EFTA00174663.pdf

From: ' Subject: RE: GS-I4 Justification --- UNCLASSIFIED Date: Fri, 10 Jan 2020 18:27:26 +0000 Importance: Normal Classification: UNCLASSIFIED Hi =, I've massaged the text that was submitted. Over the last year Mr. has exemplified an expert in Digital Video Recorder data recovery. He has completed 23 cases including high profile cases such as; the Epstein case, the Pensacola shooting case, and the Kealoha Corruption case. Mr. testified in the Kealoha corruption trial — case where the local police implicated a relative of the police chief for a crime (mailbox theft) which he did not commit; because they were having a family dispute. Mr. recovered the deleted video from 17 hard drives (3 different models of DVRs) and identified the metadata to include time and date stamps (this became important because the video in question was copied over the day after the police were served with a subpoena). Mr. testified in a Richmond Virginia Murder case where the prosecutor was about to reach a plea agreement for 5 years, after recovering the video of the murders they resulted in judgments of 40 years or more. Mr. prepared to testify in a NC Murder trial, but before he was called to testify the case pled out. Mr. has developed methods of DVR recovery by identifying the file structure and data to be recovered then he either; • Copies the data out and makes the files playable (carving) or • He creates a new file structure and copies the data into the file structure to play through the submitted DVR. (This is why he sometimes need the DVR in question) Mr. has collaborated with other law enforcement partners within the federal government and he keeps contact with the United States Secret Service, Department of Health & Human Services, and the Office of the Inspector General. (Mr. has made additional contacts through the Scientific Working Group — Digital Evidence). He also keeps in touch with Virginia State Forensic Lab and a New Jersey Police agency who perform video data recovery. Additionally Mr. has taught an FBI approved class at both the SWG-DE and the International Association for Identification — (IAI) From: . (OTD) (FBI) Sent: Monday, January 06, 2020 3:39 PM To: EFTA00174663 Subject: RE: G5-14 Justification --- UNCLASSIFIED Classification: UNCLASSIFIED Sorry for the delay, I wanted to get started on the Buffalo Robbery case again... Over the last year I completed 23 cases including the Epstein case, Pensacola shooting case, and the Kealoha Corruption case. I testified in the Kealoha corruption trial — case where the police set up a relative of the police chief for a crime (mailbox theft) he did not commit; because they were having a family dispute. Recovered deleted video from 17 hard drives (3 different models of DVRs) and identified metadata to include time and date stamps (this became important because the video in question was copied over the day after the police were served with a subpoena). I testified in a Richmond Virginia Murder case where the prosecutor was about to make plea agreements for 5 years, but after recovering the video of the murders they resulted in judgments of 40 years or more. I prepared to testify in a NC Murder trial, but the case was pled out just before I left for the trial. I have developed methods of recovery by identifying the file structure and data to be recovered; then either copy the data out and make playable (carving) or creating a new file structure and copying data into this structure and playing through the DVR. (This is why I sometimes need the DVR in question) I have collaborated with other law enforcement partners within the federal government and keep contacts with the United States Secret Service, Department of Health and Human Services, and the Office of the Inspector General. (contacts I made through the Scientific Working Group — Digital Evidence). I also keep in touch with Virginia Sate lab and a New Jersey Police agency who do video data recovery. (I taught a FBI approved class at both SWG-DE and the International Association for Identification - The IAI) Thank you for your efforts in this matter... Regards, From: Sent: Monday, January 06, 2020 1:31 PM To: (OTD) (FBI) < Subject: RE: GS-14 Justification --- UNCLASSIFIED Classification: UNCLASSIFIED It would also be helpful to say for something like "you've completed x cases in the last year, recovering data from x number of DVRs." "testified in X number of trials" (I know there's the Hawaii one. Were there others?" "Collaborated with x number of other experts (USSS?) " This should be an easy lift. We just need the details. . (OTD) (FBI) Thanks, EFTA00174664 From: (OTD) (FBI) Sent: Monday, January 06, 2020 1:23 PM To: (OTD) (FBI) Cc: Subject: GS-14 Justification -- UNCLASSIFIED > Classification: UNCLASSIFIED Hi M, I wanted to send you a quick reminder to provide me with metrics of how many cases you've done, specific to DVRs. Can you provide a brief description on how the recovery is done? I need enough material to put together a paragraph, thanks, Walt UPERVISORY PHYSICAL SCIENTIST (IMAGE EXAMINER) DIGITAL FORENSIC ANALYSIS UNIT (DROFAU) FORENSIC AUDIO. VIDEO AND IMAGE ANALYSIS PROGRAM BLDG 27958A. ERF-E. QUANTICO VA 22135 Classification: UNCLASSIFIED Classification: UNCLASSIFIED Classification: UNCLASSIFIED Classification: UNCLASSIFIED EFTA00174665