DOJ-OGR-00011312.jpg

Case 1:20-cr-00330-PAE Document 715 Filed 07/12/22 Page2of8 The Honorable Alison J. Nathan December 6, 2021 Page 2 warrants; user information associated with certain of those devices; and documents and photographs extracted from certain of those devices. The Government further anticipates that Examiner Flatley will also testify that some of the devices on which he performed extractions were clones of device extractions that had previously been performed by someone else. Gov. Sept. 15, 2021 Letter. On November 26, after the pretrial conference, the government sent a new letter to defense counsel. Despite the substance Examiner Flatley’s expected testimony, the November 26 letter continued the refrain that Examiner Flatley was not going to offer expert opinions. Said the government: The Government anticipates that Examiner Flatley will testify regarding the forensic examination of the devices marked for identification as Government Exhibits 54 and 55, and his determination that those exhibits are clones. He is expected to testify that a clone is an exact copy of one piece of media to another. Examiner Flatley is expected to explain that he connected Government Exhibits 54 and 55 to a write blocker and subsequently imaged, or made an exact copy, of the exhibits. The Government anticipates that Examiner Flatley will explain that the images of Government Exhibits 54 and 55 are exact copies of the original devices because he ran a hash, or mathematical algorithm that uniquely identifies data, on the original devices and the images, which are identical. The Government further anticipates that Examiner Flatley will testify that Government Exhibits 405 and 419 reflect registry software information for Government Exhibits 55 and 54, respectively. Examiner Flatley will explain that such registry software information includes several fields, including registered organization and registered owner, which are user input data. He is expected to explain that Government Exhibits 405 and 419 were generated by Access Data AD Lab. The Government further anticipates that Examiner Flatley will testify that he examined certain exhibits contained on the devices marked for identification as Government Exhibits 54 and 55. In particular, he is expected to testify that Government Exhibits 412, 415, and 424 are emails on Government Exhibit 54; Government Exhibits 418, 420, 421, and 422 are Word documents on Government Exhibit 54; and Government Exhibits 418B, 420B, 421B, and 422B contain the properties, or metadata, for the corresponding exhibits. Examiner Flatley is expected to testify that Government Exhibits 418, 420, 421, and 422 were created under a user profile named “gmax.” He is also expected to testify that Government Exhibit 417 is a Word document stored on Government Exhibit 55. Examiner DOJ-OGR-00011312