Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 1 of 150 1 1 IN THE UNITED STATES DISTRICT COURT 2 FOR THE DISTRICT OF MASSACHUSETTS 3 4 5 UNITED STATES ) CR. No. 03-10283-NG 6 VS. ) Courtroom No. 2 7 RUDY FRABIZIO ) 1 Courthouse Way 8 Boston, MA 02210 9 10 11 DAUBERT HEARING 12 DECEMBER 17, 2008 13 9:35 A.M. 14 15 16 17 BEFORE THE HONORABLE NANCY GERTNER 18 UNITED STATES DISTRICT COURT JUDGE 19 20 21 22 23 24 25 VALERIE A. O'HARA OFFICIAL COURT REPORTER Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 2 of 150 2 1 A P P E A R A N C E S: 2 United States Attorney's Office, by DANA M. GERSHENGORN, ASSISTANT UNITED STATES ATTORNEY and MICHAEL I. YOON, ASSISTANT UNITED STATES ATTORNEY, One Courthouse Way, Suite 9200, Boston, Massachusetts 02210, for the United States; 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 Federal Defender's Office, by MIRIAM CONRAD, ATTORNEY, 408 Atlantic Avenue, Boston, Massachusetts 02210, for the Defendant. Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 3 of 150 3 INDEX 1 EXAMINATION 2 Witness Name Direct Cross Re-Direct Re-Cross Voir Dire 3 4 5 6 RICHARD W. VORDER BRUEGGE By Mr. Yoon By Ms. Conrad 4 144 90 EXHIBITS Exhibit Page 7 No. 2 Chalk 31 Nos. 3 through 22 Entered de bene 31 No. 12 Entered into evidence 72 No. 23 Entered into evidence 139 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 4 of 150 4 1 PROCEEDINGS 2 3 THE CLERK: All rise. United States District Court is now in session. 4 THE COURT: Good morning, everyone. You can be 5 seated. 6 here. 7 Do you want to do the presenting, or, Ms. Gershengorn, are 8 you doing the presenting? I think that I'm not sure how we should orchestrate The motion for the hearing is a defendant's motion. 9 MR. YOON: Are you doing the presenting? Judge, I think I can do the presenting. 10 I think we agreed to do the Daubert hearing by presenting 11 witnesses. 12 witness. We'd be happy to proceed by proceeding with the 13 THE COURT: 14 RICHARD W. VORDER BRUEGGE, having been duly sworn 15 Fine, why don't we start. by the Clerk, testified as follows: 16 DIRECT EXAMINATION 17 BY MR. YOON: 18 Q. 19 and spell your last for our court reporter? 20 A. 21 Bruegge is two words, first word, Vorder, V, as in Victor, 22 o-r-d-e-r, second word, Bruegge is spelled B-r-u-e-g-g-e. 23 Q. And, sir, how are you employed? 24 A. I work for the FBI in the digital evidence laboratory in 25 Quantico, Virginia in the Forensic Audio, Video and Image Sir, could you please introduce yourself to the Court My name is Richard, middle initial W, last name Vorder Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 5 of 150 5 1 Analysis Unit. 2 Q. And how long have you been with the FBI? 3 A. I've worked for the FBI since January of 1995. 4 Q. And the unit that you are assigned to, the Forensic 5 Audio, Visual and Image Analysis Unit, how long have you 6 been with that unit? 7 A. 8 started with the FBI. 9 image analysis component, was transferred from one unit to It's called FAVIAU for short. Well, I have been conducting the same work ever since I The component that I work in, the 10 the FAVIAU unit in early 2000, so I've worked in FAVIAU from 11 2000, but I've worked in the image analysis unit my whole 12 career. 13 Q. And what sort of work does FAVIAU do? 14 A. Well, the name of the unit tells you the kind of work we 15 do, there's audio, video and image analysis. 16 work, that involves enhancement of audio recordings, 17 authentication of audio recordings and also speaker 18 recognition. 19 conducts enhancement of video imagery, improving the visible 20 details. 21 individuals that need to be obscured for various purposes, 22 and it also includes authentication of video recordings as 23 unedited. 24 four major subareas of work that we engage in, image 25 enhancement, also sometimes referred to as information Forensic audio The video enhancement component of the lab That can also include obscuring the identity of The image analysis component in which I work has Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 6 of 150 6 1 extraction. 2 detail in images and videos so that it's more easy to 3 determine, you know, what is shown in the pictures. That's simply improving the visibility of 4 Photographic comparison is another area that can 5 involve the comparison of individuals and objects depicted 6 in images and videos with the actual objects or people or 7 photographs depicting those objects or people. 8 9 That can also include determining whether a specific photograph came from a specific camera, digital 10 camera. 11 literally measuring with light. 12 dimensional information from photographs for the most part, 13 such as how tall an individual was in a surveillance video 14 or something of that nature, and, finally, there's image 15 authentication within the image analysis component, and that 16 is determining whether images have been manipulated or 17 whether their content represents a true and accurate 18 depiction of what is recorded. 19 Q. 20 you have -- does FAVIAU have any particular matters that 21 they handle, particularized databases that they actually 22 maintain at FAVIAU? 23 A. 24 that we maintain. 25 obscenity reference file. The photogrammetry is another area that is That's obtaining Specific to the child exploitation subject matter, do Yes, we have two major components to reference files There first is the child exploitation and Up until the mid-'90s, this file Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 7 of 150 7 1 consisted of physical copies of magazines that depicted 2 child pornography. 3 '70s and the '80s for the most part. 4 oversaw the transition of that from the hard copy to a 5 digital electronic file. 6 '90s to determine the origin of child pornography images 7 that would be recovered in cases. 8 internet, a lot of child pornography images from the 9 magazines had been scanned and would be traded and published 10 In the mid-'90s, I That file was used throughout the In the early days of the on child pornography. 11 12 The magazines had been published in the THE COURT: Was it lawful in the '70s and '80s? Why was there a proliferation in the '70s and '80s? 13 THE WITNESS: In a lot of countries, it was lawful 14 to produce these documents. 15 '80s that countries around the world realized that it 16 shouldn't be lawful and so had to publish. 17 course, there were general obscenity laws but nothing 18 specific to child pornography. 19 It wasn't until the '70s and Before that, of In addition to that CDORF or child exploitation 20 and obscenity reference file, we also maintained digital 21 files both images and that have been submitted to us in 22 prior cases in order to have them reference for future 23 analyses. 24 Q. 25 and these adjunct criminal files, how does FAVIAU maintain And with the child exploitation obscenity reference file Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 8 of 150 8 1 the security of those files? 2 A. 3 the original scans of the magazines are saved as well as 4 computer disks that are parts of the case notes that the 5 file notes, if you will, that are on disks, and those 6 materials are in a safe, okay. 7 laboratory room where we also have two stand-alone computers 8 that are not networked to anything else on which the 9 reference materials are stored electronically. 10 Well, we have computer disks, compact disks, on which That safe is located in a Those computers are password protected. The room 11 that they are in has a cipher lock that has restricted 12 access to only those examiners and technicians who would do 13 work in that room. 14 our laboratory space, our unit space, which is further 15 cipher locked on the second floor of our building. 16 the first floor of our building, we have further access 17 control in the forms of locks on doors and guards. 18 of our building, there are guards for access to the FBI 19 Academy, and beyond that, we're on the grounds of the 20 Quantico Marine Corps. Base. 21 marine corps. corridor to get onto the base. 22 Q. And what is your present position with FAVIAU? 23 A. I am a supervisory photographic technologist. 24 Q. And what are your responsibilities as a supervisory 25 photographic technologist? That room furthermore is located inside Down on Outside You have to go through a Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 9 of 150 9 1 A. 2 to conduct forensic examination of image and video evidence; 3 secondly, I supervise others who conduct forensic 4 examinations. 5 oversee others both internal to the FBI and external to the 6 FBI who conduct research in forensic analysis of image and 7 video evidence, and I also serve on multiple committees, 8 both internal to the FBI and external to the FBI, relating 9 to image and video forensics. I have multiple responsibilities, first and foremost is I also oversee, I conduct on my own and 10 Q. 11 photographic technologist? 12 A. I was promoted to that position a couple years ago. 13 Q. And, Dr. Bruegge, do you have a copy of the government's 14 exhibits before you? 15 A. And how long have you been in a role of supervisory I Do. 16 MR. YOON: Your Honor, I'll be referring to the 17 government exhibits through this. 18 copy to the Court, and I'll be referring to those during my 19 examination if, that's all right. 20 THE COURT: Counsel has submitted a That's fine. 21 Q. 22 No. 1? 23 A. I do. 24 Q. Can you describe what that document is? 25 A. This is a four-page document which is a copy of my Doctor, do you have in front of you Government Exhibit Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 10 of 150 10 1 curriculum vitae dated October 6, 2008. 2 Q. 3 engineering outline your educational background? 4 A. 5 I pursued a degree in engineering at Brown University in 6 Providence, Rhode Island. 7 degree in engineering. 8 concentration, was involved with communication systems, 9 electrical engineering and communication systems. Can you please starting with your undergraduate work in Certainly. 10 From September of 1981 through May of 1985, I received a bachelor of science The focus of my studies, the The classes for that degree included a variety of 11 basic engineering classes that involved studies of 12 electromagnetism, optics, fluid mechanics, standard 13 engineering core curriculum. 14 communication systems, I had further course work in 15 electrical systems, circuit design, communication systems, 16 how information gets transmitted from one place to another, 17 how it gets encoded, and in addition to the engineering 18 work, I also took a couple of geology classes that included 19 a one class in remote sensing that involved some degree of 20 image analysis using LAN set photography digital images 21 taken by satellites and enhancing those for course work. 22 Q. 23 education? 24 A. I did. 25 Q. Can you tell us how you did that? Within the context of the And after your engineering degree did you continue your Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 11 of 150 11 1 A. 2 Geological sciences. 3 There are a number of areas, geochemistry, petrology, 4 minerology, structural geology, oceanography, geophysics and 5 planetary geology also. 6 Ph.D. work was in planetary geology and specifically the 7 study of the planet Venus including my field area, if you 8 will, was mountain belts on Venus. 9 I stayed on at Brown University in the Department of Geological sciences is a broad field. The focus of my masters and my No one has landed on Venus. Nobody has walked on 10 the surface. 11 tell if you would be crushed first or melt first because 12 it's a very toxic environment, but in the mid-, early 13 mid-'80s, the Soviet Union sent a couple of space crafts to 14 Venus, they took radar images of the surface and so built up 15 maps of the surface, pictures of the surface. 16 17 If you were to land on Venus, it's hard to THE COURT: I have to admit I am an amateur astronomer, that's why I could go off in a minute. 18 MS. CONRAD: I was going to object on relevance 19 grounds, your Honor, but it was very interesting. 20 A. 21 of the matter is that in addition to having the Soviet data, 22 there's also a large radio telescope on the island of 23 Puerto Rico called The Arecibo Observatory. 24 25 Actually I will make it relevant, counselor. THE COURT: A. Excellent. The fact Yes, I've been there. I actually went there and took data of the Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 12 of 150 12 1 surface of Venus using that radio telescope so that I could 2 analyze it further and compare the radar data that we took 3 from Arecibo with the radar data that the Soviets took. 4 lot of that work involved enhancing those images using 5 digital image processing to bring out details in those 6 images, measuring features on those images and comparing 7 those features, those mountain belt features to mountain 8 belts on the planet earth as well as mountain belt-type 9 features on other objects in the solar system, on Mars, and 10 A so I produced a thesis. 11 The Ph.D. thesis consisted of four chapters, three 12 of which specifically dealt with image enhancement, image 13 analysis and comparison of those features on Venus with 14 other features trying to understand the structural history. 15 The fourth chapter was a geophysical analysis of the shape 16 of the mountain belts and trying to understand what the 17 crustal composition or crustal, how the crust was organized 18 on Venus. That was my Ph.D. and my masters. 19 Q. After you completed your graduate work, where 20 were you employed? 21 A. 22 Science Applications International. 23 as the Beltway Bandit. 24 and SAIC has a lot of contracts with the Federal Government 25 in which we do a lot of the contracting work. Okay. I went to work in October of 1990 with a company called In D.C., we refer to it Contracts do a lot of federal work, Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 13 of 150 13 1 In my specific position, I was supporting the 2 solar system exploration division. 3 that's responsible for developing the scientific exploration 4 of the solar system, the moon, Mars, asteroids, comets. 5 person whose job I took left to become an astronaut, and 6 that was actually something I was trying to do, so I thought 7 it would be a good career move. 8 9 This is the part of NASA The In the course of that work I would basically assist in development of science strategy, checking that 10 scientific missions that were proposed had the instruments 11 that were needed to advance the scientific requirements. 12 During that time I also applied for and received a grant 13 from NASA to be a member of the Venus data analysis 14 program. 15 At the time that I finished my Ph.D., the U.S. had 16 just sent the Magellan spacecraft to Venus to take our own 17 radar images of the planet, and so I was analyzing that 18 imagery on a low level during the time that I was at SAIC. 19 As I was wrapping up my career at SAIC in 1994, I was also 20 contracted to the Department of Defense, helped develop and 21 operate a spacecraft called Clementine which went to the 22 moon. 23 This was a mission in which the Department of 24 Defense was testing technologies for what happened had been 25 called Brilliant Pebbles, Ronald Regan's star wars. The Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 14 of 150 14 1 defense department, you could say through NASA bone and let 2 NASA have scientists who could use these images that were 3 recovered by the spacecraft to do scientific analysis, and 4 that mission produced the first global digital map of the 5 moon. 6 All of our other missions had had film-based or 7 television-based images of the moon, and as part of that 8 mission, I helped select photographic sequences that would 9 be taken and basically provided the instructions to the 10 spacecraft of what pictures to take of the earth and moon. 11 Q. 12 No. 1, you've outlined some of your professional training. 13 Can you describe for the Court and us which of these 14 trainings relate most directly to image analysis and the 15 forensic analysis you performed in this case? 16 A. 17 FBI Academy. 18 laboratory training, and that would involve basic 19 photography, crime laboratory photography and digital image 20 processing using FBI systems. 21 commercial systems, and that's just laying the ground work 22 to make sure that one understands the photographic process 23 from start to finish. 24 25 Moving onto page 2 of your C.V., Government Exhibit Yes, I can. The first bullet on page 2 talks about The This refers to training done as part of my They were for the most part Moving down to the fourth bullet, Rochester Institute of Technology, there are three classes listed Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 15 of 150 15 1 there, 1, Electronic Imaging; 2, Digital Image Processing; 2 and, 3, Photoshop for engineers. 3 took in the mid to late 1990s. 4 class, a week-long class dedicated to studying how 5 electronic imaging devices work, digital cameras, video 6 cameras all the way from the optics out to the way that the 7 images would be stored on media. 8 All of those classes I Electronic imaging was a The second one, Digital Image Processing, focused 9 on just that, digital image processing, once you've got a 10 digital image, what can be done to improve the detail, to 11 compress it. 12 JPEG compression, and that is one of the topics that would 13 have been covered in the digital image processing class. 14 For the record, JPEG is Joint Photographic Expert Group, and 15 next, Photoshop For Engineers, this refers to Adobe 16 Photoshop, which is without a doubt the most widely used 17 image processing tool in both the artistic community and in 18 the forensic community. 19 We're going to be talking a lot later about Sitting at the defense bench is an individual who 20 has written a book on the use of Photoshop for forensic use, 21 and moving down right below that there is a Workshop Society 22 of Photo-Optical Instrumentation Engineers, Basic Optical 23 Design. 24 lenses and how light is affected by the optical process. 25 When analyzing images, you want to understand about Further down, about five down from that, Orange Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 16 of 150 16 1 Technologies, Basic Photoshop 5.0. 2 took in the mid-'90s again, and as I said, Photoshop is used 3 in our laboratory, and getting basic training is a 4 prerequisite for doing this type of work. 5 This was a class that I Right now Photoshop is at Version 10 or 11, and it 6 seems like more versions are coming out one after the other 7 very quickly. 8 Software Technology AG, it's about seven or eight down below 9 the Orange Technology. 10 Moving down to Stefan Fleischmann/X-Ways THE COURT: I see it. 11 A. 12 classes together were a one-week session. 13 Stefan Fleischmann is the creator of the Win Hex software 14 and is also the owner of the company X-Ways Forensics. 15 teaches how to use Win Hex, which is X-Ways Forensics is 16 just another name for his tools, so the class was focused on 17 how to use Win Hex in a forensic setting and also the File 18 Systems Revealed focused on looking at how computer systems 19 store digital material on them. 20 Q. 21 Fleischmann's course? 22 A. That would have been I believe 2005. 23 Q. Okay. 24 A. The next one down, British Columbia Institute of 25 Technology, Forensic Video Analysis, Photographic Video 1.X-Way Forensics and 2.File Systems Revealed, those two Sir, I'm sorry to interrupt. What year was Stefan Thank you. He Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 17 of 150 17 1 Comparisons. 2 conducting photographic comparisons. 3 available in the open market on conducting photo analysis, 4 photographic comparisons, that is. 5 It's as it's advertised, how one goes about One of the few classes The next one, High Tech. Crime Institute, Computer 6 Crime Boot camp was a week-long class also in 2005 in which 7 basic computer crime issues were studied, things like 8 imaging of hard drives, which is the process by which one 9 makes a bit for bit copy of a computer hard drive. This is 10 a hands-on exercise in using some of the tools for that, 11 also looking at how computer crime investigations can take 12 place and ways one can use the Internet for investigations 13 and also how you can look at things like IP addresses and 14 things of this nature. 15 The next one, Robin Bernstein of The George 16 Washington University Surface Anatomy Seminar, this was a 17 class designed to provide the student with a solid 18 understanding of surface anatomy, which is basically the way 19 human beings look on the outside, and it addresses issues 20 like how the surface reflects the underlying muscle and bone 21 structure underneath the body so that when conducting 22 analyses to look at images which depict skin, one has a 23 better sense of what is realistic, what is not, what is 24 expected when one is looking at bodies. 25 The next one, Khaled Hadi, that's H-a-d-i at E-I-I Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 18 of 150 18 1 Communications, two classes there, Adobe Photoshop Level I 2 Custom and Forensic Photoshop. 3 is more training on Adobe Photoshop, this would have been 4 2006 or, yes, around 2006, newer versions of Photoshop and a 5 class that was geared towards forensic application of 6 Photoshop. 7 As I mentioned before, this The next one down, James Janesick of the Sarnoff 8 Corporation, Introduction to CCD and CMOS imaging sensors 9 and applications. That was a class involving how the 10 detectors that are in the back of digital cameras and video 11 cameras operate and how they are built and how they operate 12 at the electronic level. 13 Two down from that we have Reiner Creutzburg, 14 C-r-e-u-t-z-b-u-r-g, at the Brandenburg University of 15 Applied Sciences. 16 Perspectives in Sensormetrics and Tamper Detection, this was 17 focused on looking at considering both the detectors CCD and 18 CMOS devices and how knowledge of those systems can be used 19 to look for signs of tampering as well as looking for ways 20 of linking images to one another and images to a camera. 21 22 23 This course, Media Forensics and New THE COURT: And I see that you studied with Dr. Farid? THE WITNESS: Yes. Through the Air Force Research 24 Lab in Rome, New York, Dr. Farid has been working to make 25 his tamper detection tools, manipulation tools and image Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 19 of 150 19 1 processing tools translatable to a computer work station 2 environment as opposed to research environment. 3 We contracted through the Air Force Research Lab 4 to have him develop a software package called QIF, 5 questioned image forensics, and this is image authentication 6 software is currently under test and validation in our 7 laboratory. 8 training in the use of that tool. 9 Q. He came down to our lab, and we had day-long If we could move onto page 3 of your C.V., Doctor, you 10 indicated on professional affiliations, committees and honor 11 societies, you cite a working group on imaging technology or 12 SWGIT. 13 A. 14 abbreviated as SWGIT. 15 guidelines and recommendations for the use of images and 16 video in the criminal justice system. 17 Can you tell us about that? Yes, Scientific Working Group on Imaging Technology is SWGIT has the mission to develop It provides best practice, it works by a consensus 18 process of building documents that address images, that 19 address issues in photography and video analysis. 20 four committees on SWGIT right now. 21 analysis committee of which I'm a member, there is a 22 forensic video subcommittee, there is a forensic photography 23 subcommittee, and there is also an outreach committee. 24 25 There are There is an image The forensic photography committee would provide guidelines for both laboratory forensic photography as well Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 20 of 150 20 1 as for crime scene photography. 2 obviously discusses video analysis. 3 addresses those issues that I've mentioned in my area of 4 image analysis. 5 towards providing recommendations and guidelines to lawyers, 6 judges and managers, so it's more one document that's 7 currently in draft is a document on myths about digital 8 imaging. 9 committee. The forensic video Image analysis The outreach committee is geared more All of these documents are worked on in this They are hammered out and put into a standard 10 format. 11 the forensic science community using the International 12 Association for Identification website. 13 science organization that has been around for over 100 14 years. 15 They are then published as drafts to the members of IAI is a forensic The SWGIT produces these best practices documents. 16 We've got over a dozen. 17 there are a couple in the process right now. 18 documents that the image analysis subcommittee has produced 19 are a best practices for image analysis. 20 an overview of image analysis in the areas of photographic 21 comparison, image authentication and photogrammetry. 22 group also published a document on best practices for image 23 authentication, and there is a current best practices for 24 photographic comparison analysis that is in draft and has 25 been released. We're nearing 20 actually, and Among the That has included That Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 21 of 150 21 1 Q. 2 2006? 3 A. 4 Fortunately there are term limits, and I don't have to be a 5 chair any longer. 6 Q. Do you have a current position now? 7 A. The position is immediate past chair, and so I sit on 8 the executive committee as the immediate past chair and 9 continue to work with the group as a member. Sir, what position did you hold in SWGIT from 2000 to I was the chair of the SWGIT for that period of time. 10 Q. 11 2005, does the current practices of your section FAVIAU 12 conform to those best practices and those recommendations? 13 A. Yes. 14 Q. In addition to your responsibilities with SWGIT and 15 other professional committees, are you the FBI's point of 16 contact for a new initiative regarding expansion of 17 fingerprint analysis? 18 A. 19 the FBI's point of contact for face recognition 20 technologies. 21 services that it provides to our law enforcement partners 22 beyond fingerprint analysis. 23 automated fingerprint system, is being updated, upgraded to 24 have the latest technology, and there is a program in place 25 called The Next Generation. The best practice documents, most recently you said Not actually the expansion of fingerprint analysis, I am The FBI is in the process of expanding the The AFIS system, which is the Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 22 of 150 22 1 Originally it was Next Generation AFIS, but it has 2 now been renamed Next Generation Identification, and the 3 idea is that the FBI in addition to having the fingerprint 4 database, the FBI also oversees the CODIS, Combined DNA 5 Index System. 6 database. 7 stove piped, developed independently. 8 9 We also have a voice recognition system and All of those three systems have been kind of The Biometric Center of Excellence Initiative is bringing all of these modalities together into a common 10 framework so that there will be more communication between 11 them. 12 and advance the state of the art in other modalities 13 including face recognition and iris recognition as well as 14 palmprint, handwriting, some other areas that can be used. 15 It might help for me to back up and say biometrics is using 16 physical properties of human beings or their behaviors as a 17 way of identifying them. 18 recognition lead for the FBI in the Biometrics Center of 19 Excellence. 20 Q. 21 presentations and publications. 22 which of those would be most directly related or have been 23 in fact to the image analyses and the forensic exam you did 24 in this case? 25 A. It also is designed to improve the FBI's capability I was named last year as the face Also on page 3 of your C.V., you've outlined some Yes. Can you identify for us Well, if you look at the bullets, the fourth and Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 23 of 150 23 1 fifth down, Photogrammetry Is A Means To Detect Photographic 2 Deception and Detecting Fraud And Alteration In Digital 3 Imagery. 4 the issue of looking for fraud in images, image 5 manipulation. 6 Both of those were in 1997. Those were addressing Moving down a couple slots from there, you see one 7 Digital Imaging And The Examination of Photographic 8 Evidence, which I gave at the International Association for 9 Identification conference in 1998. 10 Further moving down, we go to Digital Image 11 Processing and Forensic Photographic Examinations, which I 12 gave at the International Association for Forensic Sciences 13 in 1999. 14 Moving down a few more, Techniques In Forensic 15 Images Comparison was a lecture I gave at the Toronto Police 16 identification seminar in 2001. 17 Fourth up from the bottom, Acquiring Processing, 18 And Protecting Imaging Evidence, Guidelines for managers, 19 Crime Scene Personnel, and Laboratory Experts at the 20 American Academy of Forensic Sciences in 2002. 21 workshop. 22 That was a At the bottom, there is an article, a chapter that 23 I wrote called Imagery Sciences In Forensics And 24 Criminology. 25 John Wiley & Sons in 2002. That's a chapter in the encyclopedia put by Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 24 of 150 24 1 Turning to page 4, we have the third one down, 2 Image Examinations In Child Pornography Cases that I 3 delivered at the Advance Child Exploitation Seminar at the 4 National Advocacy Center in North Carolina in 2002. 5 Next one, When Is Evidence Considered Manipulated 6 that I gave at the Texas Center for the Judiciary, 2003 7 Regional Conference in El Paso, Texas. 8 9 The next one, Detecting Image Manipulation In The Digital World in a lecture that I gave in at the IAI in 10 2003. 11 talk at the IAI up to 2006, 2007. Further down there are subsequent updates of that 12 I gave a talk on Digital Imaging In The Laboratory 13 ASCLD 2003 conference. 14 Society of Crime Laboratory Directors. 15 ASCLD, A-S-C-L-D, is the American Moving further down, let's see, Adobe Photoshop, A 16 Tool For Document Examination that I gave at the 17 Mid-Atlantic Association of Forensic Scientists 2005 18 Workshop. 19 THE COURT: Why don't we stop reading these, and 20 if there's something you want to point out and explain, that 21 makes sense. 22 MR. YOON: Yes, your Honor. 23 Q. 24 down, Detecting Manipulated Imagery Update IAI Lectures, 25 2005, 2006, 2007? Doctor, can you explain about two-thirds of the way Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 25 of 150 25 1 A. 2 it, and forensic photographers and people who are interested 3 in image analysis will attend the IAI meeting. 4 of those lectures was to provide lectures on how one goes 5 about looking for manipulation in images, what the 6 approaches are, what one does in terms of looking for 7 metadata or content within the images to detect them as well 8 as including tools one might use to look for these things, 9 so that is what that was about. Basically the IAI has an electronic imaging committee on The purpose 10 Q. 11 Verification Of Image And Video Authentication Examinations, 12 AAFS, 2008, can you explain that to us? 13 A. 14 recent meeting of the American Academy of Forensic Sciences 15 in which I reviewed some cases that had been submitted to 16 our laboratory for analysis that involved questions of the 17 authenticity of these materials, and we basically conducted 18 the analysis, sent our report out and gave the results. 19 Later events effectively verified that the analyses were 20 correct. 21 was a child pornography series called The Vicky Series. 22 That involved multiple videos and images, still images. 23 And lastly I'll ask you fourth up from the bottom, Blind Yes. That was a presentation that I gave at the most In one case there was a known child, well, there It was known as The Vicky Series but this was not 24 a known victim. 25 her father as being the one who had performed -- well, the Last year, 2007, she identified herself and Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 26 of 150 26 1 one that recorded all these videos and images. 2 subsequently arrested, therefore, it was verified that our 3 authentication of these images and videos is real was 4 authenticated by the fact that she verified, she 5 authenticated it herself. 6 He was Another case that I had been involved in was the 7 Daniel Pearl decapitation. 8 the Wall Street Journal journalist who was kidnapped in 9 Pakistan and subsequently murdered and beheaded. You may recall Daniel Pearl was We 10 received in our laboratory the video recording of that. 11 was asked to determine is this real or computer generated or 12 has it been manipulated? 13 produced video, that is to say, there were titles and 14 subparts of it had been obscured to obscure the identity of 15 the individuals who were doing these things. 16 I The video itself was a highly I conducted my analysis and reached the conclusion 17 that it was a true and accurate depiction of events that 18 were happening to the body. 19 recovered, and based on materials that I had provided to the 20 AFIP, The Armed Forces Institute of Pathology in 21 Washington D.C., a forensic pathologist went through the 22 video a frame at a time and was able to indicate where 23 specific marks on the skeleton had been made by the machete 24 and say this mark corresponds to this event in the video and 25 thereby validated, verified the conclusion that this was a Subsequently the body was Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 27 of 150 27 1 true and accurate depiction was verified. 2 Finally, we also have had -- we had another case 3 in which it's what's referred to as a snuff video. 4 particular snuff video, a woman looks at the screen, says 5 snuff films are not real and is then shot in the head, and 6 there is an explosion of viscera behind her head. 7 determined that this was most likely an artistic forgery 8 because of artifacts in the way the video sequence 9 happened. 10 In this We Subsequently it was released that there's a man in 11 Canada who his business is to produce these snuff films, 12 these imitation snuff films, and he actually had a press 13 conference with the victim in this case to talk about that 14 after the analysis had been done. 15 Q. 16 four general categories, comparison, photogrammetry, 17 information extraction and image authentication. 18 has the FBI been doing those kinds of analyses? 19 A. 20 analyses for decades. 21 Q. 22 been or are you proficiency tested? 23 A. Yes. 24 Q. Can you describe that for us? 25 A. Part of being accredited by the American Society of Thank you. You had indicated with FAVIAU there were How long Well, the FBI has been doing all of those type of And for you, with regard to those analyses, have you Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 28 of 150 28 1 Crime Laboratory Directors, Laboratory Accreditation Board, 2 which is a recognized accreditation organization, 3 laboratories must have proficiency testing for their 4 examiners, and as a result we have annual proficiency tests, 5 and the idea is you have materials submitted to you and in 6 this case we have a contract with the Law Enforcement 7 Assistance Facility in Rome, New York. 8 9 They prepare case materials for us, effectively simulated casework. That casework is then submitted to us 10 along with the typical paperwork that we would get with a 11 request for examination. 12 provide our notes and our report back. 13 Q. And how often are you proficiency tested? 14 A. You are required to have one proficiency test per 15 year. 16 Q. When was your last proficiency test? 17 A. This past summer. 18 Q. How did that turn out? 19 A. The results are still yet to come back. 20 Q. Okay. 21 test? 22 A. The year before. 23 Q. And how did that turn out? 24 A. I passed. 25 Q. Have you ever failed a proficiency test? We conduct the examination, we We're then graded. Before that when was your last proficiency Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 29 of 150 29 1 A. No, I have not. 2 Q. How many video or image, video and image analysis 3 comparisons have you performed? 4 A. 5 more than 500. 6 examinations in it, so the total number of video and image 7 analysis examinations, I have done numbered in the 8 thousands. 9 Q. Have you testified in court before? 10 A. Yes, I have. 11 Q. How many times have you testified? 12 A. I have testified over 50 times in court. 13 Q. Okay. 14 A. Yes, I have. 15 Q. And has that been in the field of image analysis to 16 include examination of film, video and digital imagery? 17 A. 18 The number of cases that have been assigned to me is Each of those cases might have multiple Have you been qualified as an expert before? Yes. MR. YOON: Your Honor, at this time the government 19 would submit Dr. Bruegge in the field of image analysis to 20 include examination of film, video and digital imagery. 21 MS. CONRAD: I'm not sure what that means in the 22 context of this hearing. 23 particular issue that is expected to be the subject of 24 Dr. Bruegge's testimony, so I'm certainly objecting to a 25 finding that he's an expert before I've had an opportunity I think my focus is on the Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 30 of 150 30 1 2 to cross-examine. THE COURT: The question is whether you want to 3 stop now, you want to cross-examine, or whether you want to 4 finish your direct examination. 5 is a hearing before me that you continue and then you 6 cross-examine and then we can reserve that issue. 7 MR. YOON: 8 THE COURT: 9 10 I would prefer since this Yes, your Honor. Thank you. I want to know whether he's disappointed that he's not an astronaut. THE WITNESS: One of the reasons I left NASA, your 11 Honor, was that I was at headquarters, I was assigned to 12 NASA headquarters, and being in Washington D.C., it's like 13 they talk about laws and sausage, you don't really want to 14 see it, and it became apparent to me -- I wanted to be an 15 astronaut to go walk on other objects. 16 an astronaut to orbit the earth, it would be cool, but 17 floating around in a tin can looking at the earth is not 18 something, and so I'm not disappointed to be an astronaut in 19 this environment. 20 THE COURT: 21 MR. YOON: I didn't want to be Okay. Your Honor, for the record the 22 government would ask that Government Exhibit 2 through 22 23 previously entered to counsel and to the Court, we received 24 de bene for the purposes of this hearing. 25 THE COURT: There's no objection, I take it, for Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 31 of 150 31 1 the purposes of this hearing? 2 MS. CONRAD: Well, there is an objection to 2, 3 your Honor, which is essentially a script of his testimony. 4 It's PowerPoint, and I view that more as a chalk than I do 5 as an exhibit. 6 testified? 7 I assume it's going to be displayed and THE COURT: We can characterize this as a chalk. 8 Again, these are distinctions that do not make a lot of 9 sense in a hearing in front of me, but, in any event, I'll 10 characterize that as a chalk. 11 bene. 12 13 The rest will come in de ( Government Exhibit No. 2 was marked as a chalk.) 14 ( Government Exhibit Nos. 3 through 22 were 15 marked and admitted de bene.) 16 MR. YOON: Thank you, your Honor. 17 Q. 18 images, do you have experience with digital cameras and how 19 they work? 20 A. Yes, I do. 21 Q. You're familiar with the digital images and the building 22 blocks or components that make them up? 23 A. Yes, I am. 24 Q. In preparation for your testimony today, did you prepare 25 a PowerPoint that was referred to by the counsel and the Doctor, in the context of your analyzing and examining Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 32 of 150 32 1 Court on digital image and thumbnails generally? 2 A. Yes, I did. 3 Q. Is that as you understand it marked Government 4 Exhibit No. 2? 5 A. Yes, it is. 6 Q. Would that assist your testimony in presenting that to 7 the Court today? 8 A. Yes, it would. 9 10 MR. YOON: Your Honor, I'd be able to publish that. 11 THE COURT: 12 MR. YOON: That's fine. Okay, thank you, Judge. I think it 13 should come up on all monitors, Judge. 14 Q. 15 just spoke of, is that on the screen right now? 16 A. Yes, it is. 17 Q. Can you tell us what you've entitled the PowerPoint 18 Government Exhibit 2? 19 A. 20 Thumbnails. 21 well as the laboratory number for identification purposes. 22 Q. 23 tell us what this presentation or what this outline is? 24 A. 25 is in fact an outline of what this PowerPoint addresses. Doctor, is the PowerPoint, the one that you had drafted, This PowerPoint is entitled Analysis of Digital Image The title slide includes the FBI case number as Just as a preview for the Court and counsel, could you If we move to the second page of this PowerPoint there Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 33 of 150 33 1 First of all, the discussion of digital files within a 2 camera, then a discussion of metadata, followed by a 3 discussion of thumbnails, then we're going to talk about 4 JPEG compression and quantization tables and conclude this 5 discussion with Photoshop 6.0 and camera thumbnails. 6 Q. 7 are these files created by a camera? 8 A. 9 how digital cameras work. And, Doctor, can you tell us how are digital images, how Well, the next two slides walk through the process of 10 MS. CONRAD: Your Honor, I'm just a little baffled 11 here. 12 it should be question and answer, not the next slide answers 13 the question. 14 the screen to support the testimony or summarize the 15 testimony, but it seems to me also I guess I'm troubled 16 because what's the record of this hearing in the event that 17 we need a record of this hearing? 18 hearing the PowerPoint, or is it the transcript that 19 Ms. O'Hara is creating with question and answer? 20 though this is not before a jury, I object to the format of 21 this direct examination. I haven't encountered this before, but it seems to me 22 You know, if it's helpful to have a slide on MR. YOON: Is the record of the Your Honor, let me respond. 23 this counsel has had this PowerPoint. 24 actually penned and authored by the witness. 25 statement. Even Obviously This has been This is his It is part of something that assists him in his Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 34 of 150 34 1 testimony. 2 then supplemented and aided by these slides itself, but the 3 record would include obviously the court reporter's 4 transcript, in addition to this which is an exhibit that 5 we're asking to enter for the purposes of this hearing. 6 I can, of course, ask questions that will be THE COURT: Well, tell me what the exhibit is 7 doing. 8 metadata, raw thumbnails, reference images, if it's 9 explaining his methodology, then your opening question could If the exhibit is explaining the concepts of 10 be, you know, what did we ask you to do, what was your 11 methodology, and this would be an explanation of his 12 methodology. 13 If this PowerPoint is his summary of his testimony 14 in this case soup to nuts, then Ms. Conrad is right, that's 15 not the narrative form, the question and answer form. 16 really is saying here's the methodology I use and this is an 17 interesting way of showing it to you, that's a different 18 question. 19 MR. YOON: If he I think what it does, it lays the 20 ground work for the testimony, and it also answers the 21 question of the methodology and the steps and the 22 background, the background and the methodology and the steps 23 that this witness took in examining these images. 24 25 THE COURT: Well, is it image specific to the images in this case or is it talking generally about his Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 35 of 150 35 1 methodology? 2 MR. YOON: No, your Honor, this first PowerPoint 3 talks generally of methodology. 4 THE COURT: 5 his methodology. 6 MR. YOON: 7 MS. CONRAD: 8 Thank you. Note my objection. Is this now not a chalk, it's now an exhibit? 9 10 I'll allow it in as a description of THE COURT: It's still a chalk. He would have to testify with respect to what's going on on the screen. 11 MS. CONRAD: 12 THE COURT: That's all I'm asking. Yes, yes. It's not an unknown 13 practice in patent cases when there is an expert on the 14 stand to essentially give the Court a primer of what he is 15 giving testimony on, Ms. Conrad is right, the words have to 16 come out of his mouth, a PowerPoint doesn't work. 17 MR. YOON: Of course, your Honor. Thank you. 18 Q. 19 created by a camera? 20 A. 21 pages, which are pages 3 and 4, provide a text overview of 22 the sequence that goes on in the production of a digital 23 image within a camera. 24 with a digital camera, you turn the camera on, you make sure 25 the lens cap is off or that the lens is working. Doctor, can you tell us how is a digital image file Yes, I can. The PowerPoint presentation on these two When you start to take a picture You then Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 36 of 150 36 1 have the option with most digital cameras to select what 2 settings you are going to use. 3 A lot of cameras have various options on the size 4 of image that you can take. 5 image size that is 3,072 pixels by 2,048 across. 6 multiply 3,000 by 2,000, that's 6 million. 7 megapixel image. 8 size of 2,048 by 1,536. 9 These are options that a lot of digital cameras allow you to For example, you can have an When you That's a 6 You can also have the image recorded at a These would be a 3 megapixel image. 10 save the image as. 11 compression, the amount of compression that's going to be 12 used to save that file. 13 You also have the option to set it, the Now, compression is in general terms a way of 14 reducing the size of a file so that you don't have to use as 15 much space to save it. 16 of compression, and there's a lot of ways, there's 17 variations in the amount of compression that you can use, 18 and on the camera you may have settings that are titled high 19 or fine or normal. 20 the image is going to be compressed or reduced in size, and 21 the user has the option to save that in most cases. 22 There are a lot of different types All of these are reflected in how much There are also a number of other things that you 23 may be able to set when you're setting your digital camera. 24 You may not want the flash to go off so you can turn it off. 25 You may be somewhat more than a casual photographer, and you Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 37 of 150 37 1 may know about aperture and exposure settings, for example, 2 if you want to catch fast action, you may want to make sure 3 that the exposure is set to a quick, a very short exposure 4 so you can freeze the action, otherwise you might want to 5 modify the aperture which modifies how much light gets in 6 and out. 7 All of these can be done automatically, but with 8 some cameras, you can set them manually, so when you're 9 taking a picture, in addition to these sorts of things, you 10 might also have set the time and date on the camera. 11 Presumably once you've set the time and date on the camera, 12 you're not going to set it again, but those are the sorts of 13 settings we're talking about. 14 Once you've got the camera on, you then look 15 through the view finder or you look at the picture on the 16 back of your camera and you compose the scene. 17 what you're going to take a picture of, then you push the 18 button, you release the shutter. 19 which the camera is going to say, okay, the light hitting 20 the detector in the back of the camera, that's what we're 21 taking a picture of. 22 You decide This is the process by So at that point the light from outside the camera 23 comes in through the lens and hits the back of the camera, 24 the detector in the focal point. The focal plain is like 25 the film plain in a film camera. In the case of digital Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 38 of 150 38 1 cameras, it's an array of what are called CCDs or CMOS 2 devices. 3 an electrical charge based on how much light is hitting it, 4 and so if we move to the next page, we now have charge, an 5 electrical charge associated with every pixel at the back of 6 the camera, and that charge actually represents both a 7 brightness, how much light was hitting it as well as a 8 color. 9 These are little electronic devices. CCDs create RGB is the typical that we refer to, red, green, 10 blue with digital images, and you also have the metadata 11 associated with that. 12 make and model of the camera as well as all the settings you 13 might have. 14 the metadata, and we'll discuss that later, but all of this 15 material is basically in the camera at this point. 16 Metadata refers to things like the There are other things that may be included in Now, for most digital cameras, once you've done 17 that the camera will display to you the image that you have 18 just recorded. 19 image, it's displaying what's called a thumbnail image, a 20 smaller version of that image on the back of the camera. 21 You can then look at that image and in most cases decide 22 whether you're going to save that image or delete it, you 23 didn't like the way it was composed, the way it came out, 24 you can just delete it. 25 want to save space or you don't have any reason for saving It's not actually displaying the whole The reason you delete it is you Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 39 of 150 39 1 everything you shoot. 2 Finally, if you select save, then that image is 3 written to the media that's being used to record the image 4 and to store the whole image. 5 that's in the camera, or it may be memory on the camera 6 itself. 7 it, the data is still there but it can be overwritten and 8 removed, then at that point you're ready to take another 9 picture. That may be a flash card If you choose to delete it, then it doesn't save 10 Q. 11 described, what is saved in the digital image file? 12 A. 13 itself, this thumbnail image that is separate from the main 14 picture and all the metadata that has the settings and that 15 tells the computer that this is an image file and what type 16 of image file it is and how to interpret it. 17 Q. Now, what can you tell us about metadata? 18 A. Okay. 19 question was asked, what is saved in the digital image file, 20 this list, the metadata. So, Doctor, when you choose to save an image, as you've You get the whole file, that is to say, the picture 21 We're going to move to the next slide, and the MS. CONRAD: That wasn't the question. The 22 question is what is metadata? 23 question on the slide, I would respectfully ask that 24 Dr. Bruegge answer the question that was proposed by 25 Mr. Yoon. Rather than answering the Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 40 of 150 40 1 THE COURT: 2 record can be clear. 3 A. 4 currently displayed for the Court, discusses, identifies 5 some of the things that are part of metadata. 6 literally data about data. 7 include a lot of information about the camera that was used 8 to record the image, it can include the make and model of 9 the camera. 10 Objection sustained, okay, so the Go on. The pages 6 and 7 of this PowerPoint, page 6 of which is Metadata is As I mentioned earlier, it can In some cases, it can include the serial number of 11 the camera itself, things like shutter speed, aperture 12 setting, focal length, the flash settings, whether it was 13 turned on or off, whether it operated, also whether there is 14 exposure, certain metering modes or exposure modes. 15 refers to how the overall scene is going to be compensated 16 for the exposure. 17 This On page 7, there are additional features 18 identified that are included in metadata, and these can 19 include things like how big is the image in pixels, whether 20 the lens has a certain range of focal lengths because not 21 just does it include what the focal length was for that 22 particular picture, but it may include information about 23 what the possible range of focal lengths that lens has. 24 can also include information about the software that the 25 manufacturer has included in the camera itself. Finally, It Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 41 of 150 41 1 there are other things that may be included like the time 2 and date at which the image was first captured, when it was 3 recorded to the media and also if it's been accessed and 4 modified. 5 THE COURT: This is not standard across cameras, 6 the metadata, what is captured on the meta data would be 7 unique to a particular camera? 8 9 THE WITNESS: Right. For the most part, virtually all cameras are going to have a lot of the same information, 10 but every manufacturer is going to be different, and there 11 may be differences between models of the cameras. 12 A. 13 earlier there's a lot of information that's included in the 14 metadata. 15 is, there's a variety of ways you can go about looking at. 16 Okay. So if we move onto the next slide, I mentioned Now, when we're looking to see what that metadata MS. CONRAD: Objection. That's not the question 17 to the witness. 18 Q. How can metadata be viewed or extracted? 19 A. There are a lot of ways that one can look and view 20 metadata, and in this PowerPoint, to aid the Court, I've 21 provided examples of two different tools that I used in this 22 case to view metadata, and with your permission, I'll move 23 onto the next set of slides. 24 25 The question was what is metadata? THE COURT: A. Yes. The first three slides are going to show what we call Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 42 of 150 42 1 readable text, okay. 2 PowerPoint shows a screen shot taken from the displays, the 3 application Win Hex. 4 window on the hexadecimal representation of the data. 5 This first page is page No. 9 in the Win Hex refers to a way to have a Hexadecimal literally refers to a system in which 6 you have numbers from zero to 15, that's 16 values. 7 Hexadecimal is 16. 8 readable language and human readable language, and in the 9 middle of this screen, you're looking at the hex This is kind of halfway between machine 10 representation of a digital image file. 11 you see the word "offset." 12 start of the image file you are, and you can see that we're 13 looking at the very beginning of the file because the offset 14 is zero. 15 At the upper left, That refers to how far from the On the right-hand side, there is a plain language 16 or text version of what this hex data represents, and this 17 is the way of looking at the readable data in the file, and 18 the next slide, No. 10, I'm pointing out the area on this 19 screen shot that we're going to look at on page 11. 20 We're now looking at page 11, and you can see at 21 the very top on the right the word "Canon" followed by the 22 word "Canon EOS D60," a couple lines below that you see the 23 numbers 2008, then a colon, then the number 10 followed by 24 the : and the No. 10, followed by 15: 25 represents is the date, October 10th, 2008 and the time, 24: 52. What that Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 43 of 150 43 1 3:24 in the afternoon. 2 Now, you see in this representation there are a 3 lot of dots and tildes and blocks. 4 necessarily legible in a plain fashion in a hex editor view, 5 so we have a device, a tool called a Metadata Extractor 6 which is able to interpret the hex code and extract the 7 metadata for different types of image files. 8 9 10 THE COURT: Not all metadata is But in order to get this pattern, you would have had to take the disk drive from the camera -- how do you generate this page in the first instance? 11 THE WITNESS: Okay. You open up the Win Hex 12 application just like any other Photoshop or Word 13 document. 14 THE COURT: 15 THE WITNESS: Right. You then select the file and you 16 open up a file, in this case we're opening up the image file 17 that is titled IMG underscore 0020.JPG. 18 19 20 THE COURT: This is an image file that is already on that computer? THE WITNESS: This is an image that is already on 21 that computer. 22 device, it can be accessed from that computer on a flash 23 card as well. 24 be on a disk. 25 It doesn't necessarily have to be -- the It doesn't have to be on the computer, it can THE COURT: I understand. Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 44 of 150 44 1 THE WITNESS: Actually if you would allow me to 2 move back two slides, you can see at the upper left-hand 3 corner, the title of this file image, image, IMG underscore 4 0020.JPG is indicated both at the very top of this slide and 5 at the upper left. 6 7 THE COURT: and produce this pattern? 8 9 10 THE WITNESS: I run this program and open that file, and this is what you see when you open this file in that program. 11 12 So essentially you run this program THE COURT: So now you're at page 11 and the question was? 13 THE WITNESS: The question was how do we view 14 metadata, and I'm continuing. 15 viewed with just this hex editor, so we have a different 16 tool, a screen shot of which is displayed on chart 12, and 17 this is the screen shot of the metadata extraction tool. 18 What you have at the upper left is a way of navigating onto 19 a particular device on the computer. 20 basically have a readout of different files, and all of 21 these tabs allow you to analyze this data in a different 22 way. 23 Not all metadata can be On the right, you In this particular application, one image is 24 highlighted, and this happens to be the same digital image 25 file that I just showed in the Win Hex, that is to say image Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 45 of 150 45 1 underscore 0020.JPG, and at the bottom is a report on the 2 metadata, and the next slide shows that specific part of the 3 report that you saw in that screen, and you can see at the 4 top, we have what are called tags and the metadata, tag of 5 the make is Canon, the model is a Canon EOS D60, just as we 6 read in the Win Hex application. 7 If you move down a few lines, you see the tag for 8 date and time, and on the right we see 2008:10:10, space, 9 15:2452. That represents October 10th, 2008, 3:24 in the 10 afternoon. 11 necessarily see before in that metadata, like the exposure 12 time of 160th of a second, the F number, that is to say the 13 F number used on the lens ISO speed rating, there are other 14 things further down, shutter speed value, aperture value. 15 Further down you see other things that we didn't THE COURT: Okay. So this is giving you 16 additional information that the other program hadn't given 17 you, okay. 18 Go on. THE WITNESS: Yes. That didn't give you in a 19 readable format, yes. 20 Q. 21 in dissecting an image; is that right? 22 A. That is correct. 23 Q. I'd like to speak specifically about these two tools. 24 Can you tell us a little bit about the validity testing of 25 Win Hex and Metadata Extractor? Win Hex and Metadata Extractor are two tools you can use Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 46 of 150 46 1 A. 2 go through test and validation in order to be used in 3 casework. 4 tested and validated by the Law Enforcement Assistance 5 Facility, LEAF, in New York, Rome, New York as part of our 6 laboratory policies. 7 All of the tools that we use in the laboratory have to Both Win Hex and Metadata Extractor have been We're not the only ones who use these tools, and, 8 in fact, the Metadata Extractor was produced for our CART 9 unit, our Computer Analysis Response Team Unit, so there are 10 hundreds of individuals who use that, and it was tested, 11 they're the ones who submitted the request to have it tested 12 and validated, so once it was tested and validated for that 13 use, we can use it. 14 Q. 15 9 through 13, you talked about MIG underscore 0020. 16 did you get that image in the file? 17 A. I took that image myself. 18 Q. So, is the Win Hex, is the data that is produced by the 19 Win Hex editor and the Metadata Extractor was that 20 information accurate reflecting the time, date and other 21 settings of the picture you took? 22 A. 23 photograph. 24 Q. 25 Metadata Extractor are used in different communities, are And specific to the slides here on your PowerPoint from Where Yes, that's the time and date that I took that And you talked about how these tools, Win Hex and Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 47 of 150 47 1 these tools accepted by the forensic community for use in 2 image analysis? 3 A. 4 The Bundes Kriminalt, the German BKA, I can't help you with 5 the spelling of that, BKA, they use Win Hex. 6 Fleischmann is a german citizen. 7 them first. 8 Win Hex. 9 something that it is available on a website that is for law Well, Win Hex is certainly accepted around the world. The distribution of the Metadata Extractor is enforcement. 11 access to this website. 13 It think he provided it to Also the Netherlands Forensic Institute uses 10 12 Stefan Individuals apply to be a member to have THE COURT: The distribution of Metadata Extractor was the second program, it further enhanced Win Hex? 14 THE WITNESS: Yes. As I said earlier, it's used 15 by hundreds of FBI examiners. 16 agencies that have access to it, but I don't know about 17 their specific use of it. 18 THE COURT: 19 MR. YOON: There are a lot of other Okay, go on. Thank you, your Honor. 20 Q. 21 from what you've already outlined for us? 22 A. 23 information about how the photograph was taken and the 24 standings. 25 to think about some other type of media like a Word Now, can Metadata include additional information aside Yes, generally speaking, there's far more than just Metadata, if you transition from digital images Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 48 of 150 48 1 document, Metadata tells the computer how to interpret the 2 digital data, so if you have a Word document, there's going 3 to be metadata that tells the computer what the font should 4 be. 5 THE COURT: Right. 6 A. 7 come back to digital images, there's a lot of information 8 about how to interpret what's saved. 9 compression comes in in this discussion. Whether Times, Roman, something like that, so when we This is where JPEG JPEG compression 10 is a way of reorganizing the image data, the pixel data in a 11 way that's a lot more compact than just saving color and 12 brightness value for every single pixel. 13 To do this it uses what are called quantization 14 tables, and these quantization tables provide basically a 15 summary lookup table that allows you to greatly reduce the 16 amount of space that you need and the amount of data you 17 need to save, and so quantization tables and Huffman tables, 18 which are another type of table, these allow, these reduce 19 the size of the image, and they're considered part of the 20 metadata, and this Metadata Extractor tool can be used to 21 extract that information from these images as well. 22 THE COURT: Okay. 23 Q. 24 digital file, can you tell us a little bit more specifically 25 what is a thumbnail? Moving from Metadata to another item that is saved in a Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 49 of 150 49 1 A. 2 Yes. I'm going to move ahead to slide 15, your Honor. THE COURT: I'm there. 3 A. 4 reduced size version or that is a small image. 5 two primary uses for these thumbnails. 6 discussed in talking about how a digital camera works, I've 7 talked about a thumbnail. 8 small image that you look at on the back of a digital camera 9 and that also allows you to review the images quickly. 10 We use the thumbnail to describe any image that's a There are I've already Basically the thumbnail is the The process of taking a big image, a 6 megapixel 11 image and making it appear on the back of your screen. 12 costs time and power on the computer to do that processing 13 because when you're looking at the image on the back of your 14 camera, you're not looking at 6 megapixels, you're looking 15 at anywhere from -- anywhere from say 10,000 up to maybe 16 250,000, so it's a lot less data that you're looking at. That 17 The back of your monitor is really like a video 18 device, a television monitor, and for that you don't need 19 that full resolution image, and it costs a lot of processing 20 time and battery life to keep converting a big image to a 21 small image, and so the digital cameras just build in this 22 thumbnail knowing that the thumbnails are going to be viewed 23 on the back of the camera, and it incorporates that into the 24 image file. 25 Now, thumbnail names aren't necessarily only the Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 50 of 150 50 1 domain of digital camera images, they're also used on 2 computers and Internet sites for any data, whether it was 3 created in a computer or in software like Adobe Photoshop, 4 and these thumbnail names are used to display the images on 5 your computer. 6 you might have a lot of pictures on your computer -- 7 If you're looking at a thumbnail view where THE COURT: Right. 8 A. 9 images all the time because, again, that's processing power, -- you don't want to be reducing the size of those 10 and engineers hate to waste processing power, so these 11 thumbnails apply to any digital image, whether it's created 12 in camera or in software. 13 Q. 14 in cameras? 15 A. 16 original image, and I'll move onto slide 16. 17 thumbnails images that are taken in the camera reflect the 18 original acquisition of the picture. 19 came out of the camera, just a small version. 20 exactly what the camera saw through the lens in a smaller 21 version. Okay. Now, so what do the thumbnails actually reflect Well, when you have the digital camera takes that 22 These They are exactly what They're For the most part, the manufacturers make them in 23 fix size so that every thumbnail is going to be the same 24 size. 25 decide that the image was going to be a big image or a You recall earlier that I talked about you could Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 51 of 150 51 1 medium-sized image or a small image, the overall image would 2 be big. 3 whether you tell your camera to make this a 6-megapixel 4 image or make it a 3-megapixel image. 5 fixed orientation for the most part. 6 The thumbnail is always the same size regardless of They also have a When I take a picture of a scene, and I'm holding 7 the camera in the normal way you hold it where a camera is 8 generally wider this way than it is tall, that's what's 9 called landscape mode. A photograph that is wider than it 10 is tall is a landscape mode. 11 end, that's in portrait mode. 12 talked about in this case didn't know that you turn the 13 camera on the side for the most part and that you were 14 taking a portrait shot, everything is landscaped, so all the 15 thumbnails are going to be landscaped, that is wider than 16 they are tall. 17 If I turn the camera on the Well, older cameras that we Furthermore, the thumbnails are going to have this 18 Metadata attached to them including these quantization 19 tables that were used with that thumbnail image itself 20 because I should note, not only is the full size image going 21 to be compressed when we have JPEG compression going on, but 22 the thumbnail image itself is going to have JPEG compression 23 to reduce the size of it because any picture takes up a lot 24 of space. 25 All of this Metadata, as you pointed out earlier, Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 52 of 150 52 1 your Honor, different manufacturers are going to use 2 different metadata, and so this would be reflected in the 3 thumbnail images as well. 4 Q. 5 assist the Court today? 6 A. Yes, I have. 7 Q. Is that reflected on slide 17? 8 A. Yes, it is. 9 Q. Okay. Can you tell us what we're looking at here? 10 A. Okay. This is the famous or infamous image IMG 11 underscore 0020 that I referenced in the Metadata Extractor 12 and in the Win Hex view. 13 view photo. 14 pixels by 2048 pixels. 15 setting, that's the highest resolution setting for this 16 camera, and it was taken in a landscape mode. Have you prepared examples from a particular camera to 17 What we have here is a landscape It was taken at the large setting, this is 3072 It was recorded at JPEG fine The next slide shows the thumbnail image for that 18 picture. 19 out, you see the white lines at the top and bottom of this 20 frame. 21 image data there. 22 image is the edge of the image. 23 ratio, 3,000 by 2,000. 24 toggle to is the thumbnail image for that, and you actually 25 see in this image a number of things. Now, before I go to the next slide, I would point Okay. The white lines are white because there's no Okay. That is actually the edge of the This is a 3 to 2 aspect The next picture that I'm going to Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 53 of 150 53 1 First of all, we have black bars at the top and 2 bottom of this image. 3 into this thumbnail image, okay. 4 part of this thumbnail image. 5 these two pages, these two images now, 17 and 18, your 6 Honor, so that you can visually compare the thumbnail image 7 to the original image. 8 major difference is resolution, okay. 9 you've got the original scene here wearing your glasses and Those black bars are actually built They are not -- they are I'm going to toggle between As I do that, you notice that the It's almost as if 10 then you take your glasses off and you're looking at this 11 thumbnail image. 12 All of these features line up. There's no new 13 features added, it's just a question of the resolution is 14 lower in this thumbnail image, but also you have these black 15 bars at the top and bottom. 16 Now, the black bars are important because they 17 make this thumbnail image go from a 3 to 2 aspect ratio to a 18 4 to 3 aspect ratio, and a 4 to 3 aspect ratio is important 19 because that's what's video is displayed at. 20 your camera is a video monitor, and it wants to show you 21 video pictures, so having a 4 to 3 aspect ratio allows you 22 to see the image in a video manner, and that's what these 23 black bars being added does. 24 Q. 25 Canon EOSD60 camera shot in a portrait view? On the back of Now, have you also prepared examples of the same camera, Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 54 of 150 54 1 A. Yes, I did. 2 Q. What can you tell us about that? 3 A. Okay. 4 We have here on the left-hand side an image taken with that 5 same camera in portrait mode. 6 this slip of paper "portrait" on, and then I rotated the 7 camera and I took a portrait photograph. 8 camera on its side. 9 I'm going to move ahead to slide 21, your Honor. Effectively all I did, I put I turned the What's on the next slide, No. 22 is what the thumb 10 name image for that photograph looks like. 11 it's displayed in landscape, and there are black bars at the 12 top and bottom. 13 comparison as we did with the other one, but it would be 14 redundant to show that it's basically resolution difference 15 here. 16 Q. 17 that we don't simply take a full size image and reduce it 18 each time for purposes of displaying on the back of the 19 camera? 20 A. 21 have the thumbnail included as part of the file. 22 Q. 23 case? 24 A. 25 which is a way to view images without having to leave the As you can see, We could go through the analysis, the Now, Doctor, you touched on this before, but why is it It reduces processing time and the power consumption to Are there some softwares that actually do that in any Yes, Photoshop and its an add-on program called Bridge, Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 55 of 150 55 1 Photoshop application view a lot of images at once, has the 2 ability that it will actually take the full size image and 3 create a thumbnail image for display as you're walking 4 through it. 5 Q. 6 the black bars that we saw in slides 18 and 22? 7 A. 8 necessarily know or want to display the images in video, it 9 just displays a reduced size version of the full file. Now, does Photoshop, when it creates a thumbnail, impose No. 10 11 THE COURT: And the black bars are unique to the video? 12 13 Photoshop doesn't add black bars, it doesn't THE WITNESS: If the camera has a 3 to 2 -- in the case of the Canon EOS D60, it has a 3 to 2 aspect ratio. 14 THE COURT: 15 THE WITNESS: Right. Canon has imposed these black bars 16 on the image to make it a 4 to 3 aspect ratio issue. 17 Q. 18 attention of law enforcement pursuant to images and 19 cameras? 20 A. 21 became aware of using thumbnails. 22 that there were thumbnails in digital images since near the 23 beginning of the century. 24 started looking at them for forensic and investigative uses 25 was with the Michael Jackson pedophile case. Now, thumbnails, Doctor, when did they come to the I would have to trace the first time that we really Well, we've been aware The first time that we really A camera was Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 56 of 150 56 1 recovered at the mansion that when the download was down of 2 the images for forensic analysis, there had been some 3 corruption to the file so you couldn't view the full size 4 images. 5 could figure out a way to make those images viewable. 6 Those images got sent to our lab in hopes that we One of my employees spent a lot of time looking at 7 those files and found that the thumbnails were totally 8 recoverable and that it was then possible to extract those 9 thumbnails from those images and view the images in this 10 reduced resolution. 11 Q. 12 analysis of thumbnails in the analysis in this case? 13 A. Yes. 14 Q. Now, moving on from thumbnails, can you tell us what 15 quantization tables are? 16 A. 17 engineers got together and wrote this standard that 18 described how you could encode visual data, pictures in a 19 manner that would make it easier to transmit them, and they 20 came up with this, what's called the JPEG standard. And you incorporated the introduction of thumbnails and Well, JPEG is a compression standard. 21 It's a bunch of The standard basically provides a lot of rules on 22 how you would encode things and what sort of tags or key 23 words you would use to encode these images. 24 component of that is the use of what are called quantization 25 tables. A critical These quantization tables are a series of numbers Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 57 of 150 57 1 that allow you to effectively interpret one single value and 2 create 64 values in its most basic form. 3 It allows you to save a lot less data by saying, 4 okay, we've got these blocks of 8 by 8 pixels, and we're 5 going to reinterpret those, the distribution of brightness 6 and colors across that 8 by 8 block, and it involves 7 frequency analysis and some firating analysis and 8 mathematical terms that I don't want to go anywhere near, 9 your Honor, but basically the idea is you can encode a lot 10 of information about those 64 values by using the 11 quantization tables to provide short cuts, if you will. 12 Now, there's a second type of table called Huffman 13 tables that are also used that further compress all this 14 data. 15 to get down into looking at the Huffman tables, but I did 16 have a lot of opportunity to look at quantization tables. 17 Q. 18 quantization tables differ from manufacturer to 19 manufacturer? 20 A. 21 the JPEG standard in its camera the way its chooses. 22 little later we have some examples of JPEG quantization 23 tables, and you'll see that there are three sets of 64 24 numbers each, so three times 64 is 192, 192 numbers, and 25 every manufacturer is going to decide how it wants to use I haven't had time in this case or in any other case Specifically to the Judge's inquiry before, would Each manufacturer is going to decide how to implement A Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 58 of 150 58 1 those tables for their own images. 2 Now, a recent paper that I just saw found that 3 some manufacturer tables for -- well, the thing to remember 4 is that if I have my camera and I can use high compression 5 or normal compression, those are going to be two different 6 sets of tables. 7 the compression is going to happen. 8 have multiple versions of the quantization tables 9 corresponding to how it wants to save that data. It's changing those tables that decide how 10 THE COURT: 11 THE WITNESS: So that one camera will How the user wants to save the data? How the user wants to save the data, 12 but the manufacturer defines those specific tables. 13 A. 14 manufacturers, different manufacturers will have used the 15 same quantization table, but for the large, overall picture. 16 You also have to remember that there is a separate 17 quantization table used for the thumbnail, and up to this 18 point in the research that I've done, I haven't found any 19 manufacturers who have the same quantization table for the 20 thumbnail images. 21 Q. 22 related to the images that you took, IMG 0020 and 0027? 23 A. Yes, I did. 24 Q. Is that reflected in slides 26, 27 and -- actually -- 25 In some cases, it has been found that some Now, have you prepared examples of quantization tables THE COURT: Before we go into this, I have a phone Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 59 of 150 59 1 call to make. We can just take a short break. 2 MR. YOON: 3 THE CLERK: 4 (A recess was taken.) 5 THE CLERK: All rise. 6 THE COURT: You can be seated. 8 MS. CONRAD: They'll be back. 9 THE COURT: 7 Of course, your Honor. All rise. The rest of your group? They'll be here. You can pick up the 10 pace. 11 understand that you're talking about those things which are 12 imbedded in the original image which enable a subsequent 13 examiner to be able to identify where it was taken, when it 14 was taken, not where, when it was taken and some other 15 issues. I think it's clear, I've read the materials, and so I 16 Go on. MR. YOON: Thank you. 17 Q. 18 previously identified as Government Exhibit No. 2, slide 19 No. 26, can you tell us what is that on your PowerPoint 20 slide? 21 A. 22 and what we're looking at that is that same picture, IMG 23 underscore 0020.JPG, and at the bottom you have the JPEG 24 quantization table for that thumbnail, I'm sorry, for that 25 picture, that full size image, and as you can see, it's Dr. Bruegge, drawing your attention to what has been Yes. This is entitled JPEG Quantization Table Example, Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 60 of 150 60 1 three sets of tables. 2 Q. 3 can you tell us what the quantization tables would be in the 4 IMG underscore 0027.JPG, the portrait mode? 5 A. 6 same settings. 7 Q. 8 slide 29, what is reflected there? 9 A. Each of those has 64 values in it. Dr. Bruegge, without going forward in the PowerPoint, They're going to be exactly the same because I used the If I could move to the thumbnail images on PowerPoint Okay, on 29, which is entitled JPEG quantization table 10 example, and it is the quantization table for the thumbnail, 11 you see at the bottom the quantization table, and just for 12 the Court's edification, there are three tables, one is for 13 the brightness in the image, and the other two are for the 14 color, and as you can see and compared to the previous 15 examples, they're significantly different from the other 16 tables that were used for the full size images. 17 Q. 18 the thumbnail for IMG underscore 0027, the portrait with 19 that same camera, can you tell us what would be reflected in 20 the quantization tables for that? 21 A. It's exactly the same. 22 Q. Now, if you were to change just singularly one value in 23 a quantization table, can you describe for us what would 24 happen to the image? 25 A. And, Doctor, without moving forward in the PowerPoint, It depends on which value you change because some of Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 61 of 150 61 1 them have more impact on the image than others. 2 an example in which I show the effect of changing that 3 second value. 4 most table, you see a 3 in the upper left corner, then to 5 its immediate right is the No. 2. 6 examples in which I changed that 2 to a 10 and then a 19 so 7 you can see how that affects. 8 9 In the upper left-hand corner of the left THE COURT: THE WITNESS: This is still with respect to the Exactly. We're only dealing with the thumbnails from here on in, your Honor. 12 THE COURT: 13 THE WITNESS: 14 I've compared two thumbnail? 10 11 I prepared This is on page 32 of the PowerPoint? Page 32 of the PowerPoint shows the No. 2, highlights what I'm going to change. 15 THE COURT: Okay. 16 A. 17 show what happens when you change it from a 2 to a 10 and 18 then from a 2 to a 19, and you can observe with your own 19 eyes how it affects the image. 20 enlarged the thumbnail on the right just to make it easier 21 to see. 22 I will advance to 32. The next two slides, I'm going to So on page 33, now I've It's the same size as the original thumbnail, but 23 you can see how the characteristics of that image, the 24 visual characteristics have been modified quite 25 significantly. There's a lot more blocky texture to it. Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 62 of 150 62 1 That dark line on the left, on the right, I'm sorry, that 2 represents tile, the edge of a tile, there's a bright line 3 and a dark line on the edge of it that switches sides, okay, 4 so just changing that 2 to a 10 has had this significant 5 effect on the thumbnail image. 6 slide which shows when you change that 2 to a 19, it's even 7 more of an effect. 8 Q. 9 you tell us what would happen if you replaced the If we then go to the next Doctor, without moving forward in the PowerPoint, can 10 quantization tables in a Canon image with those from a Fuji 11 camera? 12 A. 13 also going to have an effect on the image quality, and 14 that's demonstrated in the next slide. 15 page 36, I believe, yes. 16 more of a blockiness or not as visibly a blockiness, the 17 color has shifted and the brightness has changed. If you use somebody else's quantization table, then it's 18 THE COURT: Page 35, I'm sorry, Now, although it doesn't create But this is taking an image from the 19 Canon camera and exposing it to the quantization table from 20 a Fuji camera? 21 THE WITNESS: That's correct. You'll notice how 22 the gray tile is now kind of a brownish color and the 23 overall brightness, the brightness of the white areas has 24 been blown out. 25 Q. Okay. We've lost detail in it. Doctor, can you tell us about the quantization Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 63 of 150 63 1 tables in Adobe Photoshop? 2 A. 3 as JPEGs. 4 there's going to be. 5 only had a few levels. 6 11, from 0 to 10, and the user can do whatever the user is 7 doing in Photoshop to the image and then say I want to save 8 this as a JPEG and select how much compression it is going 9 to have. 10 Yes. Adobe Photoshop has the capability to save images It allows the user to choose how much compression In early versions of Photoshop, you In Version 5.0, for example, you had The current version of Photoshop has 13 levels, 0 11 to 12, but those 13 just added two more levels of JPEG 12 compression to the overall image. 13 those 12 levels refer to the whole, the big image, the full 14 size image. 15 table for its thumbnail images, so when Photoshop saves an 16 image in JPEG, it saves a thumbnail using the Level 5 17 quantization table, and then it saves the full image at 18 whatever level the user picks. 19 tables are completely different from the Canon tables or any 20 tables that the cameras use. 21 Q. 22 the original thumbnail once it processes an image? 23 A. 24 original thumbnail, and that was Version 6.0. 25 before that and versions after that don't save the original Now, note the Photoshop, Photoshop has always used Level 5 quantization Now, those quantization Doctor, does Photoshop version, does Photoshop preserve There is one version of Photoshop that did save the Versions Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 64 of 150 64 1 camera thumbnail, so just to further expand on that, in 2 Photoshop 6.0, Photoshop would take in the original camera 3 image, it would take note that there was a camera, that 4 there was an existing thumbnail image. 5 whatever processing you do, it saves that original 6 thumbnail, it produces a thumbnail that is consistent with 7 what you've done to the image in Photoshop, and so it saves 8 two thumbnail images in the file. 9 did that. 10 THE COURT: It then after you do That version of Photoshop But the thumbnail is not the thumbnail 11 of the original image, you said? 12 THE WITNESS: No. When Photoshop 6.0 saves JPEG 13 image files with two thumbnails in it, the original that 14 Photoshop -- the original from the image that Photoshop 15 ingested at the start of the process and then the thumbnail 16 that results from looking at what Photoshop has done to the 17 image. 18 THE COURT: 19 THE WITNESS: 20 Okay. There's some examples of this in the PowerPoint. 21 THE COURT: Okay. And if all you had was the 22 thumbnail, could you reproduce the Metadata from the 23 thumbnail? 24 25 THE WITNESS: The Metadata in the digital file, if we have a thumbnail image -- Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 65 of 150 65 1 THE COURT: 2 THE WITNESS: Yes. -- that includes not just the image 3 content itself, but it usually, it frequently has the 4 Metadata attached to it. 5 THE COURT: 6 THE WITNESS: Okay. I have not yet observed a situation 7 where I had an original thumbnail without the Metadata. 8 I've seen lots where I don't have the original thumbnail but 9 have the Metadata preserved. I should note subsequent 10 versions of Photoshop will preserve the Metadata of the 11 original camera but not the thumbnail. 12 THE COURT: Okay. 13 Q. 14 PowerPoint relating to the processing by Photoshop and the 15 resulting thumbnails; is that right? 16 A. Yes, that's correct. 17 Q. Is that reflected in slide No. 41? 18 A. It is. 19 Q. What can you tell us about slide No. 41? 20 A. I'm going to move ahead to 41. 21 is the original image, again, in this case this is image 22 0027, the one that I took in portrait mode. 23 and this is the full size image that was in portrait mode 24 just displayed as landscape mode. 25 You indicated that you had prepared some slides in a What we have on the left What I've done, I took this image into Photoshop, and in this case Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 66 of 150 66 1 I took it into Photoshop Version 6.0, I then resized the 2 image, I just changed it from a 6 megapixel image, I don't 3 recall if it's a 3 megapixel size, I changed the size, I 4 then added at the bottom left-hand corner this thing that's 5 labeled test logo. 6 that's titled test logo, and I merged that together. 7 saved that as a JPEG file and then viewed the thumbnails 8 that resulted from this. 9 Q. I just superimposed another picture I then Can you describe for us the differences, first of all, 10 both of those thumbnails were preserved? 11 A. 12 thumbnail from the image on the left as well as the 13 thumbnail of the Photoshop adjusted image was preserved 14 within that file. 15 Q. And is that represented in slide 43? 16 A. Yes, it is. 17 Q. Describe to us those thumbnails and their differences. 18 A. I'm going to move to slide 43. 19 what we've become familiar with with this Canon camera, this 20 landscape image with the black bars at the top and bottom. 21 On the right, you've got the Photoshop thumbnail image that 22 was generated by Photoshop after I resized the image and put 23 the logo on it and saved the image as a JPEG. 24 it's in portrait mode, and also it has the text logo visible 25 in that thumbnail. That's correct. In Photoshop 6, both the original On the left, you see You can see Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 67 of 150 67 1 Q. 2 on the right? 3 A. Correct. 4 Q. Okay. 5 A. Well, the Photoshop only looks at the raw image data 6 that it has for the full size image when it creates its 7 thumbnail. 8 thumbnail from that. 9 Q. Are there -- the black bars on the left are not present How is that significant? It takes what your output image is and creates a Doctor, were you asked to conduct an examination in this 10 case? 11 A. Yes, I was. 12 Q. And what specifically were you asked to do? 13 A. I was asked to examine nine digital image files and 14 determine if the individuals depicted therein, if their 15 features had been manipulated to change their appearance or 16 their identity. 17 Q. 18 submitted to you Government Exhibit 3 through 11? 19 A. Yes, they are. 20 Q. And how did you receive those images? 21 A. I received these images on a compact disk from an agent 22 of the FBI Boston field office. 23 Q. 24 you first conducted or the first thing you did for your 25 exam? Okay. And specifically are the images that were And when you received those images, can you tell us how Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 68 of 150 68 1 A. 2 disk didn't contain any viruses. 3 the contents of the disk to a work station in the 4 laboratory. 5 Q. 6 work station? 7 A. 8 which I hand carried to the National Center For Missing And 9 Exploited Children where I oversaw an examiner there conduct The very first thing I did was check that the compact After I did that, I copied And what was your next step after copying those to your What I did next was I made another copy of that disk 10 an examination of those images to locate, to determine if 11 any of the individuals depicted in those pictures was a 12 known victim. 13 Q. 14 next? 15 A. 16 the images that I had been submitted, and I found that one 17 of the images had camera data, a couple of them had Adobe 18 Photoshop information, and some of them had comments 19 included. 20 Q. 21 Metadata, what did you do next? 22 A. 23 depicted those same individuals in the questioned images. 24 Previously I had identified additional photographs depicting 25 these same individuals, and so I knew that previous cases, The results of that analysis were negative. And after you had taken those images, what did you do Well, the first thing I did was look at the Metadata of And after you had examined those subject images for Next thing I did was I looked for reference images that Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 69 of 150 69 1 all of which I had conducted, had additional images that 2 depicted some of the individuals. 3 THE COURT: In other words, the images that are 4 issue in this case you had come across in other 5 investigations? 6 THE WITNESS: Some of these specific images in 7 this case we had come across in other investigations, but 8 there were other also images depicting these same 9 individuals in other cases. 10 Q. 11 images? 12 A. Correct. 13 Q. And after identifying reference images that identified 14 the person in the scene, what did you do next? 15 A. 16 Metadata that would tell me if there was any camera 17 information attached to those images. 18 Q. 19 20 And those are what you're referring to reference Then I reviewed the reference images to look for Okay. THE COURT: Now, again the reference images were in your files? 21 THE WITNESS: 22 THE COURT: Yes. Okay. And had been obtained -- they 23 became reference images because you had come across them in 24 other investigations? 25 THE WITNESS: Yes, your Honor, at least one of the Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 70 of 150 70 1 cases that was included was the result of an Immigration and 2 Customs Enforcement investigation in which they had provided 3 to me thousands of photographs. 4 production manufacturing case. 5 THE COURT: 6 It was actually a So you got the actual photographs as opposed to online versions? 7 THE WITNESS: Yes. No, I believe it was downloads 8 from the Internet, and there were also -- there were two 9 other cases that I believe, I'd have to look at the record 10 to find out where specifically they were from, but I think 11 they were from FBI investigations. 12 Q. 13 identify came from those adjunct criminal files that you 14 spoke of at the beginning of your testimony? 15 A. Correct. 16 Q. Now, did you also relating to your investigation 17 specific to this case prepare a PowerPoint leading to your 18 examination and your findings? 19 A. Yes, I did. 20 Q. Okay. 21 today? 22 A. Yes, it would. 23 Q. And is that identified as Government Exhibit No. 12? 24 A. Yes, it is. 25 And those reference images that you were able to And would that assist in your testimony here MR. YOON: Your Honor, I'd ask to publish from Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 71 of 150 71 1 2 3 4 Government Exhibit No. 12. MS. CONRAD: I have the same objection. I would submit that this should be treated as a chalk. THE COURT: We both have them. I don't think 5 there's any need to put them on the screen unless you want 6 to put them on the screen. 7 MR. YOON: Your Honor, there is going to a portion 8 of Dr. Bruegge's testimony where he will be identifying and 9 zooming in on portions of subject images and reference 10 images and comparing reference images to reference images so 11 I think it would be helpful to have them on the computer or 12 on the screen. 13 THE COURT: I don't see why this is a chalk if 14 this is his actual process of analysis, which it's not like 15 the chalk we've seen before had been summaries of his 16 testimony, if this is the raw data of his analysis, then 17 this should come in as an exhibit. 18 that were used. 19 MS. CONRAD: These are the slides Having reviewed 35 pages of notes, 20 I'm not sure that this is the raw data of his analysis. 21 This is, as I understand, the notes. 22 charts that were prepared for testimony in this case, this 23 is not raw data. 24 25 THE COURT: These are basically I'm going to allow it. going to allow it as a full Exhibit. Go on. The others are a I'm Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 72 of 150 72 1 chalk, and this is a full exhibit. 2 is an interesting and an academic one in a case before a 3 Judge, but, in any event, go on. Again, the distinction 4 MR. YOON: 5 ( Government Exhibit No. 12 was admitted into Thank you, your Honor. 6 evidence.) 7 Q. 8 Exhibits 12. 9 application of analysis that you generally described to this Doctor, if you could pull up that PowerPoint, Government Thank you. Okay. So this represents the 10 particular case? 11 A. That's correct. 12 Q. Okay. 13 received 0021.JPEG and 100-0056.JPEG known here in this 14 hearing as Government Exhibit No. 3 and 4, did you perform 15 an analysis? 16 A. Yes, I did. 17 Q. Can you tell us what you did with regard to those 18 specific images? 19 A. 20 individual in our reference file collection. 21 22 Now, specific to images, subject images that you I found reference images that correspond to this THE COURT: That is to say you found images which you think were the same individual? 23 THE WITNESS: 24 THE COURT: 25 THE WITNESS: Correct. Okay. This is displayed on Chart 3 of the Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 73 of 150 73 1 PowerPoint, if I may proceed to that. 2 THE COURT: Yes, you may. 3 A. 4 in this analysis, and they show the individual at the top. 5 On the bottom are images that I found in our reference 6 files, and this specific reference case came from this 7 laboratory number, and this was the Immigration and Customs 8 Enforcement case. Chart 3 shows the two images that were submitted to me 9 I would note one thing in particular to draw your 10 attention to, the top images have a banner across the bottom 11 that if you had the full image in front of you, you would 12 see it said something along the lines of Freepics. 13 at the lower right, you see what appears to be an outline of 14 a girl. 15 outline of the girl. 16 Q. 17 images on the bottom of slide No. 3, Government Exhibit 12, 18 can you tell us how specifically did you find these three 19 reference images? 20 A. 21 find reference images in the case, and these particular 22 images I don't recall exactly how I found them. 23 they came from that case. 24 the bottom right is titled 100-0056.JPEG. 25 the same name of the file I was submitted in this case. However These pictures at the bottom appear to have that Now, in finding the three references, three reference Well, these reference images, there are a lot of ways to I know that You'll notice that the image on That's exactly Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 74 of 150 74 1 There are multiple ways to search our reference 2 files using things like file name searches. 3 had already noted that I had these reference files and that 4 they corresponded to this individual, and so visual 5 inspection recognition and file name searches were used in 6 combination to find these images. 7 Q. 8 site No. 3, what did you do with regard to those 9 reference? In this case I When you found these particular reference images here in 10 A. 11 thumbnails. 12 Q. What did you find? 13 A. I found that there was Metadata and thumbnail images 14 particularly associated with the image on the bottom right, 15 100-0056. 16 Q. And what was the significance of that Metadata? 17 A. The Metadata indicated the camera, the time and date 18 that that photograph was taken, among other things. 19 Q. 20 image at the bottom right, 100-0056.JPEG? 21 A. 22 thumbnail image file. 23 Q. And once you raw thumbnail image, what did you do? 24 A. I checked the Metadata to see the camera make and model. 25 In this case, and if I could go to the next slide, your Next I checked those reference images for Metadata and And what other finding did you make with that reference There was a raw thumbnail image attached to that Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 75 of 150 75 1 Honor. 2 THE COURT: Yes. 3 A. 4 bottom right. 5 The Metadata indicated that it was a Canon Power Shot S20 6 camera, that the image was taken in November of 2001. 7 thumbnail image, of course, has this landscape mode. 8 the knowledge that it was a Canon Power Shot S20 I obtained 9 copies of images that were taken with a Canon Power Shot S20 There's some of the Metadata indicated there at the The thumbnail was rotated in landscape mode. The Using 10 and I checked the quantization table of the thumbnails in 11 reference images in Canon Power Shot S20 against the 12 quantization table for this thumbnail image. 13 Q. And what did you find? 14 A. It matched. 15 Q. Now, this thumbnail on the right of this slide No. 4 16 doesn't have the black bars. 17 would be? 18 A. 19 camera. 20 image size, so it doesn't need to modify from a 3 to 2 21 aspect ratio to a 4 to 3 aspect ratio. 22 Q. 23 reference image entitled 100-0056.JPEG to the records 24 image? 25 A. That's right. Can you explain to us why that The Power Shot S20 is a point and shoot It has a 4 to 3 aspect ratio to start with in its And so were you able to compare the thumbnail from the Yes, I did. Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 76 of 150 76 1 Q. The original records image? 2 A. Yes. 3 from this case. 4 landscape mode for comparison purposes. 5 the thumbnail image, the raw thumbnail image that has the 6 quantization table from the Canon Power Shot S20 camera. 7 8 In slide 6 and 7, I have the Q3 image, the image I have rotated it so that it is in the same THE COURT: The slide No. 7 is From the reference photograph or from Q3? 9 THE WITNESS: From the reference photograph, and 10 the idea here is to visually compare the physical 11 characteristics of the thumbnail image to the image in this 12 case in the same way that we compared the thumbnail to the 13 full size camera before when we were demonstrating that the 14 thumbnail reflects the full size image. 15 With your permission, your Honor, I'll go to slide 16 6 and 7 and toggle between the two, and the first thing I 17 would draw your attention to right now I'm on image slide 18 No. 6. 19 just the freepicks banner at the bottom but also the photo 20 lolita.com logo. 21 You see there's that logo on the left-hand side, not THE COURT: Yes. 22 A. 23 banner and the lolita banners are gone. 24 back and forth, I would draw your attention to the physical 25 characteristics of the individual depicted there. I'm now toggling to 7, the banners are gone, both the Now, as I toggle You can Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 77 of 150 77 1 look at the limbs, the legs, the arm, the head, the face, 2 the chest, the genital region and even the background, the 3 chair on which the subject is sitting. 4 All of these visual comparisons as I toggle back 5 and forth will demonstrate to you that there is visually no 6 significant difference between these two images. 7 Q. 8 full size image of the reference image; is that right? 9 A. No, that is not correct. 10 Q. Okay. 11 A. Slide No. 6 is the image that was recovered in this 12 case. 13 Q. That's the Q3 image? 14 A. The Q3 image. 15 Q. Okay. 16 thumbnail from the reference? 17 A. Correct. 18 Q. Okay. 19 matching quantization tables and your comparison as you've 20 just shown here toggling between 6 and 7, what can you 21 conclude? 22 A. 23 because of the Metadata and the quantization table and the 24 fact that it was in landscape mode indicate that it was 25 recorded at the time the photograph was taken by a Canon And, Doctor, just so we are clear, slide No. 6 is the And the image represented in slide 7 is the So, given your findings, Metadata, thumbnails and The thumbnail image that is currently displayed, No. 7, Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 78 of 150 78 1 Power Shot S20. 2 depiction of the scene at the time the image was taken. This photograph is a true and accurate 3 THE COURT: 4 THE WITNESS: This photograph, the thumbnail? The thumbnail is a true and accurate 5 depiction of the scene at the time the photograph was taken. 6 Comparing that to the image in this case, I can further 7 conclude that image on 6, the full size image, accurately 8 reflects the appearance of this individual at the time the 9 photograph was taken. 10 So to respond to the question that I was asked at 11 the beginning, has this photograph been manipulated to alter 12 the identity or the appearance of the individual, my 13 conclusion is no, it has not been modified in a manner that 14 would significantly alter the appearance or identity of this 15 individual. 16 Q. 17 P8199391 known here in this hearing as Government Exhibit 5; 18 is that right? 19 A. That's correct. 20 Q. And when you received that image, can you tell us about 21 your examination with regard to that particular image? 22 A. 23 talking about here is Government Exhibit 5? 24 Q. Yes, sir. 25 A. This is an individual lying in a recumbent pose. Now, you were also submitted Q3 or subject image Yes. This is Government's Exhibit -- the image we're She Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 79 of 150 79 1 has yellow and red ties in her hair. 2 found multiple reference images that displayed her both in 3 that same scene as well as another scenes with the same ties 4 and bows, and I also found additional images of her in a 5 different scene, all of which had camera Metadata and 6 thumbnails associated with them. 7 Q. 8 the subject image and the two images you're talking about 9 that reflect the similarity in hair and ties in that hair? This individual I Now, did you prepare in a slide the images, first Q3, 10 A. Yes, I did. 11 Q. Is that reflected in slide No. 9? 12 A. Yes, it is. 13 Q. Okay. 14 A. I'll move to slide 9. 15 top of the screen is the image from this case. 16 bottom left, you can see images that were recovered from our 17 reference files. 18 are consistent with one another and that they are P81994 or 19 8199, sequential file names in one sense. 20 this other laboratory, this other case, 040928253. 21 Q. 22 simple visual or sort of a superficial observation, can you 23 tell us how specifically you can tell that these are the 24 same individuals? 25 A. What you're seeing here at the At the I would note that the names of the files These came from If we could take a step back here, in addition to your Certainly. When we do comparison analysis, we talk Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 80 of 150 80 1 about class and individual identifying characteristics. 2 Class characteristics are those characteristics that are 3 common to a large population or to a number of people or 4 objects. 5 characteristics have to do with the type of pattern, the 6 world, arch, tented arch, those type of things. 7 If you think about fingerprint comparison, class With people, class characteristics have things to 8 do with general shape of the face, the way the general 9 appearance, shape of the head, hair, hair color, hairstyle, 10 body shape, body configuration. 11 characteristics are those characteristics that allow you to 12 really hone down to a single individual or in this case 13 would be things like moles, scars, freckle patterns, what 14 not. 15 Individual identifying In this particular instance, we have the ribbons 16 in the hair, the red and yellow that are consistent in these 17 sets of photographs, but we also as well as the general 18 facial similarities, the differences only being related to 19 her specific expression, but we also have features of her 20 body, and, in particular, this prominent blemish on her 21 right breast just below and to the side of the aureole. 22 THE WITNESS: We have, your Honor, the specific 23 pictures are also loaded onto the computer, and we can look 24 in detail if you would like. 25 MR. YOON: If we may, we'd like to have the Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 81 of 150 81 1 witness show specifically what he's talking about in point 2 of similarity to identify the individual depicted in the Q3 3 image as being the same individual in the two reference 4 images. 5 THE COURT: The question is whether you need to go 6 through with respect to all of them or whether or not the 7 methodology is already clear. 8 reference images, he looks at the identification, he 9 identifies the Metadata, the thumbnail, et cetera, with He makes a comparison with 10 respect to the reference image and he, therefore, concludes 11 that the exhibit was real as well. 12 go through with each of these exhibits, but that's up to 13 you. 14 MR. YOON: I'm not sure one has to Yes, your Honor. Thank you. 15 Q. 16 No. 9, Doctor, did you find additional reference images of 17 the same person depicted in the Q3 image? 18 A. Yes, I did. 19 Q. Okay. 20 A. Yes, it is. 21 Q. Okay. 22 A. Slide 10 shows additional reference images that depict 23 the same individual in a different scene, different 24 scenes. 25 Q. In addition to the reference images displayed in slide Okay. Is that reflected in slide 10? And can you put that up on the screen for us? And can you indicate to us the point of Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 82 of 150 82 1 similarity as you observed them that allowed you to identify 2 the people in the reference, the individuals depicted in the 3 reference images as the two below as the same person 4 depicted in the Q3 image? 5 A. 6 features and the body morphology and we also have this large 7 mark, this prominent mark on the right breast. 8 Q. 9 reference image, now four in total, had you noticed in Again, we have the gross similarities of the facial Now, in your examination of this Q3 image and the 10 particular with regard to the particular birthmark that you 11 have identified? 12 A. 13 there is specific detail that you can see not birthmark, in 14 this mark that it is an irregularly shaped object, and on 15 the upper right-hand side as you were looking face on, 16 there's kind of an extension to it. 17 oval-shaped feature, it's an irregularly shaped feature. 18 Q. 19 this case? 20 A. 21 Honor, are four of the images that I found Metadata and 22 thumbnails associated with. 23 same individual that didn't necessarily have thumbnails 24 attached with them but had Metadata were also examined to 25 just verify the identification of the individual. Yes. Okay. It's not just that this is a random birthmark, but This is not an Now, is this what you did for all the images in In addition to the images, these four images, your Other images that depict this Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 83 of 150 83 1 Q. 2 on all four? 3 A. 4 image in this case, the Q3 image, P8199391 on the left, and 5 it shows the thumbnail images that I extracted from those 6 four reference images that I showed earlier. And did you prepare a slide, slide 11 with this Q3 image Yes, in slide 11, which I've just turned to shows the 7 The two images on the left at the bottom indicate 8 that it was an Olympus E20 camera and the images were taken 9 in August of 2002. The images on the right show different 10 Metadata. 11 that was used. 12 which I would note is eight months after the prior images 13 were taken, and it has in addition to all of the images 14 having the familiar landscape mode of being an original 15 thumbnail, the two Canon EOS D60 images have the black bars 16 on the top and bottom. They showed that it was a Canon EOS D60 camera The photographs were taken on April 27th, 17 MR. YOON: 18 THE COURT: Now may I have just one moment? Yes. 19 Q. 20 reference images in the same way that you did for the 21 previous two subject images? 22 A. Yes, I did. 23 Q. Okay. 24 A. Well, the Canon EOS D60, the two images on the bottom 25 right in addition to having this landscape mode and black And, Doctor, did you examine the thumbnails of the And what were your findings? Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 84 of 150 84 1 bars attached to them, and as you can see, there are no 2 logos on these thumbnails, these Canon EOS D60 thumbnail 3 images had the same quantization table as all the other 4 Canon EOS D60 thumbnail images. 5 THE COURT: 6 THE WITNESS: 7 THE COURT: 8 In this case or in general? In general. It is what Canon uses for its thumbnails? 9 THE WITNESS: It was what Canon used for its 10 thumbnails in this camera. 11 because the Olympus manufacturer seems to use some, and I 12 haven't cracked this nut yet. 13 quantization tables on a regular basis, and I haven't had an 14 opportunity to really get down in to looking at the Olympus 15 camera, and so there doesn't appear to be consistency in the 16 Olympus quantization tables for the thumbnails, however, the 17 landscape mode and the Metadata and the fact that there are 18 no logos attached are all consistent with them being 19 thumbnails from original camera images. 20 Q. What would you conclude with regard to this Q3 image? 21 A. When one compares the physical characteristics of the 22 individual depicted in the questioned image from this case, 23 the image that's in the upper left, you can see no 24 significant differences in the physical characteristics 25 between the individual in the questioned image in this case The Olympus poses a challenge Olympus seems to modify their Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 85 of 150 85 1 and the individual depicted in the images that we found in 2 the reference collection. 3 Now, I would note the images on the bottom right, 4 the Canon images that were taken eight months later, it is 5 possible to see that there is more pubic hair and there are 6 larger breasts. 7 someone aging eight months from August of 2002 to April of 8 2003. 9 raw thumbnails indicate that those images have not been Those features would be consistent with So, based on that analysis and the fact that these 10 modified since the time they were taken, my conclusion is 11 that the photographs submitted in this case, P8199391 12 accurately reflects the physical characteristics of this 13 individual at the time that photograph was taken. 14 not been manipulated to alter her identity or appearance. 15 Q. 16 age regressed the person and taken a picture of that and 17 produced this thumbnail? Doctor, with regard to this Q3 image, could someone have 18 THE COURT: 19 MR. YOON: 20 21 It has Which thumbnail are you talking about? The thumbnails reflected on the bottom right, 000-0056 and 000-091. THE WITNESS: If somebody produced an age 22 regressed image and then rephotographed a photograph, there 23 are characteristics in the photographic process that leave 24 traces behind when you take a photograph of a photograph. 25 The fact that this camera has an on camera flash Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 86 of 150 86 1 means that if you were taking a photograph of the photograph 2 and had the flash on, you'd get a reflection of the flash so 3 that the picture would show that flash. 4 details of the resolution that if you're taking a picture of 5 a picture, you wouldn't get as good detail as you do in 6 these images. 7 Q. 8 a picture of that, could you have age regressed it and 9 created a thumbnail from the changed or age regressed There are other And could you have age regressed this and just not taken 10 Photoshop image? 11 A. 12 would have to be familiar with, you would have had to 13 conduct an analysis of the Canon camera, reverse engineer 14 the quantization table, realize that the black bars have to 15 be added for it to be consistent with a Canon camera and 16 then know how to put that all together into an image file 17 that would make it appear as though it had come from the 18 original image. 19 from what an artist would need to do the age regression. 20 Q. 21 off as Dark Collection, underscore PTHC, underscore photo, 22 underscore 4, underscore 4, known here in this hearing as 23 Government Exhibit 6, was that one of the images you also 24 conducted an analysis for? 25 A. It's possible to create your own thumbnail, but you That skill set is significantly different And, finally, with regard to reference image that starts Yes, it is. Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 87 of 150 87 1 Q. 2 images for that particular Q3 image? 3 A. Yes, I was. 4 Q. And how did you find those reference images? 5 A. As I mentioned above, as I mentioned before, file name 6 searching is very useful as a way to quickly sort through 7 things. 8 been encountered as well as just simply recognizing the 9 individual and the location, the bedspread and things of And can you tell us were you able to find reference Dark Collection is a common name title that has 10 this nature, and we're talking about Government Exhibit 11 No. 6, image of an individual on a blue bedspread. 12 THE COURT: 13 THE WITNESS: 14 THE COURT: Which one are you referring to? 6, I'm referring to Exhibit 6. Oh, okay. 15 Q. 16 reference image as you had for the three previously 17 discussed Q3 images? 18 A. Yes, I did. 19 Q. And what was the conclusion after your analysis? 20 A. I found Metadata associated with several reference 21 images that indicated the make and model of the camera that 22 was used, I found raw thumbnail images, and I found that the 23 quantization tables for those raw thumbnail images matched 24 the quantization table for that different camera, and that 25 is displayed on chart No. 14 of this PowerPoint. And did you perform the same analysis on this Q3 Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 88 of 150 88 1 THE WITNESS: 2 THE COURT: If I may advance your Honor? Yes. 3 A. 4 case. 5 were the reference images that I found. 6 additional reference images that were also named Dark 7 Collection 100 something. 8 Power Shot Pro 90 IS camera, and the thumbnails as they were 9 extracted from these reference images are shown at the We have here at the upper left is the image in this In the middle, we have the two full size images that There were These were shot with a Canon 10 bottom. 11 camera is not a 3 to 2 aspect ratio, it is like a video 12 aspect ratio, so there are no bars in it, but the 13 quantization tables of these two images, these two 14 thumbnails are consistent with the quantization tables of 15 the thumbnail images recorded with Canon Power Shot pro 90 16 camera images. 17 Q. 18 about those thumbnails? 19 A. 20 Metadata and quantization tables indicate that they are raw 21 from the camera at the time the picture was taken and 22 comparing the physical characteristics of the individual in 23 these reference photos with the physical characteristics of 24 the individual in the questioned photograph, the questioned 25 photograph has not been manipulated to change the identity You see they're landscape mode. This particular After your analysis, what were you able to conclude Given that these thumbnail images and the associated Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 89 of 150 89 1 or the appearance of the individual. 2 3 MR. YOON: moment? 4 THE COURT: 5 MR. YOON: 6 Your Honor, may I just have one last You may. Your Honor, I have no further questions. 7 MS. CONRAD: Could I ask a point of clarification 8 because Dr. Bruegge's report refers to I think the expert 9 witness disclosure in this case disclosed an opinion as to 10 CR1330 and UL.JPEG. 11 presenting that because there was nothing on those? 12 MR. YOON: Is the government planning on no longer That's correct, your Honor. The 13 additional five images that were submitted, and perhaps I 14 should make that clear, okay, the only images for which the 15 government wishes to submit evidence through the witness 16 would be those four that we've discussed here referencing 17 021.JPG, 100-0056.JPEG, P8193391 and the Dark Collection as 18 it continues on. 19 There are five additional images, and the 20 government is not proffering information with regard to 21 those. 22 THE COURT: 23 trial? 24 anymore? 25 So what does that mean in terms of the Are you not relying on those in this prosecution MR. YOON: No, your Honor. Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 90 of 150 90 1 2 THE COURT: Or that other witnesses will be used to try to show that those are real? 3 MR. YOON: Yes, your Honor, other witnesses, other 4 evidence would be used to establish the reality of those 5 five images. 6 those five images. 7 Dr. Bruegge's testimony would not extend to THE COURT: Those five images and the two images 8 that were identified as real in the database as to which you 9 have real victims? 10 MR. YOON: No, your Honor, there were 12 total. 11 Three were known victims, and the nine were submitted to 12 Dr. Bruegge. 13 to prove the reality. 14 other evidence and other information. 15 16 The four here we're submitting this analysis THE COURT: The other five we'd be relying on Would that include Celeste Wilson, Dr. Wilson? 17 MR. YOON: 18 MS. CONRAD: 19 THE COURT: Yes, I know. 20 MS. CONRAD: Thank you. Yes, Judge. I have a motion on that. I just wanted to clarify 21 that. 22 preparation for this hearing, so based on the discovery I 23 received I thought we were talking about seven. That hadn't been revealed to me prior to my 24 25 CROSS-EXAMINATION BY MS. CONRAD: Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 91 of 150 91 1 Q. 2 I represent Mr. Frabizio in this case. 3 with this case prior to conducting the analySIS in June of 4 2008? 5 A. That is correct. 6 Q. When was the first time you became aware of this case? 7 A. Back when it would have been submitted to originally to 8 Mr. Musheno. 9 Q. Good afternoon, Dr. Bruegge. My name is Miriam Conrad. You were familiar That was basically back in no later than 2005, 10 correct? 11 A. Correct. 12 Q. And you actually reviewed Mr. Musheno's work in this 13 case? 14 A. That is correct. 15 Q. And you were aware that his analysis with the subject of 16 a Daubert hearing before Judge Gertner back in 2005? 17 A. Yes, I was aware of that. 18 Q. Did you attend that hearing? 19 A. I did not attend that. 20 Q. And at the time that those images were submitted to 21 Mr. Musheno, was the analysis that you just described for us 22 here today conducted? 23 A. No, it was not. 24 Q. So the first time this analysis was conducted on these 25 images from this case was in 2008, correct? Some time in 2004. Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 92 of 150 92 1 A. 2 to be clear on this. 3 thumbnails, raw thumbnails, I believe was conducted on the 4 images that were submitted to Mr. Musheno, however no 5 further analysis looking for thumbnails in the reference 6 images was conducted prior to 2008. 7 Q. 8 however, reference images that identified back in 2005, 9 correct? There were several components of this analysis. I wish The examination to see if there were I appreciate the clarification. Now, there were, 10 A. That is correct. 11 Q. And back in 2005, was the type of analysis that you're 12 now describing for us used as a method of authentication of 13 questioned images in child porn cases? 14 A. It was not used at that time, no. 15 Q. When was the first time that it was used? 16 A. This is the first time that it's being used. 17 Q. So when you talk about this being an accepted 18 methodology, are you aware of any court that has permitted 19 someone to testify based on the thumbnail extraction and the 20 Metadata extraction to offer an opinion that these images 21 depict a real person? 22 A. No, I'm not aware of that. 23 Q. And is that methodology one that has been subjected to 24 peer review? 25 A. The specific steps of the methodology used in this case, Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 93 of 150 93 1 the examination of Metadata, the examination of quantization 2 tables and applying that to questioned imagery has been 3 subjected to peer review and the use of quantization tables 4 in forensic analysis has been published. 5 Q. 6 analysis to verify or conclude that an image depicts a real 7 person? 8 A. No, it has not. 9 Q. And you -- strike that. But have any publications validated the use of that And has that methodology been 10 subjected to testing? 11 A. Of whether the individuals depicted are real or not? 12 Q. Yes. 13 A. Not in the context of images that are blind, if you 14 will. 15 Q. When you say -- 16 A. Blind images submitted, no. 17 Q. In other words, images where the origin is unknown? 18 A. Correct. 19 Q. And just to be clear about our terminology in this case, 20 the images, all of the images that you've looked at, the Q3 21 images, the images taken from the Frabizio computer hard 22 drive, the reference images that you've examined, none of 23 those were images that you actually extracted from a camera 24 physically? 25 A. That is correct. Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 94 of 150 94 1 Q. 2 digital format after being found in some way on someone's 3 computer or hard drive or CD or whatever the median was? 4 A. That is correct. 5 Q. And so these were all end stage images, if you will? 6 A. Correct. 7 Q. And when you talk about the original thumbnail image, 8 you are using the word "original" to basically characterize 9 your opinion that this depicts the original scene? All of these were images that were presented to you in 10 A. That is correct. 11 Q. Because you have no independent evidence that indicates 12 that in fact this is an original image? 13 A. 14 testified to as being original, all of the characteristics 15 that I examined are consistent with them being original 16 images. 17 Q. Okay. 18 A. That extends to images that I have taken myself and 19 compared the characteristics of to indicate that they are in 20 fact representative of original images. 21 Q. 22 done which is you take the picture and you look at the 23 quantization table and the Metadata and it's consistent with 24 what you know to be the accurate information regarding the 25 time, place and way in which that image was originally All of the characteristics of the thumbnails that I But that's the only testing, if you will, that you've Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 95 of 150 95 1 formed, correct? 2 A. Correct. 3 Q. And you don't know that about any of the Q3 images or 4 the reference images? 5 A. That is correct. 6 Q. And beyond the examples you showed of two or three 7 pictures, maybe it's just two pictures that you took 8 yourself, you have no testing of this methodology? 9 A. No. I took pictures with multiple cameras, each of the 10 cameras that are listed that were presented today, the Canon 11 EOS D60, the Canon Power S20 and the Pro 90 IS, also we had 12 other cameras in the laboratory that we used for testing, 13 Minolta, there were other images that had Minolta, Nikon 14 cameras, Fuji cameras, all those I took pictures with, I 15 extracted thumbnails, I verified that the thumbnails 16 quantization tables matched the quantization tables of all 17 the pictures. 18 Q. 19 testimony that each quantization table is unique to a 20 particular camera? 21 A. No, it is not. 22 Q. And how many different quantization tables are you 23 familiar with? 24 A. 25 types of quantization tables identified in the literature. And with respect to the quantization tables, is it your I'm aware that there have been at least 189 different Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 96 of 150 96 1 Q. Which literature? 2 A. This would be the forensic literature, Dr. Farid has 3 conducted recent work in which he downloaded close to 4 500,000 images from Flicker, used the Metadata to 5 characterize the source of those images, what kind of 6 camera, make and model, he then compared the quantization 7 tables and found that he could differentiate those into 189 8 different quantization table sets. 9 Q. And do you know where he published that work? 10 A. It's available on his website. 11 the proceedings of the IEEE, but I don't know where it is 12 going. 13 Q. 14 you aware of whether there is overlap among those? 15 A. Yes, there is. 16 Q. And do you know the extent of that overlap? 17 A. The paper has about 26 pages of just tables that list 18 all of the cameras that have similar quantization tables, 19 the same quantization tables broken out by groupings. 20 are some that only have two different cameras, two different 21 cameras included or maybe only one camera has that specific 22 quantization table. 23 out, but there are some that have five cameras, share the 24 same quantization tables. 25 Q. I believe it may be in And of those 189 quantization tables, was there -- are There I haven't had a chance to break that Now, with respect to the quantization tables that you've Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 97 of 150 97 1 identified with respect to the four images that were 2 discussed in this case, I'm going to talk about each of 3 those images separately, but just with respect to those that 4 you've talked about, have you determined whether those 5 quantization tables also match some other camera other than 6 the Canons that you've talked about? 7 A. No, I have not determined that, but it's irrelevant. 8 Q. Could you explain why you think that's irrelevant? 9 A. The fact of the matter is, your Honor, the quantization 10 table matches the camera that the Metadata indicates that it 11 is consistent with. 12 another camera or not, you have to know that that 13 quantization table corresponds to that specific camera. 14 doesn't matter if other cameras use that same quantization 15 table because you're matching the quantization table that 16 the thumbnail image has to the Metadata that is consistent 17 with that specific make and model of camera. 18 Q. Is it possible to alter Metadata? 19 A. Yes, it is. 20 Q. And with respect to quantization tables, am I correct 21 that software or photo processing software such as 22 Photoshop, for example, has its own quantization table? 23 A. That is correct. 24 Q. And do you know whether the software programs that can 25 be used to process photographs, whether any of them have Whether that picture was taken with It Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 98 of 150 98 1 quantization tables that match those quantization tables 2 that you've identified in this case? 3 A. 4 quantization tables that match those that I had found in 5 this case. 6 Q. And which software programs did you check? 7 A. Photoshop, Image Pro Plus and that would be it as far as 8 image processing software goes. 9 Q. What about Picasa? 10 A. I have not looked at Picasa. 11 Q. Is it fair to say that you have not excluded the 12 possibility that these quantization tables also match other 13 photo processing software? 14 A. 15 software available today that has quantization tables that 16 match. 17 back and see if photo processing software available at the 18 time these images were recorded was available to find that 19 quantization table. 20 Q. But you have not done that? 21 A. I have actually looked at the Internet literature to see 22 if I could find image processing software that specifically 23 gave the user the opportunity to select their specific 24 quantization table. 25 Internet today that allows you to pick your own quantization I have found no photo processing software that has It is possible that there may be photo processing It would be an interesting historical exercise to go There is software available on the Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 99 of 150 99 1 tables and set the quantization tables for the full size 2 image. 3 This software, the majority of it, has only been 4 released since 2005 or 2006. 5 processing image processing software called MATLAB that 6 Dr. Farid uses, anybody who is doing image processing in a 7 regular scientific manner is using MATLAB, M-A-T-L-A-B. 8 MATLAB included in a September, 2003 tool kit that it 9 released the ability to define your own quantization 10 There is a scientific tables. 11 I have not yet been able to find any other image 12 processing software earlier than that, earlier than 13 September of 2003 that specifically said that the user could 14 set their own quantization table. 15 Q. 16 to set your own quantization table is significant. 17 Presumably there were software, photo processing software 18 programs other than Photoshop and Image Pro available in 19 2003, correct? 20 A. Yes. 21 Q. And was Picasa one of them? 22 A. I do not know. 23 Q. And Picasa is also a widely available line of software I 24 think through Google; is that correct? 25 A. I'm sorry, maybe I'm not quite following why the ability I believe that's the case. I don't use Picasa so I'm Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 100 of 150 100 1 not familiar with it. 2 Q. 3 that right? 4 A. That's correct. 5 Q. And the only ones that you use are Photoshop and any 6 others? 7 A. 8 for image processing, but most of our work is done in those 9 two packages. So you're only familiar with the ones that you use; is Image Pro Plus. We have other applications that we use 10 Q. 11 quantization table back in 2003 using one of these photo 12 processing software programs, nevertheless those photo 13 processing software programs would have to have a 14 quantization table, correct? 15 A. Correct. 16 Q. And that's because that's how it converts it into a 17 JPEG, right? 18 A. That's the way it works. 19 Q. So by definition there's a quantization table? 20 A. Correct. 21 Q. So whether or not you can select that quantization 22 table, that quantization table would exist for particular 23 software? 24 A. Correct. 25 Q. And it's your testimony that you don't know whether the And so whether or not you could pick your own Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 101 of 150 101 1 quantization tables that you've extracted in this case might 2 also match one of those photo processing software 3 programs? 4 A. 5 image processing program in the world. 6 definitive statement. 7 Q. 8 quantization tables, that the quantization table was 9 produced not by a Canon but by a software processing, a That is correct, I have not been able to examine every That's a pretty So you cannot exclude the possibility that these 10 photo processing software? 11 A. That's correct. 12 Q. And so if we remove that from your analysis, then the 13 basis of your conclusion that these images are real is the 14 fact that you were able to extract camera Metadata, 15 correct? 16 A. No, that is not correct. 17 Q. Okay. 18 quantization table piece of this, what is the basis of your 19 conclusion that these images, that the thumbnails, that I 20 should say, depict an original image? 21 A. 22 First of all, when we look at the Canon EOS D60 images, 23 there are the black bars that are added to the image. 24 Anyone working in photo processing, I'm unaware of any photo 25 processing application that inserts black bars into Why don't you tell me if you take out the There's multiple features to consider in this analysis. Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 102 of 150 102 1 images. 2 Q. Have you checked? 3 A. No, I have not. 4 Q. Okay. So when you say I am unaware -- 5 THE WITNESS: 6 THE COURT: May I finish my answer, your Honor? Yes, go on. 7 A. 8 presentation of the thumbnails, which is consistent with 9 them coming from the camera. In addition to the black bars, we have the landscape We also have the fact that 10 there are no logos or other information superimposed on 11 these images. 12 Q. 13 consistent with a Canon original image? 14 A. That is correct. 15 Q. But you cannot tell us that they are inconsistent with 16 any photo processing software? 17 A. That is correct. 18 Q. So your conclusion that these are original 19 images -- well, strike that. 20 With respect to the thumbnails, is it correct that when 21 someone uses a photo processing software that that photo 22 processing software produces a thumbnail? 23 A. That's correct. 24 Q. And, for example, if you use Photoshop or one of the 25 other photo processing software programs to create, to add So what you're telling us is that these thumbnails are I think I've made my point. Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 103 of 150 103 1 text or a logo to an image, then the thumbnail for that 2 image would have the logo, correct? 3 A. Correct. 4 Q. And, in fact, of the four thumbnails that you found, or 5 maybe it's the reference images, for 100-0056 and 021, there 6 actually were thumbnails that had the logo on them, 7 correct? 8 A. 9 without logos. There are both thumbnails with logos and thumbnails 10 Q. 11 software that would preserve the original thumbnail even 12 after a logo was added? 13 A. 14 6.0 preserved the original logo. 15 chart that showed that, but Photoshop Version 6.0 preserved 16 both the original camera thumbnail and the Photoshop 17 thumbnail after the logo was produced. 18 Q. 19 logos, that the way in which the logos was added was through 20 Photoshop 6? 21 A. 22 a raw thumbnail included, Photoshop 6 is the most likely 23 sort of that image having been produced with a logo. 24 Q. 25 that would have produced that result? And so are you familiar with any photo processing As I testified earlier, your Honor, Photoshop Version We could go back to the So, is it your opinion that these images that have the For those images that have a logo and for which there is And are you aware of any other photo processing software Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 104 of 150 104 1 A. No, I'm not. 2 Q. What steps have you taken to determine whether any other 3 photo processing software would have produced that result? 4 A. 5 software would produce that result. 6 Q. 7 cases, one of the child pornography cases, to determine 8 whether the images depict a real individual is to see if you 9 can identify a known individual who's depicted in those I have not looked to see if other photo processing Now, the usual procedure when you get one of these 10 images, correct? 11 A. Can you repeat that? 12 Q. The usual procedure in your unit, the first step is to 13 determine whether or not the images you receive in a 14 suspected child pornography case depict so-called known 15 victims? 16 A. That is correct. 17 Q. And that is done by checking the various databases with 18 NESMIC and CEROF, correct? 19 A. That is correct. 20 Q. And in this case with respect to the nine images that 21 you were originally provided, you were unsuccessful in 22 making any identification? 23 A. That is correct. 24 Q. The examination that your unit conducts is usually aimed 25 at determining whether or not an image has been manipulated, Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 105 of 150 105 1 correct? 2 A. Correct. 3 Q. And, in fact, many of your papers or lectures talk about 4 detecting manipulation, correct? 5 A. That is correct. 6 Q. Detecting forgery? 7 A. Correct. 8 Q. So, does the fact that you cannot detect manipulation 9 mean that an image has not been manipulated? 10 A. No, it does not. 11 Q. Are you aware of any protocol that permits you to 12 conclude that the absence of evidence of manipulation means 13 that you can conclude that the image is in fact real? 14 A. 15 manipulation -- that an image has not been manipulated and 16 is real under certain conditions. 17 Q. And those conditions are? 18 A. If you have lots and lots of pictures of the same 19 individual, I believe this was the subject of the previous 20 hearing in this case, and you're well familiar with that. 21 Q. 22 evidence? 23 A. 24 25 Our protocol allows us to determine that the You're aware that Judge Gertner excluded that Exactly. MR. YOON: Objection, your Honor, the relevance and whether he has any knowledge of previous testimony. Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 106 of 150 106 1 THE COURT: 2 MS. CONRAD: Sustained. May I be heard briefly on that, your 3 Honor, to the extent that the protocol he's talking about is 4 based on the same protocol that this Court previously 5 excluded, I think that's relevant. 6 THE COURT: That's not relevant to his testimony, 7 it's relevant to my use of his testimony. 8 it's your argument to me. 9 Q. In other words, The term "original thumbnail" or "raw thumbnail" that 10 you have used throughout your testimony in your reports, is 11 that a term of art in your field? 12 A. 13 me, but it's a term that we have adopted. 14 Q. Who is we? 15 A. We in the FBI lab and in talking to others in our field 16 about raw and original. 17 Q. 18 that's used in the field of photography, correct? 19 A. Yes, correct. 20 Q. That is not what you're talking about? 21 A. No, absolutely not. 22 Q. Can you tell us what a raw image is? 23 A. Raw images, .raw files refer to the manufacturer 24 specific implementation of their digital image storing 25 procedure. The definition of what term of art is is not clear to Well, certainly there is something called a raw image It's raw from the standpoint that it represents Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 107 of 150 107 1 exactly what hit the detector on the back of the camera, and 2 it stores it in its own manufacturer specific manner. 3 the case of Nikon cameras, they have a raw format that you 4 can only open the file using Nikon software. 5 Q. 6 in this case? 7 A. Yes. 8 Q. And you put "raw" I think in quotes? 9 A. Yes. 10 Q. Why did you put it in quotes? 11 A. Coming back to your question, to use it as a term of 12 art, if you will. 13 Q. 14 that you just defined a "raw image"? 15 A. 16 I described it in terms of the camera manufacturer data is a 17 term of art. 18 putting the word "raw" in my report in quotes, I would hope 19 that I had made the distinction between a raw file of the 20 type that you're discussing and that was not a part of my 21 analysis. 22 Q. 23 report in quotes, what do you mean by that? 24 A. I mean raw exactly as it came out of the camera. 25 Q. And that's your opinion based on further analysis? In And you talk in your report about a raw thumbnail image But you're not using it as a term of art in the same way I would not say that the definition of a "raw image" as Okay. That is a standard across the industry, and by So now I'm confused. So when you say raw in your Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 108 of 150 108 1 A. Correct. 2 Q. So when you say I extracted a raw thumbnail from these 3 full size images, right, there's nothing about just 4 looking -- strike that. 5 raw thumbnail? 6 A. 7 in my testimony, correct. 8 Q. 9 Q3 images and the reference images? That's your opinion that it is a Based on all of the features that I've described earlier Now, did you conduct a hash value comparison between the 10 A. No, I did not. 11 Q. And can you explain what a hash value comparison is? 12 A. Hash value comparison is simply utilizing an algorithm 13 to take the contents of a digital file, run those contents 14 through this Algorithm and produce a single number, a 15 fingerprint for that image file. 16 this digital image file is identical to that digital file. 17 The fact that I did not have reference images that were 18 identical to the questioned images means that it would be 19 pointless to conduct a hash analysis between those images. 20 21 THE COURT: Hashes are used to say Because it would have only shown some differences, and you already knew that? 22 THE WITNESS: Exactly. 23 Q. 24 images, the one from this case and the one from the 25 reference files was identical? Well, I thought you testified that the two 100-0056 Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 109 of 150 109 1 A. 2 the record to reflect that that is not a correct 3 characterization of my testimony. 4 Q. So there are differences between those two images? 5 A. Yes, there are. 6 Q. What are the differences? 7 A. The reference image that was recovered has -- is a 8 smaller sized full size image. 9 the image. I did not testify to that, and if I did, I would like It is not the same size as It had exactly the same file name, but it was 10 not the same size. 11 images. 12 Q. 13 attempted to extract Metadata or thumbnails from the Q3 14 images. Now, your report doesn't indicate whether you actually 15 16 That's a major difference in those two Did you do that? THE WITNESS: May I refer to my report, your Honor? 17 THE COURT: Yes, you may. 18 A. I believe your statement is incorrect. 19 Q. I'll be happy to have you correct it if I'm wrong. 20 A. Here we are. 21 Government Exhibit -- oh, I don't believe there is a 22 government exhibit for this. 23 24 25 At the top of page 3 of my report, this is MR. YOON: Your Honor, I think the report is 22. I may not have labeled it. THE COURT: Yes. Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 110 of 150 110 1 2 THE WITNESS: Okay. Government Exhibit 22 at the top of page 3, if I may read, your Honor. 3 THE COURT: Go ahead. 4 A. 5 were examined to locate Metadata and thumbnail images that 6 would indicate their source of origin and/or processing 7 history. 8 indicating the camera of origin. 9 "P1.JPG", and P8199391.JPG also contain Metadata indicating "Preliminary examination, the Q3 digital exhibit files The file "P8199391.JPG" contains Metadata The files "CR-1330-JPG", 10 that they have been processed in Adope Photoshop. 11 discussion is provided below." 12 Q. 13 anything, you found in the other six images? 14 A. No, it does not. 15 Q. Did you find any Metadata in the other six images? 16 A. I believe there were some that had comments in them. 17 Q. What were those comments? 18 A. I don't recall. 19 Q. Did you make a record of those comments? 20 A. The notes that had been provided to you, the electronic 21 results that have the Metadata extraction included, they're 22 included in my file. 23 THE COURT: 24 25 Further So I apologize, I misspoke, but it does not say what, if The other six images, you mean the ones that this witness will not be used to testify about? MS. CONRAD: No, your Honor. There were a total Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 111 of 150 111 1 of nine images, as I understand it, that were submitted for 2 examination. 3 those. 4 I believe one of those three is not going to be the subject 5 of testimony at trial, so it's kind of different overlap, 6 but it's nine were examined. 7 Metadata. 8 I'm not sure I understand this report so maybe I'm going to 9 have to back up. He is providing information about four of The report lists information about three of those. As I understand it, one had That's the subject of testimony. 10 Q. 11 clearer. 12 of origin? 13 A. Correct. 14 Q. And what did that Metadata show? Three -- well, Let me use the numbers and maybe than will make it P8199391 contains Metadata indicating the camera 15 THE WITNESS: 16 THE COURT: If I may check my notes? Yes, please. 17 A. 18 was taken on August 19th, 2002 at 1:15, 10 p.m. and that it 19 was subsequently modified on November 11th, 2002. 20 Q. In Photoshop? 21 A. I don't know about the modification in Photoshop date. 22 I don't know when in fact the Photoshop was applied to 23 that. 24 Q. 25 processed in Photoshop? Contains Olympus E20 camera Metadata, indicating that it But you did find Metadata indicating it had been Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 112 of 150 112 1 A. Correct. 2 Q. And was that camera information consistent with the 3 reference images? 4 A. Absolutely, down to the date and time. 5 Q. But you couldn't identify the quantization table, is 6 that correct, for the Olympus? 7 A. 8 that's correct. 9 Q. I could not identify specific quantization tables, Now, with respect to the other images, Q3 images that 10 you examined, did you find camera Metadata for those 11 images? 12 A. 13 images. 14 Q. 15 these were processed in Photoshop? 16 I found no other camera Metadata for those other But you did find in 1330 and P1.JPG an indication that MR. YOON: Objection, your Honor, the government 17 is not submitting this witness for evidence on those 18 particular files. 19 THE COURT: But you can examine why. In other 20 words, that's the nature what you're trying to do is examine 21 why his -- in other words, you want to be able to look at 22 the significance of the fact that he's not testifying about 23 the others as well? 24 25 MS. CONRAD: Well, also the significance of the fact that others did not have Metadata, the actual images in Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 113 of 150 113 1 this case. If I could just -- 2 THE COURT: 3 MS. CONRAD: Go on. Thank you. 4 Q. 5 processing software for any of the other Q3 images? 6 A. 7 P1.JPG in addition to P8199391. 8 Q. 9 simpler, leaving aside P8199391 for a second, with respect Did you find Metadata indicating the use of any photo Just as I testified earlier, the CR-1330.JPG and the So, with respect to -- let me make this a little 10 to the other three images that you've testified on direct 11 examination here today, you are unable to extract thumbnails 12 from them; is that correct? 13 A. 14 images. 15 Q. But you were able to extract thumbnails? 16 A. Correct. 17 Q. And those thumbnails had the same logos that the full 18 size images had? 19 A. Exactly. 20 Q. And that would be an indication right off the bat that 21 those images were processed somehow in Photoshop or some 22 other photo processing software? 23 A. Absolutely. 24 Q. Now, all of the images we're talking about here are 25 JPEGs, correct? I was unable to extract what I would call raw thumbnail Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 114 of 150 114 1 A. Correct. 2 Q. And all of the thumbnails are JPEGs; is that correct? 3 A. That is correct. 4 Q. And JPEGs are compressed file formats, correct? 5 A. That is correct. 6 Q. And each time a JPEG is opened and closed, it is 7 compressed further, correct? 8 A. Only if you resave it -- 9 Q. Okay. 10 A. -- will it be compressed. 11 compressed further. 12 Q. 13 processed image would generally reflect the changes that 14 were made in that image? 15 A. Correct. 16 Q. Because when it's recompressed, it's saving, or, excuse 17 me, when it's saved, it's saving the changes that were 18 made? 19 A. 20 you save that image as a JPEG and you've modified the image 21 somehow, the thumbnail that is now generated will be 22 compressed. And that is one of the reasons why a thumbnail of a Yes. When you have a processed image in Photoshop and 23 THE COURT: 24 THE WITNESS: 25 Q. It would be recompressed, With those changes? With those changes included in it. Now, if it's your theory that the explanation for why Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 115 of 150 115 1 the thumbnails don't have the logos, even though the full 2 size images do, now I'm talking about both the Q3 images and 3 the reference images, is that they must have been processed 4 in Photoshop 6, correct? 5 A. That is the most likely explanation. 6 Q. Are there other explanations? 7 A. The other explanations would be that there are other 8 software programs out there that would have retained the 9 original camera thumbnail when it was processed, when it was 10 doing the processing. 11 Q. 12 last modified, and maybe this is a new note, the last 13 modified date as opposed to the origination date? 14 A. Do I actually reference that in my report? 15 Q. In your notes. 16 A. In my notes, yes. 17 Q. Now, could you explain under what circumstances you 18 would draw the conclusion that a date in the Metadata 19 reflected the last modified date as opposed to the 20 origination date? 21 A. 22 modification date. 23 Q. 24 date? 25 A. Now, you refer in your report in various places to the Well, there is a tag in the JPEG standard that refers to But is there a tag that referred to the origination Yes. Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 116 of 150 116 1 Q. 2 changed? 3 A. 4 And isn't that date updated every time the image is It depends. THE COURT: In other words, would the date on the 5 thumbnail say the last date of modification rather than 6 reflecting the date of origination? 7 MS. CONRAD: Correct. 8 A. 9 the image file, that original digitized date, the As long as the original camera Metadata is preserved in 10 origination date will be retained, and it will not change as 11 long as that is saved. 12 Q. How do you know whether it was saved? 13 A. How do I know if what was saved? 14 Q. The original camera, the original date was saved. 15 A. If you have -- when I took my test images, I looked at 16 the Metadata, and I saw that the original date, the 17 digitized time and date was consistent with the time and 18 date that I took the photograph. 19 Photoshop and modify that image by resizing it, rotating it 20 and putting a logo on it, that original digitized date will 21 stay as the time and date I took it. 22 date will reflect when I modified the image in Photoshop. 23 Q. That's only for Photoshop 6 though? 24 A. To preserve that original date. 25 some versions of Photoshop -- no, I believe the current If I then go into The new, the modified There's a question in Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 117 of 150 117 1 versions of Photoshop will retain the original digitized 2 date. 3 THE COURT: But isn't it a moot point, the images 4 that are at issue in this case, even on your theory, had to 5 have been the Photoshops that were available in whatever the 6 dates of the possession were, so later versions of Photoshop 7 are irrelevant? 8 9 MS. CONRAD: Q. Right. Do you know if Photoshop 6 was available in 2003? Maybe 10 I should ask that question. 11 A. Yes, it was. 12 Q. Okay. 13 not being proffered, but I would just like to ask this for a 14 moment, I think 56 and 57, for example, show earliest 15 modification date, according to your notes, of March 13th, 16 2003? 17 A. Can you direct me to that page of my notes? 18 Q. Sure. 19 Some of the images as to which your opinion is One second. THE COURT: You know what, let's do this, let's 20 take a break. 21 tried to squeeze in without interrupting, then you all can 22 come back at 2:30. 23 I have another proceeding at 1:30 which I MS. GERSHENGORN: I'm scheduled to be in front of 24 Judge Collings for a final status conference at 3:00 that 25 I've been unable to find coverage for but I can go up and Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 118 of 150 118 1 see if I can. 2 3 THE COURT: Can we proceed in your absence or would you rather not? 4 MS. GERSHENGORN: No, if the Court does not mind 5 my coming in as soon as I'm done, you can proceed in my 6 absence. That should be short. 7 THE COURT: 8 MS. GERSHENGORN: 9 at 2:30 and then slip out? We'll start up again at 2:30. Would it be all right if I start 10 THE COURT: By all means. 11 THE CLERK: All rise. 12 (A recess was taken.) 13 THE CLERK: All rise. 14 THE COURT: Sorry, I'm in the middle of a major 15 trial that keeps on interfering. 16 Mr. Gershengorn is at Magistrate Collings? 17 MR. YOON: 18 THE COURT: I understand Yes. That's fine. Go on. 19 Q. 20 the Metadata data that you extracted from the Q3 images, and 21 if I could draw your attention to page 7 of your notes. 22 Actually -- 23 A. 24 found what you were looking for, and I can clear this up 25 straight away. Dr. Bruegge, before we broke, I was asking you some of Counselor, I have based on your previous question, I Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 119 of 150 119 1 Q. Okay. 2 A. These dates that are referenced on the bottom of page 7 3 of my notes that includes 56 and 57, no camera data, 4 earliest modification date, 3-13-2003, those notes refer to 5 the reference images that are related to those Q3 images. 6 Q. It doesn't say that though, does it? 7 A. No, it does not say that in my notes. 8 continuation of my analysis of the reference images. 9 Q. This is just a Okay. 10 THE COURT: 11 MS. CONRAD: This indeed is not rocket science. I know. I think the problem is it's 12 too thick. 13 Q. I'm just going to ask the question. 14 A. Please. 15 THE COURT: I have no idea what you're doing. 16 Q. 17 were taken according to the Metadata in March, several of 18 them were taken in the period of March, April and May of 19 2003, correct? 20 A. 21 of my notes? 22 Q. Yes. 23 A. These have dates, some of which are earliest 24 modification date and some of which correlate to the actual 25 date on which the images were taken. All right. So, these images, according to your notes, The bottom -- you're talking about the bottom of page 7 Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 120 of 150 120 1 Q. Okay. 2 A. It's commingled. 3 Q. Could you explain the difference? 4 A. Okay. 5 modified and then resaved, there will be a modification date 6 when they are saved. 7 which the original camera image was taken reflects the date 8 that the camera fired, that the camera recorded the image, 9 and effectively you will have dates, you may have multiple 10 When computer files are saved, when they're The digitization date, the date on dates in a digital file. 11 It's not just digital image files, but any digital 12 file could have the date on which it was originally created, 13 and there might be Metadata data that indicates the date 14 that it was saved later, and that is what you're looking at 15 here for the example of 56 and 57. 16 earliest modification date is that it was March 13th, 2003. 17 I didn't have original camera data for those images. 18 reason 56 and 57 are not a subject of my testimony today is 19 that I couldn't find any camera images and therefore 20 couldn't find any thumbnail images for those images. 21 Q. So for 1330 and UL -- 22 A. Yes. 23 Q. -- you gave respectively a date 3-25-03 for 1330 and 24 4-11 -- well, let's stick with 1330 for a second. 25 testimony that 3-25-03 is the digitization date? The reason why I wrote The It's your Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 121 of 150 121 1 A. These are for the reference -- 2 Q. Right. 3 A. -- images, not for the image from the computer. 4 Q. I understand. 5 A. I'm not sure if those are modification dates or camera 6 dates. 7 has the Metadata extraction for that. 8 Q. Wouldn't that be an important distinction? 9 A. It may be that I have that information elsewhere in my I would have to go back to the computer disk that 10 notes if I can have the leave of the Court to look for 11 that. 12 13 14 THE COURT: These are the modification dates or the dates of the origination of the photograph? THE WITNESS: Yes, and that would have been 15 something that I would have checked on later. 16 is focused on the images that I had for reference, and as I 17 already indicated in my testimony earlier, some of those 18 images that reflect the subject in the P819 image were taken 19 in 2003, April of 2003, so, yes. 20 THE COURT: This summary Because if it's only the modification 21 date, then presumably an altered image, a la Photoshop, 22 could be passed along, could be passed along the Internet, 23 and if so, the modification could have been the date of the 24 Photoshop rather than the date of the origination? 25 MS. CONRAD: Correct, that's what I was getting Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 122 of 150 122 1 to. 2 THE COURT: I'm ahead of you. 3 Q. 4 images, are you aware of what date those were seized? 5 A. 6 2003. 7 Q. 8 different times written next to that date 3-25-03, 9 2:21 p.m., 2:39 p.m., 3:35 and 3:47 p.m. And are you aware that the images in this case, the Q3 I'm aware that they were seized I believe in January of And on the bottom of page 7 for 1330, you have four Can you explain 10 why there are different times? 11 A. 12 reference images that correlate to the subject and seen in 13 the images. 14 Q. Each of these times is for different reference images? 15 A. Exactly. 16 Q. Okay. 17 Photoshop the image would save? 18 A. The original thumbnail. 19 Q. Would it also save the modified thumbnail? 20 A. Absolutely. 21 Q. So you would have two thumbnails for each of those 22 images? 23 A. 24 Photoshop and then save that file and you did not 25 subsequently modify that file and resave it, then you should Yes, because as I testified earlier, I'm referring to my Just to clarify one thing, you said that in You would have -- if all you did was take it into Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 123 of 150 123 1 have two thumbnails and the full image. 2 Q. 3 believe the images, excuse me, the thumbnails that you 4 abstracted for the reference images have no logo even though 5 the full size images have the logo, your explanation for 6 that was that you believed that these were modified, that 7 the logo was added in Photoshop 6, right? 8 A. Correct. 9 Q. Okay. Okay. So with respect to your explanation of why you For those reference images where you found the 10 thumbnail with no logo, did you also find the thumbnail with 11 the logo? 12 A. Yes, I did. 13 Q. Are those reflected in what you've offered to the Court 14 today? 15 A. 16 demonstrated how the logo would be preserved if I went 17 through the process of saving that, and they are in my 18 notes, the disk that shows all of the work that I did and 19 that has all the files that I processed. 20 Q. 21 those images? 22 A. Yes. 23 Q. Would they have the same file name? 24 A. Would the extracted thumbnails have the same? 25 Q. Yes. I did not present any of those images in court today. And that would have both the thumbnails for each of I Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 124 of 150 124 1 A. 2 didn't go through the details of that extraction process. 3 In the Win Hex application, there is the capability to 4 select a file and then say extract from that file specific 5 file types, so from within a single file, you may be able to 6 extract JPEGs. Okay. 7 Let me explain the extraction process since I The modification, the way that this then works is 8 I use Win Hex, I say I want to extract all the JPEG images 9 that are included in this one file, so that would be any 10 thumbnails and the full size image, and then write those out 11 to a folder, and that file name that I would give would 12 generally have, I would use a file name convention which 13 would trace back to that image, or if it were a specific 14 subject type of folder like Photo Lolita or something like 15 that, I would use that starting name and then every JPEG 16 that was extracted would be either one, two, three or four, 17 for example. 18 Q. 19 thumbnails that were extracted, right? 20 A. There were four JPEGs -- I'm sorry, from a single image? 21 Q. Yes. 22 A. From a single image, there would be four images that 23 were extracted. 24 Q. Those four JPEGs would be what? 25 A. Probably 100-0056, underscore, 0001, 0002, 0003, 0004. Now, and, for example, for 100-056, there were four Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 125 of 150 125 1 Q. 2 reflect? 3 A. 4 thumbnail, the full size image and the full size image 5 repeated. 6 find the JPEG that it looks for the tag that indicates the 7 beginning of the file and the end of the file, and this has 8 the result that the full size image, which is down at the 9 end, has the beginning, the tag that indicates beginning of No, what I meant, what would each of those JPEGs They would be the original thumbnail, the modified It's a function of the way that Win Hex works to 10 a new image. 11 Q. Okay. 12 A. So that full size image would be extracted, but there 13 would also be the original image that has the same tag at 14 the very beginning of the file. 15 Q. 16 you did not testify on direct, you had opined in your report 17 that that image depicted an individual whose image had not 18 been altered, I'm just looking for the exact phrasing of 19 that. 20 conclusion about, right? 21 A. 22 couldn't find reference images. 23 Q. 24 "That these have not been modified to alter the identity or 25 physical appearance of the individuals depicted therein, With respect to 1330, one of the Q images about which So, 57 and 56 and I think P1 you did not draw any I did not conduct further examinations on them because I Right. But CR-1330 and UL, you wrote in your report, Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 126 of 150 126 1 correct? 2 A. That is correct. 3 Q. Now, with respect to 1330, you were unable to locate a 4 raw thumbnail image that depicted -- well, you were unable 5 to locate or extract any so-called raw thumbnail images that 6 depicted either of those individuals, correct? 7 A. That would be -- yes, that's correct. 8 Q. But despite the fact that you could not extract those 9 raw thumbnail images depicting what you concluded were the 10 same individuals, you, nevertheless, concluded that those 11 images were not modified to alter the identity of the 12 individual; is that right? 13 MS. GERSHENGORN: Your Honor, the government is 14 going to object because they're are not images we intend to 15 present evidence from the witness at trial. 16 THE COURT: No, I understand, but if A factor 17 qualifies for him to conclude that the pictures are real and 18 another group is not A and he concludes that they're also 19 real, it seems to me that that can be the basis of 20 examination. 21 Q. 22 1330 and UL.JPEG have not been modified to alter the 23 identity or physical appearance of the individuals that are 24 depicted therein, the basis for your conclusion, as I 25 understand it, is that you were able to extract raw That's all in terms of testimony. Go on. So, the basis of your conclusion that the Q3 images, Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 127 of 150 127 1 thumbnails from images that depicted the same couch that 2 was, for example, depicted in CR-1330? 3 A. Correct. 4 Q. And so you concluded that because one individual had a 5 picture taken seated or lying on a certain couch that your 6 examination led you to conclude that that individual was 7 real, that, therefore, a different individual depicted on 8 the same couch therefore must also be real? 9 right? Is that 10 A. 11 there was a single individual. 12 images reflect actual photographs taken of individuals in 13 that scene on that couch that had not been modified, the raw 14 thumbnails, the quantization tables are all present, and the 15 individuals depicted in CR-1330 and UL are furthermore 16 depicted in hundreds of other images. 17 Q. But none of which had raw thumbnail images? 18 A. Correct. 19 Q. So, the basis of your conclusion in your report, and I 20 understand it's not something that's going to be the subject 21 of testimony at trial, but the basis of your conclusion in 22 the report that those individuals, excuse me, that the Q3 23 images, 1330 and UL have not been modified to alter the 24 identity of the individual is based on what with respect to 25 those two images? Not fully. It is not based solely on the fact that I mean, the raw thumbnail Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 128 of 150 128 1 2 THE WITNESS: If I may refer to my report, your Honor? 3 THE COURT: Go right ahead. 4 A. 5 22, I believe, page 6, second paragraph, "91 of the 6 reference images that depict the individual in CR 13-30.JPEG 7 contain camera Metadata including date and time information. 8 Seven of those images also contain Metadata indicating that 9 they were taken with a Minolta DiMage 7i camera on From page 6 of my report, which is Government Exhibit 10 January 7, 2003. 11 indicating that they were taken with a Nicon E 5700 camera 12 between 2:21.50 p.m. and 3:47.18 p.m. on March 23d, 2003." 13 Q. Can I just stop you? 14 A. Yes. 15 Q. Because that's all it says about 1330? 16 A. Correct. 17 Q. Therefore your conclusion is because this looks like the 18 same person that's in a number of other pictures with 19 Metadata identifying the camera and the date that the image 20 was taken, that led you to conclude, that fact standing 21 alone led you to conclude that these were real? 22 A. No. 23 Q. Okay. 24 A. If I may continue. 25 84 of those images contain Metadata There is Metadata. THE COURT: Go on. Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 129 of 150 129 1 A. 2 depict the individual in UL.JPG contain camera Metadata. 3 Five of these images contain Metadata indicating that they 4 were taken with a Minolta DiMage 7i camera between 5 11:56:47 p.m. on December 27, 2002 and 12:09.46 a.m. on 6 December 28, 2002. 7 indicating that they were taken with an Olympus C 4040 Z 8 camera. 9 is recorded as a default value, all zeros. Third paragraph reads, "159 of the reference images that 154 of these images contain Metadata The date and time associated with the latter images The five Minolta 10 images depict the same couch as seen in the Q3 image, 11 CR 13-30.JPG." 12 The next paragraph reads, "Raw thumbnail images 13 that depict the couch seen in the Q3 image, CR 13-30.JPG 14 were located in reference images beginning with the 15 characters CR-37, however, no raw thumbnail images were 16 located that depict either of the individuals depicted in 17 the Q3 files CR 13-30.JPG and UL.JPG. 18 raw thumbnail images indicates that photographs of that 19 couch were taken with a camera that accurately reflect that 20 scene. 21 The finding of the The fact that the individuals were taken that we 22 have so many photographs that have Metadata associated with 23 them coupled with the fact that there is raw thumbnail 24 images of that couch leads me to conclude that these are 25 real images. Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 130 of 150 130 1 Q. 2 what you're saying is there's a lot of pictures of what 3 appears to be the same person? 4 A. That is correct. 5 Q. Which was basically the basis of Mr. Musheno's testimony 6 back in 2005? 7 A. Yes. 8 Q. Okay. 9 different from what Mr. Musheno relied upon in drawing his Okay. Putting the couch aside for a minute, basically And the only information that you now have that's 10 conclusion, which was rejected by this Court, is the fact 11 that, first of all, there was Metadata indicating the type 12 of camera that was used, correct? 13 A. Correct. 14 Q. And the fact that the couch appears in some raw 15 thumbnails with different individuals? 16 A. Correct. 17 Q. Now, how does the fact that the couch is real add to any 18 conclusion that the person is real? 19 A. 20 consistent with an actual camera provide further support for 21 the observation, the conclusion that these photographs were 22 taken with a real camera. 23 was photographed with a real camera with individuals in 24 it. 25 Q. The fact that we have raw thumbnail images that are We have evidence that this scene And the fact, when you process an image in photo Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 131 of 150 131 1 processing software, does that processing necessarily erase 2 the Metadata regarding the camera that it was taken with? 3 A. Sometimes it can, sometimes it will not. 4 Q. So, the fact that there's Metadata indicating what type 5 of camera it was taken with at most indicates that at some 6 point this image started out as a photograph? 7 A. That's correct. 8 Q. It doesn't mean it was not altered? 9 A. That's correct. 10 Q. And it also does not mean that someone didn't alter the 11 Metadata? 12 A. That's correct. 13 Q. You talked about Photoshop 6. 14 Photoshop 6 for a minute. 15 image and used some type of photo processing software to 16 edit that image, okay, then used Photoshop to do some 17 further editing on it? 18 A. Okay. 19 Q. What you're calling the original raw thumbnail image 20 would be the image that Photoshop first saw when Photoshop 21 began to process it, correct? 22 A. That is correct. 23 Q. And so in that sense, in that scenario, the so-called 24 original raw thumbnail would not be the image at the time it 25 was captured by the camera, it would be the image at the Let me just go back to Suppose someone took an original Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 132 of 150 132 1 time it was first processed by Photoshop 6? 2 A. 3 that's correct. 4 Q. 5 showing up in Photoshop 6, or, excuse me, the thumbnail that 6 you're extracting from this image that you're identifying as 7 the original was in fact the image that was taken at the 8 point of capture by the camera or was simply the image in 9 its state when it was first touched by Photoshop? That was the first time it was ingested by Photoshop 6, You have no way of knowing whether the thumbnail that is 10 A. 11 into Photoshop, the file would have had to have all of these 12 hallmarks of an image that came directly from a camera. 13 Q. Such as? 14 A. The hallmarks that I've been through before, the 15 landscape mode of the thumbnail, the quantization table 16 consistent with the camera and the Metadata of the camera. 17 Q. 18 table is not unique? 19 A. 20 the thumbnails are not unique. 21 THE COURT: 22 23 That is correct, with the proviso that before it came We've already discussed the fact that the quantization We do not know for a fact that the quantization table of We don't know that they are not unique? THE WITNESS: We do not know for a fact that they 24 are not unique. 25 large images may not be unique, but no analysis has been We know that quantization tables of the Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 133 of 150 133 1 done of the thumbnails of the quantization tables yet. 2 Q. By you? 3 A. By me or by anyone I'm aware of. 4 Q. Because no one has tried to do what you're trying to do 5 in this case? 6 A. Not yet. 7 Q. And the other thing you mentioned was the landscape 8 orientation, right? 9 A. Yes. 10 Q. And that could also be the product of some other type of 11 camera that might do that, right? 12 A. 13 producing landscape mode, yes. 14 Q. 15 or something else? 16 A. The landscape orientation alone, no. 17 Q. Do you know whether photo processing software would turn 18 something into landscape orientation? 19 A. 20 the other processing application as a portrait mode 21 photograph and saved as a portrait mode photograph, there 22 would be no reason for the processing software to save it as 23 a landscape. 24 Q. 25 three different types of software that you use, right? I would expect that all of the cameras at the time were And so that doesn't particularly identify it as a Canon It would be highly unlikely. If it were processed in What you've told us, you're familiar with, I think, Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 134 of 150 134 1 A. Yes. 2 Q. Out of the 169 that there are, that's the quantization 3 table? 4 A. No, that's the quantization table. 5 Q. Out of that, how many photo processing software? 6 A. There's probably a lot, dozens of photo processing 7 software that's out there. 8 Q. 9 operates? And you're not familiar with how each of those 10 A. Not with all of them, no. 11 Q. And with respect to the black bars that you talked 12 about -- 13 A. Yes. 14 Q. -- as I understand it, that's a function of sort of 15 making the -- now I can't remember -- 16 A. -- aspect ratio -- 17 Q. I knew it began with an A. 18 -- fit the monitor, correct? 19 A. Yes. 20 Q. Okay. 21 Canon? 22 A. No, I'm not aware if that is unique to Canon. 23 Q. Are you aware of whether that is something that might 24 occur in a photo processing software? 25 A. I couldn't find the word. And are you aware of whether that's unique to As I mentioned earlier, I doubt that it would be in Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 135 of 150 135 1 other photo processing software, but since I don't know 2 every photo processing software out there, I guess that the 3 possibility exists. 4 Q. 5 standard operating procedures that are used within your 6 unit, right? 7 A. 8 not. 9 Q. First of all, your notes refer to certain SOPs, right? 10 A. Yes. 11 Q. Those are FAVIAU I think 12 and 16? 12 A. Correct. 13 Q. And neither of those sets forth a standard operating 14 procedure for the type of analysis that was done in this 15 case? 16 A. 17 looking at things like the Metadata image file content, 18 things of this nature. 19 Now, you testified on direct examination about the I'm not sure if we actually went through the SOPs or A component of 16 addresses SOP-15 which includes MS. CONRAD: Well, I would like to be provided 20 with SOP-15. 21 but I was not provided with 15, so if that's one of the 22 things that was relied upon in this case, I would like to 23 get a copy of that. 24 25 I was provided by agreement with 12 and 16, THE COURT: Ms. Gershengorn? No. Is there an objection, Mr. Yoon or That will be provided. Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 136 of 150 136 1 Q. 2 unit that provides for the type of analysis and perhaps more 3 importantly the type of conclusion that you're drawing in 4 this case? 5 A. Not specifically, no. 6 Q. And are you aware of any best practices that SWIGT, for 7 example, has come out with to be for doing this type of 8 analysis? 9 A. Let me put it a different way. Is there an SOP for your Yes, the SWIGT has a best practices for image 10 authentication which addresses issues that one looks at when 11 seeking to authenticate images and videos. 12 Q. 13 it? 14 A. 15 discussion of Metadata in there, and thumbnail may be 16 included as part of that. And none of that talks about raw thumbnail images, does I think that there may be a mention, there's definitely 17 18 THE WITNESS: Your Honor, if I could clarify the record. 19 THE COURT: Go right ahead. 20 A. 21 that allowed me to reach the conclusion that I did. 22 image characterization SOP No. 15 which is a subreference in 23 SOP-16 does refer to examining the Metadata and other parts 24 of the image, basically doing this dissection process, just 25 as it's spelled out specifically. The SOP-15, the question was asked if there was an SOP The The SOPs are written in a Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 137 of 150 137 1 general manner that gives the analyst leeway to apply best 2 practice to the analysis, and the SOP-16 refers to taking in 3 all of this data and reaching a conclusion, and, therefore, 4 I would submit that SOP-16 does in fact allow me to reach 5 the conclusions that I reached as part of the SOP. 6 Q. Well, if I can find it. 7 8 THE COURT: you some help. 9 MR. YOON: 10 11 Mr. Yoon is trying to reach to give MS. CONRAD: 16? Yes, do you have it? Thank you. If may I approach the witness, your Honor? 12 THE COURT: 13 MS. CONRAD: Yes. Since I'm having trouble with the 14 Elmo. 15 Q. 16 authentication? 17 A. Yes. 18 Q. Take a moment and tell me where it says you can 19 authenticate an image based on Metadata. 20 A. 21 Practices For Image Authentication," if I may read the 22 paragraph titled, "Metadata Analysis, digital image files 23 contain both pixel data and information about the structure 24 and content of the file itself. 25 as Metadata. This is SWIGT best practices for images At the top of page 2 of the SWIGT authentication, "Best The latter is referred to Metadata may be useful in identifying the Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 138 of 150 138 1 source and processing history of the file but can be absent 2 or altered." 3 Q. 4 altered based simply on the presence of Metadata? 5 A. I would agree with you on that. 6 Q. You think you can make that determination that this 7 justifies making that determination simply based on the 8 presence of Metadata? 9 A. End of paragraph. To you that says you can conclude something has not been No, that does not justify the determination based solely 10 on the presence of Metadata. 11 Q. 12 Authentication," that is the SOP for your unit, correct? 13 A. Yes. 14 Q. And this was updated actually February or issued 15 February 25th, 2008, correct? 16 A. Correct. 17 Q. And that was after the previous Daubert hearing in this 18 case involving Mr. Musheno, right? 19 A. That is correct. 20 Q. And so the SOP for that has changed since Mr. Musheno's 21 testimony, correct? 22 A. 23 have to go and pull the file. 24 simply be the addition of references. 25 Q. And showing you FAVIAU HQ-16, entitled "Image Content I don't know to what extent it has changed. Okay. I would It may be simply -- there may And in this FAVIAU HQ-16 it essentially is a Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 139 of 150 139 1 comparison among images that I guess is the type of analysis 2 that Musheno did in this case? 3 A. 4 comparison, however I would point, I would direct the 5 Court's attention to page 2 of the SOP. The majority of this SOP refers to that type of 6 THE COURT: 7 MS. CONRAD: 8 MR. YOON: 9 copy. What exhibit number is this? It's not in. I don't know whether anybody else has a You have my only copy. 10 MS. CONRAD: 11 MR. YOON: 12 MS. CONRAD: 13 MS. GERSHENGORN: I have two copies. Okay. Any objection? Well, we definitely want it to 14 go in and remain under seal. 15 protective order that the Court entered. 16 Let me find it. THE COURT: This is subject to a No problem. 17 it is under seal. 18 hearing are under seal? 19 specifically designated. The record will reflect How many of these exhibits to this I don't know whether we 20 MR. YOON: I think quite a few of these. 21 THE COURT: Why don't we do this, we'll 22 presumptively seal them all and have you unseal as we talk 23 about it. 24 25 Go on. ( FAVIAU HQ-16 was marked and admitted into evidence as Exhibit No. 23.) Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 140 of 150 140 1 THE WITNESS: Page 2, Section 6.3 characterize 2 submitted images, see FAVIAU HQ-15, image characterization. 3 It is the policy in our laboratory, your Honor, that when we 4 use an SOP that subsumes other SOPs in it, as it does in 5 this case, it is only necessary to document the use of the 6 overriding SOP. 7 THE COURT: Okay. 8 Q. 9 based on an extraction of Metadata that an image is real? So, where in this SOP does it say that you can conclude 10 A. 11 whether the subjects are real or not. 12 Q. 13 manipulation within an image or to distinguish between 14 virtual and real images? 15 A. That is correct. 16 Q. And that's what you're trying to do in this case, 17 right? 18 A. Yes. 19 Q. And you didn't follow this SOP? 20 A. I'm sorry. 21 Q. You didn't follow this SOP? 22 A. That's a statement. 23 Q. Well, okay. 24 does it say that you can conclude that an image is an 25 unaltered image and the individual depicted is real based on The SOP does not specifically address the issue of So, well, the purpose in paragraph 1 is to detect Is that a question? Let me ask a question. Where in this SOP Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 141 of 150 141 1 the extraction of Metadata and/or thumbnails? 2 A. 3 other SOP. 4 Q. 5 followed by the FPI? 6 A. 7 explicit instruction in an SOP. 8 Q. 9 that you used in conducting your analysis? It does not specifically say that in this SOP or in any So your analysis is not based on any existing SOP No, the results, the conclusion is not dependent upon Well, in your notes you said that these are the SOPs 10 A. Yes, it is. 11 Q. Let me ask it a different way and then I think I'll drop 12 the subject. 13 A. 14 that says document actions taken and results in case notes. 15 The conclusion is a result of the actions that I have taken 16 and the conclusions that I draw from those actions. 17 Q. Now, your lab is accredited, is it not? 18 A. Yes, it is. 19 Q. It's accredited by what group or agency? 20 A. The American Society of Crime Laboratory Directors' 21 Laboratory Accreditation Board. 22 Q. 23 laboratory follow a written SOP? 24 A. Yes, it does. 25 Q. Does it require that that written SOP be subject to What part of this SOP did you follow? I followed the entire SOP down to the very last step And does that require that analyses done by your Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 142 of 150 142 1 validity testing? 2 A. Yes, it does. 3 Q. Has this been subject to validity testing? 4 A. Within our lab, it has, yes. 5 Q. HQ-16? 6 A. Yes, indeed. 7 Q. But no outside validation? 8 A. No separate outside validation of our SOP. 9 Q. And this proficiency testing you talked about on direct 10 examination, did that proficiency testing, did that relate 11 to the subject matter of your testimony here today? 12 A. No, it did not. 13 Q. And the procedure that you're following in your 14 testimony here was not subject to validity testing, 15 correct? 16 A. 17 information and getting the information out of the 18 thumbnails, making the observations that I used has been 19 validated through the use of the tools that I am using. 20 Q. But not for the purpose for which you're using them? 21 A. But not for the purpose of identifying these images as 22 unmanipulated, correct. 23 Q. 24 that you're drawing in your testimony? 25 A. The methodology that I used in extracting the And not for the purpose of validating any conclusion I would say that's probably correct, yes. Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 143 of 150 143 1 Q. 2 else? 3 A. Absolutely. 4 Q. And how was that review conducted? 5 A. That was conducted the same way our peer review process 6 in the laboratory, another examiner reviews the notes, 7 verifies that all the steps taken were accurate, were 8 appropriate, that the tools used were appropriate and that 9 the conclusions reached are valid. And was your analysis in this case reviewed by anyone 10 Q. 11 including your conclusions? 12 A. That is correct. 13 Q. So it's not a blind review? 14 A. Not in this case, no. That's based on actually seeing what you've done 15 MS. CONRAD: 16 THE COURT: May I have one moment, please? Yes. 17 Q. 18 I think I'm done. 19 called JP Snooper, JPEG Snooper? 20 A. I believe I've heard of it, yes. 21 Q. Have you ever used it? 22 A. No, I have not. 23 modification products that I found in my research that was 24 first made available around 2005 or 2006, I believe. 25 I just want to take one last look at my notes, and then Oh, are you familiar with the software THE COURT: I believe it was one of the JPEG What is it? Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 144 of 150 144 1 Q. 2 in this type of analysis? 3 A. 4 testified. 5 quantization tables. 6 THE COURT: 7 THE WITNESS: 8 MS. CONRAD: 9 MR. YOON: 10 THE COURT: Are you aware that it's a tool for extracting Metadata Yes, it allows you to analyze JPEGs, as I just I believe it also may allow you to modify the I'm not sure about that though. It was available as of what date? I believe no earlier than 2005. I have nothing further. A couple questions. With respect to this hearing, will we 11 finish with this witness and then reschedule for another 12 day? You have witnesses that you will be using, Ms. Conrad? 13 MS. CONRAD: No, if we're done with this witness, 14 we're done with the testimony. 15 THE COURT: 16 Okay. Go on. REDIRECT EXAMINATION 17 BY MR. YOON: 18 Q. 19 were asked on cross-examination about standard operating 20 procedures, SOPS. 21 A. 22 individual conducting an examination follows the same 23 practices during the course of an examination. 24 Q. Is it to find proper methodology? 25 A. Yes. Doctor, I want to ask you briefly some questions. What is the purpose of an SOP? The purpose of an SOP is to make sure that the You Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 145 of 150 145 1 Q. 2 you are to draw? 3 A. And does the SOP actually set forth specific conclusions No, it does not. 4 MS. GERSHENGORN: 5 THE COURT: Nothing else, your Honor. Thank you very much. Where do you 6 wish to go from here? 7 this on the papers, do you want to submit anything in 8 addition in the light of the testimony? 9 MS. CONRAD: The question, whether I should do Whatever your Honor prefers. I mean, 10 I certainly would at some point if Dr. Bruegge is going to 11 testify at trial, he's permitted to testify at trial, I'd 12 like to receive a transcript, but I think I can probably put 13 together a written submission without the transcript. 14 THE COURT: I don't think that one is necessary. 15 I think I can go by what I have heard today. 16 be marked, Maryellen, this is the exhibit to all 17 presumptively sealed. 18 number was 22, this is 23? 19 MS. CONRAD: This needs to This is the next number. That is right. The last 22 was his report. 20 didn't realize that when the file went in. 21 makes much difference since there was cross-examination 22 about it, but I certainly wouldn't want the report to 23 substitute for live testimony. 24 THE COURT: 25 No, I would not. I I don't know it He just testified from it, so I want to make sure that 23 is the SOP. All the Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 146 of 150 146 1 exhibits will be sealed until we hear otherwise from 2 counsel. 3 THE CLERK: Okay. 4 THE COURT: The witness is standing up. 5 THE WITNESS: I'm sorry, if you could issue an 6 order for the release of SOP-15, then I will see that a copy 7 is made available for defense. 8 made the -- 9 THE COURT: 10 MS. CONRAD: 11 12 13 The same manner that you Happy to do that. Can I just ask for all of the underlying SOPs that are referenced in FAVIAU HQ-16? THE COURT: Why don't you give me the form of the order, and I'll sign it. 14 THE WITNESS: 15 THE COURT: Is there a trial date scheduled? 16 THE CLERK: Yes. 17 MS. GERSHENGORN: Thank you, your Honor. I think we need to discuss the 18 trial date. 19 inclined to hear some sort of summary argument, or would it 20 be in lieu of that if we wanted to submit something? 21 One question we had, I'm sorry, is the Court THE COURT: Well I, think I understand the 22 arguments, you've argued about it such a long time not with 23 respect to this particular witness. 24 hear argument, I can do it on the papers. 25 leave it at this. I don't think I need to Why don't we It's been a very, very long day of a Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 147 of 150 147 1 number of long days. 2 If either side wishes to submit something, please do so by 3 January 5th, okay, otherwise I will go on the papers that I 4 have. 5 submission, but if you choose to, that would be the date I'd 6 want to see it. 7 I'd like to do without argument now. No one is under any obligation to file any additional MS. CONRAD: I think I would, your Honor, because 8 my submission was simply a request for this hearing. 9 didn't lay out the arguments against because, frankly, I I 10 didn't have a full understanding of what the underlying 11 theory was, so I will be submitting something. 12 that I be given, if necessary, I doubt that it will be, an 13 opportunity either to submit the additional FAVIAU HQs, the 14 SOPs, that is to the Court as supplemental exhibits, or, if 15 necessary, we call Dr. Bruegge. 16 able to avoid that given the difficulty of scheduling this 17 matter. 18 need arises once I get those materials. 19 I would ask That I hope we would be I want to be able to supplement the record if the THE COURT: You would move for leave to supplement 20 the record. 21 since this is a threshold in front of me, let me make a 22 decision about that, but both sides do simultaneous briefing 23 January 5th, if you choose. 24 25 I'm not sure how much supplementing I need, and MS. GERSHENGORN: scheduling issue. Okay. Thank you. Your Honor, I'm sorry, I have a We are set for trial February 23d. I Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 148 of 150 148 1 have a conflict with that date, and I was wondering if it 2 was convenient for the Court and the parties if it was 3 possible to move it 30 days to the 16th or the 23d of March 4 rather than February. 5 MS. CONRAD: 6 this came up before. 7 middle. 8 birthday. I'm only laughing because I think My kids' birthday is smack in the They hate it when I'm on trial during their 9 THE COURT: When is that? 10 MS. CONRAD: March 18th. 11 MS. GERSHENGORN: 12 THE COURT: 13 Perhaps if we start the 23d. How long do you anticipate? Three days of jury selection. 14 MS. GERSHENGORN: If we went right into it that we 15 would definitely finish the following week because I 16 think it would interfere with vacation plans. 17 MS. CONRAD: 18 MS. GERSHENGORN: 19 MS. CONRAD: 20 23 24 25 Then my travel plans, but I. -- Dr. Bruegge is indicating he may have something to say about this. 21 22 I'm not going anywhere. THE WITNESS: I have a passover that week and Easter. MS. GERSHENGORN: If we were done prior to that. I anticipate we would be done prior to that. THE COURT: This would be the week of the 23d? Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 149 of 150 149 1 MS. GERSHENGORN: 2 THE COURT: 3 pretrial March 11th conference. 4 MS. CONRAD: 5 Yes. The 23d then for Frabizio with a I don't have my '09 book so I'm going to have to object later if it's a problem. 6 THE COURT: If there's any excludable time, good 7 Lord, in this case. 8 attentive to the excludable time if something needs to be 9 filed. Ms. Gershengorn, I would hope you'd be 10 MS. GERSHENGORN: 11 THE COURT: 12 MS. GERSHENGORN: 13 THE COURT: Okay. 14 THE CLERK: All rise. 15 (Whereupon, the hearing was suspended at 3:34 16 17 18 19 20 21 22 23 24 25 p.m.) I will file. Okay. I will file something. Thank you very much. Case 1:03-cr-10283-NG Document 207 Filed 01/08/09 Page 150 of 150 150 1 C E R T I F I C A T E 2 3 UNITED STATES DISTRICT COURT ) 4 DISTRICT OF MASSACHUSETTS ) 5 CITY OF BOSTON ) 6 7 I, Valerie A. O'Hara, Registered Professional 8 Reporter, do hereby certify that the foregoing transcript 9 was recorded by me stenographically at the time and place 10 aforesaid in No. 03-10283-NG, in re: 11 Rudy Frabizio and thereafter by me reduced to typewriting 12 and is a true and accurate record of the proceedings. 13 United States vs. 14 /S/ VALERIE A. O'HARA _________________________ VALERIE A. O'HARA 15 REGISTERED PROFESSIONAL REPORTER 16 17 18 19 20 21 22 23 24 25