Skip to content
Sean Combs— Case Archive
personpersonEnrique SantosEnrique SantosInvestigative analyst at the U.S. Attorney's Office for the Southern District of New York specializing in digital forensics.← All People
Law enforcement

Enrique Santos

Investigative analyst at the U.S. Attorney's Office for the Southern District of New York specializing in digital forensics.

Appeared2025 Federal Trial
75 lines·2 proceedings

About

Enrique Santos, an investigative analyst with the U.S. Attorney's Office, testified on Day 21 about forensic work performed on three phones attributed to Casandra Ventura. He described full file-system extractions, recovery of some deleted records, and integrity-checking procedures, including the use of hash values.

Santos also explained how Cellebrite reports can present digital material differently from the underlying data. His testimony addressed participant names, timestamps, emojis, audio links, screenshot metadata, and the possibility that deleted messages may have missing or corrupted fields in report outputs.

On cross-examination, defense counsel questioned him about recovered deleted WhatsApp messages, the use of different forensic-analysis tools, and a screenshot's capture date. Santos said deleted data can remain hidden until overwritten and gave a qualified assessment that a capture date best reflects when an image was captured or screenshotted, rather than necessarily when the underlying conversation occurred. After he was excused, the Court admitted Government Exhibit 1309 and the exhibits listed in Government Exhibit 1503.

Key Points

Trial Record (2)

Trial 12025 Federal TrialMay 5, 2025 – Jul 2, 2025Called by prosecution

Enrique Santos testified on Day 21 about forensic extraction, integrity checks, and report-format limitations for three phones attributed to Casandra Ventura. On cross-examination, he addressed deleted WhatsApp data and qualified the meaning of screenshot capture-date metadata.

Day 21

DirectEnrique Santos — DirectEnrique SantosEmily A. Johnson5highlights64lines spoken

Summary

Investigative analyst Enrique Santos explained the extraction and interpretation of data from three phones attributed to Casandra Ventura, including deleted records and Cellebrite report metadata.

Highlights (5)

testimony highlightSantos described the forensic workflow for extracting phone data, including isolation from networks, hash-value verification, and processing through Cellebrite Physical Analyzer.Open in transcript →
Quote“We do that by verifying the hash value that's produced when the device is extracted.”— Enrique SantosSantos identified the integrity check used after extraction.Open in transcript →
evidence eventSantos identified three iPhones attributed to Casandra Ventura, testified that each received a full file-system extraction, and said several deleted records were recovered.Open in transcript →
Quote“We recovered several deleted records.”— Enrique SantosSantos testified that the three examined phones yielded deleted records.Open in transcript →
Show all 5 highlights
testimony highlightSantos explained how Cellebrite reports display screenshots and described the created, modified, access, and capture-time fields shown in Government Exhibit C-361-C-M.Open in transcript →
CrossEnrique Santos — CrossEnrique SantosTeny R. Geragos4highlights11lines spoken

Summary

Santos explained deleted-message recovery and screenshot metadata on cross; the Court then admitted Government Exhibit 1309 and additional government exhibits.

Highlights (4)

testimony highlightSantos explained that deleted WhatsApp messages can remain hidden in the phone's operating system until older data is overwritten.Open in transcript →
Quote“They're just hidden. And what happens is that over time, as the phone creates new records and needs space to store the new records, it will start to overwrite older data.”— Enrique SantosExplains the forensic basis for recovering some deleted phone data and the limits created by overwriting.Open in transcript →
testimony highlightSantos testified that a screenshot's capture date is the most accurate reflection of when the image was captured, while distinguishing it from the underlying conversation's date.Open in transcript →
Quote“But in my experience and from what I get from my training is that the capture date is the most accurate reflection of when that picture was taken or screenshotted.”— Enrique SantosStates Santos's qualified opinion about the reliability of image capture-date metadata.Open in transcript →