Stephen Flatley — Direct/Cross/Redirect/Recross
568 linesDIRECT EXAMINATION BY MS. POMERANTZ:
MS. POMERANTZ: Good morning.
STEPHEN FLATLEY: Good morning.
MS. POMERANTZ: Where do you work?
STEPHEN FLATLEY: I work for the Federal Bureau of Investigation, New York division.
MS. POMERANTZ: Is that also known as the FBI?
STEPHEN FLATLEY: Yes, it is.
MS. POMERANTZ: Do you work any particular unit at the FBI?
STEPHEN FLATLEY: Yes. I work in the Computer Analysis Response Team, or CART.
MS. POMERANTZ: And what is CART?
STEPHEN FLATLEY: CART is responsible for collecting and processing digital evidence.
MS. POMERANTZ: What is your title in the CART team?
STEPHEN FLATLEY: I am the CART coordinator.
MS. POMERANTZ: And what does that mean?
STEPHEN FLATLEY: That means I mentor other people and handle the day-to-day activities.
MS. POMERANTZ: Do you have any other roles on the CART team?
STEPHEN FLATLEY: I am a senior examiner. I am also a field instructor from Quantico.
MS. POMERANTZ: You mentioned that you're an examiner. What kind of examiner are you?
STEPHEN FLATLEY: I am a forensic -- digital forensic examiner.
MS. POMERANTZ: How long have you been a forensic digital examiner for the FBI on the CART team?
STEPHEN FLATLEY: 16 and a half years.
MS. POMERANTZ: What did you do prior to joining the FBI?
STEPHEN FLATLEY: I was a computer consultant and programmer.
MS. MENNINGER: Your Honor, I think since we're just doing fact testimony that any more than this would be inappropriate under 702.
JUDGE NATHAN: Okay. You can move on. Thank you.
MS. POMERANTZ: Thank you, your Honor.
BY MS. POMERANTZ:
MS. POMERANTZ: You mentioned digital evidence. What do you mean by digital evidence?
STEPHEN FLATLEY: Things like computers, thumb drives, CDs, anything that stores information in a digital format.
MS. POMERANTZ: Taking a step back, what does it mean to forensically examine an electronic device?
STEPHEN FLATLEY: Basically we just categorize and organize the data so it's easier to look through.
MS. POMERANTZ: Mr. Flatley, what is considered a computer?
STEPHEN FLATLEY: To be considered a computer, a device has to have four characteristics. It has to take input, it has to give output, it has to have some kind of processor, and have some kind of storage.
MS. POMERANTZ: Where is information stored on a computer?
STEPHEN FLATLEY: On your average computer, it's stored on the hard drive.
MS. POMERANTZ: What is a hard drive?
STEPHEN FLATLEY: It's an electromechanical device for storing digital data.
MS. POMERANTZ: When you analyze digital evidence, what, if anything, do you know about the case?
STEPHEN FLATLEY: Usually nothing.
MS. POMERANTZ: Mr. Flatley, did there come a time when you examined digital evidence in this case?
STEPHEN FLATLEY: Yes, there did.
MS. POMERANTZ: In approximately what year or years?
STEPHEN FLATLEY: It began in 2019.
MS. POMERANTZ: Your Honor, I would like to show the witness what's been marked for identification as Government Exhibit 54.
JUDGE NATHAN: Okay.
MS. POMERANTZ: Thank you, your Honor. I'm going to show it to defense counsel.
JUDGE NATHAN: Thank you.
BY MS. POMERANTZ:
MS. POMERANTZ: Mr. Flatley, do you recognize this?
STEPHEN FLATLEY: Yes, I do.
MS. POMERANTZ: What is it?
STEPHEN FLATLEY: It's one of the hard drives I examined in this case.
MS. POMERANTZ: What is the NYC number?
STEPHEN FLATLEY: The NYC number here, NYC024350. It's a unique identifier that I place on different pieces of evidence. Every piece of evidence gets its own NYC number.
MS. POMERANTZ: How do you recognize Government Exhibit 54 as a device you examined?
STEPHEN FLATLEY: It has my initials on it and it has the case number and the date.
MS. POMERANTZ: What was the first step you took in examining Government Exhibit 54?
STEPHEN FLATLEY: When I received government's 54, I plugged it into a write blocker --
MS. POMERANTZ: I'm sorry, Mr. Flatley. Just to take a step back, when you first get it, do you mark it in some way?
STEPHEN FLATLEY: Yes. I'm sorry. The first thing I do is put the NYC number on it and the sticker with my initials.
MS. POMERANTZ: After marking it, do you create an image of the drive?
STEPHEN FLATLEY: Yes. In this case, I had to inspect it to see what kind of data was on it, to see if it was already an image or if it was a clone so that if it was a clone, I would have to image it. If it was an image, I would just have to copy it.
MS. POMERANTZ: Did you end up making an image of this device?
STEPHEN FLATLEY: Yes, I did.
MS. POMERANTZ: What does it mean to make an image of a device?
MS. MENNINGER: Your Honor, this is outside the 702 disclosure.
JUDGE NATHAN: Overruled.
STEPHEN FLATLEY: So an image is a bit-for-bit copy of the media from the very beginning to the very end. We take those -- that copy and we write it into several different files and then that way it containerizes the data inside it so we don't accidentally mess it up.
MS. POMERANTZ: Did you image the drive that's been marked for identification that's been marked as Government Exhibit 54?
STEPHEN FLATLEY: Yes, I did.
MS. POMERANTZ: Can you explain to the jury how you made or what tools you used to make a forensic image of the hard drive?
STEPHEN FLATLEY: Sure. There is a possibility of three different tools that we can use. One is a physical piece of equipment called a TX1 disc duplicator --
MS. POMERANTZ: Mr. Flatley, sorry to interrupt. In this case, what did you use here?
STEPHEN FLATLEY: I used the TX1 disc duplicator.
MS. POMERANTZ: Why not just examine the drive itself in this case, Government Exhibit 54?
STEPHEN FLATLEY: Hard drives are a little fragile, especially this one, it's pretty old. The fact that we spin it up, that may be the last time it ever spins. So we always make a copy and we work off the copy so that we have our data. We can make arguably infinite copies of that data and prove that it's the same data. So that's what we do.
MS. POMERANTZ: What, if anything, do you do to determine that the image you made from Government Exhibit 54 matched the data on Government Exhibit 54?
STEPHEN FLATLEY: We run a hash algorithm, which is basically a math problem against the data that we copied and the data from the original, and if the hashes match, then the data is identical, and the data was in this case.
MS. POMERANTZ: After you made an image of Government Exhibit 54, what do you do next?
STEPHEN FLATLEY: After the 54 was imaged, I then placed it through our software, AccessData's lab to categorize and organize the data.
MS. POMERANTZ: What is AccessData's lab?
STEPHEN FLATLEY: It's a piece of forensic software.
MS. POMERANTZ: Did there come a time when you were asked to review the image you made of Government Exhibit 54?
STEPHEN FLATLEY: Yes, there did.
MS. POMERANTZ: Ms. Drescher, could we please pull up for the witness, the Court, and the parties what's been marked for identification as Government Exhibit 419.
MS. POMERANTZ: Mr. Flatley, do you recognize this?
STEPHEN FLATLEY: Yes, I do.
MS. POMERANTZ: What is it?
STEPHEN FLATLEY: It is a piece of the software registry information for government's 54.
MS. POMERANTZ: And what is registry software information?
STEPHEN FLATLEY: So the registry is a database, a hierarchical database that Windows uses to store all its settings.
MS. POMERANTZ: Does Government Exhibit 419 fairly and accurately reflect the registry software information for Government Exhibit 54?
STEPHEN FLATLEY: Yes, it does.
MS. POMERANTZ: Your Honor, the government offers Government Exhibit 419.
MS. MENNINGER: No objection, your Honor.
JUDGE NATHAN: Thank you. GX419 is admitted. You may publish.
(Government's Exhibit 419 received in evidence)
MS. POMERANTZ: Mr. Flatley, let's walk through the information listed in Government Exhibit 419. What is listed as the install date for Government Exhibit 54?
STEPHEN FLATLEY: It's February 22nd, 2001.
MS. POMERANTZ: What is listed as the product name here?
STEPHEN FLATLEY: Microsoft Windows 2000.
MS. POMERANTZ: Do you see where it says registered organization?
STEPHEN FLATLEY: Yes, I do.
MS. POMERANTZ: What is registered organization mean?
STEPHEN FLATLEY: It's a standard user inputtable field that Windows displays to you when you first set up the computer and it asks for basically the company name that owns the computer.
MS. POMERANTZ: You just mentioned user inputtable. Just briefly, what does that mean?
STEPHEN FLATLEY: That means when you first start the computer, it asks who is the organization, who owns this, and you answer, you type in on a keyboard.
MS. POMERANTZ: What is listed as the registered organization?
STEPHEN FLATLEY: Gmax.
MS. POMERANTZ: And what is registered owner?
STEPHEN FLATLEY: It's the same kind of field as registered organization. It's user inputtable field that's put in when you first start the computer.
MS. POMERANTZ: What is listed as the registered owner here?
STEPHEN FLATLEY: Gmax.
MS. POMERANTZ: Ms. Drescher, now we can bring that down. Can we pull up for the witness, the Court, and the parties what's been marked for identification as Government Exhibit 424.
MS. POMERANTZ: Mr. Flatley, do you see that?
STEPHEN FLATLEY: Yes, I do.
MS. POMERANTZ: Do you recognize Government Exhibit 424?
STEPHEN FLATLEY: Yes, I do. It's an email that was printed from Government's 54.
MS. POMERANTZ: And how do you recognize this?
STEPHEN FLATLEY: I reviewed it prior to court today.
MS. POMERANTZ: Is Government Exhibit 424 a true and accurate copy of an email on Government Exhibit 54?
STEPHEN FLATLEY: Yes, it is.
MS. POMERANTZ: Your Honor, the government offers Government Exhibit 424.
MS. MENNINGER: No objection, your Honor.
JUDGE NATHAN: Thank you. GX424 is admitted. You may publish.
(Government's Exhibit 424 received in evidence)
MS. POMERANTZ: Thank you, your Honor. Ms. Drescher, if we can publish.
BY MS. POMERANTZ:
MS. POMERANTZ: I'd like to turn to the first email in the chain on page 2. Mr. Flatley, what is the date and time of the email?
STEPHEN FLATLEY: The email was sent on Friday, May 25th, 2001, at 12:05 p.m.
MS. POMERANTZ: Who is the email from?
STEPHEN FLATLEY: It's from gmax1@mindspring.com.
MS. POMERANTZ: Who is the recipient of the email?
STEPHEN FLATLEY: Sally Markham.
MS. POMERANTZ: I'd like to ask, Ms. Drescher, if you could, highlight the language starting with "I need to know" and we can go through the end of number 6.
MS. POMERANTZ: Mr. Flatley, can I ask you to read the highlighted language, please?
STEPHEN FLATLEY: "I need to know what if any list John is using and he needs to understand that he is doing a truly awful job. 1. There was no drinking water in the black Merc. 2. There were no pens in the black Merc. 3. The bulb on JE desk was burnt out when we arrived. 4. The pool deck was so filthy, JE had to ask him to pressure wash it. Is this not the gardener's job? And if so, why does John not have it done? 5. Even though John said that he changed the color card in the computer, having done it would it could not -- he could not see that it was exactly the same as before, i.e., no different, and that obviously JE would not be happy with it. 6. The massage creams, et cetera, in JE's bathroom were a mess. No one had it tidied up and arranged them so it was neat."
MS. POMERANTZ: And if we could highlight the last two lines of this. Sorry, Ms. Drescher. Starting with "How are we doing." Thanks very much.
MS. POMERANTZ: Mr. Flatley, can you read that highlighted language, please.
STEPHEN FLATLEY: Sure. "How are we doing with the PB manual — where do we stand with it? G."
MS. POMERANTZ: We can move out of that and let's move up to page 1 of this exhibit and take a look at the email response to the prior email that we just looked at.
MS. POMERANTZ: Mr. Flatley, what is the date and time of the email?
STEPHEN FLATLEY: It's 6:46 p.m. on May 25th, 2001.
MS. POMERANTZ: And who is the email addressed to?
STEPHEN FLATLEY: It's addressed to Ms. Maxwell.
MS. POMERANTZ: And if we could just scroll down to the bottom of the email. And who is it signed by?
STEPHEN FLATLEY: Signed by Sally.
MS. POMERANTZ: Ms. Drescher, let's pull back up to the first page. Thank you very much.
JUDGE NATHAN: Ms. Pomerantz, could I get you a little bit louder, please.
MS. POMERANTZ: Of course, your Honor. Thank you. Ms. Drescher, can you highlight the paragraph starting with "John and I specifically talked."
MS. POMERANTZ: Mr. Flatley, can you read that paragraph, please.
STEPHEN FLATLEY: Sure. "John and I specifically talked last week about how important these details are. About two weeks ago, I faxed your checkoff lists to John in preparation for the manual. These are the lists you made and I'd say they are at least 3/4 complete. (This is the third time I've reviewed these lists with him since I've started.) He stated the lists are complete, although I definitely want to add to them and edit them as your needs change."
MS. POMERANTZ: If we can pull out of that, we can drop that call out, and if we can zoom in on the paragraph starting with "Our household manual draft." Thanks very much.
MS. POMERANTZ: Mr. Flatley, can you please read that.
STEPHEN FLATLEY: Sure. "Our household manual draft does indicate where to purchase "Cleaning supplies" (Publix and Sam's Club-PB Gardens) and states "Use only Tide with bleach, Downy softeners (switch fragrance every 2-3 months) Bounce dryer sheets. We did edit and reviewed this information last week. However, we have not completed an inventory list/check off list of supplies yet."
MS. POMERANTZ: Thank you, Mr. Flatley. And directing your attention to the top of page 1, who is this email from?
STEPHEN FLATLEY: It is from gmax, gmax1@mindspring.com.
MS. POMERANTZ: And who is this email to?
STEPHEN FLATLEY: MarkhamCPM@earthlink.net.
MS. POMERANTZ: Ms. Drescher, we can pull that down. Thanks very much. Ms. Drescher, can we pull up for the witness, the Court, and the parties what's been marked for identification as Government Exhibit 418 and 418R. If we can pull them up side by side.
BY MS. POMERANTZ:
MS. POMERANTZ: Mr. Flatley, do you recognize this exhibit?
STEPHEN FLATLEY: Yes, I do.
MS. POMERANTZ: What is it?
STEPHEN FLATLEY: That's a document that was printed from Government 54.
MS. POMERANTZ: And are you referring Government Exhibit 418 or 418R?
STEPHEN FLATLEY: Both of them. One was -- one is just redacted.
MS. POMERANTZ: And just to be clear for the record, which is the redacted one?
STEPHEN FLATLEY: Redacted is 418R.
MS. POMERANTZ: And Government Exhibit 418, how do you recognize this exhibit?
STEPHEN FLATLEY: I reviewed it prior to court today.
MS. POMERANTZ: Where did you locate this exhibit?
STEPHEN FLATLEY: It was on Government's 54.
MS. POMERANTZ: Is this a true and accurate copy of a document on Government Exhibit 54?
STEPHEN FLATLEY: Yes, it is.
MS. POMERANTZ: Your Honor, the government would offer Government Exhibit 418 under seal and 418R publicly.
MS. MENNINGER: No objection to that, your Honor. I would note that the unredacted one is visible on counsel's table. So I'm not sure if the --
JUDGE NATHAN: We'll take those down from counsel's table.
MS. POMERANTZ: We can take down Government Exhibit 418. Thank you.
JUDGE NATHAN: So 418 is admitted under seal because it has third-party telephone numbers. And 418R is admitted with some of those phone numbers redacted.
(Government's Exhibits 418, 418R received in evidence)
MS. POMERANTZ: Thank you, your Honor. Ms. Drescher, could we pull up for the witness, the Court, and the parties what has been marked for identification as Government Exhibit 418B.
MS. POMERANTZ: Mr. Flatley, do you recognize this?
STEPHEN FLATLEY: Yes, I do.
MS. POMERANTZ: What is it?
STEPHEN FLATLEY: It is the properties of the document you just showed me, 418.
MS. POMERANTZ: And does Government Exhibit 418B fairly and accurately reflect the properties for Government Exhibit 418?
STEPHEN FLATLEY: Yes, it does.
MS. POMERANTZ: How do you know that?
STEPHEN FLATLEY: I reviewed it prior to court today.
MS. POMERANTZ: What did you do to review?
STEPHEN FLATLEY: I'm sorry?
MS. POMERANTZ: What did you do to review?
STEPHEN FLATLEY: I looked at it in my forensic software.
MS. POMERANTZ: The government offers Government Exhibit 418B.
MS. MENNINGER: No objection, your Honor.
JUDGE NATHAN: Thank you. GX418B is admitted. You may publish.
(Government's Exhibit 418B received in evidence)
MS. POMERANTZ: Thanks, your Honor. If I may, I'm going to go through a couple more exhibits to enter them and then I'll publish them for the jury.
JUDGE NATHAN: That's fine. Thank you.
MS. POMERANTZ: Thank you, your Honor. Ms. Drescher, could we pull up for the witness, the Court, and the parties what's been marked for identification as Government Exhibit 420 and 421.
BY MS. POMERANTZ:
MS. POMERANTZ: Mr. Flatley, please let me know when you've reviewed those exhibits.
STEPHEN FLATLEY: I have.
MS. POMERANTZ: Thank you.
MS. POMERANTZ: Ms. Drescher, if we could pull up Government Exhibit 422 for just the witness, the Court, and the parties.
MS. POMERANTZ: Mr. Flatley, let me know when you've reviewed that, please.
STEPHEN FLATLEY: I have.
MS. POMERANTZ: Do you recognize Government Exhibits 420, 421, and 422?
STEPHEN FLATLEY: Yes, I do.
MS. POMERANTZ: What are they?
STEPHEN FLATLEY: They're documents that were printed off of Government Exhibit 54.
MS. POMERANTZ: What kind of documents are they?
STEPHEN FLATLEY: They are Word documents.
MS. POMERANTZ: And how do you recognize these exhibits?
STEPHEN FLATLEY: I reviewed them prior to court today.
MS. POMERANTZ: Are they true and accurate copies of Word documents on Government Exhibit 54?
STEPHEN FLATLEY: Yes, they are.
MS. POMERANTZ: Your Honor, the government offers Government Exhibit 420, 421, and 422.
MS. MENNINGER: No objection, your Honor.
JUDGE NATHAN: Thank you. 420, 421, and 422 are admitted. (Government's Exhibits 420, 421, 422 received in evidence)
MS. POMERANTZ: Ms. Drescher, we can pull that down. If we can pull up for the witness, the Court, and the parties what's been marked for identification as Government Exhibit 420B and 421B.
MS. POMERANTZ: Mr. Flatley, please let me know when you've reviewed this.
STEPHEN FLATLEY: I have.
MS. POMERANTZ: Ms. Drescher, if we can pull up 422B, please.
MS. POMERANTZ: Mr. Flatley, let me know when you've reviewed that.
STEPHEN FLATLEY: I have.
MS. POMERANTZ: Do you recognize Government Exhibits 420B, 421B, and 422B?
STEPHEN FLATLEY: Yes, I do.
MS. POMERANTZ: What are they?
STEPHEN FLATLEY: They are the properties of the documents that are associated with.
MS. POMERANTZ: Do these exhibits fairly and accurately reflect the properties for the corresponding exhibits?
STEPHEN FLATLEY: Yes, they do.
MS. POMERANTZ: How do you know that?
STEPHEN FLATLEY: I reviewed it prior to court today.
MS. POMERANTZ: The government offers Government Exhibits 420B, 421B, and 422B.
MS. MENNINGER: No objection, your Honor.
JUDGE NATHAN: 420B, 421B, 422B are admitted. (Government's Exhibits 420B, 421B, 422B received in evidence)
MS. POMERANTZ: Thank you, your Honor.
MS. POMERANTZ: Mr. Flatley, where were Government Exhibits 418, 420, 421, and 422 saved?
STEPHEN FLATLEY: They were on Government Exhibit 54.
MS. POMERANTZ: Were they saved under any user account?
STEPHEN FLATLEY: Just give me one second. Yes, they were saved under -- in the documents folder for a user, Ghislaine.
MS. POMERANTZ: When you say they were saved under a user account, what does that mean?
MS. MENNINGER: Objection, your Honor. The user account was outside the scope.
JUDGE NATHAN: Overruled.
STEPHEN FLATLEY: So when you have a computer, a Windows computer, when you have a sign-in, a log-in ID username and password, it creates a folder structure under that name to organize the different data on it in case there is other users that are also on the machine. So, these particular documents were saved under the documents folder under the user Ghislaine.
MS. POMERANTZ: What kind of files are Government Exhibits 418, 420, 421, and 422?
STEPHEN FLATLEY: They're Microsoft Word documents.
MS. POMERANTZ: Where are properties stored in a Word document?
STEPHEN FLATLEY: So Word documents are actually not just one file, there are several files that are kind of cobbled together and one of those files maintains the properties of the document.
MS. POMERANTZ: Just put simply, how can someone determine the properties in a Word document?
STEPHEN FLATLEY: So there are two ways you can do it. If the document is open in Word and you go up to File and go down to Properties, it will tell you that. Or, if the document is closed, you can just right-click on the document and select Properties and it will tell you the same information.
MS. POMERANTZ: When a Word document is created, is there metadata that is generated that reflects the creation date of that file?
STEPHEN FLATLEY: Yes, there is.
MS. POMERANTZ: Do Word documents have metadata regarding dates of modification?
STEPHEN FLATLEY: Yes, they do.
MS. POMERANTZ: And what is that referred to as?
STEPHEN FLATLEY: The date modified.
MS. POMERANTZ: What does that metadata reflect?
STEPHEN FLATLEY: The last time somebody saved it.
MS. POMERANTZ: Ms. Drescher, could you please publish Government Exhibit 420 and 420B, which are now in evidence, side by side.
MS. POMERANTZ: Let's just take a look at 420B, Mr. Flatley. What is listed as authors?
STEPHEN FLATLEY: The author is listed as gmax.
MS. POMERANTZ: What is listed as last saved by?
STEPHEN FLATLEY: That is also gmax.
MS. POMERANTZ: And what is listed as the content created date for this document?
STEPHEN FLATLEY: Created on September 7th, 2002.
MS. POMERANTZ: And what is listed as the date last saved?
STEPHEN FLATLEY: September 13th, 2002.
MS. POMERANTZ: What is listed here for last printed?
STEPHEN FLATLEY: September 7th, 2002.
MS. POMERANTZ: And what is listed as the total editing time?
STEPHEN FLATLEY: 30 minutes.
MS. POMERANTZ: Mr. Flatley, just focusing on --
JUDGE NATHAN: I'm sorry, Ms. Pomerantz. I can't hear you.
MS. POMERANTZ: I'm sorry, your Honor. My apologies.
MS. POMERANTZ: Looking at Government Exhibit 420, what is the date in the top-right corner?
STEPHEN FLATLEY: September 7th, 2002.
MS. POMERANTZ: And if you could read the title of the document, please.
STEPHEN FLATLEY: Sure. It's PB New Shampoo and Massage Products.
MS. POMERANTZ: Ms. Drescher, we can take that down. Thanks very much. Ms. Drescher, could you now publish Government Exhibit 418R and 418B. They're already in evidence, so we can publish them side by side, please.
MS. POMERANTZ: Let's start with 418R, Mr. Flatley. On the first page, can you read the top of the document, which I'm going to ask Ms. Drescher to highlight for you.
STEPHEN FLATLEY: It says, Palm Beach House Workers.
MS. POMERANTZ: We can pull that down.
MS. POMERANTZ: If you can read the names under full-time workers and just the first entry would be fine. Thank you.
STEPHEN FLATLEY: John and Mary Alessi.
MS. POMERANTZ: If we can turn to page 2 of this document, can you read the top of the page 2 of this document.
STEPHEN FLATLEY: Palm Beach House Maintenance.
MS. POMERANTZ: And I want to direct your attention to where it says FedEx. Can you read that, please.
STEPHEN FLATLEY: Sure. It says, FedEx an 800 number, 800-463-3339. The account number is 114420816. Nearest dropoff — box next to P.B. National Bank on Worth Avenue.
MS. POMERANTZ: Ms. Drescher, we can take that down.
MS. POMERANTZ: Let's take a look at 418B. Who is the author?
STEPHEN FLATLEY: The author is gmax.
MS. POMERANTZ: Who is the document last saved by?
STEPHEN FLATLEY: Last saved by gmax.
MS. POMERANTZ: What is the revision number listed here?
MS. POMERANTZ: And what is the last printed date here?
STEPHEN FLATLEY: The last printed date is January 29th, 2002, 6:01 p.m.
MS. POMERANTZ: And what is the content created date?
STEPHEN FLATLEY: It's January 29th, 2002, 6:05 p.m.
MS. POMERANTZ: Ms. Drescher, we can pull those down now. Thank you. If we could pull up Government Exhibit 421 and 421B, which are already in evidence.
MS. POMERANTZ: Mr. Flatley, can you read Government Exhibit 421.
STEPHEN FLATLEY: Sure. It says: "Help wanted. Are you a massage therapist? Work in Palm Beach home. Excellent pay. Mostly weekends. Please call 351-1000. Leave message."
MS. POMERANTZ: Mr. Flatley, focusing on 421B, who is listed as authors?
STEPHEN FLATLEY: The author is gmax.
MS. POMERANTZ: Who is listed as last saved by?
STEPHEN FLATLEY: Last saved by gmax.
MS. POMERANTZ: On what date was the content created?
STEPHEN FLATLEY: Created on September 17th, 2001.
MS. POMERANTZ: What's listed as the date last saved?
STEPHEN FLATLEY: September 17th, 2001.
MS. POMERANTZ: Ms. Drescher, we can pull that down. If we could publish 422 and 422B.
MS. POMERANTZ: Mr. Flatley, I want to focus your attention to Government Exhibit 422B.
STEPHEN FLATLEY: Okay.
MS. POMERANTZ: On what date was the document created?
STEPHEN FLATLEY: The document was created on October 14th, 2002.
MS. POMERANTZ: And what's listed as the late last saved?
STEPHEN FLATLEY: October 14th, 2002.
MS. POMERANTZ: What's listed as the last printed date?
STEPHEN FLATLEY: October 13th, 2002.
MS. POMERANTZ: What is the total editing time?
STEPHEN FLATLEY: 20 minutes.
MS. POMERANTZ: And I want to direct your attention to Government Exhibit 422.
MS. POMERANTZ: Ms. Drescher, can you please zoom in on the first paragraph.
MS. POMERANTZ: Mr. Flatley, can you please read the first photograph gmax wrote?
STEPHEN FLATLEY: Sure. "Jeffrey and Ghislaine have been together, a couple for the last 11 years. They are, contrary to what many people think, rarely apart — I almost always see them together."
MS. POMERANTZ: We can pull that down. Let's zoom in on the second paragraph.
MS. POMERANTZ: Mr. Flatley, can you please read the second paragraph gmax wrote.
STEPHEN FLATLEY: Sure. "Ghislaine is highly intelligent, and great company with a ready smile and an infectious laugh who always puts one at one's ease, and always makes one feel welcome."
MS. POMERANTZ: And let's pull up the next paragraph. A. "Jeffrey and Ghislaine share many mutual interests and they have a lot of fun together. They both have keen searching and inquisitive minds. She grew up amongst scientists and in an academic and business environment."
MS. POMERANTZ: We can pull that down, Ms. Drescher. Thank you. Can we zoom in on the last paragraph, please.
MS. POMERANTZ: Mr. Flatley, can you please read this last paragraph. Thank you.
STEPHEN FLATLEY: "Jeffrey and Ghislaine complement each other really well and I cannot imagine one without the other. On top of being great partners, they are also the best of friends."
MS. POMERANTZ: Your Honor, may I have one moment, please?
JUDGE NATHAN: You may.
MS. POMERANTZ: No further questions, your Honor.
JUDGE NATHAN: Thank you. Ms. Menninger.
CROSS-EXAMINATION BY MS. MENNINGER:
MS. MENNINGER: Good morning, Mr. Flatley.
STEPHEN FLATLEY: Good morning.
MS. MENNINGER: How are you?
STEPHEN FLATLEY: I'm fine.
MS. MENNINGER: Good. The exhibit that represents the hard drive, do you have that in front of you?
STEPHEN FLATLEY: Yes, ma'am.
MS. MENNINGER: That's GX54; correct?
STEPHEN FLATLEY: Yes, ma'am.
MS. MENNINGER: And it's your understanding that that hard drive was found within Mr. Epstein's home in New York; correct?
STEPHEN FLATLEY: Yes, ma'am.
MS. MENNINGER: And what you actually saw were three copies of that hard drive; right?
STEPHEN FLATLEY: That is correct.
MS. MENNINGER: And there was no information about why there were three copies of that same hard drive; correct?
STEPHEN FLATLEY: No, ma'am.
MS. MENNINGER: And, in fact, the three hard drives were in a box; correct?
STEPHEN FLATLEY: Yes, ma'am. That's how I received them.
MS. MENNINGER: And when they were in the box, the front of the box had a xerox copy of another hard drive on the front; correct?
STEPHEN FLATLEY: Yes, ma'am.
MS. MENNINGER: You have no idea why there was a different hard drive xeroxed on the front of the box; right?
STEPHEN FLATLEY: I have my thoughts of why that would be.
MS. MENNINGER: But you don't know?
STEPHEN FLATLEY: But no one told me or conveyed to me why it was like that, no.
MS. MENNINGER: And there was evidence tape on the box; right?
STEPHEN FLATLEY: Yes, ma'am.
MS. MENNINGER: And you didn't break that evidence tape; correct?
STEPHEN FLATLEY: Not for that one, no, ma'am.
MS. MENNINGER: It was already broken when you received the box?
STEPHEN FLATLEY: That is correct.
MS. MENNINGER: And there was some indication that the drive had been seized in July of 2007; correct?
MS. POMERANTZ: Objection, your Honor.
JUDGE NATHAN: Grounds?
MS. POMERANTZ: Foundation. Relevance.
JUDGE NATHAN: Foundation, sustained.
BY MS. MENNINGER:
MS. MENNINGER: Did you write a report in which you talked about the fact that these devices show they were seized in July of 2007?
STEPHEN FLATLEY: No, ma'am.
MS. MENNINGER: And they had a name D. Klyman on them?
MS. POMERANTZ: Objection, your Honor. Hearsay.
JUDGE NATHAN: Sustained.
MS. MENNINGER: Your Honor, I'm asking if he can identify Government Exhibit 54 as something he previously referred to with a different indication. It goes to the --
JUDGE NATHAN: You can ask him that question. Sustained on the current question.
MS. MENNINGER: Okay.
BY MS. MENNINGER:
MS. MENNINGER: Do you recall whether the drive that you examined had a representation on it that it was from D. Klyman?
STEPHEN FLATLEY: Not on the drive, no, ma'am.
MS. MENNINGER: On the box in which the drive was located; correct?
STEPHEN FLATLEY: No, ma'am.
MS. MENNINGER: On the bag in which the box in which the drive was located?
STEPHEN FLATLEY: I do recall a D. Klyman on a bag for one of these hard drives, but I couldn't tell you if it was that one.
MS. MENNINGER: And you don't know who he is or what that means; correct?
STEPHEN FLATLEY: No, ma'am.
MS. MENNINGER: When you examined that hard drive, you don't have the device, the computer that that hard drive was in; correct?
STEPHEN FLATLEY: That is correct.
MS. MENNINGER: You don't know if it was from a desktop computer; right?
STEPHEN FLATLEY: I can make -- actually, yes, I can say it was from a desktop computer.
MS. MENNINGER: So not a laptop computer?
STEPHEN FLATLEY: Correct.
MS. MENNINGER: In a stationary place; right?
STEPHEN FLATLEY: Correct.
MS. MENNINGER: People don't usually take their desktops with them on airplanes, for example; right?
MS. POMERANTZ: Objection.
JUDGE NATHAN: Sustained.
MS. MENNINGER: A desktop is more difficult to transport than a laptop; is that fair to say?
STEPHEN FLATLEY: Yes, ma'am.
MS. MENNINGER: So when you examined this hard drive, you actually learned that the hard drive itself was a clone of some other hard drive; right?
STEPHEN FLATLEY: That is correct.
MS. MENNINGER: So you made a clone of a clone?
STEPHEN FLATLEY: I did not. I made an image of a clone.
MS. MENNINGER: Thank you for the clarification. You made an image of a clone; right?
STEPHEN FLATLEY: Yes, ma'am.
MS. MENNINGER: But you were not able to match the clone with whatever it had cloned; right?
STEPHEN FLATLEY: I don't understand the question.
MS. MENNINGER: Well, on direct examination, you talked about how an image was a bit-for-bit copy of the clone; right?
STEPHEN FLATLEY: Yes, ma'am.
MS. MENNINGER: And that means you were able to then confirm that the image you made was identical to the clone from which you made it; right?
STEPHEN FLATLEY: That is correct.
MS. MENNINGER: And then you believe that the thing you were imaging was a clone of something else?
STEPHEN FLATLEY: Yes, ma'am.
MS. MENNINGER: And you don't have that something else to make sure that you did an identical copy, that the clone was an identical copy; correct?
STEPHEN FLATLEY: Correct, I do not know what happened or who made that clone or where it came from.
MS. MENNINGER: Right. You just don't know?
STEPHEN FLATLEY: Correct.
MS. MENNINGER: So you don't know whether anything was changed in the course of that copying; correct?
STEPHEN FLATLEY: That is correct.
MS. MENNINGER: You just don't have something to compare it to; right?
STEPHEN FLATLEY: Correct.
MS. MENNINGER: If you had the other one, you could run the same program; right?
MS. POMERANTZ: Objection, your Honor.
JUDGE NATHAN: Overruled.
MS. MENNINGER: If you had the other one, you could run the same program and make sure that they were identical; right?
STEPHEN FLATLEY: That's correct.
MS. MENNINGER: So, because you don't have that other thing to compare it to — what you think is a desktop; right?
STEPHEN FLATLEY: Correct.
MS. MENNINGER: — you don't know where that desktop was living when any of these exhibits were created; correct?
MS. POMERANTZ: Objection, your Honor.
JUDGE NATHAN: Overruled.
STEPHEN FLATLEY: No, I don't.
MS. MENNINGER: Right. You don't have a location, a geo location for any of these particular documents you've been testifying about; correct?
STEPHEN FLATLEY: That's correct.
MS. MENNINGER: So the desktop could have been in Florida or in New York or somewhere else; right?
STEPHEN FLATLEY: Yes, that's correct.
MS. MENNINGER: And so, when you examined these particular documents, you were able to tell, and I think you told the jury about the user that was associated with the computer, you testified was the author; correct?
STEPHEN FLATLEY: Correct.
MS. MENNINGER: Because that's the piece of information that's contained in the properties, author; right?
STEPHEN FLATLEY: That's correct.
MS. MENNINGER: An author is just drawn from the person who set up the computer in the first place; right?
STEPHEN FLATLEY: No. In that particular instance, the author is another user inputtable field from Microsoft Word when you start using it and it's saved to your account. So, where the account name was Ghislaine, the author name was gmax.
MS. MENNINGER: So when you first set up Word, you put in your name because you're the person who's installing the Word; right?
STEPHEN FLATLEY: Correct.
MS. MENNINGER: And then when you create documents from that Word program, it auto populates the name of the author from the person who set it up; right?
STEPHEN FLATLEY: That's correct.
MS. MENNINGER: It doesn't actually mean a particular person is sitting in front of Word on a particular time when they say new document; right?
STEPHEN FLATLEY: That's correct.
MS. MENNINGER: It just auto populates it from Word; right?
STEPHEN FLATLEY: Yes, that is correct.
MS. MENNINGER: And it auto populates the created date or the modified date and the other dates you talked about; right?
STEPHEN FLATLEY: Yes, ma'am.
MS. MENNINGER: That's not a person inputting a created date, it just comes from the program; right?
STEPHEN FLATLEY: Yes, it gets it from the system, from the clock in the computer.
MS. MENNINGER: So you didn't specify whether this particular computer was password protected; right?
STEPHEN FLATLEY: That's correct.
MS. MENNINGER: You don't have any information that this computer was password protected; right?
STEPHEN FLATLEY: In the registry, it said that it was.
MS. MENNINGER: You were able to get into the computer no problem; right?
STEPHEN FLATLEY: We don't actually get into the computer. We don't go through the operating system. We just take the information that's on the drive and categorize it. The password and user name and all that only protects the computer when you're accessing it through its operating system.
MS. MENNINGER: And you were accessing it through a hard drive copied cloned image?
STEPHEN FLATLEY: All through our forensic software.
MS. MENNINGER: Which was running off of the image of the clone of something; right?
STEPHEN FLATLEY: Yes, ma'am.
MS. MENNINGER: And so, you don't know whether it was an easy-to-remember password or whether the computer actually just had the password on a Post-it next to it; right?
STEPHEN FLATLEY: I have no idea.
MS. MENNINGER: So when you were looking at these documents, these Word documents, you talked about the created date; right?
STEPHEN FLATLEY: Yes, ma'am.
MS. MENNINGER: And that, as we just discussed, was something that was populated by the computer system; right?
STEPHEN FLATLEY: Correct.
MS. MENNINGER: And you didn't then go out and look at that created date to see where any particular person was at that point in time; correct?
STEPHEN FLATLEY: No, ma'am.
MS. MENNINGER: So if, for example, Government Exhibit 418 had some metadata associated with it in 418B -- could we pull that up, 418B. You see that; correct?
STEPHEN FLATLEY: Yes, ma'am.
MS. MENNINGER: And that tells you that the document was created on January 29th, 2002; right?
STEPHEN FLATLEY: Yes, ma'am.
MS. MENNINGER: And it was only edited and so forth on that day, no other day; right?
STEPHEN FLATLEY: It says that it was created on the 29th and it was last saved on the 29th.
MS. MENNINGER: And last printed on that date; right?
STEPHEN FLATLEY: Yes, ma'am.
MS. MENNINGER: So, for example, if you were to go get a flight log and tell where gmax was on January 29th, 2002, it might tell you that gmax was in the same place as the computer or a different place; right?
MS. POMERANTZ: Objection, your Honor.
JUDGE NATHAN: Sustained.
MS. MENNINGER: You don't know who was actually sitting down creating this document; right?
STEPHEN FLATLEY: That's correct.
MS. MENNINGER: You don't even know where the computer was; correct?
STEPHEN FLATLEY: That is correct.
MS. MENNINGER: And if you were to ascertain that gmax was in several different places when different of these documents were created, it might lead one to believe that she's not the one who created all these documents; right?
MS. POMERANTZ: Objection.
JUDGE NATHAN: Sustained.
MS. MENNINGER: Other people had access to this computer, potentially; right?
MS. POMERANTZ: Objection.
JUDGE NATHAN: Overruled.
STEPHEN FLATLEY: I have no idea.
MS. MENNINGER: You don't know whether the computer was sitting in the middle of a kitchen that other people could access it; right?
STEPHEN FLATLEY: I don't know where the computer was.
MS. MENNINGER: You don't know who was around the computer at any particular point in time; correct?
STEPHEN FLATLEY: The only thing I know is that there were three user accounts on the computer — two were created by default when the computer was made and the only other user account was Ghislaine.
MS. MENNINGER: So anyone who used that computer was using that Ghislaine Maxwell user account; right?
STEPHEN FLATLEY: That's correct.
MS. MENNINGER: No other user account was used; correct?
STEPHEN FLATLEY: That's correct.
MS. MENNINGER: So if Ghislaine was not present with the computer when a document was made, that would suggest other people had access to the computer; correct?
STEPHEN FLATLEY: I don't know who had access to the computer.
MS. MENNINGER: May I have one moment, your Honor?
JUDGE NATHAN: You may.
MS. MENNINGER: No further questions of this witness. Thank you.
JUDGE NATHAN: Ms. Pomerantz?
MS. POMERANTZ: Just briefly, your Honor.
REDIRECT EXAMINATION BY MS. POMERANTZ:
MS. POMERANTZ: Mr. Flatley, during the course of your review of Government Exhibit 54, did you review emails?
STEPHEN FLATLEY: Yes, I did.
MS. POMERANTZ: And as to the emails you reviewed on Government Exhibit 54, how many emails did not include gmax1@mindspring.com on the email chains?
STEPHEN FLATLEY: They were all from that account.
MS. POMERANTZ: No further questions, your Honor.
MS. MENNINGER: Your Honor, on that point.
JUDGE NATHAN: Okay.
RECROSS EXAMINATION BY MS. MENNINGER:
MS. MENNINGER: You know about email clients; right?
STEPHEN FLATLEY: Yes, ma'am.
MS. MENNINGER: An email client is something like Outlook or Mail; correct?
STEPHEN FLATLEY: Correct.
MS. MENNINGER: And when an email client like Outlook or Mail is installed on a computer, it often goes up to the server and refreshes itself from the server whenever that computer is connected to the internet; correct?
STEPHEN FLATLEY: That is correct.
MS. MENNINGER: Just like my cellphone may be constantly drawing down emails or sent emails, even though I'm not using it at the moment; correct?
STEPHEN FLATLEY: That is correct.
MS. MENNINGER: So anytime the computer was connected to the internet, it may have been populating emails through an email client on it; correct?
STEPHEN FLATLEY: That's correct.
MS. POMERANTZ: No further questions. Thank you.
JUDGE NATHAN: Thank you. Mr. Flatley, you're excused. You may step down. Members of the jury, we'll take our mid morning break. See you in about 15 minutes. Thank you.
(Continued on next page)
(Jury not present)
JUDGE NATHAN: Mr. Flatley may step down and out.
(Witness excused) Counsel, do we need to speak before the break?
MS. POMERANTZ: Nothing from the government, your Honor.
JUDGE NATHAN: I'll be back in 10 if anybody needs to see me before the break ends. Thank you.
(Recess)
(Continued on next page)
JUDGE NATHAN: All right. Where are we? Ms. Comey.
MS. COMEY: I don't believe we have matters to take up, your Honor.
JUDGE NATHAN: Oh, okay.
MS. COMEY: I think that the next witness will likely go past the lunch break, so we can deal with the issue with Brian hopefully during the lunch break.
JUDGE NATHAN: I hadn't totally understood Ms. Moe's point about the potential need to take a witness out of order given the length. And it's fine with me if that's what makes sense and there's no objection from the defense.
MS. COMEY: Thank you, your Honor. We'll see how long this next witness takes and then go from there.
JUDGE NATHAN: Okay.
MR. PAGLIUCA: Your Honor, might I hand up potential cross-examination exhibits?
JUDGE NATHAN: Will we get there before lunch?
MR. PAGLIUCA: I doubt it.
MS. COMEY: We might, but unlikely, your Honor.
JUDGE NATHAN: Sure. Thank you, Mr. Pagliuca. All right. We can bring in the jury please, Ms. Williams. Thank you.
JUDGE NATHAN: Just one second please. We're about to start with the jury. I'm sorry, Ms. Moe, I didn't realize we were waiting for you.
MS. MOE: No, your Honor. I just apologize. I got a message saying that folks were waiting for me, so I apologize for being late.
JUDGE NATHAN: Oh, no, no. That's fine. Everybody has a lot going on. I understand.
(Jury present)
JUDGE NATHAN: Thank you, members of the jury. Ms. Comey, the government may call its next witness.
MS. COMEY: The government calls Carolyn.
JUDGE NATHAN: The witness testifying under the name Carolyn may come forward. CAROLYN, called as a witness by the Government, having been duly sworn, testified as follows:
JUDGE NATHAN: Once seated, please remove your mask. This witness will be testifying under the pseudonym Carolyn. I remind the sketch artists that my order is in place requiring no exact likenesses of the witnesses testifying under pseudonym.
MS. COMEY: Your Honor, just to be clear, this witness is testifying just under her first name, not a pseudonym. But we would ask the same order be in place.
JUDGE NATHAN: Thank you, Ms. Comey. The witness is testifying under her first name, and the anonymity order with respect to exact likenesses applies. Go ahead, Ms. Comey.
MS. COMEY: Thank you, your Honor. May I inquire?
JUDGE NATHAN: You may.