Charles Snipes Forensic Examiner DSicovery LLC 500 Church St., Ste. 300 Nashville, TN 37929 July 26th, 2017 TEMA 3041 Sidco Dr. Nashville, TN 37204 I am a Certified Computer Examiner employed full-time by DSi in Nashville, TN. I have been a computer forensic examiner since 2007. I have worked criminal, civil, and corporate investigations across a wide range of subjects. I have testified as an expert witness in computer forensics, mobile device forensics, and criminal investigations in state and federal courts. I was instructed to review a computer at the Tennessee Office of Emergency Management (TEMA). I have no previous history of doing work for or with TEMA. I have no personal relationship with any employee of TEMA. My primary contact at TEMA was the General Counsel’s Office of the Tennessee Department of Military. I was directed to recover calls from November 28th, 2016 and prior, or determine why they were not available. My examination of the computer took place on July 10th, 2017. The computer was used to archive voicemails, outgoing, and incoming phone calls to TEMA. The computer displayed the state tag number of M61049. I was given complete access to the computer and its contents for the purpose of conducting my forensic examination. The computer in question served as a local PC that was responsible for communicating with and downloading calls recorded on the TEMA PBX phone system. This PBX system ties together the traditional phone line network, provided by the phone company, to an internal data network system that is linked to phones in the TEMA Operations Center. I was able to make the following determinations in regard to the computer and phone calls in question: 1) With the exception of three calls from late in the day, the phone calls from November 28th, 2016 and prior were not present on the computer or the associated PBX phone server. 1 Page 2) I was able to determine the following events to have occurred with relation to the phone archiving software: a. The automatic backups of calls began failing in October of 2016. b. By the time a person manually ran the backup process on December 8, 2016 all files from before November 28, 2016 at 21:48 no longer existed on the PBX server. c. There is a finite amount of storage on the PBX server. This storage is used to retain calls in a temporary "buffer." As the system runs out of storage, the oldest calls are deleted to make room for newer calls. Based on my examination of the computers and the related witness statements, it is my opinion that there was no intentional or malicious deletions of the call recordings from November 28th. The calls were lost as a result of the file buffer being full. Due to limited storage capacity, the PBX server was only able to hold the calls going back to the end of the day on November 28th. 2 Page