03071 – July 3rd 2002 – Transcript of David Westerfield Trial Day 16 – morning 1

The full Marcus Lawson report on what he found on Westerfield’s computers is available here

TRIAL DAY 16 – PART 1- morning 1
SAN DIEGO, CALIFORNIA, WEDNESDAY, JULY 3, 2002, 8:58 A.M. (morning 1)


WITNESS:
Marcus Lawson (President of Global Compusearch, testified about what was on Westerfield’s computer drives, zip, cds)

–O0O–

(THE FOLLOWING OCCURRED OUT OF THE PRESENCE OF THE JURY:

(PROCEEDINGS NOT PART OF THE PUBLIC RECORD.)

(END OF PROCEEDINGS OUT OF THE PRESENCE OF THE JURY.)

THE COURT: GOOD MORNING, LADIES AND GENTLEMEN.
MY EXTENDED FAMILY IN ST. LOUIS HAS INDICATED THEY WOULD LOVE TO HAVE THE PADRES SPEND THE REST OF THE SUMMER BACK THERE AND SOLIDIFY THEIR POSITION AS NUMBER ONE IN THE CENTRAL DIVISION. I DON’T KNOW WHAT TO TELL YOU. BUT, YOU KNOW, AT LEAST IT IS A DIVERSION. I WILL SAY THAT.
ALL RIGHT. MR. FELDMAN.
MR. FELDMAN: THANK YOU, YOUR HONOR.
CALL MARCUS LAWSON.

MARCUS LAWSON,
CALLED AS A WITNESS BY THE DEFENDANT, HAVING BEEN DULY SWORN, TESTIFIED AS FOLLOWS:
THE CLERK: SIR, WOULD YOU PLEASE STATE YOUR NAME AND SPELL IT FOR THE RECORD.
THE WITNESS: MY NAME IS MARCUS LAWSON. M-A-R-C-U-S
L-A-W-S-O-N.
MR. FELDMAN: PROCEED, YOUR HONOR?
THE COURT: YES, SIR.
DIRECT EXAMINATION
BY MR. FELDMAN
Q.: SIR, WHAT’S YOUR PRESENT OCCUPATION?
A.: I’M THE PRESIDENT OF GLOBAL COMPUSEARCH. WE ARE A COMPUTER FORENSICS FIRM LOCATED IN SPOKANE, WASHINGTON.
Q.: CAN YOU TELL ME, SIR, A LITTLE BIT ABOUT YOUR ACADEMIC TRAINING, PLEASE.
A.: I HAVE A BACHELOR’S DEGREE IN THE ADMINISTRATION OF JUSTICE FROM PORTLAND STATE UNIVERSITY. AND I ALSO HAVE A J. D. DEGREE FROM PEPPERDINE UNIVERSITY SCHOOL OF LAW IN MALIBU.
Q.: HAVE YOU SERVED AS AN ADJUNCT PROFESSOR AT ANY INSTITUTIONS?


A.: AT PORTLAND STATE UNIVERSITY I HAVE.
Q: WITH REGARD TO YOUR POST-EDUCATIONAL TRAINING, COULD YOU TELL THE JURY A LITTLE ABOUT THAT, PLEASE.
A.: POST EDUCATION IS I LEFT LAW SCHOOL IN 1983. WHEN I GRADUATED, I TOOK A JOB WITH U. S. SECRET SERVICE. THE FIRST LAW ENFORCEMENT ACADEMY I WENT TO WAS THE BASIC LAW ENFORCEMENT ACADEMY FOR TREASURY AGENTS IN 1983. THAT’S IN GLENCO, GEORGIA. SHORTLY AFTER GRADUATING FROM THAT, I WENT TO THE U. S. SECRET SERVICE TRAINING ACADEMY WHICH WAS AT THAT TIME IN WASHINGTON, D. C.
Q.: SUBSEQUENT TO YOUR TRAINING AT THE SECRET SERVICE, DID YOU MOVE TO ANY OTHER FEDERAL AGENCIES, SIR?
A.: YES. I WAS A SECRET SERVICE AGENT FOR APPROXIMATELY FOUR YEARS. AFTER THAT I WENT TO THE DRUG ENFORCEMENT ADMINISTRATION. I WENT TO THE DRUG ENFORCEMENT ADMINISTRATION ACADEMY IN QUANTICO. I HAVE FORGOTTEN THE EXACT MONTHS. 1987 WAS A D. E. A. AGENT ASSIGNED TO THE LOS ANGELES FIELD OFFICE FOR APPROXIMATELY TWO YEARS.
Q.: SUBSEQUENT TO YOUR ASSIGNMENT WITH THE D. E. A., DID YOU — WHAT WAS YOUR NEXT ASSIGNMENT?
A.: FROM D. E. A. I WENT TO THE UNITED STATES CUSTOMS SERVICE. I WAS A SPECIAL AGENT WITH U. S. CUSTOMS BEGINNING IN 1988 AND CONTINUING UNTIL AUGUST OF 2000.
Q.: DID YOU HAVE ANY AREAS OF SPECIALIZATION WITHIN THE UNITED STATES CUSTOMS SERVICE?
A.: YES, I DID.
Q.: CAN YOU TELL US WHAT THOSE AREAS OR AREA IS OR WERE?
A.: MY AREA OF SPECIALIZATION WITH U. S. CUSTOMS WAS THE INVESTIGATION OF CHILD PORNOGRAPHY CRIMES.
Q.: AND SO YOU HAVE BEEN INVESTIGATING CHILD PORN. CRIMES SINCE 1988, SIR?
A.: SINCE 1988, THAT’S CORRECT.
Q.: HOW DID THIS PROCESS BEGIN?
A.: INITIALLY IN 1988, WHEN I CAME TO CUSTOMS FROM D. E. A., I WAS INTERESTED IN INVESTIGATING SOME OTHER CRIMES OTHER THAN NARCOTICS. I LEARNED THAT IN THE ACADEMY THAT U. S. CUSTOMS INVESTIGATED THE IMPORTATION AND DISTRIBUTION OF CHILD PORNOGRAPHY AND BECAME INTERESTED IN INVESTIGATING THOSE TYPES OF CRIMES MYSELF. I DEVELOPED AN UNDERCOVER PROGRAM THAT BASICALLY USED A LOT OF THE SAME TECHNIQUES THAT WE HAD USED IN D. E. A. FOR DRUG UNDERCOVER OPERATIONS AND PUT TOGETHER AN UNDERCOVER OPERATION FOR CHILD PORNOGRAPHY IN THE NORTHWEST. IT WAS REASONABLY SUCCESSFUL. THERE WERE SEVERAL ARRESTS. AND, AS A RESULT, LIKE MANY THINGS IN THE GOVERNMENT, IT SORT OF BECAME MY SHTICK, MY AREA OF EXPERTISE.
Q.: HAVE YOU EVER TAUGHT LAW ENFORCEMENT IN THE AREA OF COMPUTER-RELATED CHILD PORNOGRAPHY?
A.: YES, I HAVE.
Q.: WHAT PARTICULAR LAW ENFORCEMENT AGENCIES HAVE YOU TAUGHT, SIR?
A.: I’M GOING TO HAVE TO REFER TO MY LIST IF THAT’S ALL RIGHT.
Q.: PLEASE.
A.: WHAT I’M REFERRING TO IS I HAVE MY C.V. ON THE STAND, A LIST OF SOME OF THE TRAINING THAT I’VE GIVEN AND RECEIVED AND THEN ALSO THE REPORT AND NOTEBOOK THAT I PREPARED FOR THIS CASE.
THE LIST OF TRAINING THAT I’VE GIVEN TO OTHER LAW ENFORCEMENT PERSONNEL SINCE 1988, AND THIS IS SPECIFICALLY RELATED TO CHILD PORNOGRAPHY AND/OR COMPUTER EVIDENCE IN CHILD PORNOGRAPHY CASES, THE CRIME VICTIMS ASSISTANCE NETWORK IN ASHLAND, OREGON; CUSTOMS CYBER SMUGGLING CENTER IN VIRGINIA; GREAT FALLS, MONTANA, CUSTOMS-SPONSORED SEMINAR FOR MONTANA LAW ENFORCEMENT; NORTHWEST CHILD EXPLOITATION SEMINAR; CRIME VICTIMS ASSISTANCE NETWORK IN EUGENE, OREGON; SPOKANE U. S. ATTORNEY’S OFFICE; SPOKANE/IDAHO PUBLIC DEFENDERS OFFICE; SPOKANE COUNTY PROSECUTOR’S OFFICE; SPOKANE POLICE DEPARTMENT; COWLITZ COUNTY SHERIFF’S OFFICE; LONGVIEW, WASHINGTON, POLICE DEPARTMENT; KELSO, WASHINGTON, POLICE DEPARTMENT; RICHLAND, WASHINGTON, POLICE DEPARTMENT; PASCO, WASHINGTON, POLICE DEPARTMENT; THREE FEDERAL GRAND JURIES IN THE EASTERN DISTRICT OF WASHINGTON; LONGVIEW POLICE DEPARTMENT; KELSO POLICE DEPARTMENT; CITIZENS POLICE ACADEMY; MIDWEST AMERICAN PROBATION/PAROLE OFFICERS ASSOCIATION IN CHICAGO; FEDERAL PUBLIC DEFENDERS INVESTIGATORS ASSOCIATION IN KANSAS CITY, MISSOURI; PIERCE COUNTY SHERIFF’S OFFICE; CLATSOP COUNTY DISTRICT ATTORNEY; PACIFIC COUNTY SHERIFF’S OFFICE; PACIFIC COUNTY DISTRICT ATTORNEY; EUGENE, OREGON, POLICE DEPARTMENT; AMERICAN PROBATION/PAROLE OFFICERS ASSOCIATION; ASTORIA POLICE DEPARTMENT; OREGON STATE POLICE; AND APPROXIMATELY TWENTY PUBLIC SERVICE GROUPS THROUGHOUT THE NORTHWEST.
Q.: HAVE YOU EVER HAD OCCASION TO TEACH, FOR INSTANCE, AT THE F. B. I. OR THE UNITED STATES POSTAL SERVICE?
A.: THE NORTHWEST CHILD EXPLOITATION SEMINAR WAS A SEMINAR THAT I COORDINATED. MY AGENCY SPONSORED IT. AND I COORDINATED AND TAUGHT AT THAT SEMINAR. AND WE TAUGHT A NUMBER OF FEDERAL AGENCIES THAT CAME TO THAT SEMINAR, INCLUDING THE F. B. I., POSTAL INSPECTORS. AND I BELIEVE THERE WERE EVEN TWO DEPUTIES FROM THE SAN DIEGO COUNTY SHERIFF’S OFFICE THAT ATTENDED THAT.
Q.: SIR, NOW, YOU TOLD US THAT YOUR PRESENT OCCUPATION WAS AS THE — I’M SORRY. I THINK YOU SAID PRESIDENT OF GLOBAL COMPUSEARCH.
A.: YES.
Q.: WHAT SORT OF COMPANY — WHAT’S THE PURPOSE OF YOUR COMPANY?
A.: WE ASSIST ATTORNEYS THAT ARE INVOLVED IN LITIGATION ISSUES REGARDING ANYTHING TO DO WITH COMPUTERS IN THE COURTROOM. IT CAN INCLUDE RECOVERING EVIDENCE FOR DISCOVERY. WE HAVE A NUMBER OF CRIMINAL CASES. WE ASSIST ATTORNEYS INVOLVED IN LITIGATION WITH COMPUTERS USE.
Q.: AND HAVE YOU QUALIFIED AS AN EXPERT WITNESS IN THE COURTS IN THE UNITED STATES?
A.: YES, I HAVE.

Q.: SIR, DO YOU HAVE CERTAIN FORENSIC TOOLS THAT YOU UTILIZE TO ASSIST ATTORNEYS IN THE INVESTIGATION OF COMPUTER-RELATED ISSUES?
A.: YES, SIR.
Q.: WHAT KIND OF FORENSIC TOOLS?
A.: IN OUR LABORATORY ACTUALLY HAS A NUMBER OF FORENSICS TOOLS. THE PRIMARY TOOL THAT I USE AND WAS USED IN THIS CASE IS A FORENSIC SOFTWARE CALLED EN CASE.
Q.: I’M SORRY. E-N-D-C-A-S-E?
A.: CAPITAL E-N CAPITAL C-A-S-E.
Q.: AND WHAT’S END CASE?
A.: IT’S EN. EN CASE.
IT’S A FORENSIC SOFTWARE THAT ALLOWS THE INVESTIGATION OF COMPUTER MEDIA WITHOUT ALTERING THE ORIGINAL MEDIA IN TERMS OF TIMES AND DATES AND THINGS LIKE THAT.
Q.: YOU’VE PREPARED A SERIES OF SCREEN PRINTS, HAVE YOU NOT? AT LEAST TWO — LET ME JUST SHOW YOU A FEW DOCUMENTS, SLIGHTLY OUT OF SEQUENCE, BUT I’LL COME BACK TO THIS.
MR. FELDMAN: COUNSEL.
BY MR. FELDMAN:
Q.: IN CONNECTION WITH THIS CASE, SIR, WERE YOU RETAINED BY THE DEFENSE TO ASSIST US?
A.: YES, I WAS.
Q.: AND WHAT DID YOU UNDERSTAND YOUR ASSIGNMENT TO BE?
A.: I WAS CONTACTED BY YOUR OFFICE APPROXIMATELY A MONTH AGO, AND I WAS ASKED TO REVIEW COMPUTER DISCOVERY THAT YOU HAD OBTAINED OR WERE ABOUT TO OBTAIN. I DON’T RECALL THAT I RECEIVED ANY SPECIFIC DIRECTIONS FROM YOU OTHER THAN REQUESTING TO KNOW WHAT WAS ON THE COMPUTER MEDIA AND IF THERE WERE ANY ISSUES OF IMPORTANCE.
Q.: WERE YOU EVER ASKED OR DID ANY MEMBER OF THE DEFENSE TEAM ASK YOU TO DETERMINE WHO DOWNLOADED ANY IMAGES?
A.: NO. THAT WOULD — THAT WOULD BE AN ISSUE THAT I WOULD ALWAYS LOOK AT. THERE WAS NO SPECIFIC REQUEST TO DO SO BY YOUR OFFICE.
Q.: AS A RESULT OF THE REQUEST THAT CAME FROM OUR OFFICE, WHAT, IF ANYTHING, DID YOU DO FOR THE PURPOSE OF OBTAINING THE COMPUTER MEDIA IN THIS CASE?
A.: ACTUALLY A MEMBER OF YOUR OFFICE, MISS REBECCA JONES, SUPPLIED HARD DRIVES THAT HAD BEEN COPIED BY THE SAN DIEGO REGIONAL FORENSICS LABORATORY WHICH REPRESENTED THE COMPUTERS THAT WERE SEIZED IN THIS CASE. THOSE COMPUTERS WERE ACQUIRED IN EN CASE AND EXAMINED INITIALLY HERE IN SAN DIEGO. AFTER DETERMINING THAT MOST OF THE MEDIA DIDN’T CONTAIN ANY KIND OF QUESTIONABLE IMAGE, I REQUESTED THAT THOSE HARD DRIVES THEN BE SENT TO MY OFFICE IN SPOKANE, WASHINGTON, SO THAT I COULD ANALYZE THEM WITH MORE DETAIL.
Q.: AND ULTIMATELY DID YOU RECEIVE A CERTAIN NUMBER OF HARD DRIVES IN YOUR OFFICE?
A.: YES, I DID.
Q.: CAN YOU TELL US HOW MANY DIFFERENT COMPUTER HARD DRIVES DID YOU CHECK?
A.: I RECEIVED ACTUALLY FOUR COMPUTER HARD DRIVES, ONE REPRESENTING A LAPTOP COMPUTER, AND I’M NOT CERTAIN WHERE THAT WAS INITIALLY TAKEN FROM. I RECEIVED TWO HARD DRIVES THAT REPRESENTED TWO HEWLETT-PACKARD COMPUTERS THAT WERE SEIZED FROM MR. WESTERFIELD’S OFFICE, AND ONE HARD DRIVE REPRESENTING A GATEWAY COMPUTER THAT WAS SEIZED FROM MR. WESTERFIELD’S SON’S BEDROOM.
Q.: DID YOU RECEIVE ANY LOOSE MEDIA?
A.: I’M SORRY?
Q.: DID YOU RECEIVE ANY LOOSE MEDIA?
A.: (NO RESPONSE.)
Q.: DID YOU RECEIVE ANY LOOSE MEDIA?
A.: NOT IN SPOKANE. I INVESTIGATED THE LOOSE MEDIA HERE IN SAN DIEGO.
Q.: SO IN SAN DIEGO DID YOU GO TO — YOU WERE ABLE TO AT LEAST EVALUATE SOME ZIP DISKS, IS THAT RIGHT?
A.: THE ZIP DISKS AND THE C.D.’S HAD BEEN COPIED BY THE SAN DIEGO REGIONAL FORENSICS LABORATORY HAD BEEN COPIED TO A HARD DRIVE. AND THAT WAS INVESTIGATED HERE IN SAN DIEGO.
Q.: AND IT WAS YOUR UNDERSTANDING THAT EVERYTHING THAT HAD BEEN INVOLVED IN THE CASE HAD BEEN PROVIDED TO YOU, IS THAT RIGHT?
A.: YES, SIR.
Q.: NOW, I’M USING THE TERM LOOSE MEDIA, AND YOU’RE USING THE TERM HARD DRIVE. IS THERE SOME MANNER IN WHICH THE LOOSE MEDIA WAS COPIED ONTO A HARD DRIVE? IS THAT YOUR UNDERSTANDING OF WHAT SAN DIEGO DID?
A.: YES, SIR.
Q.: SO ALTHOUGH THEY HAD I GUESS ZIP DISKS AND C.D.’S, YOU HAD ALL OF WHATEVER DATA WAS ON THOSE LOOSE MEDIA ON A HARD DRIVE, IS THAT RIGHT?
A.: THAT’S CORRECT.
Q.: WHAT DID YOU DO WITH THAT NOW?
A.: AS I HAD BEEN ASKED BY YOUR OFFICE, WE — I BEGAN INVESTIGATING THE MEDIA TO DETERMINE WHAT, IF ANY, CONTRABAND EXISTED ON THE MEDIA, WHO WAS RESPONSIBLE FOR THE DOWNLOADING OF ANY PARTICULAR GIVEN IMAGE. BASICALLY WHAT WAS OF EVIDENTIARY VALUE ON THE HARD DRIVES.
Q.: SO BASICALLY YOUR TASK WAS TO LOOK THROUGH THE IMAGES THAT HAD BEEN PRESENTED TO YOU AND MAKE OBSERVATIONS AND COMMENTS TO US, IS THAT RIGHT?
A.: THAT’S RIGHT.
Q.: AND YOU IN FACT DID THAT, IS THAT RIGHT?
A.: YES, SIR.
Q.: HOW MUCH TIME WOULD YOU ESTIMATE YOU’VE SPENT IN THE AREA OF YOUR INVESTIGATION IN SORTING THROUGH OR GOING THROUGH THE HARD DRIVES?
A.: AT THIS POINT ROUGHLY BETWEEN 125 AND 150 HOURS.
Q.: AND DID YOU UTILIZE THE SOFTWARE EN CASE ON EACH OF THE COMPUTERS?
A.: YES, SIR.
Q.: AND WHAT IS IT THAT EN CASE ALLOWS YOU TO DO?
A.: IT’S A VERY USEFUL FORENSICS TOOL. IT ALLOWS FOR THE INVESTIGATION OF DATA THAT’S ON A GIVEN PIECE OF MEDIA OR A HARD DRIVE WITHOUT ALTERING THE DATES OF THE FILES WHICH CAN BE VERY IMPORTANT FOR EVIDENTIARY PURPOSES. IT ALSO ALLOWS FOR THE RECOVERY OF DELETED FILES FROM THE UNALLOCATED FILE SPACE OF THE COMPUTER AND ALLOWS THE EXAMINATION OF THOSE.

Q.: I’M SORRY. YOU JUST TOLD ME IT ALLOWS FOR RECOVERY OF THE DELETED FILES AND ALLOWS FOR?
A.: THE INVESTIGATION OF FILES THAT ARE IN WHAT’S CONSIDERED TO BE ACTIVE VOLUME OR WHAT YOU SEE WHEN YOU TURN ON THE COMPUTER AND ACCESS YOUR FILES. IT WILL ALLOW YOU TO INVESTIGATE THOSE WITHOUT CHANGING DATES AND TIMES.
Q.: OKAY.
I THINK YOU USED THE TERM ACTIVE VOLUME. I THINK THAT’S A NEW TERM TO US. CAN YOU PLEASE TELL US WHAT YOU MEAN BY THAT.
A.: WHAT I MEAN IS THE FILES THAT ARE VISIBLE WHEN A PERSON SITS DOWN AND TURNS ON THE COMPUTER, THE FILES THAT COME UP AS AVAILABLE ON THE — IN THE EXPLORER TREE WHEN YOU CLICK ON DIFFERENT FOLDERS AND OPEN THEM. THE FILES THAT ARE THERE VISIBLE FOR A PERSON TO USE, SEE.
Q.: CAN YOU TELL HOW AND WHEN DATA WAS ACQUIRED?
A.: YES. OFTEN.
Q.: CAN YOU FIND OUT WHAT ACTIVITY WAS PERFORMED ON A PARTICULAR DATE?
A.: QUITE OFTEN, YES.
Q.: ARE THERE OTHER THINGS THAT THE SOFTWARE OR YOUR TRAINING AND EXPERIENCE ALLOWS YOU TO DETERMINE?
A.: IT WILL ALLOW YOU TO DETERMINE IN SOME CASES WHO A PARTICULAR COMPUTER USER IS AND WHAT THEIR ACTIVITY WAS ON A SPECIFIC DATE.
Q.: HOW?
A.: THAT IS USUALLY DONE, AT LEAST IN MY OFFICE IT’S USUALLY DONE BY ATTEMPTING TO DETERMINE FROM THE COMPUTER DATA THAT’S AVAILABLE PERSONAL THINGS THAT RELATE TO A SPECIFIC INDIVIDUAL, THAT RELATE ONLY TO THAT PERSON, AND THEN DETERMINING THE DATE AND TIME THAT THOSE FILES WERE ACCESSED, AND THEN COMPARING THAT TO WHAT OTHER ACTIVITY OCCURRED ON THE COMPUTER IN AND AROUND THAT DATE AND TIME.
Q.: WHAT SORT OF PERSONAL THINGS CAN YOU IDENTIFY?
A.: FOR INSTANCE, ONE OF THE COMMON THINGS THAT I DO IN VIRTUALLY EVERY CASE THAT WE GET THAT INVOLVES THIS SORT OF INVESTIGATION IN TERMS OF DETERMINING WHO IS USING THE COMPUTER IS A WORD SEARCH FOR THE DIFFERENT E-MAIL ADDRESSES, THE DIFFERENT INTERNET — EXCUSE ME — DIFFERENT INTERNET-BASED
E-MAIL SERVICES THAT ARE AVAILABLE, SUCH AS HOT MAIL AND YAHOO MAIL. AND I WILL RUN A WORD SEARCH FOR THE WORD HOT MAIL DOT COM. WHICH WILL SEARCH THROUGH THE COMPUTER’S BOTH ACTIVE VOLUME AND THE DELETED FILES AND BRING UP INSTANCES WHERE AT HOT MAIL DOT COM. WAS USED.
Q.: WITH REGARD TO THE PROGRESS OF YOUR INVESTIGATION, SIR, DID YOU FIRST — DID YOU START WITH ANY PARTICULAR ONE OF THE HARD DRIVES?
A.: I STARTED WITH THE GATEWAY HARD DRIVE.
Q.: OKAY.
THAT’S THE HARD DRIVE THAT CAME FROM WHICH ROOM OR YOU’VE IDENTIFIED AS HOW?
A.: THE SON’S BEDROOM.
Q.: ALL RIGHT.
AND WHAT WERE YOU LOOKING AT THE GATEWAY FOR?
A.: AGAIN IT WAS ONE OF THE PIECES OF MEDIA THAT WAS SUPPLIED WAS A HARD DRIVE REPRESENTING THE GATEWAY COMPUTER. AND AS I INDICATED, WE BEGAN THAT REVIEW TO DETERMINE WHAT, IF ANY, EVIDENCE WAS THERE THAT WOULD BE OF INTEREST TO YOU OR THE PROSECUTOR OR OF INTEREST IN THIS CASE.
Q.: AND WHEN YOU INITIALLY REVIEWED THE HARD DRIVE, WHAT, IF ANYTHING, DID YOU NOTE?
A.: IF I MAY REFER TO MY REPORT, . . .
Q.: PLEASE.
A.: I HAVE A GREAT DEAL OF MEDIA, AND IT’S VERY DIFFICULT TO KEEP TRACK OF IT ALL IN MY HEAD.
MR. CLARKE: I’M SORRY. MAY I APPROACH JUST TO SEE WHAT THE WITNESS IS LOOKING AT?
THE COURT: SURE.
MR. FELDMAN: HE’S GOT IT, YOUR HONOR.
(PAUSE.)
MR. FELDMAN: YOUR HONOR, FOR THE RECORD, WE HAVE PROVIDED COUNSEL WITH DISCOVERY.
THE COURT: ALL RIGHT.
THE WITNESS: OKAY. I’M READY.
BY MR. FELDMAN:
Q.: CAN YOU TELL ME, PLEASE, AT LEAST WITH REGARD TO THE GATEWAY COMPUTER WHAT DID YOU OBSERVE?
A.: ONE OF THE ITEMS OF INTEREST THAT I NOTED WAS THAT THE COMPUTER INITIALLY — I NEED TO BACK UP. INITIALLY I DID NOT KNOW THAT MR. WESTERFIELD EVEN HAD A SON. ALL I KNEW THE GATEWAY COMPUTER HAD BEEN SEIZED FROM A BEDROOM.
Q.: ALL RIGHT.
A.: I DIDN’T KNOW IF THAT WAS MR. WESTERFIELD’S BEDROOM OR WHOSE BEDROOM IT WAS.
Q.: OKAY.
A.: BUT IN ANALYZING THE DATA IN THE COMPUTER, IT APPEARED TO BE THE COMPUTER BELONGING TO A SON OF MR. WESTERFIELD.
MR. CLARKE: OBJECTION. LACK OF FOUNDATION.
THE COURT: YES. AS TO THE CONCLUSION.
LAY THE FOUNDATION, PLEASE.
SUSTAINED.
THE WITNESS: I’M SORRY.
BY MR. FELDMAN:
Q.: SIR, IT’S BEEN EXPLAINED TO YOU THAT THERE’S A DAVID A. WESTERFIELD, IS THAT RIGHT
A.: YES, SIR.
Q.: AND IT’S BEEN INDICATED THAT DAVID A. WESTERFIELD IS MY CLIENT, IS OUR CLIENT.
A.: THAT’S CORRECT.
Q.: IT’S ALSO BEEN EXPLAINED TO YOU THAT THERE’S A DAVID N. WESTERFIELD, IS THAT RIGHT?
A.: YES, SIR.
Q.: AND IT WAS REPRESENTED TO YOU THAT DAVID N. WESTERFIELD MIGHT HAVE BEEN THE SON, IS THAT RIGHT?
A.: YES, SIR.
Q.: WITH REGARD TO YOUR STATEMENTS ABOUT THE SON, ARE YOU REFERRING TO COMPUTER FILES THAT REFERENCE DAVID N. WESTERFIELD AS OPPOSED TO DAVID A. WESTERFIELD?
A.: YES, SIR.
MR. CLARKE: OBJECTION. LACK OF FOUNDATION AGAIN.
THE COURT: OVERRULED.
YOU MAY PROCEED, MR. FELDMAN.
BY MR. FELDMAN:
Q.: WHAT SORTS OF FILES DID YOU SEE THAT CAUSED YOU TO FORM THE OPINION THAT WHAT YOU WERE SEEING BELONGED TO DAVID N. WESTERFIELD AS OPPOSED TO DAVID A. WESTERFIELD?
A.: WELL, AND THIS IS REALLY WHAT BEGAN MY UNDERSTANDING THAT THERE WAS OBVIOUSLY A YOUNGER PERSON, ANOTHER DAVID WESTERFIELD, OTHER THAN THE DEFENDANT, BECAUSE THE FILES THAT I’M REFERRING TO ARE OR WERE SCHOOL-RELATED FILES. THEY WERE TEXT DOCUMENTS THAT HAD BEEN WRITTEN AS APPARENTLY PART OF A SCHOOL ASSIGNMENT IN THE NAME OF DAVID NEAL WESTERFIELD.
Q.: AND WHAT CAUSED YOU TO FORM THE OPINION THEY WERE TEXT DOCUMENTS THAT WERE WRITTEN FOR SCHOOL?
A.: IN THE REPORT THAT I PREPARED FOR YOUR OFFICE I MADE SCREEN PRINTS WHICH IS MY COMMON PRACTICE AS I DO THESE EXAMINATIONS.
Q.: SIR, LET ME JUST —
MR. FELDMAN: COUNSEL.
BY MR. FELDMAN:
Q.: I WOULD LIKE TO SHOW YOU WHAT’S BEEN PREVIOUSLY MARKED 149. IS — I’M A LITTLE BIT OFF YOUR SEQUENCE HERE, BUT IS 149 — WELL, COULD YOU PLEASE TELL THE JURY WHAT’S 149.
A.: I’M SORRY. I NEED MY GLASSES.
I’M NOT SURE EXACTLY WHAT YOU WOULD CALL IT, BUT IT REPRESENTS CLASSES TAKEN AT APPARENTLY SAN DIEGO STATE UNIVERSITY. IT REFERS TO CLASSES LIKE CALCULUS, PRINCIPLES OF PHYSICS, PHYSICS LAB.
Q.: AND WHAT’S THE NAME YOU SEE AT THE TOP?
A.: DAVID NEAL WESTERFIELD.
Q.: DID YOU PROVIDE THAT TO MY OFFICE?
A.: YES, I DID.
Q.: THANK YOU.
SO WHEN YOU WERE REFERRING TO THE KINDS OF DOCUMENTS THAT MIGHT HAVE INDICATED OWNERSHIP OR THAT MAYBE A STUDENT OTHER THAN DAVID A. WESTERFIELD WAS INVOLVED, 149 WOULD BE SUCH A DOCUMENT, IS THAT RIGHT, SIR?
A.: THAT’S CORRECT.
Q.: SIR, WAS THAT DOCUMENT I JUST SHOWED YOU A SCREEN PRINT?
A.: YES, SIR.
Q.: WHAT’S A SCREEN PRINT?
A.: IN THE COURSE OF DOING THE INVESTIGATIONS THAT I DO USING THE EN CASE SOFTWARE, I OFTEN WANT TO DOCUMENT ITEMS THAT I FIND THAT I FEEL ARE GOING TO BE IMPORTANT SO THAT IT’S NOT — SO IT DOESN’T RELY ON MY SOMETIMES FEEBLE MEMORY, AND PARTICULARLY SO THAT IF I GO — IF I DO GO TO TESTIFY, THAT I HAVE A DOCUMENT THAT I CAN REFER TO AND SAY THIS IS WHAT I SAW ON THE SCREEN USING EN CASE.
I USE A SCREEN CAPTURE PROGRAM THAT BASICALLY FREEZES WHAT I’M LOOKING AT ON THE SCREEN WITH EN CASE, PRINTS IT OUT. AND THEN I, AS I DID HERE, AS OFTEN THE CASE, AS I WRITE THE REPORT, I REFER TO THE SCREEN PRINTS BY NUMBER.
Q.: SO, IN OTHER WORDS, A SCREEN PRINT REALLY IS JUST — A SCREEN CAPTURE IS JUST KIND OF LIKE A SNAPSHOT OF WHAT’S ON A PERSON’S COMPUTER SCREEN AT ANY GIVEN TIME.
A.: THAT’S CORRECT.
I GOT IN THE HABIT WORKING UNDERCOVER PROGRAMS FOR
U. S. CUSTOMS WHERE THINGS WOULD HAPPEN ON THE COMPUTER THAT YOU WOULD WANT TO DOCUMENT. FOR INSTANCE, THE TRANSFER OF A CHILD PORNOGRAPHY FILE TO ME FROM A SUSPECT. I WOULD CAPTURE WITH A SCREEN CAPTURE AND DOCUMENT THAT FOR COURT PURPOSES LATER.
Q.: ALL RIGHT.
SO IT’S BASICALLY A SNAPSHOT OF WHAT’S ON ANYBODY’S COMPUTER SCREEN AT ANY GIVEN TIME.
A.: THAT’S CORRECT.
Q.: WITH REGARD TO THE COMPUTER THAT CONTAINED THE DOCUMENTS FOR DAVID N. WESTERFIELD, WERE YOU ABLE TO, FOR INSTANCE, DETERMINE THE LAST ACCESS DATE OF DOCUMENTS?
A.: THE EN CASE PROGRAM AS CAN BE SEEN IN A NUMBER OF THE SCREEN PRINTS THAT I TOOK OF SPECIFIC FILES WILL GIVE THE FILE CREATION DATE, THE LAST WRITTEN DATE, AND THE LAST ACCESS DATE OF A GIVEN FILE AS PART OF THE PROGRAM. WHEN YOU LOOK AT ANY GIVEN FILE, THAT INFORMATION IS AVAILABLE UNLESS THE FILE HAS BEEN UNDELETED FROM THE UNALLOCATED FILE SPACE AND THAT INFORMATION LOST.
Q.: DID YOU HAVE OCCASION TO LOOK INTO WHAT’S CALLED A RECYCLE BIN FOR THE PURPOSE OF DETERMINING PRESENCE OR ABSENCE OF COMPUTER IMAGES?
A.: YES.
Q.: IN THE GATEWAY COMPUTER?
A.: YES.
Q.: IN THE GATEWAY COMPUTER THAT BELONGED TO DAVID N. WESTERFIELD OR AT LEAST SHOWS INDICATIONS OF DAVID N. WESTERFIELD, IS THAT RIGHT?
A.: YES, SIR.
Q.: NOW, YOU GOT A BINDER UP THERE WITH YOU, SIR, IS THAT RIGHT?
A.: YES, SIR.
Q.: IF I ASKED TO HAVE THE BINDER MARKED AND YOU LOSE IT, WOULD THAT BE OKAY?
A.: YES, SIR.
MR. FELDMAN: YOUR HONOR, I WOULD ASK TO HAVE MARKED AS THE COURT NEXT IN ORDER THIS BINDER THAT THE WITNESS IS REFERRING TO BECAUSE I’M GOING TO BE REFERRING TO MUCH OF THE —
THE COURT: ALL RIGHT. THAT WILL BE 157 FOR IDENTIFICATION PURPOSES.
MR. FELDMAN: THANK YOU. BUT I WOULD ASK THE WITNESS BE PERMITTED TO REMOVE THAT WHICH IS HIS PERSONAL AS OPPOSED TO WHAT WAS PREPARED FOR THE CASE.
THE WITNESS: MY C.V. AND THE TRAINING DOCUMENTS I REFERRED TO.
MR. FELDMAN: I’M SORRY. I MISSED THE NUMBER.
THE COURT: 157.
MR. FELDMAN: THANK YOU.
(BINDER AND CONTENTS [COMPUTER DOCUMENTS] MARKED
TRIAL EXHIBIT NUMBER 157 FOR IDENTIFICATION.)
MR. FELDMAN: YOUR HONOR, FOR THE RECORD, I’VE PLACED THE EXHIBIT TAG 157 ON A BINDER THAT READS “WESTERFIELD CASE TRIAL NOTEBOOK.”
BY MR. FELDMAN:
Q.: SIR, IS 157 A DOCUMENT THAT I ASKED YOU — WELL, IS 157 THE ORIGINAL OF COPIES THAT YOU PROVIDED TO MY OFFICE AND THE DISTRICT ATTORNEY’S OFFICE WITHIN THE PAST WEEK OR SO?
A.: YES.
MR. CLARKE: OBJECTION. LACK OF FOUNDATION.
THE COURT: OVERRULED.
PROCEED, MR. FELDMAN.
MR. FELDMAN: THANK YOU.
BY MR. FELDMAN:
Q.: WERE YOU ABLE TO ANSWER THAT? I JUST DIDN’T HEAR.
A.: YES, SIR.
Q.: I WOULD LIKE TO SPECIFICALLY DIRECT YOUR ATTENTION TO A PARTICULAR SCREEN PRINT. WELL, LET ME BACK UP FOR A SECOND. YOU JUST TOLD ME I THINK THAT THERE WERE CIRCUMSTANCES WHERE YOU WERE ABLE TO LOOK INTO THE RECYCLE BIN TO DETERMINE WHETHER OR NOT ANY IMAGES WERE LOCATED THEREIN. IS THAT RIGHT?
A.: YES, SIR.
Q.: IN YOUR NOTEBOOK YOU HAVE NUMBERED IN THE UPPER RIGHT CORNER A SERIES OF PAGES, IS THAT CORRECT?
A.: YES, SIR.
Q.: IF I TALK TO YOU IN TERMS OF CORRELATE THE NUMBERS OF — WELL, DOES EACH OF THE NUMBERS ON THE PAGES CORRELATE TO A PARTICULAR SCREEN PRINT THAT’S REFERENCED IN YOUR REPORT?
A.: YES, SIR.
Q.: I WOULD LIKE TO DIRECT YOUR ATTENTION, SIR, TO SCREEN PRINTS 8 AND 9.
A.: YES, SIR.
Q.: NOW, YOU PREVIOUSLY MENTIONED THAT THERE WAS A SCHOOL DOCUMENT THAT YOU HAD IDENTIFIED THAT YOU CALLED A SCREEN PRINT 1, IS THAT CORRECT?
A.: YES, SIR.
Q.: SO, IN OTHER WORDS, 1, 8, AND 9 COME FROM THE SAME COMPUTER, IS THAT RIGHT?
A.: YES, SIR.
Q.: IT’S JUST 8 AND 9 ARE DELETIONS OR APPARENT ATTEMPTED DELETIONS OF FILES. IS THAT RIGHT?
A.: THAT’S CORRECT.
Q.: TELL ME, SIR, WHAT’S ON EXHIBIT 8? I’M SORRY. 157, SCREEN PRINT 8.
A.: IS A PICTURE OF A NAKED WOMAN ON A MOTORCYCLE SITTING SORT OF SIDESADDLE ON THE MOTORCYCLE.
Q.: AND YOU HAVE A BLUE LINE THAT’S DRAWN OR I GUESS IN SOME MANNER COLORED RIGHT ACROSS. WHAT DO YOU MEAN TO COMMUNICATE BY THAT, IF ANYTHING?
A.: WHAT THAT IS DOING IS SHOWING THE — THIS IS A VIEW —
MR. FELDMAN: EXCUSE ME.
THE WITNESS: I’M SORRY.
MR. FELDMAN: MAY I HAVE HIM LIFT THIS UP SO AT LEAST THE JURY CAN SEE THE LINE? I’M JUST ASKING WHAT DIRECTION ON HOW TO DO THIS. YOUR HONOR, THESE ARE THE COPIES OF WHAT I —
THE COURT: NO. I UNDERSTAND.
AS BEST YOU CAN, I REALIZE IT’S AWKWARD, MR. LAWSON, BUT IF YOU CAN DO IT COMFORTABLY AND TESTIFY AT THE SAME TIME.
THE WITNESS: SURE. NO PROBLEM.
THIS IS A SCREEN PRINT OF MY VIEW OF THIS COMPUTER HARD DRIVE IN EN CASE, AND THIS IS LOOKING AT JUST A SPECIFIC PORTION OF THE COMPUTER.
WHAT I’M LOOKING AT IS THE RECYCLING BIN FOR THIS COMPUTER. AND THE BLUE HIGHLIGHT IS ACTUALLY PUT THERE BY EN CASE. THAT’S NOT ANYTHING I DID IN MAKING THIS SCREEN PRINT. THE SCREEN PRINT IS ACTUALLY WHAT WAS ON MY SCREEN AS I AM SEEING THIS. AND WHAT I’VE DONE IS — YOU CAN HIGHLIGHT INDIVIDUAL FILES AS YOU GO DOWN THIS ROW. AND THIS PARTICULAR FILE IS THE ONE THAT’S HIGHLIGHTED. AND WHEN A FILE IS HIGHLIGHTED, THEN YOU’LL SEE WHAT THE FILE IS IN THE SECOND WINDOW DOWN BELOW. AND THE FILE THAT’S HIGHLIGHTED IS A DELETED FILE FROM THE RECYCLING BIN CALLED DASH C136 DOT B.M.P., WHICH INDICATES IT’S A PICTURE FILE.
BY MR. FELDMAN:
Q.: LET ME STOP YOU FOR A MINUTE. YOU JUST USED AN EXTENSION CALLED DOT B.M.P. I HAVE JUST USED THE WORD EXTENSION. WHY DON’T YOU TELL THE JURY WHAT THE WORD EXTENSION MEANS.
A.: FILE EXTENSIONS ARE DESIGNATORS ON INDIVIDUAL FILES TO HELP KEEP TRACK OF WHAT INDIVIDUAL FILES ARE. GIVE THE USER A PARTICULAR POINT OF REFERENCE TO KNOW WHAT ANY GIVEN FILE IN THE COMPUTER IS. THE COMPUTER ITSELF DOESN’T ALWAYS NEED TO KNOW THE DESIGNATOR OF THE PARTICULAR FILE TO RECOGNIZE THAT IT IS A FILE OF A SPECIFIC KIND. FOR INSTANCE, EVEN IF THIS FILE HAD A DIFFERENT DESIGNATOR AND IT WAS CALLED DOT T.X.T., REPRESENTING A TEXT FILE, THE COMPUTER WOULD STILL RECOGNIZE IT AS AN IMAGE FILE.
Q.: I WOULD LIKE TO SHOW YOU WHAT’S BEEN PREVIOUSLY MARKED COURT EXHIBIT 144. 144 LISTS A VARIETY OF EXTENSIONS. IS THAT RIGHT?
A.: THAT’S CORRECT.
Q.: YOU JUST DISCUSSED OBSERVING ON THIS PARTICULAR SCREEN PRINT A B.M.P. FILE. IS THAT RIGHT?
A.: THAT’S CORRECT.
Q.: SO THAT’S JUST — THAT’S A KIND OF — THAT’S A PICTURE FILE, RIGHT?
A.: YES, SIR.
Q.: AND THIS PICTURE FILE TO WHICH YOU’RE MAKING REFERENCE APPEARS TO HAVE BEEN DELETED ON SEPTEMBER THE 26TH, 2001, OR WAS IT CREATED ON THAT DATE OR CAN YOU TELL?
A.: IT WOULD APPEAR THAT THE FILE WAS BOTH CREATED AND DELETED ON 9/26/01. THE LAST ACCESS DATE IS 9/26/01. WHEN YOU FIND A FILE THAT’S BEEN DELETED IN THE RECYCLING BIN, THE LAST ACCESS IS GOING TO BE, FOR THE MOST PART, IN MOST CASES GOING TO BE THE DATE THAT IT WAS THROWN AWAY.
Q.: ALL RIGHT.
AND YOU JUST MENTIONED IN THE RECYCLE BIN, YOU MEAN THE TRASH CAN OF THE COMPUTER?
A.: CORRECT.
Q.: SO IF I TRY AND DUMP SOMETHING INTO MY COMPUTER’S TRASH CAN, PEOPLE LIKE YOU CAN COME AND RETRIEVE IT, IS THAT RIGHT?
A.: YES, SIR.
Q.: I WOULD LIKE TO DIRECT YOUR ATTENTION TO ANOTHER SCREEN PRINT. 9. THAT’S ANOTHER SCREEN PRINT THAT YOU RECEIVED FROM THE GATEWAY COMPUTER, IS THAT RIGHT, SIR?
A.: THAT’S CORRECT.
Q.: WITH REGARD TO SCREEN PRINT 9, CAN YOU TELL THE JURY WHAT’S THAT?
A.: IT’S ANOTHER — IT’S A NAKED WOMAN. IT’S A LITTLE BIT MORE GRAPHIC IMAGE THAN THE SCREEN PRINT 8. SHE HAS HER LEGS APART. I WOULD PROBABLY CONSIDER THAT TO BE A PORNOGRAPHIC PICTURE.
Q.: HOW DO YOU USE THE TERM PORNOGRAPHIC? WHAT DOES THAT MEAN?
A.: PORNOGRAPHIC MEANING IT’S A MORE LASCIVIOUS POSE THAN SCREEN PRINT 8.
Q.: MORE SEXUAL?
A.: MORE SEXUAL.
Q.: ALL RIGHT.
AND 8 AND 9 CAME OUT OF D. N. WESTERFIELD’S COMPUTER, IS THAT RIGHT?
A.: THAT’S CORRECT.
Q.: WHAT ABOUT IS THERE, IN YOUR BUSINESS, IS THERE A FORM OF DOWNLOAD OR COMPUTER CALLED AN ANIME’ FILE?
A.: YES, SIR. WELL, IT’S NOT — THAT’S NOT A — YOU WANT TO DIFFERENTIATE BETWEEN A TYPE OF FILE AS WE ARE TALKING ABOUT HERE WITH THE DESIGNATOR AND JUST A GENERAL SCHEME OF —
Q.: OKAY.
WHAT I WANT TO JUST, THEN, THE SOFTBALL IS THEN CAN YOU PLEASE IDENTIFY ANIME’. WHAT DO YOU MEAN SO WE ARE ON THE SAME PAGE IN TERMS OF COMMUNICATING?
A.: ANIME’ USUALLY MEANS CARTOON-CREATED — ANIMATED IMAGES THAT ARE — THEY CAN BE CREATED BOTH BY HAND AND BY COMPUTER.
Q.: ARE THOSE AVAILABLE ON THE INTERNET?
A.: YES. THEY ARE VERY POPULAR.
Q.: ARE THEY COMMON ON THE INTERNET?
A.: YES.
Q.: IS THERE A STYLE OF ANIME’ THAT APPEARS FREQUENTLY ON THE INTERNET?
A.: CERTAINLY NOT ALL, BUT A GOOD PERCENTAGE OF — IN FACT, I WOULD PROBABLY GO SO FAR AS TO SAY MOST ANIME’ IS — IT’S ORIENTAL-RELATED. IT’S REFERRED TO AS JAPANESE ANIME’. AND I CAN’T PRONOUNCE THE JAPANESE WORD. IT’S HENTAI OR ALONG THOSE LINES THAT REFERS SPECIFICALLY TO JAPANESE ANIMATED.
Q.: SPECIFICALLY DIRECTING YOUR ATTENTION TO THAT COMPUTER WE’VE BEEN DISCUSSING, THE ONE THAT’S D. N. WESTERFIELD, DID YOU NOTE THE PRESENCE OR ABSENCE OF ANY ANIME’ OF A SEXUAL NATURE?
A.: YES, I DID.
Q.: SPECIFICALLY DIRECTING YOUR ATTENTION TO SCREEN PRINTS 10 THROUGH 36.
A.: YES, SIR.
Q.: SCREEN PRINTS 10 THROUGH 36 GENERALLY DEPICT, DO THEY NOT, ANIME’?
A.: YES, SIR.
Q.: WHICH REALLY CONSTITUTES WOMEN OR DRAWINGS OF WOMEN ENGAGED IN ANY NUMBER OF DIFFERENT ACTS WHICH ONE MAY OR MAY NOT CONSIDER SEXUAL, IS THAT RIGHT?
A.: THAT’S CORRECT.
Q.: FOR INSTANCE, ON SCREEN PRINT 10 WE SEE WOMEN PLAYING WITH THEMSELVES, IS THAT RIGHT?
A.: THAT’S CORRECT.
Q.: THESE ARE ALL NOW CARTOONS, AREN’T THEY?
A.: YES, SIR.
Q.: SCREEN PRINT 11 IT APPEARS AS THOUGH THE SEX IS BECOMING MORE GRAPHIC. IS THAT RIGHT?
A.: THAT’S CORRECT.
Q.: AND SO ON THROUGHOUT THE SERIES OF — I’M SORRY. IS THAT TWENTY-SIX PRINTS, SCREEN PRINTS?
A.: YES.
Q.: NOW, WITH REGARD TO THESE ANIME’S, THEY ARE A THEME THAT ONE GENERALLY ASSOCIATES WITH THIS TYPE OF MATERIAL. STRIKE THAT. IS THERE A THEME THAT YOU WERE ABLE TO ASSOCIATE WITH THIS PARTICULAR SERIES OF SCREEN PRINTS?
A.: A CONSIDERABLE NUMBER OF THESE SCREEN PRINTS INVOLVE BONDAGE. SCENARIOS WITH ANIME’ WHERE WOMEN ARE TIED IN ROPES AND THINGS LIKE THAT.
Q.: DOES THE MERE EXISTENCE OF ANIME’ THAT DEPICTS WOMEN IN ROPES OR LIKE THAT, DOES THAT — IS THAT A COMMON THEME?
MR. CLARKE: OBJECTION. LACK OF FOUNDATION.
THE COURT: OVERRULED.
YOU CAN ANSWER.
THE WITNESS: IN MY EXPERIENCE WITH THE ANIME’ THAT I OFTEN ENCOUNTER IN THE HARD DRIVES THAT WE ANALYZE IN OUR OFFICE, THAT IS A COMMON THEME AND MAY — OFTEN INVOLVES BONDAGE SCENARIOS.
BY MR. FELDMAN:
Q.: NOW, I WOULD LIKE TO DIRECT YOUR ATTENTION TO SOME SCREEN PRINTS THAT I THINK YOU’VE IDENTIFIED AS 130 THROUGH 133. FIRST OF ALL, SCREEN PRINTS 130 THROUGH 133, CAN YOU TELL ME, PLEASE, —
MR. FELDMAN: AND, COUNSEL, THEY ARE CORRELATED TO NUMBER. I JUST WANT TO MAKE SURE. . .
THE WITNESS: OKAY.
BY MR. FELDMAN:
Q.: LET ME DIRECT YOUR ATTENTION, PLEASE, TO ANIME’ 1. I’M SORRY. SCREEN PRINT 133. I’M SORRY. 130. COULD YOU PLEASE TELL ME WHAT THIS SCREEN PRINT 30 DEPICTS.
A.: IT’S A HOT MAIL. IT’S A SCREEN PRINT AS WE DISCUSSED EARLIER OF A HOT MAIL E-MAIL THAT I WAS ABLE TO RECOVER FROM I BELIEVE THIS IS — I WANT TO MAKE CERTAIN.
Q.: IT SAYS AN E-MAIL ADDRESS AT THE BOTTOM, DOESN’T IT?
A.: I WANTED TO DESCRIBE WHICH COMPUTER IT HAD COME FROM.
Q.: OKAY.
A.: ONE OF THE TWO OFFICE COMPUTERS.
Q.: OKAY.
A.: ONE OF THE TWO HEWLETT-PACKARD OFFICE COMPUTERS. IT’S GOING TO TAKE ME TOO LONG TO TELL YOU WHICH OF THE TWO.
Q.: SPECIFICALLY DIRECTING YOUR ATTENTION TO 130, THERE’S AN E-MAIL ADDRESS AT THE BOTTOM, IS THAT RIGHT?
A.: THAT’S CORRECT.
Q.: WHAT’S THE E-MAIL ADDRESS?
A.: CAPITAL D CAPITAL N CAPITAL W E-S-T AT HOT MAIL DOT COM. D. N. WEST AT.
Q.: YOU’VE USED THE WORD HOT MAIL NOW SEVERAL TIMES. COULD YOU PLEASE TELL US WHAT IS HOT MAIL.
A.: HOT MAIL IS AN INTERNET-BASED E-MAIL SERVICE THAT’S MADE AVAILABLE BY MICROSOFT FOR PEOPLE TO CREATE E-MAIL ACCOUNTS FOR THEMSELVES. BASICALLY ALL THAT’S NECESSARY IS THAT YOU ACCESS THE HOT MAIL DOT COM. WEB PAGE, ANSWER SOME QUESTIONS, AND YOU CAN CREATE AN E-MAIL ACCOUNT FOR YOURSELF. IT MAY OR MAY NOT BE ACCURATE IN TERMS OF YOUR NAME. MANY PEOPLE USE HOT MAIL E-MAIL ADDRESSES THAT HAVE NOTHING TO DO WITH THEIR NAME. OTHERS DO.
Q.: IT’S FREE, ISN’T IT?
A.: IT’S FREE, YES.
Q.: SO DOES THAT MEAN I CAN JUST GO ON LINE AND CREATE AS MANY E-MAIL ADDRESSES AS I WAS USING HOT MAIL?
A.: THAT’S CORRECT.
Q.: SPECIFICALLY DIRECTING YOUR ATTENTION TO 130 AGAIN, WITH REGARD TO 130, IT SAYS ABOVE THE E-MAIL ADDRESS THANKS FOR JOINING ANIME’ DOT COM. WHAT’S ANIME’ DOT COM.?
A.: ANIME’ DOT COM. IS A WEB SITE THAT OFFERS LINKS TO OTHER ANIME’-RELATED SITES, ANIME’ BEING THE TYPE OF MATERIAL THAT WE WERE TALKING ABOUT EARLIER, ANIMATED IMAGES AND FILES THAT ARE AVAILABLE FOR VIEWING ON THE INTERNET. ANIME’ DOT COM. IS BASICALLY A LINK PAGE THAT ALLOWS A PERSON TO GO TO OTHER ANIME’ PAGES AROUND THE INTERNET.
Q.: A MOMENT AGO YOU WERE LOOKING FOR I GUESS ONE OF YOUR PAPERS TO HELP YOU FIND — I’M SORRY. BUT YOU’RE RECOVERING FROM THE FLU, AREN’T YOU
A.: YES.
Q.: IT’S KIND OF THE PLAGUE THAT’S GOING AROUND.
A.: I APOLOGIZE.
Q.: THAT’S ALL RIGHT.
I THINK WE HAVE WATER ON COUNSEL TABLE, SIR, IF YOU NEED IT. AND YOU’RE PROMISING NOT TO SHARE, RIGHT?
A.: I PROMISE.
Q.: SIR, YOU WERE TRYING TO IDENTIFY WHICH COMPUTER THIS ANIME’ DOT COM. JOINDER OR JOINING CAME FROM. LET ME SHOW YOU A PAGE OF YOUR REPORT. IT’S 1476 IN THE DEFENSE DISCOVERY SEQUENCE.
A.: YES, SIR.
Q.: DOES LOOKING AT THIS DOCUMENT REFRESH YOUR RECOLLECTION AS TO WHICH COMPUTER THESE ANIME’ SCREEN CAPTURES COME FROM?
A.: YES. WHAT I HAD THOUGHT THAT I REMEMBERED, THESE PARTICULAR SCREEN CAPTURES CAME FROM WHAT I REFERRED TO AS THE SECOND H. P. OFFICE COMPUTER AS OPPOSED TO — THERE WERE TWO. AND THEY WERE VERY CLOSE TO EACH OTHER IN SIZE. AND THEY WERE ALSO BOTH H. P.’S. SO WE JUST, TO KEEP THEM STRAIGHT IN TERMS OF WHAT I RECOVERED FROM WHICH ONE, ONE IS NAMED NUMBER ONE AND ONE IS NAMED NUMBER TWO.
Q.: OKAY.
AND WITH REGARD TO SCREEN PRINT 131, WHAT DOES SCREEN PRINT 131 DEPICT?
A.: AGAIN IT’S A SCREEN PRINT OF MY VIEW OF EN CASE LOOKING AT THE TEMPORARY INTERNET FILE FOLDER. THIS WOULD BE AGAIN H. P. COMPUTER NUMBER TWO. AND I AM HIGHLIGHTING AN H.T.M.L. FILE CALLED ANIME’.
Q.: I’M SORRY. YOU JUST THREW US ANOTHER TERM. H.T.M.L. IT DOESN’T GO UNDER EXTENSIONS, BUT I’M GOING TO ADD IT. I THINK IT’S 141. H.T.M.L. NOW, I KNOW THAT’S HYPERTEXT MARKUP LANGUAGE, BUT I HAVE NO IDEA WHAT THAT MEANS. COULD YOU TELL US, PLEASE.
A.: SIMPLY EXPLAINED IT JUST REFERS TO A WEB PAGE. IT’S
— HYPERTEXT MARKUP LANGUAGE IS LANGUAGE THAT’S USED TO CREATE WEB PAGES ON THE INTERNET. IT MEANS THAT YOU ARE LOOKING AT A WEB PAGE.
Q.: SO THE IMPORT OF THE SCREEN CAPTURE 131 IS THAT IT REFLECTS A WEB PAGE, IS THAT RIGHT?
A.: THAT’S CORRECT.
Q.: AND A WEB PAGE IS ONE OF THOSE PAGES YOU CAN CLICK TO GET YOURSELF FROM POINT A HYPOTHETICAL ANIME’ TO POINT B ANOTHER ANIME’ OR SERIES OF IMAGES, IS THAT RIGHT?
A.: THAT’S CORRECT.
Q.: 132, DIRECTING YOUR ATTENTION TO SCREEN CAPTURE 132. CAN YOU TELL ME, PLEASE, WHAT DOES SCREEN CAPTURE 132 DEPICT?
A.: THIS IS THE — A PAGE FROM ANIME’ DOT COM. WHERE A PERSON JOINS ANIME’ DOT COM. BY ENTERING THEIR NAME AND THEIR
E-MAIL ADDRESS.
Q.: AGAIN ALL OF THESE COME FROM —
A.: H. P., HEWLETT-PACKARD COMPUTER NUMBER TWO.
Q.: AND SOMEHOW BEAR D. N. WEST, IS THAT RIGHT, AS AN IDENTIFIER?
A.: THAT’S CORRECT.
Q.: SIR, WITH REGARD TO YOUR EXAMINATION OF GATEWAY FILES, DID YOU NOTICE PORNOGRAPHY FILES IN THE PLURAL?
A.: YES.
Q.: AND WITH REGARD TO YOUR EXAMINATION OF THE GATEWAY PORNOGRAPHY FILES, DID YOU NOTE THAT FOR THE MOST PART THEY TENDED TO SHOW OR THEY ALL SHOWED BOTH FILE CREATION DATES AND LAST ACCESS DATES OF DECEMBER 17TH, ’01?
MR. CLARKE: OBJECTION. I THINK THAT’S LEADING, YOUR HONOR.
THE COURT: IT IS.
REPHRASE.
BY MR. FELDMAN:
Q.: SIR, I WOULD LIKE TO DIRECT YOUR ATTENTION TO SCREEN PRINTS 37 AND 38.
A.: YES.
Q.: WITH REGARD TO 37 AND 38, WHAT DO THEY DEPICT?
A.: THESE WERE — AGAIN THESE ARE SCREEN PRINTS OF A VIEW OF A PARTICULAR FILE LOOKING AT THIS COMPUTER WITH EN CASE. AND WHAT I’VE DONE IS HIGHLIGHT A PARTICULAR FILE, EXPAND THE SCREEN SO THAT YOU CAN SEE IT. IN OTHER WORDS, WHEN WE LOOKED BEFORE, WE SAW —
Q.: I’M SORRY. BUT IF YOU COULD HOLD IT UP HIGHER BECAUSE IT’S HARD TO SEE. AND WE’RE SHOWING ALL THE WAY ACROSS. JUST SO THAT YOU KNOW, SIR, THERE’S EIGHTEEN FOLKS.
A.: WHEN WE LOOKED AT THE PREVIOUS SCREEN PRINT, WE HAD TWO WINDOWS. ONE WAS WHERE — IT WAS THE LIST OF FILES THAT WE HAD HIGHLIGHTED, AND THEN THE SECOND WINDOW WAS THE SMALLER VERSION OF THE IMAGE. WHAT I’VE DONE IS ACTUALLY ENLARGED THE ENTIRE IMAGE AND THEN CLICKED ON REPORT WHICH IN EN CASE ALLOWS YOU TO FIND OUT SPECIFIC INFORMATION, THE PROPERTIES BASICALLY OF THAT GIVEN FILE. AND THIS PARTICULAR FILE IS SHOWING LAST ACCESS AND FILE CREATED DATES OF 12/17/01.
Q.: 38, WHAT DOES 38 SHOW?
A.: AGAIN THIS IS THE VIEW. IT’S THE SAME THING. IT’S A GIVEN REPORT OF THIS PARTICULAR FILE, AND IT SHOWS LAST ACCESS AND FILE CREATED DATES OF 12/17/01.
Q.: WHAT DOES THAT MEAN?
A.: THAT THIS PARTICULAR FILE OR THESE TWO PARTICULAR FILES WERE PLACED ON THIS COMPUTER ON 12/17/01 AND APPARENTLY NEVER ACCESSED BEYOND THAT. IF THEY HAD BEEN ACCESSED AFTER 12/17/01, THEN THAT LAST ACCESS DATE WOULD CHANGE TO WHATEVER DATE IT WAS THAT THE FILE WAS LAST LOOKED AT.
Q.: ALL RIGHT.
DIRECTING YOUR ATTENTION NOW TO A SECOND HARD DRIVE IN A GATEWAY COMPUTER. AND NOW I’M SPECIFICALLY DIRECTING YOUR ATTENTION TO I THINK IT’S CALLED A MAXTOR, M-A-X-T-O-R,
12-GIGABYTE DRIVE. DID YOU EXAMINE A MAXTOR 12-GIGABYTE DRIVE?
A.: YES, SIR.
Q.: WHY?
A.: IT WAS ONE OF THE TWO HARD DRIVES THAT WAS REPRESENTED IN THE DOCUMENTATION THAT CAME WITH THE HARD DRIVES THAT WE RECEIVED FROM THE SAN DIEGO FORENSICS LAB. THERE WAS AN INDICATION THAT THERE WERE TWO HARD DRIVES IN THE GATEWAY, AND THIS IS THE SECOND OF THOSE TWO.
Q.: DID YOU NOTICE ANYTHING OF CONSEQUENCE OR RELEVANCE IN THERE?
A.: I DID NOT. AS I RECALL, I THINK IT HAD GAMES PRIMARILY.
Q.: ALL RIGHT.
DID YOU HAVE OCCASION TO EXAMINE A LAPTOP COMPUTER?
A.: YES, SIR.
Q.: CAN YOU TELL ME WHAT WAS YOUR PURPOSE IN EXAMINING THE LAPTOP COMPUTER?
A.: AGAIN IT WAS ONE OF THE PIECES OF MEDIA THAT WAS SUPPLIED TO US FOR EXAMINATION. AND I SUBSEQUENTLY EXAMINED IT TO DETERMINE IF THERE WAS ANYTHING OF EVIDENTIARY VALUE IN THIS CASE.
Q.: YOU SPECIFICALLY NOTED ACCESS DATES TO THE LAPTOP COMPUTER, IS THAT CORRECT?
A.: THAT’S CORRECT.
Q.: WHEN WAS THE LAPTOP COMPUTER ACCESSED?
A.: I NOTED THAT THE LAPTOP HAD BEEN ACCESSED ON THREE DATES THAT CAME TO — THAT WERE I FELT POSSIBLY OF IMPORTANCE. 1/31/02, 2/02/02, AND FINALLY 02/04/02.
Q.: FEBRUARY 4TH, ’02?
A.: THAT’S CORRECT.
Q.: COULD YOU DETERMINE WHAT ACTIVITY TOOK PLACE ON THOSE DATES?
A.: I DIDN’T —
Q.: I’M SORRY. THAT WAS OF RELEVANCE TO THE CASE.
A.: I’M SORRY.
I DIDN’T INCLUDE IT IN MY REPORT. I DIDN’T FIND THAT THERE WAS ANYTHING OF ANY PARTICULAR RELEVANCE THAT WAS ACCESSED ON THOSE DATES.
Q.: ALL RIGHT.
NOW I WOULD LIKE TO DIRECT YOUR ATTENTION TO I THINK IT’S AN H. P. COMPUTER, WHICH YOU REFERRED TO AS H. P. COMPUTER NUMBER ONE, WHICH WAS LOCATED FROM THE OFFICE. IS THAT RIGHT?
A.: YES, SIR.
Q.: THAT COMPUTER OSTENSIBLY WAS RECOVERED FROM MR. WESTERFIELD’S OFFICE AND CONTAINS A WESTERN DIGITAL 30-GIGABYTE HARD DRIVE, IS THAT RIGHT?
A.: THAT’S CORRECT.
Q.: YOU DID AN INITIAL EXAMINATION OF THAT COMPUTER, IS THAT RIGHT?
A.: YES, SIR.
Q.: DID YOU NOTICE WHETHER OR NOT THERE WAS COMPUTER USE AND VISITS TO APPARENT PORNOGRAPHIC WEB SITES ON FEBRUARY THE 4TH, 2002?
MR. CLARKE: OBJECTION. I THINK COUNSEL IS LEADING THE WITNESS AGAIN.
THE COURT: HE IS.
JUST REPHRASE.
BY MR. FELDMAN:
Q.: DID YOU NOTICE WHETHER OR NOT THERE WAS ANY ACCESS OR USE OF THE COMPUTER ON FEBRUARY 4, 2002?
A.: YES, I DID.
Q.: WHAT KIND OF VISITS, IF ANY, DID YOU NOTE TO ANY WEB SITES?
A.: I NOTED THAT THE COMPUTER HAD BEEN USED IN THE AFTERNOON AND EVENING HOURS OF THE 4TH OF FEBRUARY, 2002. AND I NOTED THAT THERE HAD BEEN ACCESS TO BOTH ANIME’ SITES AND — PORNOGRAPHIC ANIME’ SITES AND WHAT I REFERRED TO IN MY REPORT AS, QUOTE, TEEN SEX SITES.
Q.: LET ME REDIRECT YOUR ATTENTION TO DEFENDANT’S EXHIBIT NUMBER A.
THE COURT: WHAT?
MR. FELDMAN: I’M SORRY. IT’S 142-A.
THE COURT: OKAY.
BY MR. FELDMAN:
Q.: THIS IS DEFENDANT’S EXHIBIT 142-A I BELIEVE YOU TOLD ME IS A COPY OF ONE OF YOUR SCREEN PRINTS THAT YOU TOOK FROM THE PARTICULAR COMPUTER WE’RE DISCUSSING. IS THAT CORRECT?
A.: THAT’S CORRECT.
Q.: WHAT’S THE TIME OF ACCESS?
A.: 4:47:58 P.M.
Q.: I’M SORRY. 4:47:58 P.M., IS THAT RIGHT?
A.: P.M.
Q.: OKAY.
AND WHAT’S BEING ACCESSED?
A.: THIS IS A TEMPORARY INTERNET FILE FOR A SITE OR APPARENTLY A SITE CALLED TEEN DREAMER. IT’S A — WHAT YOU CAN SEE IN THE LOWER PORTION OF THE REPORT IS THE NAME TEEN DREAMER AND THE TOP OF APPARENTLY A YOUNG WOMAN’S HEAD. IT WOULD BE AN IMAGE THAT WAS ON THIS PARTICULAR PAGE THAT WAS ACCESSED ON THE INTERNET AND ENDED UP IN THE TEMPORARY INTERNET FILES ON 2/4/02.
Q.: DIRECTING YOUR ATTENTION TO WHAT’S BEEN MARKED 142-B. WHAT’S 142-B?
A.: IS BASICALLY THE SAME THING. IT’S A COPY OF A TEMPORARY INTERNET FILE THAT WAS FOUND IN THE TEMPORARY INTERNET FILE FOLDERS. THE TEXT ABOVE THE PICTURE IS LESBIAN BORDELLO, AND THE DATE IS SHOWING AS 2/4/02 AT 4:47:58 P.M.
Q.: DIRECTING YOUR ATTENTION TO WHAT’S BEEN MARKED — THANK YOU, SIR.
DIRECTING YOUR ATTENTION TO WHAT’S BEEN PREVIOUSLY MARKED 143. IS 143 ANOTHER SCREEN CAPTURE THAT YOU PROVIDED?
A.: YES.
Q.: AND CAN YOU TELL THE JURY WHAT’S 143.

A.: NUMBER 143 IS A CAPTURE OF A HOT MAIL MESSAGE THAT I WAS ABLE TO RECOVER. DISCUSSED HOT MAIL BEING AN E-MAIL ACCOUNT, AN INTERNET-BASED E-MAIL ACCOUNT. THIS PARTICULAR
E-MAIL IS ADDRESSED TO D. N. WEST FROM HOT MAIL, IT’S FROM EDITOR AT NEWSLETTER DOT PINK FOR FREE DOT COM.
Q.: WHAT’S PINK FOR FREE DOT COM.?
A.: IT’S AN ADULT PORNOGRAPHIC WEB SITE THAT OFFERS LINKS TO OTHER PORNOGRAPHIC SITES BASICALLY.
Q.: AND, SIR, I THINK YOU JUST USED A PHRASE TEMPORARY INTERNET FILES. WHAT ARE TEMPORARY INTERNET FILES?
A.: THE WINDOWS OPERATING SYSTEM HAS A FOLDER CALLED THE TEMPORARY INTERNET FILE FOLDER THAT ALLOWS FOR THE — WHAT HAPPENS IS AS A PERSON SEARCHES THE INTERNET USING A PARTICULAR COMPUTER WITH THE WINDOWS OPERATING SYSTEM, THE COMPUTER TAKES FOR LACK OF A BETTER PHRASE SNAPSHOTS OF THE WEB PAGES AND THE IMAGES AND WHATNOT THAT A PERSON GOES TO, STORES THEM IN THE TEMPORARY INTERNET FILE FOLDER, AND THAT WAY, AS I’M SURE PEOPLE HAVE NOTICED IN THE JURY THAT HAVE USED THE INTERNET, WHEN YOU COME BACK TO A PAGE THE SECOND TIME, IT LOADS MUCH FASTER. THE REASON IS BECAUSE IT LOADS FROM THE TEMPORARY INTERNET FILE FOLDER AS OPPOSED TO OUT ON THE INTERNET.
Q.: SO IT’S A PLACE WHERE FILES GET STORED TEMPORARILY?
A.: TEMPORARILY. BUT THEY CAN STAY THERE FOR QUITE A WHILE.
Q.: AND CERTAINLY THEY ARE, I’LL SAY, SUSCEPTIBLE TO YOUR ABILITY TO USE EN CASE TO RETRIEVE THEM. IS THAT A FAIR STATEMENT?
A.: THAT’S CORRECT.
Q.: DO YOU USE THE TEMPORARY INTERNET FILES, THEN, TO TRACK INTERNET SURFING? IS THAT RIGHT?
A.: THAT IS CORRECT. IT IS ONE WAY TO DETERMINE WHERE A PERSON HAS BEEN ON THE INTERNET AND THE SORTS OF WEB SITES THAT THEY HAVE ACCESSED.
Q.: WITH REGARD TO THE EXHIBITS THAT I JUST SHOWED YOU, WE SPECIFICALLY DISCUSSED THE TIME OF ACCESS. AND 142-A AND -B ARE BOTH SOMEWHERE AROUND 4:47 P.M. AND 58 SECONDS —
A.: M-HM.
Q.: — ON THE 4TH.
WE’VE HEARD SOMETHING IN HERE ABOUT DOCTORING THE CLOCK. DOES THAT TERM HAVE ANY MEANING TO YOU?
A.: WELL, IN THE GENERIC SENSE. I WOULD ASSUME THAT YOU ARE REFERRING TO CHANGING THE DATE ON THE COMPUTER CLOCK OR THE TIME SO THAT IT SHOWED A DIFFERENT DATE AND TIME THAN WAS ACTUALLY THE DATE AND TIME THE PERSON WAS USING THE MACHINE.
Q.: DO YOU SEE ANY EVIDENCE OF ANY KIND THAT THAT HAPPENED WITH REGARD TO ANY OF THE COMPUTERS THAT YOU WERE LOOKING AT?
MR. CLARKE: OBJECTION. LACK OF FOUNDATION.
THE COURT: OVERRULED.
YOU MAY ANSWER.
THE WITNESS: NO, I DID NOT.
BY MR. FELDMAN:
Q.: HOW WOULD YOU FIND OUT?
A.: WE’VE HAD THAT COME UP AS AN ISSUE IN AT LEAST TWO CASES THAT I CAN RECALL THAT HAVE COME INTO MY OFFICE IN THE LAST TWO YEARS, WHERE THE ALLEGATION WAS THAT THE COMPUTER CLOCK HAD BEEN CHANGED. AND IN BOTH INSTANCES I WAS NOT ABLE TO DETERMINE THAT THAT HAD OCCURRED.
THERE ARE A NUMBER OF WAYS TO DETERMINE THAT. ONE BEING THE REGISTRY FILES FOR THE COMPUTER WHICH KEEPS TRACK OF THE WINDOWS OPERATING SYSTEM AND WHEN THE DATES AND TIMES THAT FILES ARE ACCESSED WHEN THE COMPUTER IS TURNED ON. WHAT I’VE NOTICED IN PARTICULAR AS I’VE GONE OUT AND EXPERIMENTED WITH THAT TO DETERMINE HOW TO FIND THAT OUT, HOW TO FIND OUT IF COMPUTER CLOCKS HAVE BEEN CHANGED, IS THAT ONE WILL FIND — IN MY EXPERIENCE, ONE WILL FIND THAT, FOR INSTANCE, DATES SUCH AS WE’RE LOOKING AT IN EXHIBIT 142-B WILL NOT BE CONSISTENT. YOU’LL HAVE A LAST ACCESS DATE, FOR INSTANCE, THAT IS EARLIER THAN THE FILE CREATION DATE. SOMETHING THAT BASICALLY IS IMPOSSIBLE. AND WHEN YOU SEE SOMETHING LIKE THAT, THEN YOU KNOW TO LOOK DEEPER IN TERMS OF PERHAPS VIRUS-SCANNING PROGRAMS THAT REGULARLY RUN ON THE COMPUTER AT SPECIFIC TIMES AND DETERMINE IF THERE ARE OTHER THINGS THAT DON’T ADD UP AND MATCH UP IN TERMS OF TIMES AND DATES.
I DIDN’T SEE ANYTHING LIKE THAT IN THESE COMPUTERS. I DIDN’T READ ANYTHING IN THE FORENSICS REPORTS OF THE OTHER LAW ENFORCEMENT PEOPLE WHO LOOKED AT THESE COMPUTERS SAYING THAT THERE WAS ANY INDICATION THE CLOCKS WERE NOT ACCURATE.
Q.: I’M SORRY. YOU JUST MADE REFERENCE TO OTHER FORENSIC REPORTS. YOU WERE PROVIDED WITH INFORMATION THAT WAS REPRESENTED TO YOU TO BE COMPLETE FROM THE R. C. F. L., REGIONAL FORENSICS LABORATORY, IS THAT RIGHT?
A.: YES, SIR.
Q.: AND YOU READ REPORTS OF A MR. WATKINS, IS THAT RIGHT?
A.: YES, SIR.
Q.: A MR. ARMSTRONG, IS THAT CORRECT?
A.: I’M SORRY. I THINK IT WAS MR. ARMSTRONG, YES. AND I BELIEVE MR. WATKINS, TOO. BUT I’M NOT POSITIVE.
Q.: YOU ALSO WERE PROVIDED HIS TESTIMONY, WEREN’T YOU?
A.: YES, SIR.
Q.: WITH REGARD TO YOUR TRYING TO ASCERTAIN WHO WAS USING THE COMPUTER AT WHAT TIMES, I WOULD LIKE TO DIRECT YOUR ATTENTION TO SCREEN PRINTS 39, 40, AND 41. WITH REGARD TO YOUR SCREEN PRINTS 39, 40, AND 41, —
A.: YES, SIR.
Q.: — WHAT DID YOU MEAN TO COMMUNICATE BY HAVING THEM PREPARED?
FIRST OF ALL, LET ME DIRECT YOUR ATTENTION TO 39. WHAT’S 39?
A.: 39 IS A CAPTURE OF THE EN CASE VIEW AGAIN OF THIS COMPUTER. AND WE ARE TALKING NOW ABOUT THE H. P. COMPUTER NUMBER ONE. AND IT IS A SCREEN PRINT OF THE EN CASE VIEW OF
H. P. NUMBER ONE. AND I’M — WHAT’S BEEN HIGHLIGHTED OR MY — WHAT I PUT THE CURSOR ON WAS A PARTICULAR H.T.M.L. FILE WHICH WE TALKED ABOUT WAS A WEB PAGE FILE FOR GET MESSAGE WHICH I RECOGNIZE AS BEING A HOT MAIL MESSAGE THAT WAS RECEIVED ON THIS COMPUTER. AND WHAT YOU’RE SEEING IS THAT THE PERSON LOOKED AT THEIR E-MAIL MESSAGE ON THE INTERNET, AND IT IS CAPTURED AS AN H.T.M.L. FILE BY THE COMPUTER.
Q.: AND THE DATE?
A.: 1/12/02 AT 12:51:30 P.M.
Q.: DIRECTING YOUR ATTENTION TO SCREEN PRINT 40, SIR. WHAT DOES SCREEN PRINT 40 DEPICT?
A.: THIS IS — 39 IS SHOWING WHERE THIS PARTICULAR H.T.M.L. FILE WAS FOUND BY EN CASE IN RELATION TO THESE OTHER FILES. THEN NUMBER 40 IS ACTUALLY THE FILE ITSELF. IT IS A HOT MAIL FILE AS WE DISCUSSED. IT IS TO D. N. WEST AT HOT MAIL DOT COM. IT’S FROM E Z BOOKS AT DARTH DOT S. D. S. U. DOT E.D.U., WHICH I ASSUME WOULD BE SAN DIEGO STATE UNIVERSITY.
Q.: AND SPECIFICALLY SAYS SUBJECT S. D. S. U. BOOKSTORE, E Z BOOK ORDER CONFIRMATION, IS THAT RIGHT?
A.: THAT’S CORRECT. THAT’S IN THE SUBJECT LINE HERE.
Q.: AND 41. WHAT IS SCREEN PRINT 41 INTENDED TO COMMUNICATE?
A.: AT THE BOTTOM OF SCREEN PRINT 40 YOU SEE — YOU CAN BEGIN TO SEE THE ACTUAL TEXT OF THE E-MAIL MESSAGE IT SAYS THANK YOU FOR YOUR ORDER. AND IT GIVES A CONFIRMATION NUMBER. THEN THIS IS — THEN WHAT I DID WAS PAGE DOWN SLIGHTLY SO WHAT I JUST READ IS UP HERE AND NOW YOU’RE SEEING THE BULK OF THE TEXT. AND IT TALKS ABOUT THE COST, $25.00 FOR A RESHELVING FEE. AND THEN CUSTOMER INFORMATION.
Q.: SIR, DID YOU NOTICE ANY SCREEN PRINTS OF CONSEQUENCE THAT RELATED TO THE DATE OF DECEMBER 13TH, 2001, AND MORE SPECIFICALLY DIRECTING YOUR ATTENTION TO SCREEN PRINTS 42 THROUGH 47? WITH REGARD TO SCREEN PRINTS 42 TO 47, SIR.
A.: YES, SIR.
Q.: WHAT DO SCREEN PRINTS 42 THROUGH 47 COMMUNICATE?
A.: FOR SOME REASON SOME OF MY COPIES ARE UPSIDE DOWN. I’M NOT SURE WHY.
Q.: I HAVE RIGHT-SIDE-UP ONES.
A.: 42, 43, 44, 45, 46, AND 47 REPRESENT ANOTHER E-MAIL FILE THAT WAS — HOT MAIL FILE THAT WAS RECOVERED FROM THIS COMPUTER. AGAIN TO D. N. WEST AT HOT MAIL DOT COM. IT’S FROM EDITOR AT NEWSLETTER DOT PINK FOR FREE DOT COM., WHICH, AS WE DISCUSSED A FEW MOMENTS AGO, IS AN ADULT PORNOGRAPHIC WEB SITE WITH LINKS TO OTHER ADULT PORNOGRAPHIC WEB SITES.
Q.: ALL RIGHT.
IS THAT WHAT YOU INTENDED TO COMMUNICATE THROUGH THAT SEQUENCE OF SCREEN PRINTS?
A.: THAT’S CORRECT.
Q.: SO THIS APPEARS TO BE KIND OF LIKE PORN.-SURFING ACTIVITY ON 13 DECEMBER.
MR. CLARKE: OBJECTION. LACK OF FOUNDATION.
THE COURT: SUSTAINED.
YOU NEED NOT ANSWER.
BY MR. FELDMAN:
Q.: DOES THIS APPEAR TO BE PORN.-SURFING ACTIVITY ON DECEMBER 13TH?
MR. CLARKE: SAME OBJECTION.
THE COURT: OVERRULED.
YOU MAY ANSWER.
THE WITNESS: YES. THAT’S WHAT I WOULD THINK.
BY MR. FELDMAN:
Q.: BY?
A.: D. N. WEST.
Q.: THE APPROXIMATE TIME IS 4:47 P.M., ISN’T IT?
A.: THAT’S CORRECT.
Q.: WHY DO YOU THINK IT’S — I’M SORRY. WHY DO YOU THINK THESE SCREEN PRINTS DEPICT PORN. SURFING?
A.: BECAUSE THAT WAS THE ACTIVITY THAT WAS OCCURRING ON THE COMPUTER ON 2/4/02 AT THAT PARTICULAR TIME.
Q.: OKAY.
SIR, YOU’VE ALSO HAD DEVELOPED SCREEN PRINTS 48 AND 49 WHICH APPARENTLY DOCUMENT A COMPUTER USER’S ACCESS TO ANOTHER SITE THAT’S FREQUENTED BY D. N. WEST AT HOT MAIL. IS THAT RIGHT?
MR. CLARKE: OBJECTION. LACK OF FOUNDATION AND PREFACE.
THE COURT: AS TO THE PREFACE. JUST REPHRASE THE QUESTION.
BY MR. FELDMAN:
Q.: SPECIFICALLY DIRECTING YOUR ATTENTION TO SCREEN PRINTS 48 AND 49, SIR. WHAT DO THEY TEND TO DEPICT OR WHAT ARE THEY ILLUSTRATIVE OF?
A.: WHAT I NOTED WAS THAT ON THE DATES THAT I — ON THE DATES THAT I INCORPORATED IN THE REPORT WHERE I HAD FOUND ACCESS BY D. N. WEST TO HIS HOT MAIL ACCOUNT, I ALSO NOTED IN SEVERAL INSTANCES VERY CLOSE TO THE SAME TIME PROXIMITY, WITHIN A COUPLE MINUTES, THE ACCESS OF A PAGE CALLED — I HAVE TO READ IT, IT’S BASICALLY PIGGS-HAUSE, P-I-G-G-S DASH H-A-U-S-E, DOT COM., WHICH IS A GAMING SITE.
Q.: ALL RIGHT.
SCREEN PRINTS 50 THROUGH 55 DEMONSTRATE WHAT, SIR?
A.: THESE ARE AGAIN SCREEN PRINTS THAT I MADE OF MY EN CASE VIEW OF THIS PARTICULAR COMPUTER. SCREEN PRINT 50 IS AGAIN HIGHLIGHTING A PARTICULAR HOT MAIL FILE THAT I FOUND ON 12/15/01.
51 IS — 50 IS SHOWING WHERE I FOUND THE HOT MAIL IN RELATION TO THE OTHER FILES THAT WERE AROUND IT. AND THEN SCREEN PRINT 51 IS THE FILE ITSELF.
Q.: ALL RIGHT.
AND ARE THESE — IS THERE A PARTICULAR SITE TO WHICH THESE SCREEN PRINTS REFER? THAT WOULD BE 50 THROUGH 55, RIGHT?
A.: WHAT THESE WERE — WAS CAPTURED TO REPRESENT WAS, AND THERE ARE I THINK, WHAT, A TOTAL OF THREE INSTANCES OF ACCESSING BOTH THE PIGGS-HAUSE SITE AND THE HOT MAIL DOT COM. SITE ON 12/15 AT ROUGHLY 7:00 O’CLOCK IN THE EVENING.
Q.: LET ME DIRECT YOUR ATTENTION TO SCREEN PRINT 61 AND 62. CAN YOU TELL ME, PLEASE, WHAT’S SCREEN PRINT 61.
A.: 61 IS THE SCREEN PRINT OF A GIF FILE WHICH IS AN IMAGE FILE THAT WAS CAPTURED FROM AN INTERNET WEB PAGE CALLED I FRIENDS DOT COM. IT WAS ACCESSED ON 12/15/01 AT 8:00 O’CLOCK IN THE EVENING.
Q.: AND THEN SCREEN PRINT 62, WHAT DOES THAT SHOW?
A.: WHAT IT APPEARED, AND I ONLY INCLUDED THE ONE, THIS ONE SCREEN PRINT, BUT THERE WERE ACTUALLY SEVERAL. WHAT IT APPEARED WAS THAT THE PERSON WAS ATTEMPTING TO JOIN I FRIENDS DOT COM. AND THEY USED A NUMBER OF DIFFERENT PASSWORDS AND NAMES TO CREATE THEIR ACCOUNT, AND THEY KEPT GETTING REJECTED. I ONLY INCLUDED I BELIEVE ONE EXAMPLE OF THAT, BUT THAT’S WHAT SCREEN PRINT 62 IS, AN EXAMPLE OF THE ATTEMPT TO JOIN I FRIENDS.
Q.: DO YOU NEED SOME KIND OF PASSWORD TO DO THAT?
A.: YES. APPARENTLY SO.
Q.: AND WHAT’S THE PASSWORD THAT WAS ATTEMPTED?
A.: PORNO 4 ME.
Q.: I’M SORRY? PORNO 4 ME?
A.: PORNO, THE NUMBER 4, ME.
MR. FELDMAN: YOUR HONOR, I CAN KEEP GOING. I JUST DON’T WANT TO MAKE SURE I’M LOSING ANYBODY.
THE COURT: YOU’RE NOT LOSING ANYBODY. I’M KEEPING MY EYE ON THEM.
BY MR. FELDMAN:
Q.: DIRECTING YOUR ATTENTION TO SCREEN PRINT 63 AND 64. WHAT DO 63 AND 64 DEPICT?
A.: 63 REPRESENTS AGAIN THE SCREEN PRINT OF THE EN CASE VIEW OF THIS PARTICULAR COMPUTER. I’VE HIGHLIGHTED A HOT MAIL MESSAGE. IT’S AGAIN THE GET MESSAGE DOT H.T.M.L. THEN 64 IS THE MESSAGE ITSELF. IT’S TO D. N. WEST AT HOT MAIL DOT COM. IT’S FROM EDITOR AT NEWSLETTER DOT PINK FOR FREE DOT COM.
Q.: 65 AND 66. DID I JUST COVER THOSE? I’M SORRY.
A.: THAT WAS 63 AND 64.
Q.: OKAY.
65 AND 66.
A.: 65 IS A SCREEN PRINT SHOWING — IT’S ABBREVIATED HERE BECAUSE OF THE — IT’S KEEPING THE TEXT WITHIN THE ROW. BUT IT’S AN H.T.M.L. FILE CALLED DAILY DASH TOON. AND AGAIN IT’S 12/15/01 AT 8:22 P.M.
66 IS GOING TO BE WHAT WAS ON THAT PAGE ON THE DAILY-TOON PAGE. AND IT SAYS HOT, AND THIS IS THE WORD I WAS STRUGGLING TO PRONOUNCE, HENTAI TOONS.
Q.: OKAY.
A.: REFERRING TO JAPANESE PORNOGRAPHIC CARTOONS.
THE COURT: WOULD YOU SPELL THAT FOR MY REPORTER, PLEASE.
THE WITNESS: YES, SIR. CAPITAL H-E-N-T-A-I.
THE COURT: THANK YOU.
BY MR. FELDMAN:
Q.: 65 AND 66. I’M SORRY. WE JUST COVERED THOSE.
A.: YES.
Q.: 67 INDICATES WHAT?
A.: 67 IS AN IMAGE THAT CAME — AS WE SEE, AS YOU — I DON’T KNOW IF YOU CAN SEE IT FROM THAT FAR AWAY, BUT WHEN EN CASE RECOVERS THE H.T.M.L. FILE, IT WILL PUT X’S WHERE THERE ARE NORMALLY PICTURES. IT DOESN’T RECOVER THE PICTURE AS WELL. THE PICTURE IS RECOVERED SEPARATELY BECAUSE IT’S ACTUALLY A SEPARATE FILE. SO WHAT YOU’RE LOOKING AT WITH 67 IS THE IMAGE THAT GOES WITH THAT FILE.
Q.: NOW, AT 67 IT APPEARS AS THOUGH THERE’S AN ACCESS DATE THAT’S REFLECTED OF 2/4/02.
A.: YES, SIR.
Q.: CAN YOU TELL WHAT TIME?
A.: THE LAST ACCESS DATES DON’T CARRY A TIME STAMP. JUST THE DATE STAMP.
Q.: OKAY. SO WHAT WE SEE ON 67 IS AN INDICATION THAT THIS PARTICULAR FILE WAS LAST ACCESSED DECEMBER THE 4TH — I’M SORRY — FEBRUARY THE 4TH, IS THAT RIGHT?
A.: THAT’S CORRECT.
Q.: IT INDICATES IT WAS LAST WRITTEN DECEMBER 15TH, 2001, IS THAT RIGHT?
A.: THAT’S CORRECT.
Q.: AND THEN IT SAYS FILE CREATED DECEMBER 15TH, 2001.
A.: THAT’S CORRECT.
Q.: WHAT DOES 68 DEPICT?
A.: 68 DEPICTS AN H.T.M.L. PAGE AS WE SAID. IT’S A — IT’S DEPICTING A PARTICULAR WEB PAGE THAT WAS ACCESSED ON THIS COMPUTER ON 12/15/01 AT 8:22 P.M. IN THE EVENING.
THEN SCREEN PRINT 69 —
Q.: I’M SORRY. SCREEN PRINT 69. LET’S STOP ON THAT ONE. WITH REGARD TO SCREEN PRINT 69, WHAT’S IT CALLED?
A.: IT’S EXTREME ASIAN BONDAGE. TOTALLY UNCENSORED.
Q.: SAYS THE MOST SEXUALLY PERVERTED SITE ON LINE, IS THAT RIGHT?
A.: YES, SIR.
Q.: I’M SORRY. WHERE DID THIS SCREEN PRINT COME FROM?
A.: THIS IS THE H. P. COMPUTER IN THE DEFENDANT’S OFFICE.
Q.: AND WHO DO YOU THINK OR DO YOU HAVE — WHOSE — ARE YOU ABLE TO TELL, BASED ON YOUR INVESTIGATION, WHO THE LIKELY SOURCE OF THIS PARTICULAR SCREEN PRINT WAS?
MR. CLARKE: OBJECTION. NO FOUNDATION.
THE COURT: WELL, YOU CAN SAY WHAT HE FINDS ON THE RECORD, BUT WHO IT WAS, WE DON’T KNOW. SO BE MORE SPECIFIC IN YOUR QUESTIONING.
BY MR. FELDMAN:
Q.: WITH REGARD TO 69, SCREEN PRINT 69, SCREEN PRINT 69 COMES FROM A SERIES OF SCREEN PRINTS THAT YOU’VE PREVIOUSLY BEEN ABLE TO LINK TO A PARTICULAR INDIVIDUAL’S E-MAIL ADDRESS, IS THAT CORRECT?
A.: ACCORDING TO THE DATE AND TIME, YES, SIR.
Q.: AND WITH REGARD TO THE LINKS THAT YOU’VE MADE WITH REGARD TO THE PARTICULAR INDIVIDUAL AND HIS E-MAIL ADDRESS, WHO IS THAT INDIVIDUAL WHO MAY, BASED ON YOUR INVESTIGATION AND PROFESSIONAL EXPERIENCE, BE RESPONSIBLE IF YOU ARE ABLE TO FORM THAT OPINION?
MR. CLARKE: SAME OBJECTION AS PHRASED.
THE COURT: AS PHRASED, SUSTAINED.
BY MR. FELDMAN:
Q.: ARE YOU ABLE TO FORM AN OPINION AS TO WHO THE SOURCE OF SCREEN PRINT 69 MAY BE?
MR. CLARKE: SAME OBJECTION.
THE COURT: IT’S NOTED.
I THINK YOUR EXPERT KNOWS WHAT HE’S BEING ASKED, BUT YOU’RE HAVING A LITTLE TROUBLE GETTING THERE, MR. FELDMAN. TRY IT AGAIN.
MR. FELDMAN: TIME OUT, PLEASE.
THE COURT: ALL RIGHT.
BY MR. FELDMAN:
Q.: WHAT WAS THE E-MAIL ADDRESS FROM WHICH YOU OBTAINED THE INFORMATION?
A.: D. N. WEST AT HOT MAIL DOT COM.
Q.: AND 69 CAME FROM D. N. WEST AT HOT MAIL DOT COM.?
A.: NO.
Q.: WHERE DID IT COME FROM?
A.: D. N. WEST AT HOT MAIL DOT COM. AND PIGGS-HAUSE DOT COME. WERE ACCESSED ON 12/15/01 AT SEVEN — BEGINNING AFTER 7:00 O’CLOCK IN THE EVENING, 7:11, 7:09, 8:26. SCREEN PRINT 69 WAS ACCESSED ON 12/15/01 AT 8:22 P.M., WHICH IS THE SAME TIME THAT THE D. N. WEST WAS CHECKING HIS HOT MAIL. DOES THAT MAKE SENSE?
Q.: YES. IT MAKES SENSE. SO WITHOUT FORMING AN OPINION WHAT YOU’RE TELLING US IS IT APPEARS AS THOUGH SOMEBODY IS ENGAGING IN ACTIVITY IN PARTICULAR TIMES THAT YOU HAVE JUST TOLD US ABOUT. IS THAT A FAIR STATEMENT?
A.: YES, SIR.
Q.: AND AMONG THE ACTIVITY THAT HE OR SHE IS ENGAGING IN OUT COMES EXTREME ASIAN BONDAGE, IS THAT RIGHT?
A.: CORRECT.
Q.: WITH REGARD TO SCREEN PRINTS 69 THROUGH 74, SIR, THOSE SCREEN PRINTS DEPICT SOME OF THE WHAT, SITES THAT ONE CAN VISIT VIA SCREEN PRINT 69?
A.: AS WE WERE DISCUSSING WITH THE PREVIOUS H.T.M.L. PAGE THAT WE LOOKED AT, THE SOFTWARE DOES NOT PUT THE IMAGE IN THE PAGE ITSELF. THE IMAGE IS A SEPARATE FILE AND THUS IS RECOVERED SEPARATELY. SO THESE ARE — BECAUSE THEY WERE ALL ACCESSED AT EXACTLY THE SAME TIME, 8:22, THESE ARE GOING TO BE IMAGES THAT WERE ON THIS PAGE. AND THEY WERE RECOVERED AS SEPARATE FILES. THEY ARE I THINK KIND OF HARD TO SEE FROM FAR AWAY. THEY BASICALLY DISPLAY BONDAGE-TYPE IMAGES.
THE COURT: OKAY. LET’S TAKE THE MORNING BREAK.
LADIES AND GENTLEMEN, PLEASE REMEMBER THE ADMONITION OF THE COURT NOT TO DISCUSS ANY OF THE EVIDENCE OR TESTIMONY AMONG YOURSELVES OR WITH OTHERS NOR FORM OR EXPRESS ANY OPINION ON THE CASE UNTIL IT IS SUBMITTED TO YOU FOR DECISION.
PLEASE BE OUTSIDE THE DOOR AT A QUARTER TO 11:00. 10:45, PLEASE.
(RECESS, 10:30 O’CLOCK, A.M., TO 10:45 O’CLOCK, A.M.)

03072 - July 3rd 2002 - Transcript of David Westerfield Trial Day 16 - morning 2
10072 - July 10th 2002 -Transcript of David Westerfield Trial Day 19 - morning 2