On Day 13, Homeland Security Investigations computer forensic agent Joshua Croft described extracting and preserving data from three laptops, including recovered phone-backup and chat data. Cross-examination addressed duplicate entries, a damaged drive, and the limits of his post-extraction review; redirect addressed warrant timing for a separate user partition.
Law enforcementHomeland Security Investigations
Joshua Croft
Homeland Security Investigations special agent and computer forensic agent.
Appeared2025 Federal Trial
112 lines·3 proceedings
About
On Day 13, Homeland Security Investigations computer forensic agent Joshua Croft testified for the government about extracting and preserving data from three laptops he understood belonged to Casandra Ventura. He described forensic imaging, hash-value verification, preservation of original extraction material, and the connection between the devices, custody documentation, and forensic reports.
Croft said one laptop continued to contain data after it displayed a factory-reset setup screen. He also described partial recovery from a damaged drive with bad sectors, and explained that iTunes phone backups and differences in forensic displays could affect how chat entries appeared. He said he checked raw data to verify what the Axiom software displayed.
Defense questioning focused on the contrast between an error-free extraction and the damaged laptop, duplicate messages, and Croft's role after extraction. Croft acknowledged that phone backups could explain some, but not every, duplication and that he performed spot checks before other agents conducted the full review. On redirect, he said investigators preserved but did not process or search a separate user partition until after obtaining a warrant.
Trial Record (3)
No proceedings match this filter.