DIRECT EXAMINATION BY MS. JOHNSON:
MS. JOHNSON: Good afternoon, Mr. Santos.
ENRIQUE SANTOS: Good afternoon.
MS. JOHNSON: Where do you work?
ENRIQUE SANTOS: The U.S. Attorney's Office for the Southern District of New York.
MS. JOHNSON: What's your title there?
ENRIQUE SANTOS: I'm an investigative analyst.
MS. JOHNSON: And how long have you worked as an investigative analyst at the U.S. Attorney's Office for the Southern District of New York?
ENRIQUE SANTOS: As an analyst for about 11 years, but I've been at the office for 17.
MS. JOHNSON: What are some of your duties and responsibilities as an analyst?
ENRIQUE SANTOS: I perform forensic examinations of electronic devices, such as cell phone, tablets and GPS devices.
MS. JOHNSON: Have you received training in the analysis of electronic evidence and forensic examinations?
ENRIQUE SANTOS: Yes.
MS. JOHNSON: And have you performed extractions of electronic devices in your job at the Southern District of New York?
ENRIQUE SANTOS: Yes.
MS. JOHNSON: And approximately how many cell-phone extractions have you performed?
ENRIQUE SANTOS: Close to 3,000.
MS. JOHNSON: At a high level, what does it mean to forensically examine a cell phone?
ENRIQUE SANTOS: It means we preserve, extract and analyze electronic data.
MS. JOHNSON: And again, at a high level, can you please outline the general steps that you take when you extract data from a cell phone?
ENRIQUE SANTOS: Generally, when we receive a device at the lab, we will review our search authority, so usually that comes in the form of a search warrant or a signed consent form from the owner of the device. We will try to isolate the phone from any sort of external networks to try to prevent the phone from being wiped. So we'll put the phone in either airplane mode or remove the SIM card, or we'll put it in a Faraday box, which blocks all sort of external signals. We will do some quick research on the device and see what level of support is available for that device. We'll try to use whatever tool will result in the most complete extraction of that device.
MS. JOHNSON: So pausing you there, what tools do you use for extraction of electronic devices such as cell phones?
ENRIQUE SANTOS: For cell phones, it's usually either Cellebrite Premium or GrayKey.
MS. JOHNSON: And did you use GrayKey in this case?
ENRIQUE SANTOS: Yes, we did.
MS. JOHNSON: And after you use GrayKey to extract the data from the cell phone, what do you do after that?
ENRIQUE SANTOS: Once we have an extraction of the device, we'll validate that the extraction is in good condition. We do that by verifying the hash value that's produced when the device is extracted. We'll verify the hash value with a third-party tool and make sure that the integrity of the file's been -- is still intact. Once we have that extraction, we'll load it into another tool that will then parse that data and make it so that we can review the data. We'll be able to do key word searches, filter data, sort data, things like that, make the data more useable.
MS. JOHNSON: And when you say you use a second tool to make the data more useable, what's that second tool that you use?
ENRIQUE SANTOS: There are various tools, but for this case, we used Cellebrite Physical Analyzer.
MS. JOHNSON: And what is the end result when you process data through Cellebrite Physical Analyzer?
ENRIQUE SANTOS: Our end result is usually a report that we generate. It's available in different formats, but generally we'll produce something called a Cellebrite reader report that we turn over to the case agents and the prosecution.
MS. JOHNSON: And is the Cellebrite reader report sort of the more user-friendly, searchable item that you spoke about a few minutes ago?
ENRIQUE SANTOS: Yes.
MS. JOHNSON: And during this process, how, if at all, do you confirm that the data extracted and processed correctly?
ENRIQUE SANTOS: So, usually we'll just reference that hash value that was initially produced. That will give us an indication whether the extraction was intact. In rare circumstances, we will go back to the device itself, but those circumstances are pretty rare.
MS. JOHNSON: Were you asked to extract electronic devices for this case?
ENRIQUE SANTOS: Yes.
MS. JOHNSON: And in particular, were you asked to extract three iPhones?
ENRIQUE SANTOS: Yes.
MS. JOHNSON: OK. I'm going to direct your attention to the Redweld sitting next to you. Were you aware of the source of the iPhones that you were asked to extract?
ENRIQUE SANTOS: At the time of -- that I received the device, I didn't know who they were, but later on I found out who they belonged to.
MS. JOHNSON: And who did those three iPhones belong to?
ENRIQUE SANTOS: Casandra Ventura.
MS. JOHNSON: And for each of those three iPhones, did you follow a similar process for the extraction and processing of the data?
ENRIQUE SANTOS: Yes.
MS. JOHNSON: Can you please look at the three iPhones in the Redweld and let me know how you know if you performed extraction on these devices?
ENRIQUE SANTOS: Sure. OK. I'm ready.
MS. JOHNSON: Did you perform an extraction on those three devices?
ENRIQUE SANTOS: Yes.
MS. JOHNSON: How do you know that?
ENRIQUE SANTOS: Before I came to court today, I had a chance to review these phones and I was able to confirm against the paperwork that I produced for this case that these are the phones that I indeed searched. And I initialed them so that I could recognize them in court today. So there's three of them.
MS. JOHNSON: And those are Government Exhibit B400, Government Exhibit B500 and Government Exhibit B600?
ENRIQUE SANTOS: Correct.
MS. JOHNSON: And you see your initials on the exhibit stickers?
ENRIQUE SANTOS: Yes.
MS. JOHNSON: And for each of those three extractions, you previously testified you followed a similar process, is that right?
ENRIQUE SANTOS: Correct.
MS. JOHNSON: And what kind of extraction were you able to obtain using the GrayKey tool for those three phones?
ENRIQUE SANTOS: There are different levels of extractions. We were able to achieve something called a full file system extraction for each of these devices.
MS. JOHNSON: And what is a full file system extraction?
ENRIQUE SANTOS: For an iOS device, such as these three, it's the most complete form of extraction we can perform on a digital device.
MS. JOHNSON: Is iOS the operating system for Apple iPhone?
ENRIQUE SANTOS: Correct.
MS. JOHNSON: During your extraction of these three devices, were there any indications of errors during those extractions?
ENRIQUE SANTOS: Not that I remember.
MS. JOHNSON: When you received the phones, at a high level, what condition were they in?
ENRIQUE SANTOS: They were in generally fine shape. I mean there's -- some of the devices are cracked, but it didn't affect the operability of the devices.
MS. JOHNSON: And what, if any, indication of previous repairs did you observe on one of the devices?
ENRIQUE SANTOS: There was one device for which the IMEI number printed externally on the device did not match the, what the internal iOS setting was in the system settings menu.
MS. JOHNSON: And what could that indicate?
ENRIQUE SANTOS: That that specific phone had been previously repaired.
MS. JOHNSON: And what's an IMEI number?
ENRIQUE SANTOS: It's an acronym that stands for International Mobile Equipment Identifier, and it's a number that's usually assigned to a device when it's manufactured.
MS. JOHNSON: Does each device have a unique IMEI number?
ENRIQUE SANTOS: Yes.
MS. JOHNSON: Are forensic tools like the ones that we've discussed able to extract data from electronic devices where that data has been deleted from the device itself?
ENRIQUE SANTOS: The IMEI number?
MS. JOHNSON: No. I'm sorry. Let me back up. Do forensic tools offer the capability to recover deleted data from an electronic device like a cell phone?
ENRIQUE SANTOS: Yes.
MS. JOHNSON: OK. And what, if anything, did you observe in this case regarding the extraction of deleted items in the three iPhones that you examined?
ENRIQUE SANTOS: We recovered several deleted records.
MS. JOHNSON: Were you asked to view some select text message threads from the Cellebrite reader reports in this case?
ENRIQUE SANTOS: Yes.
MS. JOHNSON: And can you explain what effect, if any, the recovery of deleted data has on how the deleted data appears in the Cellebrite report?
ENRIQUE SANTOS: Yes. The messages that I was given to review, I was able to confirm that those -- that at least a good portion of those messages were deleted. And the effect that it had was that those messages were in various states of deletion. So what you would see is that certain fields were missing or corrupted. So, for example, there might have been a contact whose name was missing or they were, like, weird characters that you wouldn't normally associate with someone's name.
MS. JOHNSON: OK. And what effect, if any, does Cellebrite's decoding have on the message threads that would appear in the Cellebrite reader platform?
ENRIQUE SANTOS: There was -- there were a couple messages where the name of one of the participants in a message thread was missing. I mean we were able to figure out who it was, and I think in -- in most, if not all, cases, the participant's name was Casandra.
MS. JOHNSON: And can the way that cell-phone data appears on the Cellebrite reader platform look different if it's taken out of the Cellebrite platform and put into a different tool?
ENRIQUE SANTOS: Yes.
MS. JOHNSON: Ms. Becker, could you please pull up what's in evidence and publish Government Exhibit B-504.
MS. JOHNSON: Mr. Santos, is this an example of a Cellebrite reader report?
ENRIQUE SANTOS: Yes. This is a PDF version of the report.
MS. JOHNSON: OK. And I want to just direct your attention to the green bubble.
MS. JOHNSON: And in particular, Ms. Becker, if you could blow up the time stamp at the bottom of that bubble.
MS. JOHNSON: Looking at that time stamp, what does UTC plus zero mean?
ENRIQUE SANTOS: So, UTC is an acronym that stands for Universal Coordinated Time, and it's also known as, like, Greenwich time. It's basically like the referenced time zone by which the rest of the world sets its clocks to.
MS. JOHNSON: And when it says UTC plus zero, does that mean that the time stamp is in UTC?
ENRIQUE SANTOS: Correct. This hasn't been adjusted to New York or whatever time zone.
MS. JOHNSON: If it had been adjusted to, for example, East Coast time in New York, how, if at all, would it look different in the Cellebrite report?
ENRIQUE SANTOS: The time would be adjusted by either four or five hours to reflect the Eastern time zone, depending on whether you're in Daylight or Standard time.
MS. JOHNSON: And specifically as to how the report would look, would that be reflected as UTC minus four or UTC minus five on the time stamp?
ENRIQUE SANTOS: Correct.
MS. JOHNSON: You can take that down now, Ms. Becker. And the government would offer at this time Government Exhibit 1310, which is a stipulation related to UTC.
THE COURT: 1310 will be admitted.
(Government Exhibit 1310 received in evidence)
BY MS. JOHNSON:
MS. JOHNSON: Mr. Santos, a few more questions about Cellebrite reader reports. For chat threads that contain audio messages, how do the audio messages appear in a PDF Cellebrite report?
ENRIQUE SANTOS: You would see the name of the file, and then you would have a link that, if clicked, would open up the actual audio file within a media player.
MS. JOHNSON: And are the audio files extracted separately as standalone audio files?
ENRIQUE SANTOS: Correct. If you export a PDF version of the report, any media files would exist within a different directory.
MS. JOHNSON: And is the link that's within the PDF the same name as the audio file that's exported?
ENRIQUE SANTOS: Yes.
MS. JOHNSON: And again, focusing on PDF exports, are emojis always visible in chat threads in the PDF exports?
MS. JOHNSON: And why is that?
ENRIQUE SANTOS: So, PDFs only support a specific set of characters. They don't quite support every single emoji that's available on your cell phone. So Adobe, for example, may encounter a certain emoji that it doesn't recognize and can't interpret it accurately, so it might appear as, like, a weird character.
MS. JOHNSON: Turning to screenshots, if a user takes a screenshot on a cell phone, what type of file is created when a screenshot is made?
ENRIQUE SANTOS: Usually it's an image.
MS. JOHNSON: And what, if any, metadata is associated with an image file, with a screenshot image file?
ENRIQUE SANTOS: Normally you would expect to see something like a creation date, a modified date. You would see the name of the file, and in addition to that, you will see the location where that file is stored within the phone's folder structure.
MS. JOHNSON: And is that metadata preserved when an image, the screenshot is forensically extracted from the phone?
ENRIQUE SANTOS: Yes.
MS. JOHNSON: Ms. Becker, can you please pull up and publish what's in evidence as Government Exhibit C-361-C-M, page 2, please. And if you could zoom in on the middle.
MS. JOHNSON: Mr. Santos, is this another extraction from a Cellebrite report?
ENRIQUE SANTOS: Yes.
MS. JOHNSON: And I just want to direct your attention to the middle box with the created, modified, access and capture time information and then walk through those. What does the created time stamp -- what could that reflect?
ENRIQUE SANTOS: For an iOS device, it usually reflects the time and date that the file was created on that specific device.
MS. JOHNSON: And could that be a time and date that a file was transferred to that device, for example?
ENRIQUE SANTOS: Correct.
MS. JOHNSON: And what does the modified date typically reflect?
ENRIQUE SANTOS: There may be some cases where you may modify an image by editing it. In this case, it doesn't seem like that happened, so the modified date is the same date and time as the created date.
MS. JOHNSON: And what about the access date?
ENRIQUE SANTOS: Just what it implies, the last date and time that the file was accessed.
MS. JOHNSON: And then looking at the bottom, where it says capture time, what does capture time reflect?
ENRIQUE SANTOS: So, this is probably the most accurate reflection of when that file was captured.
MS. JOHNSON: OK. And then just directing your attention to the last on the file path, the embedded part of the file path that says CPL assets, are you aware what that refers to?
ENRIQUE SANTOS: Yes. That's a known directory where photos from Apple iCloud are usually stored.
MS. JOHNSON: No further questions at this time.
THE COURT: All right. Thank you, Ms. Johnson.
MS. GERAGOS: Just a few, your Honor.
CROSS-EXAMINATION BY MS. GERAGOS:
MS. GERAGOS: Mr. Santos, I just have a few questions. You testified that you extracted devices that you learned belonged to Ms. Ventura, correct?
ENRIQUE SANTOS: Yes.
MS. GERAGOS: And there were multiple different phones, right?
ENRIQUE SANTOS: Yes.
MS. GERAGOS: And we talked a little bit about deleting messages, but if you could just -- if I could ask a few questions about that. Is it true that there were many deleted messages on those iPhones?
ENRIQUE SANTOS: Yes.
MS. GERAGOS: And about two-thirds of the messages were deleted -- I should say two-thirds of the messages provided to you to review you had found were deleted messages on those devices?
ENRIQUE SANTOS: Yes.
MS. GERAGOS: OK. And can you just explain to us, like, when a message is deleted, how are you able to then recover it within -- when you do the extraction?
ENRIQUE SANTOS: So, just because you mark a file for deletion doesn't mean it goes all the way -- goes away, you know, instantly, at least not always. I mean that could be a scenario for certain applications. I believe most of these messages were WhatsApp, and it just so happened that for -- in these cases the messages were marked for deletion and although they're not accessible to the user, they still exist within the phone's operating system. They're just hidden. And what happens is that over time, as the phone creates new records and needs space to store the new records, it will start to overwrite older data. So that's what happened for some of these messages that I had a chance to review, is that certain tables where this data was kept started to go away.
MS. GERAGOS: Understood. All right. And then we talked a little bit about emojis and Cellebrite reports and Adobe and PDFs, so I want to ask you questions about that. When you do a forensic extraction, you save that extraction and it's accessible, I think, you said in Cellebrite, right?
ENRIQUE SANTOS: Yes.
MS. GERAGOS: But you can also -- an individual looking at your extraction can also put those extractions in a different platform, right?
ENRIQUE SANTOS: That's right. There's several different tools that are available to parse and analyze data.
MS. GERAGOS: But when you do the extraction, emojis and messages that are sent within it, those are preserved within the extraction, so even though it might not show up in Adobe, it may show up in another platform, right?
ENRIQUE SANTOS: Yes.
MS. GERAGOS: OK. Thank you. We just looked at C-361-C-M, and you talked about the capture date.
MS. GERAGOS: If we could bring that up really quickly, and just look at my last question, page 2.
MS. GERAGOS: You said that the capture date -- while we bring this up, the capture date is probably the most accurate as to when a file was captured. But it's probably or it is? If you could just look at that capture date, September 30, your testimony said it's probably the most accurate, because we're looking at one, two, three different dates here at the top. Right?
ENRIQUE SANTOS: So, when it comes to trying to determine the source of a picture or when something was taken, as an examiner we don't like to speak in absolute terms. We speak in, like, probability, because even -- unless I was there to witness the picture being taken, we speak to the likelihood of, you know, this was captured at this time and date. But in my experience and from what I get from my training is that the capture date is the most accurate reflection of when that picture was taken or screenshotted.
MS. GERAGOS: And it's just -- the capture date is an accurate reflection of the screenshot but not of the conversation itself, right?
ENRIQUE SANTOS: That would be my understanding.
MS. GERAGOS: OK. Great. One moment, your Honor? All right. Thank you so much, Mr. Santos.
THE COURT: Ms. Johnson, anything further?
MS. JOHNSON: No, your Honor.
THE COURT: Thank you very much, Mr. Santos.
ENRIQUE SANTOS: Thank you.
(Witness excused)
MS. FOSTER: Your Honor, before the next witness, the government would offer a stipulation between the parties, which has been marked Government Exhibit 1309.
THE COURT: All right. Government Exhibit 1309 will be admitted.
(Government Exhibit 1309 received in evidence)
MS. FOSTER: Ms. Gavin, could we just briefly publish it.
MS. COMEY: While that's being pulled up, your Honor, I'll also -- oh, there it is.
MS. FOSTER: And the next page as well. And then one more. OK. Thank you. You can take that down.
MS. COMEY: Your Honor, I've marked for identification a document as Government Exhibit 1503. It contains three different lists of exhibits that the government is going to offer before the next witness's testimony. The exhibits listed under the header "sealed GX" are exhibits we are offering under seal pursuant to your Honor's pseudonym order to protect a witness's identity. The exhibits offered under the header "sealed X series" are exhibits that we offer both under the pseudonym order and because they contain sexually explicit material. And the remaining exhibits are not offered under seal. And so with your Honor's permission, I will offer all of those exhibits now in evidence, and I will hand Government Exhibit 1503 as a demonstrative to the court reporter to note those exhibits in the transcript.
THE COURT: All right. Any objection?
MS. GERAGOS: No, your Honor.
THE COURT: All right. The exhibits in Government Exhibit 1503 will be admitted on the basis specified.
(Government Exhibits 3R-101, 3R-121, 3R-122, 3R-123, 4H-122, A-104-1 through A-104-12, A-104-16, A-104-17, A-104-19 through A-104-29, A-104-34, A-104-37, A-104-40, A-104-40A, A-104-40B, A-104-41, A-104-42, A-104-44, A-104-46, A-104-48, A-104-49, A-104-53, A-104-54, A-104-55, A-104-59, A-104-61 through A-104-71, A-104-74, A-104-75, A-207-A, A-207-B, A-301-B, A-301-C, A-301-G ,A-301-H, A-301-I, A-301-J, A-301-N, A-301-P, A-442-1, A-442-3, A-442-4, A-442-5, A-442-11, A-442-12, A-442-13, A-442-16, A-442-17, A-442-18, A-442-19, A-442-20, A-442-22 ,A-442-29, A-442-30, A-442-34, A-442-35, A-442-35A, A-442-35B, A-442-37 through A-442-43, A-510-B, A-510-C, A-510-D, A-510-E, A-510-G, A-510-H, A-906, A-1202-A, C-348-A, C-348-B, C-261, E-103, E-103-M, E-105, E-105-M, E-108, E-108-M, E-110 through E-131, E-110-M through E-131-M, E-133 through E-138, E-133-M through E-138-M, E-141, E-141-M, E-144 through E-150, E-144-M though E-150-M, E-152, E-152-M, E-156, E-156-M, E-160, E-160-M, E-168, E-168-M, E-169, E-169-M, E-185, E-185-M, E-186, E-186-M, E-188 through E-196, E-188-M through E-196-M, E-198, E-198-M, E-206, E-206-M, E-207, E-207-M, E-209 through E-213, E-209-M through E-213-M, E-238, E-238-M, E-248, E-248-M, E-252, E-252-M, E-253, E-253-M, E-255 through E-257, E-255-M through E-257-M, E-259, E-259-M, E-260 through E-268, E-260-M through E-268-M, E-271, E-271-M, E-272, E-272-M, E-273, E-273-M, E-278, E-278-M, E-279, E-279-M, E-281, E-281-M, E-282, E-282-M, E-283, E-283-M, E-285, E-285-M, E-286, E-286-M, E-287, E-287-M, E-288, E-288-M, E-289, E-289-M, E-292 through E-298, E-292-M through E-298-M, E-306, E-306-M, E-307, E-307-M, E-321, E-321-M, E-332, E-332-M, E-333, E-333-M, F-101, G-101, G-102, G-103, G-203, G-213, G-214, J-107-A and J-107-B, sealed, received in evidence)
(Government Exhibits AX-101, AX-101-A, AX-101-B, AX-101-B1, AX-101-C, AX-102, AX-102-A, AX-102-B, AX-102-C, AX-102-D, AX-102-D1, AX-102-E, AX-103, AX-103-A, AX-104, AX-104-A, AX-105, AX-105-C, AX-105-C1, AX-105-D, AX-105-E, AX-108, AX-701, AX-701-65, AX-701-65A, AX-701-71, AX-701-73, AX-701-77, AX-701-79, AX-701-79-A, AX-701-79-B, AX-701-79-BT (aid), AX-701-81, AX-702, AX-702-F, AX-702-F1, GX AX-703, AX-703-33, AX-703-35, AX-703-42, AX-703-42A, AX-703-90, AX-703-91, AX-703-91A, AX-1102, AX-1102-A, AX-1102-A1, EX-101 through EX-121, EX-165, EX-165-A, EX-165-M, EX-166, EX-166-A, EX-166-M, EX-167, EX-167-A, EX-167-M, EX-170, EX-170-M, EX-177, EX-177-M, EX-178, EX-178-M, EX-179, EX-179-A, EX-179-M, EX-180, EX-180-M, EX-181, EX-181-A, EX-181-M, EX-182, EX-182-M, EX-184, EX-184-A, EX-184-M, EX-185 and EX-185-M, X-series, received in evidence)
(Government Exhibits 3R-103 through 3R-120, 9A-101, 9A-102, 9S-101, C-348, E-102, E-102-M, E-106, E-106-M, E-139, E-139-M, E-163, E-163-M, E-177, E-177-M ,E-260, E-260-M, E-265, E-265-M, E-266, E-266-M, E-267, E-267-M, E-268, E-268-M, E-290, E-290-M, E-303, E-303-M, E-304, E-304-M, E-305, E-305-M, E-183, E-183-M, E-184, E-184-M, E-221, E-221-M, E-222, E-222-M, E-223, E-223-M, E-247, E-247-M, E-249, E-249-M, E-250, E-250-M, E-251, E-251-M, E-258 and E-258-M, public, received in evidence)
MS. COMEY: Thank you, your Honor. At this time the government calls the witness testifying under the pseudonym Jane.
THE COURT: OK. Members of the jury, I will remind you of the instruction that I gave previously, which is you are about to hear from a witness testifying under a pseudonym; that is, not using her real name. The government, the defense, the Court and you, the jury, will know her real name. Her name will not be used in open court solely to protect her privacy from disclosure to persons who are not parties to this case. The fact that this witness is testifying using a pseudonym does not mean that her testimony is deserving of greater or lesser weight than that of any other witness. With that, Ms. Comey, we'll bring the witness in.
MS. COMEY: Thank you. And while she's coming in, could I please ask your deputy to confirm that the exhibit screens in the overflow have been turned off and that the public screen in this courtroom has also been turned off?
COURT CLERK: Confirmed. I cannot see the monitor from here, but I'm sure it has happened as well.
MS. COMEY: Thank you very much. JANE, called as a witness by the government, having been duly sworn, testified as follows:
THE COURT: Ms. Comey, you may proceed when ready.
MS. COMEY: Thank you, your Honor.