Skip to content
Ghislaine Maxwell- Case Archive
personpersonStephen FlatleyStephen FlatleyFederal Bureau of Investigation digital-forensics examiner assigned to its Computer Analysis Response Team.← All People
Witness· Federal Bureau of Investigation

Stephen Flatley

Federal Bureau of Investigation digital-forensics examiner assigned to its Computer Analysis Response Team.

AppearedFederal Criminal Trial
207 lines·7 proceedings·3 mentions

About

Called by the government on Day 7, Stephen Flatley, an FBI digital-forensics examiner, described imaging Government Exhibit 54, preserving the original drive, and using hash comparison to verify the forensic image. He identified registry information, emails, and Word documents recovered from the drive, including documents stored in the Ghislaine user's documents folder and metadata listing gmax as author or last saver for certain records.

On cross-examination, defense counsel questioned the source and history of the cloned drive and the limits of the document metadata. Flatley said he did not know who created the documents, where the computer was located, who had access to it, or why a different hard drive had been copied. He explained that Word author and date fields may be populated from account settings or the computer system.

On redirect, Flatley testified that the emails he reviewed from Government Exhibit 54 were from the gmax1@mindspring.com account. On recross, he agreed that an installed email client may refresh from its server whenever a computer connects to the internet.

Trial Record (7)

FederalFederal Criminal TrialNov 29, 2021 – Dec 29, 2021Called by prosecution

Called by the government on Day 7, FBI digital-forensics examiner Stephen Flatley testified about imaging Government Exhibit 54, hash verification, and recovered registry, email, and document metadata. Cross-examination addressed the unknown source and history of the cloned drive and the limits of attributing metadata to a particular user.

Day 7

DirectStephen FlatleyLara Pomerantz4highlights130lines spoken

Summary

Stephen Flatley authenticated electronic records from Government Exhibit 54 and identified document metadata and a Ghislaine user folder.

Highlights (4)

rulingThe court overruled a defense objection and allowed Flatley to explain that a forensic image is a bit-for-bit copy of the media.Open in transcript →
Quote“We run a hash algorithm, which is basically a math problem against the data that we copied and the data from the original, and if the hashes match, then the data is identical, and the data was in this case.”— Stephen FlatleyFlatley described the verification method he used to compare the forensic image with the original drive.Open in transcript →
rulingThe court overruled an objection concerning the user account and Flatley testified that the documents were in the documents folder for the user Ghislaine.Open in transcript →
Quote“So, these particular documents were saved under the documents folder under the user Ghislaine.”— Stephen FlatleyFlatley identified the user folder in which the admitted documents were stored.Open in transcript →
CrossStephen FlatleyLaura A. Menninger5highlights70lines spoken

Summary

Stephen Flatley acknowledged limits on identifying the original cloned drive, the computer's location, document authorship, and who could access the computer.

Highlights (5)

testimony highlightFlatley testified that he imaged a cloned drive but did not know what had been cloned, who made the clone, or where it came from.Open in transcript →
Quote“Correct, I do not know what happened or who made that clone or where it came from.”— Stephen FlatleyFlatley acknowledged that he could not identify the source or creation of the clone he examined.Open in transcript →
testimony highlightFlatley explained that the Word author field was user-entered when Word was set up and did not establish who was sitting at the computer when a document was created.Open in transcript →
Quote“No. In that particular instance, the author is another user inputtable field from Microsoft Word when you start using it and it's saved to your account. So, where the account name was Ghislaine, the author name was gmax.”— Stephen FlatleyFlatley distinguished the Word author field from proof of who created a particular document.Open in transcript →
Show all 5 highlights
Quote“The only thing I know is that there were three user accounts on the computer — two were created by default when the computer was made and the only other user account was Ghislaine.”— Stephen FlatleyFlatley identified the account structure while maintaining that he did not know who had access to the computer.Open in transcript →
RecrossStephen FlatleyLaura A. Menninger1highlight5lines spoken

Summary

Stephen Flatley agreed that an email client may refresh and populate emails when a computer connects to the internet.

Highlights (1)

testimony highlightOn recross, defense counsel obtained Stephen Flatley's agreement that an installed email client may refresh from a server when a computer connects to the internet, potentially populating emails without active use of the computer.Open in transcript →

Day 12