Joshua Croft Testimony & Transcripts - Sean Combs Case Archive

About

On Day 13, Homeland Security Investigations computer forensic agent Joshua Croft testified for the government about extracting and preserving data from three laptops he understood belonged to Casandra Ventura. He described forensic imaging, hash-value verification, preservation of original extraction material, and the connection between the devices, custody documentation, and forensic reports.

Croft said one laptop continued to contain data after it displayed a factory-reset setup screen. He also described partial recovery from a damaged drive with bad sectors, and explained that iTunes phone backups and differences in forensic displays could affect how chat entries appeared. He said he checked raw data to verify what the Axiom software displayed.

Defense questioning focused on the contrast between an error-free extraction and the damaged laptop, duplicate messages, and Croft's role after extraction. Croft acknowledged that phone backups could explain some, but not every, duplication and that he performed spot checks before other agents conducted the full review. On redirect, he said investigators preserved but did not process or search a separate user partition until after obtaining a warrant.

Key Points

Croft described extracting data from three laptops, using forensic preservation practices and hash-value checks to verify the work. ^[1]

He said one laptop retained data after showing a factory-reset screen, while bad sectors on another drive prevented recovery of some data. ^[1]

Croft explained that phone backups could produce some duplicate chat entries, but said that explanation did not account for every duplication. ^[1][2]

On redirect, he distinguished preservation of a separate user partition from later processing or searching it after a warrant was obtained. ^[1]

Trial Record (3)

Trial 12025 Federal TrialMay 5, 2025 – Jul 2, 2025Called by prosecution

On Day 13, Homeland Security Investigations computer forensic agent Joshua Croft described extracting and preserving data from three laptops, including recovered phone-backup and chat data. Cross-examination addressed duplicate entries, a damaged drive, and the limits of his post-extraction review; redirect addressed warrant timing for a separate user partition.

Day 13

May 22, 2025

DirectJoshua Croft — DirectJoshua CroftEmily A. Johnson2highlights77lines spoken

Summary

HSI forensic agent Joshua Croft described extracting and verifying data from three laptops associated with Cassie Ventura, including recovery limits and how chat data could appear in forensic reports.

Highlights (2)

testimony highlightCroft explained that he preserves an original “gold copy” of extracted data and uses working copies so later changes can be checked against the original hash value.Open in transcript →

evidence eventCroft said a damaged MacBook Pro had bad sectors that prevented recovery of some data, although a majority of the drive's contents was recovered and the extraction log identified the unrecovered sectors.Open in transcript →

CrossJoshua Croft — CrossJoshua CroftTeny R. Geragos1highlight32lines spoken

Summary

Croft described successful extraction from B-200, damage affecting B-300, possible iTunes-backup duplicates, and his limited post-extraction review role.

Highlights (1)

testimony highlightCroft attributed some duplicate chat entries to phone backups stored through iTunes, while qualifying that he could not explain every duplication.Open in transcript →

RedirectJoshua Croft — RedirectJoshua CroftEmily A. Johnson1highlight3lines spoken

Summary

Croft said a separate user partition on B-200 was preserved but not searched until a warrant was obtained; the court then addressed scheduling and defense-access requests.

Highlights (1)

testimony highlightCroft said investigators preserved B-200 with a forensic image after locating the Frank Black user partition, but did not process or search that partition until a warrant was obtained.Open in transcript →