains the the data is taken every time the vehicle is turned on, and stops when the vehicle is turned off.
Portnoy explains the next exhibit - it’s the initial points of track 99, in an animation.Track 99 is one of the routes recorded from the Jeep. It looks like a map with blue lines, indicating the travel points. Portnoy says it’s a neighborhood in South Austin.
The original animation is over an hour long, but prosecution is speeding it up. The actual track time (car on to off) would’ve been that hour plus length.
Prosecution: it appears the vehicle is driving on S Lamar Boulevard, correct Portnoy: Yes
Portnoy says it’s heading north
The animation showing path of travel continues. Prosecution pauses it - Portnoy reads out 7:20 p.m. on May 11, 2022. Portnoy says he used surveillance video to verify the GPS data as well.
Portnoy says the pauses of the vehicle are consistent with real life traffic.
Portnoy says the vehicle has traveled to the downtown area, near Whole Foods off of fifth street. Then it goes down W 6th street. Prosecution says the vehicle altered its path, Portnoy says the vehicle took a side street to go eastbound.
Portnoy says now it looks like the vehicle made a circle around the block. Vehicle at 7:29 is traveling down w 5th street going eastbound, according to Portnoy.
Portnoy confirms at 7:35 pm, vehicle approaches I-35.
Vehicle turns on MLK Jr blvd. Vehicle turns onto Cedar, then Maple Avenue. Armstrong is watching the blue line travel down Maple Avenue.
Portnoy says the vehicle travels down various blocks in this immediate vicinity. He says it does not leave the neighborhood.
Portnoy confirms, from his recollection, the vehicle will go over the same areas. That stacks the blue lines on top of each other.
7:52-7:55 pm Portnoy says the vehicle may be at rest. The track log continues running. Portnoy says that indicates the electronics of the vehicle are on, can’t tell about vehicle though.
Prosecution increases the speed again. Vehicle in the same location at 8 pm, and then starts moving. 8:05 pm Portnoy says it’s on 18th street. The blue line then goes to Maple.
Portnoy says compared to the surveillance videos he watched from neighbors, the GPS data matches within 4 seconds. He says that means it’s pretty accurate.
8:08 pm., vehicle travels down 16th street.
The blue line keeps going around the general area. By 8:29 the vehicle is at 18th and Chesnut, Portnoy explains. Then the line/vehicle is stationary.
8:37 pm, Portnoy says the vehicle appears to be at the alley by Maple.
A new track starts at May 11, 2022, 9:17 p.m. State asks if Portnoy is aware of the time gunshots went off in the area. Portnoy says the gunshot happened approx 5 minutes before or sooner. Portnoy agrees that could be better verified with previous testimony.
Portnoy says something went wrong with the track point at 9:17, an anomaly, where it didn’t accurately track the vehicle’s physical movement.
State asks if there’s a general known accuracy rate they expect to see. Portnoy says they’re accurate within 15 meters, 95% of the time.
Vehicle heading westbound on 17th street at 9:17 pm
Vehicle drives northbound on I-35. Still the case by 9:24 pm, but 9:26 Portnoy says vehicle used an underpass to go on frontage road on I-35. Now the vehicle is heading the opposite way on I-35.
Portnoy says 9:31 vehicle traveling through downtown area.
Vehicle now traveling through South Austin, passing St. Edwards.
Portnoy says 9:36, vehicle left I-35 and made a turn onto Battle Bend Blvd. 9:37, Portnoy says vehicle briefly stopped (stationary, track log is still active) in that area.
Vehicle resumes driving at 9:42 and turned south on a side street. Vehicle is stationary for another period of time. 9:46 resumes driving. 9:47 pulled slightly off the roadway. 9:48, the track log ends. Portnoy doesn’t remember the street the vehicle stopped on.
State pulls up video - Portnoy can see what street it was now: Fort Clark Drive.
Seeing a GrayKey progress report displayed on the monitors. It includes Det. Portnoy’s name.
Portnoy says the record we’re looking at is for an iPhone 13 Pro, but named iPhone 11 Pro. Portnoy says when people get new phones, it’s common to transfer over data - so the name may have transferred if that were the case here.
The device report we’re looking at, Portnoy points out there are two IMEI numbers. He says that’s common, and associated with SIM card usage. It makes it possible to have two phone numbers contained it one phone.
Portnoy agrees there’s a large amount of data they were not able to pull from this phone. We can see on the display that the owner name of this phone is listed at Kaitlin.
Court recesses until Monday.