Court filing
TRANSCRIPT of Jury Trial Proceedings as to Carla Jackson, Teldrin Foster held on… — USA v. Thomas et al (Dkt. 1028)
Summary
An official certified transcript, Document 1028 filed 06/14/24, of jury trial proceedings, Volume 5 (PM Session), dated February 9, 2024, in United States of America v. Carla Jackson and Teldrin Foster, Docket No. 1:20-CR-00296-JPB, in the Northern District of Georgia, Atlanta Division, before the Honorable J.P. Boulee. The index lists James Berni on cross-examination (cont'd) and Jim Persinger on direct, cross and redirect examination. In the opening pages the Court revisits an issue about the Secret Service report and the Christian statements, saying it may have jumped the gun and withdrawing its earlier ruling that morning. It says the defense may try to lay the foundation about the effect on the listener.
Summary drafted by a model from the document's text below and checked by script against that text before publication. It is a navigation aid, not a reading of what the document proves. Where AI is used
Record facts
| Court | U.S. District Court for the Northern District of Georgia |
|---|---|
| Filed | 2024-06-14 |
Cite this document
“TRANSCRIPT of Jury Trial Proceedings as to Carla Jackson, Teldrin Foster held on… — USA v. Thomas et al (Dkt. 1028).”
U.S. District Court for the Northern District of Georgia, No. 1:20-cr-00296-JPB-CMS, Doc. 1028, filed 2024-06-14. Archived at Pandemic Darlings, https://pandemicdarlings.com/court-filings/full-docket-bern-benoit-gand-279866/2024-06-14-gov-uscourts-gand-279866-1028-0-doc-1028/
, SHA-256 707af05ef85c194c77dfbe8a59c66c25de7e975d29b89ca4898e00832daf9261.Full text
UNITED STATES DISTRICT COURT - OFFICIAL CERTIFIED TRANSCRIPT
THE FOLLOWING IS THE PDF OF AN OFFICIAL
TRANSCRIPT. OFFICIAL TRANSCRIPTS MAY ONLY BE FILED IN CM/ECF
BY THE OFFICIAL COURT REPORTER AND WILL BE RESTRICTED IN
CM/ECF FOR A PERIOD OF 90 DAYS. YOU MAY CITE TO A PORTION
OF THE ATTACHED TRANSCRIPT BY THE DOCKET ENTRY NUMBER,
REFERENCING PAGE AND LINE NUMBER, ONLY AFTER THE COURT
REPORTER HAS FILED THE OFFICIAL TRANSCRIPT; HOWEVER, YOU ARE
PROHIBITED FROM ATTACHING A FULL OR PARTIAL TRANSCRIPT TO ANY
DOCUMENT FILED WITH THE COURT.
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 1 of 145
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
UNITED STATES DISTRICT COURT - OFFICIAL CERTIFIED TRANSCRIPT
155
UNITED STATES DISTRICT COURT
FOR THE NORTHERN DISTRICT OF GEORGIA
ATLANTA DIVISION
UNITED STATES OF AMERICA,
)
)
)
-VS-
) DOCKET NO. 1:20-CR-00296-JPB
) VOLUME 5 (PM SESSION)
CARLA JACKSON AND
)
TELDRIN FOSTER,
)
)
DEFENDANTS.
)
TRANSCRIPT OF JURY TRIAL PROCEEDINGS
BEFORE THE HONORABLE J.P. BOULEE
UNITED STATES DISTRICT JUDGE
FEBRUARY 9, 2024
APPEARANCES:
ON BEHALF OF THE GOVERNMENT:
TAL C. CHAIKEN, ESQ.
SAMIR KAUSHAL, ESQ.
BABASIJIBOMI MOORE, ESQ.
ASSISTANT UNITED STATES ATTORNEYS
ON BEHALF OF THE DEFENDANT - TELDRIN FOSTER:
LEIGH ANN WEBSTER, ESQ.
SARALIENE DURRETT, ESQ.
ON BEHALF OF THE DEFENDANT - CARLA JACKSON:
DAVID D. MARSHALL, ESQ.
STENOGRAPHICALLY RECORDED BY:
PENNY PRITTY COUDRIET, RMR, CRR
OFFICIAL COURT REPORTER
UNITED STATES DISTRICT COURT
ATLANTA, GEORGIA
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 2 of 145
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
UNITED STATES DISTRICT COURT - OFFICIAL CERTIFIED TRANSCRIPT
156
I N D E X
WITNESS:
PAGE:
1. JAMES BERNI
CROSS-EXAMINATION (CONT'D).................170
2. JIM PERSINGER
DIRECT EXAMINATION.........................177
CROSS-EXAMINATION..........................217
REDIRECT EXAMINATION.......................254
- - - - -
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 3 of 145
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
UNITED STATES DISTRICT COURT - OFFICIAL CERTIFIED TRANSCRIPT
157
(PROCEEDINGS HELD IN OPEN COURT AT 1:44 PM, ATLANTA, GEORGIA)
THE COURT: Let me have Special Agent Stites step out
of the courtroom, please.
(Witness excused from the courtroom.)
THE COURT: All right. I know there's an issue with
the current witness. Ms. Lee sent an e-mail. I guess y'all
communicated something to her, which we can address.
But before I get to that, I want to circle back to
the issue from last night and into this morning regarding the
Secret Service report and the Christian statements, because I
think I may have jumped the gun a little bit and assumed
something that wasn't established in my ruling this morning.
But where I was last night was, you know, we've got the two
layers of hearsay. And the one, I understand, not offered for
the truth, that wasn't the contentious issue. The contentious
part was the other layer and whether it qualified for effect
on the listener.
And where I was last night was, I'm happy to see if
you can lay the foundation about the effect on the listener.
And I think that's right and where I should continue to be for
now, until that's either been laid or not laid.
What I did this morning was when the issue came back
up, was -- I think I had heard Ms. Chaiken talk about that
investigation being completely separate. And I think I
assumed from that that this was then something that Special
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 4 of 145
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
UNITED STATES DISTRICT COURT - OFFICIAL CERTIFIED TRANSCRIPT
158
Agent Stites would have reviewed just in preparation for trial
and not as part of his investigation.
And I don't know if that's the case or not. I think
there's been some inconsistencies on that. And I'm just not
sure when he would have looked at it and what he would have
done or not done after he looked at it.
So I'm going to withdraw -- and so basically, I
was -- where I was was I thought the relevance was slim to
none if it was a completely separate investigation that wasn't
part of his and not something he considered, and, therefore, I
thought the 403(b) analysis was pretty clearly going to keep
this out because it's just confusing otherwise.
But I think I was in error to say that because I
don't know what use he made of it, when he made that use of it
and what effect, if any, him reading this had on his
investigation.
So I withdraw my ruling on that. And I'm happy to
have the defense see if they can lay that foundation. I just
don't know if they'll be able to or not.
I also did look at the Kyle v. Whitley case that the
defense cited and it seems like, you know, generally that line
of questioning can be fair game.
So we'll see if the foundation can be laid or not.
And it may be that you can, may be that you can't. I don't
know. So that's issue 1.
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 5 of 145
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
UNITED STATES DISTRICT COURT - OFFICIAL CERTIFIED TRANSCRIPT
159
Issue 2, I understand from just a short e-mail from
Ms. Lee that something arose over the lunch hour regarding the
current expert witness of the government. Is that something
we can discuss with him on the stand or do we need to ask him
to step out?
MS. DURRETT: Can we ask him to step out, Your Honor?
THE COURT: All right. Sir, if you could please step
out of the courtroom as well.
And on your way out, would you -- if you see Special
Agent Stites out there, will you let him know he's welcome to
come back in?
THE WITNESS: Yes, Your Honor.
(Witness excused from the courtroom.)
THE COURT: Okay. What's the new issue?
MS. DURRETT: Your Honor, before the break we were
questioning Agent Berni about his report, and I think the
Court could probably tell, we were leading up to and trying to
get information about how there was different information in
his report than there is in the records that we have. And we
took a break for an hour.
When we came back into the courtroom, the government
provided us a certification of records that they just got over
the break to support a claim that somehow the timing in the
report is correct. And then they also sent us another report,
an Excel spreadsheet, that the agent relied on when he made
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 6 of 145
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
UNITED STATES DISTRICT COURT - OFFICIAL CERTIFIED TRANSCRIPT
160
his report.
So that wasn't detailed in the report that he
provided and it was not told to me when I talked to him
earlier this week on the phone. Your Honor had ordered that I
be able to speak with him and he did speak with me, but no one
told me that he had been provided an Excel spreadsheet that
was created by a forensic examiner.
And so, Your Honor, we would move for a mistrial at
this point. We're halfway through cross-examination, and they
have provided two new pieces of evidence related to this
witness to contradict the testimony that he's already
provided.
THE COURT: Well, let's do this. Let me interrupt
you.
I guess, first off, can I see these two new
documents? I don't know if we're talking about an
encyclopedia or something else.
MS. DURRETT: One was e-mailed to us. I don't have a
copy.
Leigh Ann's going to forward that to Ms. Lee.
THE COURT: I'm sorry, one moment.
MR. MARSHALL: And, Judge, am I being copied on these
e-mails? On that last one?
THE COURT: I have no idea. I'm not copied on them
either. Let's make sure you --
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 7 of 145
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
UNITED STATES DISTRICT COURT - OFFICIAL CERTIFIED TRANSCRIPT
161
MR. MARSHALL: Sorry, Judge. Well, I shouldn't ask
you. Sorry, Your Honor.
Thank you. Thank you very much.
COURTROOM DEPUTY CLERK: Someone send it to me and
I'll send it to the judge.
THE COURT: All right. Well, let's -- I guess this
first document I'm looking at, just so the record's clear, I
guess the government handed it to me, so -- well, let's just
make this Court's Exhibit whatever we're on, Ms. Lee.
COURTROOM DEPUTY CLERK: 3.
THE COURT: Okay. Court's Exhibit 3 is the
certificate of authenticity of business records.
And then the second document is what?
MS. WEBSTER: It's an Excel spreadsheet that we
forwarded to Ms. Lee. Sorry.
MS. DURRETT: It came to us in an e-mail, so we just
forwarded it to Ms. Lee.
THE COURT: Okay. Give me a moment. Give her and me
a moment.
While that's going through cyberspace, hitting a -- I
don't know if it'll hit a cell tower before it gets to me or
not, how that works.
But while that's making its way to me, let me hear
from the government as to these two documents. I mean, the
one just looks like a certificate of authenticity of business
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 8 of 145
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
UNITED STATES DISTRICT COURT - OFFICIAL CERTIFIED TRANSCRIPT
162
records, which I -- you know, we'll see what the government
says and I'll see what Ms. Durrett says, but it wouldn't seem
like that'd be cataclysmic, but go ahead.
MR. MOORE: Your Honor, just to make sure that the
record is clear, they have had all of the records related to
his testimony since 2020, 2021. In any case, for more than
two years.
What we have provided them is the work product of an
analyst who took the data that they had been provided and
changed the time zone based off of the fact that it was in
Central Time Zone and we are not in Central Time Zone, we are
in Eastern Time Zone, to make it relevant for the jury.
And that is what was provided to the expert and that
is what he created his report from. All of the underlying
data had been disclosed to them in the large Excel sheet that
included all of Teldrin Foster's transactions with the rapid!
PayCards and additionally all of the other transactions with
the rapid! PayCard.
THE COURT: Okay. So the certificate of authenticity
is just the certificate as to the underlying spreadsheet?
MR. MOORE: So they received the initial certificate
of authenticity for the underlying spreadsheet. We -- because
they have this confusion about the time zone, over the break
we then asked for an updated certificate of authenticity that
just explains the time zone issue. There's only that -- the
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 9 of 145
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
UNITED STATES DISTRICT COURT - OFFICIAL CERTIFIED TRANSCRIPT
163
slight additional line in number 1 saying what the time zone
is.
But the original certificate of authenticity which
they provided with the original records has been provided to
them before today. So the only new information in the
certificate they provided today is it now notes that their
records are in the Central Time Zone.
THE COURT: All right. And so this spreadsheet that
we'll mark, that we'll -- is this a spreadsheet that's small
enough to print out and make a court's exhibit just so it's
clear what's what? I don't want to say we're going to print
out the spreadsheet and mark it as a court's exhibit if it
somehow is a 35,000-page document.
MS. CHAIKEN: No. I don't know if it'll fit on one
page, but it will be small enough.
THE COURT: Okay. All right. Well, I'll tell you
what. Let me impose on the government a request that their
paralegal print a hardcopy of this to get to Ms. Lee to make
it Court's Exhibit 4. Thank you.
I know spreadsheets are sometimes easier or difficult
to print out.
All right. So, Mr. Moore, if I understand it, this
is two things: One is it's the spreadsheet that converts
Central to Eastern; and, two, it's a certificate of
authenticity that says this is a document in which we
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 10 of 145
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
UNITED STATES DISTRICT COURT - OFFICIAL CERTIFIED TRANSCRIPT
164
converted from --
MR. MOORE: So the certificate of authenticity -- the
update is just to say that the records we originally received
were in Central Time Zone to help explain why an analyst
needed to update it to Eastern.
THE COURT: All right. And what do you think about
Ms. Durrett's request for a mistrial because you gave her
these over the lunch hour?
MR. MOORE: Your Honor, we oppose it. She has had
all of the underlying data, the data that the expert relied
on. And all that has -- is different now is that we have
updated their confusion on the time zone. And she has
cross-examined him on it, that would be the appropriate way
for that issue to be addressed. She talked to him for an
hour. This was not one of the questions she asked. If we had
understood she had this confusion, we would have been happy to
have taken this step before, but she raised this confusion for
the first time during the cross-examination today.
THE COURT: All right. Ms. Durrett?
MS. DURRETT: Your Honor, it's not confusion. It's
the fact that all of the records we have had have had one time
in them. And we have asked about the records last night. I,
again, e-mailed and said what is the basis for this summary
chart of the rapid! Pay records. And they told us the
spreadsheet and I looked at that spreadsheet.
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 11 of 145
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
UNITED STATES DISTRICT COURT - OFFICIAL CERTIFIED TRANSCRIPT
165
It has certain times in it. We've never had anything
until today about 5, 10, 15 minutes ago, something that says,
oh, wait, this is actually Central Time.
THE COURT: Okay. But -- I would take from the
context of your cross-examination from this morning that you
knew full well there was an issue there and that's why you
were cross-examining him about the times.
MS. DURRETT: That's correct.
THE COURT: So what's the big deal?
MS. DURRETT: Because now we have -- we look like we
don't understand the records, but they --
THE COURT: Okay. Well, that's fine. We can do a
quick -- I'll make a quick statement to the jury that explains
the issue. This is not a -- I can't imagine -- I mean, do you
really want a mistrial over that issue?
MS. DURRETT: I do, Your Honor.
THE COURT: Okay. Well, that's denied. That's -- I
can't even imagine giving a mistrial over this fairly simple
issue.
I mean, as I see it, you know, everyone's had the
documents for a long time. You recognized full well in your
review of the documents they were off by a couple hours or an
hour. You made fodder of it during the start of your
cross-examination. Over the lunch hour the government
realized, yeah, that's right. And so they sent you -- you
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 12 of 145
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
UNITED STATES DISTRICT COURT - OFFICIAL CERTIFIED TRANSCRIPT
166
know, I think in good faith, sent you -- you know, looked into
it and sent you something that explains that. And it sounds
like it confirms what you already knew. And so I think a
brief statement to the jury about what happened is more than
adequate.
MS. DURRETT: Your Honor?
THE COURT: Yes, Ms. Durrett.
MS. DURRETT: If the Court is not going to grant a
mistrial, we would ask that his testimony be excluded. We
have already asked to exclude his testimony because it was
provided to us in an untimely manner. There wasn't a full
conclusion in it. The conclusion doesn't say anything about
this time. And it was yesterday while I was here in court
looking at the records that I realized there was a time
problem. And so it's not --
THE COURT: Did you ask the government if they
realized there was a time problem and if they had additional
records?
MS. DURRETT: Your Honor, with all due respect, I
don't think that's how we normally do it. If someone has --
THE COURT: I was just asking, you know, if it's --
I'm just -- I just don't see how this is a substantial issue.
If you knew full well it was off by an hour, it seems like a
simple, minor issue.
I'm not going to grant a mistrial. It would seem
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 13 of 145
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
UNITED STATES DISTRICT COURT - OFFICIAL CERTIFIED TRANSCRIPT
167
like -- you know, I, frankly, don't even know that I need to
give a statement to the jury about it, it's such a minor
issue. But I'd be happy -- if you think there is some
prejudice given that you cross-examined on it and now you've
been given the document, I kind of see that and I'd be happy
to give a statement to the jury that there was an issue with
the time zones on the documents and an additional document
clarifying the time zones was provided by the government over
the break. But anything more than that, I think is way out of
line.
MS. DURRETT: Your Honor, I also think there's an
issue because they gave --
THE COURT: So I'm going to deny your motion to
strike his testimony. I'm going to deny your motion for
mistrial.
Anything else on this issue?
MS. DURRETT: Well, Your Honor, I do.
The problem is they gave us a spreadsheet just before
you came in, I notified your clerk when we got it, that we
haven't been able to look it. And so they said, here, oh,
this is what he actually looked at, this is the thing he
actually looked at. And we haven't had time to look at it.
So it's brand-new evidence to us.
THE COURT: Brand-new evidence that has one
difference from the old evidence you had, which is that
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 14 of 145
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
UNITED STATES DISTRICT COURT - OFFICIAL CERTIFIED TRANSCRIPT
168
everything's off by an hour?
MS. DURRETT: I don't know, Your Honor. I haven't
had --
THE COURT: Well, that's what the government's
represented.
Is that what it is, Mr. Moore?
MR. MOORE: That is correct, Your Honor. And it has
the times with the -- the one hour different and it lists the
address of all the locations.
THE COURT: All right. Take the time you need,
Ms. Durrett, and we'll stand by. We stand adjourned.
(After a recess at 2:09 p.m., the proceedings
continued at 2:31 p.m. as follows:)
THE COURT: Y'all can be seated. Thank you.
MR. KAUSHAL: Your Honor, just to complete the record
on that last issue Your Honor discussed, I just wanted to
clarify that the information that was requested last night by
the defense was the underlying records for summary chart 3015,
and it was not the information that the agent relied on for
preparation of the report. And I just wanted to make that
clear because I think it was a little bit unclear earlier and
I want the record to reflect that.
THE COURT: Okay. I guess -- let's do clear that up.
I mean, I think either way, you know, based on what the
difference was, it seems, again, very, very minor and the
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 15 of 145
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
UNITED STATES DISTRICT COURT - OFFICIAL CERTIFIED TRANSCRIPT
169
record will reflect we were at a recess for, what, 15,
20 minutes and that Ms. -- and it's 2:31, and I was told
Ms. Durrett was ready to go back on the record.
So I thought it was something that came up over the
lunch hour that you'd sent them based on the cross, but it was
instead based on a request from last night or something?
MR. KAUSHAL: No, Your Honor. They were different
requests. I just wanted to make that clear, that the requests
were, in fact, different and that this new issue came up today
and we provided records that we normally would not provide in
response to their request for the underlying information from
the expert. That is all.
THE COURT: All right.
Ms. Durrett, did you want me to say anything to the
jury when they come back before you started your cross?
MS. DURRETT: No, Your Honor. Thank you.
THE COURT: All right. I would be happy to if so,
but it sounds like you don't want me to.
Let's bring in the jury, please.
And, Ms. Durrett, just so I am clear, you've now had
time to look at those documents; correct?
MS. DURRETT: I have, Your Honor. Thank you.
THE COURT: All right. Very well.
(Witness recalled to the witness stand.)
MR. KAUSHAL: Do you just want to tender it,
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 16 of 145
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
UNITED STATES DISTRICT COURT - OFFICIAL CERTIFIED TRANSCRIPT
170
Saraliene?
MS. DURRETT: Sure.
MR. KAUSHAL: He hasn't seen it, so --
MS. DURRETT: Okay.
(The jury entered the courtroom at 2:34 p.m.)
THE COURT: Y'all can be seated. Thank you.
Ladies and gentlemen of the jury, I know that was a
much longer lunch break than you'd expected when I released
you at about 12:30 or so. My apologies for that. Again,
things arise that I need to deal with and I don't always know
when that's going to happen. So I apologize. Thank you for
being here.
Ms. Durrett, you can continue your cross.
MS. DURRETT: Thank you, Your Honor.
CROSS-EXAMINATION (CONT'D)
BY MS. DURRETT:
Q.
Over the break we were provided with what has been marked
as Court's Exhibit 4. Do you recognize that document?
A.
I recognize the document as the original financial, I
guess, exhibit that was turned in, yes.
Q.
I'm sorry. It's not Court's Exhibit 4. Sorry about
that.
But do you recognize that document?
A.
I do recognize the document, yes.
MS. DURRETT: I move to admit Defense Exhibit 1003.
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 17 of 145
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
UNITED STATES DISTRICT COURT - OFFICIAL CERTIFIED TRANSCRIPT
171
MR. MOORE: Can we see what document?
MS. DURRETT: It's the spreadsheet.
(Organizational pause.)
BY MS. DURRETT:
Q.
I'm going to show you Exhibit 2954. And that's already
been admitted.
MS. DURRETT: Please show it.
BY MS. DURRETT:
Q.
Okay. We have been told that this is the data that you
relied on when you wrote your report, the part about Teldrin
Foster; is that correct?
A.
Well, this is -- this appears to be the -- I guess the
original spreadsheet that was turned over in discovery, yes.
Q.
Okay. And all I want to do is have you focus on a few of
the transactions in this exhibit, which has been admitted,
2954.
I want you to start by looking at July 17th, 2020. And
there should be an entry for 2:39:55. July 19th, sorry.
If I were to change 2:39:55 to military time, what would
that be?
A.
14:39:55.
Q.
Okay. And is that what is reflected there in that
spreadsheet?
A.
Well, it's reflected in non-military, but it says -- oh,
there it is. Yep. It says on there 14:39:55. Yep.
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 18 of 145
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
UNITED STATES DISTRICT COURT - OFFICIAL CERTIFIED TRANSCRIPT
172
Q.
Okay. And then I'm going to show you your report,
page 19. And do you see the rapid! card transaction that you
included in your report?
A.
I do, yeah.
Q.
And what is the time that you included there?
A.
It says 3:39:55 p.m.
Q.
So your report says the rapid! card transaction happened
at 3:39 p.m.; correct?
A.
Correct. In Eastern Time.
Q.
Right. But that's not what's reflected in this
spreadsheet that I'm showing you; correct?
A.
I guess not, no.
Q.
All right. I'm going to show you your report, page 21,
which talks about a transaction from July 20th, 2020, at
11:52.
And what time do you have listed for that transaction,
that rapid! pay transaction?
A.
11:52:43 a.m. on the 20th.
Q.
Okay. And when you look at the spreadsheet that is on
the screen, what is the time that is reflected for that entry
on July 20th, 2020?
A.
It says 10:52:43.
Q.
So there's an hour difference?
A.
There is.
Q.
I'm going to show you your report at page 30. And your
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 19 of 145
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
UNITED STATES DISTRICT COURT - OFFICIAL CERTIFIED TRANSCRIPT
173
report there reflects a transaction on July 31st, 2020,
correct, on your report?
A.
It does.
Q.
What time did that rapid! pay transaction occur based on
your report?
A.
11:43:06 a.m.
Q.
And when you look at the spreadsheet of the rapid! pay
transactions on the screen, what time is reflected there for
that transaction?
A.
10:43:06.
MS. DURRETT: Your Honor, I'm going to move to admit
Defendant's Exhibit 1001, pursuant to Rule 902.11.
MR. MOORE: Can I see what the exhibit is? It's a
new one?
MS. DURRETT: Yes.
MR. MOORE: All right. No objection, Your Honor.
THE COURT: Mr. Marshall?
MR. MARSHALL: No objection.
THE COURT: It's admitted.
MS. DURRETT: Thank you, Your Honor.
BY MS. DURRETT:
Q.
Mr. Berni, I'm going to show you this exhibit now. Do
you know what this exhibit is?
A.
I mean, this is my first time seeing it. I can see that
it's a certificate of authenticity of business records.
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 20 of 145
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
UNITED STATES DISTRICT COURT - OFFICIAL CERTIFIED TRANSCRIPT
174
Q.
And can you tell me when it was issued?
A.
Let's see. It looks like -- it says date of execution
would be February 9th of 2024.
Q.
Is that today?
A.
It is.
Q.
And do you see in that certificate anything about the --
well, first of all, tell me what the certificate is about,
what kind of records.
A.
These appear to be Green Dot Bank records.
Q.
Is that the certificate for the rapid! pay transactions
in this case?
A.
I'm not 100 percent sure. Again, I'm here to testify
about the cellphone records. These appear to be financial
records. So I can't say for sure that they are. I don't
know.
Q.
Did your report include information about rapid! pay
records?
A.
It included date, times and locations of transactions,
yes.
Q.
And in the certificate that you have there, what does it
say about the time zone that those records are issued in?
A.
Give me a second to read it.
Q.
Sure.
A.
It states in here that they're in Central Standard Time
Zone.
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 21 of 145
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
UNITED STATES DISTRICT COURT - OFFICIAL CERTIFIED TRANSCRIPT
175
MS. DURRETT: Thank you. I have no further
questions, Your Honor.
MR. MOORE: Very briefly, Your Honor.
THE COURT: Let me just check with Mr. Marshall.
MR. MARSHALL: No questions, Your Honor.
THE COURT: Go ahead, Mr. Moore.
REDIRECT EXAMINATION
BY MR. MOORE:
Q.
And Central Time Zone, is that one hour different than
Eastern Time Zone?
A.
It is.
Q.
And we're currently in Eastern Time Zone?
A.
We are.
Q.
So to make the time zones relevant for the jury, you
would need to adjust it one hour; is that accurate?
A.
You would need to add an hour, correct.
Q.
You were shown -- you were asked about rush hour traffic
in Atlanta. Do you know if during 2020 there was a global
pandemic that affected traffic patterns?
A.
There was.
Q.
Do you have any idea, based on your personal knowledge,
if traffic was maybe diminished during this global pandemic?
A.
I didn't come to Atlanta very often, but in my area the
traffic was less.
Q.
How long have you worked on cell site data?
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 22 of 145
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
UNITED STATES DISTRICT COURT - OFFICIAL CERTIFIED TRANSCRIPT
176
A.
Well, for the bureau, since 2015. And then, again, in
the military, 2000 to 2007.
Q.
And this is the work that you do to not just testify here
but also find fugitives and missing persons?
A.
That's correct.
Q.
And the bureau relies on you to do that analysis in these
high-stakes areas?
A.
It does. Every day.
Q.
Is the analysis that you've done today for this jury
accurate?
A.
It is.
MR. MOORE: Thank you.
Nothing further, Your Honor.
THE COURT: Any recross?
MS. DURRETT: No, Your Honor.
THE COURT: Mr. Marshall?
MR. MARSHALL: No, Your Honor.
THE COURT: All right. Sir, you can step down.
Thank you.
THE WITNESS: Thank you, Your Honor.
(Witness excused.)
THE COURT: Please call your -- actually, I think at
this point are we going to hear from one of Mr. Foster's
witnesses?
MS. WEBSTER: Yes, Your Honor.
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 23 of 145
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
UNITED STATES DISTRICT COURT - OFFICIAL CERTIFIED TRANSCRIPT
177
THE COURT: Okay. Please call that witness.
MS. WEBSTER: Mr. Foster calls Jim Persinger to the
stand.
THE COURT: All right. Thank you.
Good afternoon, sir.
THE WITNESS: Good afternoon to you.
COURTROOM DEPUTY CLERK: Please raise your right
hand.
_____________________________
JIM PERSINGER
a witness herein, being first duly sworn,
was examined and testified as follows:
____________________________
COURTROOM DEPUTY CLERK: Would you please state and
spell your name for the record.
THE WITNESS: Jim Persinger, P-E-R-S-I-N-G-E-R.
DIRECT EXAMINATION
BY MS. WEBSTER:
Q.
Good afternoon, Mr. Persinger.
A.
Good afternoon.
Q.
Can you tell the Court what your occupation is?
A.
I'm a digital forensics cybercrime and cellphone
analysis. I also write software for law enforcement.
Q.
And where do you work?
A.
PM Investigations, Inc.
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 24 of 145
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
UNITED STATES DISTRICT COURT - OFFICIAL CERTIFIED TRANSCRIPT
178
Q.
Did you start that company?
A.
I'm sorry?
Q.
Did you start that company?
A.
I did.
Q.
And how long ago did you do that?
A.
Late 2000, incorporated 2001.
Q.
Are you the owner of that company?
A.
I am.
Q.
Can you tell us roughly how many cases as a digital
forensic specialist you've been involved with?
A.
About 3500.
Q.
And are those civil, criminal or both?
A.
Both.
Q.
And have you conducted any investigations of cellphones
as part of your cases?
A.
I have.
Q.
And about how many cases involving cellphones?
A.
About 650 to 700.
Q.
And Mr. Foster and I retained you to work on this case;
is that correct?
A.
That's correct.
Q.
And I'm a defense attorney; is that right?
A.
Yes.
Q.
And are there times when you also work for the
prosecution?
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 25 of 145
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
UNITED STATES DISTRICT COURT - OFFICIAL CERTIFIED TRANSCRIPT
179
A.
That's correct.
Q.
So you've been on both sides of cases?
A.
That's correct.
Q.
Can you briefly tell us what sort of cases you've been
involved in?
A.
Everything from murder, child pornography, intellectual
property theft, hacking, any kind of will contesting. I used
to do divorce cases. Just about anything that involves data.
Q.
Can you tell us about some of your work experience prior
to PM Investigations?
A.
I'm a retired Cobb County police officer. Prior to that,
I started a software company called JB Enterprises that's
still around today. And before that, I was doing research and
development for some major corporations.
Q.
Do you have any kind of professional licensing or board
membership in your field?
A.
I'm a licensed private investigator, a licensed private
investigator instructor. I'm POST certified, which is a
police officer standard training instructor for law
enforcement.
Q.
Can you give us sort of a short summary of your education
and training?
A.
So I've got high school, some college. I've been to a
number of different software vendors that deal with how to
create software, using their software. I've also been to
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 26 of 145
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
UNITED STATES DISTRICT COURT - OFFICIAL CERTIFIED TRANSCRIPT
180
training of hardware devices, such as routers, switches,
servers and the configurations between the software and
hardware.
Q.
And are you a digital forensic and cellphone examiner
instructor?
A.
I am.
Q.
Can you describe that for us?
A.
So not only do I create software for law enforcement, but
I take the tools that are out there and teach law enforcement
how to analyze data. Data, even though it's changed, is still
ones and zeros, but we come across pieces of evidence that we
need to analyze, and I help law enforcement understand that.
Q.
So have you taught law enforcement in forensics?
A.
Yes.
Q.
And who have you taught?
A.
FBI, GBI, Secret Service, Homeland Security, several
different sheriff's departments, police departments throughout
the United States.
Q.
And have you assisted in research and writing documents
in your field?
A.
I have.
Q.
Can you describe that?
A.
So I've worked closely with Dr. Jim Tanner out of
Boulder, Colorado, to help him come up with a process to
track and maintain, dealing with child pornographers, to give
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 27 of 145
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
UNITED STATES DISTRICT COURT - OFFICIAL CERTIFIED TRANSCRIPT
181
probation tools that they can monitor the individual's
Internet traffic or computer usage.
Q.
And have you produced any content or done software
development in your field?
A.
I have.
Q.
Can you describe that?
A.
First, there's CATIE, which stands for Capture and Track
Investigative Evidence, available to only law enforcement,
that allows them to look at the Internet, find pieces of
artifacts, collect it in a safe and pure forensic manner.
There's ICIE, which is In Case of Internet Emergency.
It's patented, the first 911 button that allows a child to
push if they feel depressed or threatened, either at home or
at school, collecting information to notify those of the
authority.
There's Iron Shield, which is patented. It is a firewall
protection that offers something totally unique on how it
handles data.
And then there's Field Search. I have 32,000 users
worldwide, that includes our military, the Canadian border
police, just about every state has at least one examiner that
allows the investigator to quickly analyze a system.
Q.
And have you been qualified as an expert witness before?
A.
I have.
Q.
Can you tell us about where?
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 28 of 145
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
UNITED STATES DISTRICT COURT - OFFICIAL CERTIFIED TRANSCRIPT
182
A.
Not only here in the Northern District, middle Georgia,
all the way up to Ohio, New York, California. Several
different states in the middle, as well as superior courts,
Cobb County, Fulton County, Gwinnett County, Clayton County,
down to Gwinnett -- or I'm sorry -- down in Glynn County and
several other states that are superior court and state courts.
Q.
And have you ever not been qualified as an expert
witness?
A.
I have never been not qualified.
Q.
Okay.
MS. WEBSTER: So at this point I would move to
qualify Mr. Persinger as a digital forensic cybercrime and
cellular data expert.
MS. CHAIKEN: No objection, Your Honor.
MR. MARSHALL: No objection.
THE COURT: So admitted.
BY MS. WEBSTER:
Q.
I'm going to give you a binder. Can you look at the
binder that's actually already in front of you and turn to
F23A.
A.
Okay. I'm there.
Q.
And can you tell me what that is?
A.
Yeah, it's a copy of my resume.
Q.
And is that a copy that you've provided to me?
A.
It is.
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 29 of 145
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
UNITED STATES DISTRICT COURT - OFFICIAL CERTIFIED TRANSCRIPT
183
MS. WEBSTER: Your Honor, I move to admit that as
Defendant's Exhibit F23A.
MS. CHAIKEN: No objection.
MR. MARSHALL: No objection.
THE COURT: It's admitted.
MS. WEBSTER: Thank you.
BY MS. WEBSTER:
Q.
In this case did we ask you to look at some devices that
we were provided in discovery?
A.
You did.
Q.
What were those devices?
A.
Well, they consisted of three different types. There was
what's called a forensic image of a computer that could
include a laptop or a desktop. There was cellphone datas that
were coming from a cellphone that were imaged. And then there
were SIM cards. The SIM is actually what makes the phone talk
to a tower.
Q.
And did I provide all of those to you on a hard drive?
A.
You did.
Q.
Okay. For the laptop, the forensic image, is it -- is
that something that a normal person, a layperson, someone
without your expertise, can look at and review?
A.
No.
Q.
What did you have to do in order to be able to review it?
A.
So when a forensic image is made, if you would consider a
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 30 of 145
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
UNITED STATES DISTRICT COURT - OFFICIAL CERTIFIED TRANSCRIPT
184
record, a 33 album record, the needle starts at the outer edge
and works its way to the middle as you're listening to the
songs.
Well, the forensic imaging process is really no
different. It starts from the outer edge of the hard drive
internally and it records that information into files that
then can be reassembled that allows you to analyze the data.
Now, at the conclusion of that image, there's a process
called hashing. Hashing is the verification process that says
the original hard drive matches the forensic image. Now, you
have to understand how you can first mount those images and
then use forensic software to analyze those forensic images.
Q.
Is that what you did in this case?
A.
That is.
Q.
And after reviewing the devices that you were provided,
did you determine how many had relevant information on them?
A.
I did.
Q.
And how many had relevant information?
A.
There was one out of all of them.
Q.
And was one device encrypted via BitLocker?
A.
That's correct.
Q.
So you couldn't get into that one; is that right?
A.
That's correct. BitLocker today is difficult to get
around. If the device is password protected, generally as
forensic specialists we can get around that. But BitLocker is
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 31 of 145
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
UNITED STATES DISTRICT COURT - OFFICIAL CERTIFIED TRANSCRIPT
185
a form of encryption that prevents access to it. So without
the key, you can't get into it.
Q.
And do you remember which device that was?
A.
Number 8.
Q.
So did you write a report in this case?
A.
I did.
Q.
And did you prepare exhibits with that report?
A.
I did.
Q.
Can you look in the binder in front of you and look at
Exhibits F23B through T.
A.
Okay.
Q.
And are those the exhibits that you prepared to go along
with the report?
A.
They are.
Q.
Would it help the jury to be able to see these exhibits
while you're testifying?
A.
It would.
MS. WEBSTER: Your Honor, I'd move to admit Exhibits
F23B through F23T.
MS. CHAIKEN: No objection.
MR. MARSHALL: No objection, Judge.
THE COURT: So admitted.
MS. WEBSTER: Okay.
BY MS. WEBSTER:
Q.
So you were talking about the hashing process. Is that
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 32 of 145
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
UNITED STATES DISTRICT COURT - OFFICIAL CERTIFIED TRANSCRIPT
186
the first thing you did in this case or --
A.
I don't actually do a hash, I do a rehash. You see, when
the government does a forensic image, they first hash it. And
like I said earlier, they get a verification. So they provide
this hash value to me, I can then take that digital media,
that forensic image, rehash it and they should match. So my
hash value would match their hash value. That's the first
thing to do. And in this case, I did that and they equaled.
Q.
Okay. And I have on the Elmo what has been marked and
admitted as F23B. Is that your exhibit showing that?
A.
Yes, it is.
Q.
And what is -- does this just tell you that the
forensic -- the image that you have is correct, is a match?
A.
That's correct.
Q.
Then what did I ask you to do in this case?
A.
Well, you gave me some search terms that were basically
including an e-mail address and wanted to see if across these
devices I could find that e-mail address.
Q.
And what was the -- what were the e-mail addresses that I
asked you to look for?
A.
It had to do with Tedlin (phonetic/sic) Foster at Yahoo
and then another one was Tedlin 23 at iCloud.
Q.
Okay. And so what was the first thing that you learned
about the device?
A.
Well, outside that they were Windows computers and that
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 33 of 145
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
UNITED STATES DISTRICT COURT - OFFICIAL CERTIFIED TRANSCRIPT
187
when I put in the search terms, I got returns.
Q.
And so as to the teldrin_foster@yahoo.com, what did you
find?
A.
I received a positive hit. And I could see that somebody
had accessed that e-mail address off of one of the forensic
images that I was provided.
Q.
And what could you tell about the use of that e-mail
address?
A.
Well, the person obviously had to have the username and
password. And I could see over a period of time that some of
the e-mails were actually being opened, they were being read.
Q.
And so were you seeing more than just the fact that
someone was logged in, or were you seeing that someone was
actually using it?
A.
Somebody was actually using it. And the way you can tell
is there's a number count as to how many that are unread and
then they change to how many are actually unread. So you know
somebody is actually opening the e-mails.
Q.
Were you able to make any determinations about whose
laptop it appeared to be?
A.
From the information that was provided to me, it was
collected at an individual by the name of Darrell Thomas.
Q.
So it was seized from his house; is that correct?
A.
That's correct.
Q.
And were you able to do -- to determine the IP address
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 34 of 145
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
UNITED STATES DISTRICT COURT - OFFICIAL CERTIFIED TRANSCRIPT
188
that had been used in this case for this device?
A.
I was.
Q.
And would seeing Exhibit 4 of your report help you?
A.
It would.
Q.
I'm going to put it here.
Can you -- sorry, this isn't very clear. Can you see
this at all? Not really?
A.
No, it's too blurry.
Q.
Let me just give it to you.
MR. MARSHALL: What's this exhibit number?
MS. WEBSTER: It's actually 3 --
MR. MARSHALL: Wait till you get it back. That's
fine.
MS. WEBSTER: M, I think. It should be M.
MR. MARSHALL: Thank you.
BY MS. WEBSTER:
Q.
Does that tell you which IP address was being used?
A.
Well, it tells me that it's -- first of all, it's a
Comcast IP address service provider. And then the IP
addresses that were provided, I was able to do a lookup on and
see that they are, in fact, related to Comcast.
Q.
Okay. And can you -- it's on the document, but can you
just tell us what the IP address is?
A.
Yeah. The -- so IPs come in two different flavors. You
have what's called an IP4, you have an IP6. And the IP
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 35 of 145
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
UNITED STATES DISTRICT COURT - OFFICIAL CERTIFIED TRANSCRIPT
189
473.43.127.162. And, again, if I trace that number, it comes
back to Comcast.
And then the other IP6 is 2601, colon, C as in Charles, B
as in boy, colon, 8200, colon, 69D, David, 10, colon, D,
David, 2 at foxtrot, colon, 524 A, Adam, colon, A, Adam, 7, A,
Adam, A, Adam, colon, 37 at foxtrot 0. And when you do a
lookup on that long number, alphanumeric number, it comes back
to Comcast as well.
Q.
Mr. Persinger, were you able to identify that IP address
from the device?
A.
No. Comcast doesn't really store the IP address per se
on Windows anymore. They used to and you could see the
complete history. Now what we do is we can see that there is
a connection made to Comcast that establishes what the
computer is using.
Q.
So where did you get that IP address from?
A.
It came through discovery.
Q.
Okay. Thank you.
Okay. I'm going to show you what is -- what is admitted
as F23N. We'll see if this shows up a little bit better.
Is the Exhibit 005, is that your internal exhibit number?
A.
It is.
Q.
And at the bottom there's a F23N, which is our exhibit
number from court; is that right? Right there?
A.
Yes.
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 36 of 145
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
UNITED STATES DISTRICT COURT - OFFICIAL CERTIFIED TRANSCRIPT
190
Q.
So can you tell us what Exhibit 005 shows?
A.
So, again, when I put in the teldrin_foster@yahoo, the
forensic software has the intelligence to find what's called
the string value equivalent. It matches up with this and
tells me the data that's around that particular search string,
that in this case shows if there was activity that dealt with
this business Namerk Painting that shows an e-mail address
just below that.
Q.
So this shows the use of the teldrin_foster@yahoo.com
address; correct?
A.
Correct.
Q.
And what does it show us about the
arcadepaintco03@gmail.com address?
A.
So in the top part of that document, you'll see where it
says file offset and selection. If I send you a letter and
you live at 344 Peachtree, I put that on the letter, the
envelope, and then mail it. It knows that it's going to your
house.
That's what those numbers at the top represent. So when
I put in the search string and it finds it, it's all related
within that house. So we know that that information is
directly associated with that Yahoo e-mail address.
Q.
Okay. Were you able to tell what the person who was
interacting with the Yahoo e-mail address was doing at the
time?
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 37 of 145
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
UNITED STATES DISTRICT COURT - OFFICIAL CERTIFIED TRANSCRIPT
191
A.
I could see there was documents that were being
exchanged. Again, the e-mails were open. There were some
that indicated sent. But they were mainly documents that were
related to that e-mail address.
Q.
Okay. And did you see something about a Bellator Phront
Group bank statement?
A.
I did.
Q.
So I'm showing you what's marked as F23O. And is this
that -- your internal exhibit that you prepared to go with
this report?
A.
It is.
Q.
And what were you able to determine about the accessing
of the Bellator Phront Group bank statement?
A.
Well, in Exhibit Number 4, it mentions this information.
So I see in 5 is directly correlated to that e-mail address.
Q.
Going back to this for a second. Is it this account
number, is that what we're looking at?
A.
It is.
Q.
Okay. And so because you saw that, you knew that it was
associated with this document; is that right?
A.
That's correct.
Q.
Okay. And so could you tell what was being done with it
or could you just tell they were accessing it?
A.
Well, because I was able to find it on the system, I knew
factually it was accessed. What they did with it thereafter,
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 38 of 145
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
UNITED STATES DISTRICT COURT - OFFICIAL CERTIFIED TRANSCRIPT
192
I don't know.
Q.
And so were you able to tell how often the Yahoo e-mail
address was being used?
A.
Within a limited scope. You see, even though the
computer is like a sponge and it records lots of information,
it doesn't really do a repetitive action. It doesn't continue
every time that you open it. It could be that an individual
would leave the browser open, for example, and that record is
already on the computer, so it doesn't have a need to repeat
that because it still sees that it's opened.
Q.
So does that mean there would be a log of every time
someone accessed the Yahoo account?
A.
Not every time. Again, it's all dependent on what the
user does. If the user closes the browser and is forced to
log in each time, yes, you would find a new record to that
effect. But if you keep that tab open, then the computer just
says it's open and doesn't continue to record at that point.
Q.
And what if someone stays logged in, has the box that
says "stay logged in" on this computer, what effect does that
have on that analysis?
A.
Yeah, there's really two versions of that. There's stay
logged in or remember me. And we do this because we don't
want to have to put the username and password in every time,
we just want to read our e-mail.
When you check that box, it then treats it as you're
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 39 of 145
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
UNITED STATES DISTRICT COURT - OFFICIAL CERTIFIED TRANSCRIPT
193
friendly to the system. Meaning that every time you open that
browser and you go to that e-mail address, it's automatically
going to log you in and not require you to do it again.
Q.
Okay. So I'm going to show you what's been marked as
F23E.
Can you tell me what this is?
A.
So this is one of the exhibits where I can actually see
what's called "recent documents." It's also called MRUs. And
MRU is most recently used. So it keeps up with a person's
history as to what they're clicking. And it simply does this
so that the process is sped up.
If you're opening up an Excel spreadsheet and you go to
that spreadsheet often, then through this process it knows
exactly where that information is and can quickly load it for
you so that you can see the content. And that's why we see --
over to the left of the document it's telling us this numeric
value. That's the order of which things are actually being
opened.
Q.
And so when it has -- can you tell us what's in the row
labeled 107?
A.
So in 107 you'll see the parentheses 1,790 unread, the
teldrin_foster@yahoo.com e-mail address. So that's saying
that out of the list, this has been part of the most recently
opened files.
Q.
And now I'm going to show you part of what's been marked
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 40 of 145
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
UNITED STATES DISTRICT COURT - OFFICIAL CERTIFIED TRANSCRIPT
194
as F23I. This is going to be a little bit harder to read, but
can you -- can you see that or is it still too blurry? Still
a little blurry?
A.
Still a little blurry. It's almost like an eye test.
Q.
Let me just give it to you.
You have it in front of you. 23I?
MS. WEBSTER: Ms. Holland, could you pull up RF23I?
I hear you have our exhibits in your Trial Director, so thank
you. And can you pull out that -- sort of the top half of it.
Right there.
THE WITNESS: I've yet to find it.
MS. WEBSTER: No. No. She's doing it.
Yes, just over from there. Thank you so much.
THE WITNESS: Oh, much better.
BY MS. WEBSTER:
Q.
Okay. Do you see it on the screen?
A.
I do.
Q.
So I think you mentioned earlier you could see that some
of the unread e-mails in this were changing; is that right?
A.
Correct.
Q.
So what does that tell you?
A.
Again, if you look at even the top row, the 2,044, and
you go down to about the middle, it's 2,098, and then it goes
back to 45. This is highly suggestive that somebody is
actually opening the e-mails and reading them.
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 41 of 145
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
UNITED STATES DISTRICT COURT - OFFICIAL CERTIFIED TRANSCRIPT
195
Q.
So it's not just it's logged in and it's cataloging them;
right? It's just -- it's someone is actually in the account;
is that right?
A.
That's correct. It's got some human interaction with it.
Q.
Okay. And were there other instances on this exhibit
where this -- well, first, let me ask, what is the date of
this access?
A.
Well, they go between June 24th, 2020, there's June 30th.
You see, again, the job of the Internet history that's on your
system, it will purge over time. So it doesn't keep up with
every instance. This is the most current instance that you
would see in it.
Q.
And do you recall seeing other dates listed that someone
had accessed this e-mail account?
A.
Yes, I did.
Q.
But you -- I just want to be very clear. You're not able
to say for sure exactly when all the instances were that that
e-mail address was accessed; is that right?
A.
That's correct.
Q.
And then what else did I ask you to look for on this
device?
A.
The reference to the iCloud account.
Q.
One second before we go there.
MS. WEBSTER: Can you take out the cull-out part,
portion.
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 42 of 145
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
UNITED STATES DISTRICT COURT - OFFICIAL CERTIFIED TRANSCRIPT
196
BY MS. WEBSTER:
Q.
Do you see what else people are searching for under the
Yahoo references?
A.
Yes, I see that.
Q.
And what are they searching for?
A.
Fonts, different fonts.
Q.
Okay. Thank you. Okay. Going back to the iCloud
account.
What did I ask you to search for?
A.
It was teldrin23, the best I remember, @icloud.com.
Q.
And what did you find?
A.
I got positive returns on it.
MS. WEBSTER: And can we pull up F23R, please.
BY MS. WEBSTER:
Q.
Is that an exhibit that you prepared about the
teldrin23@icloud.com account?
A.
It is.
Q.
Tell us what that shows you.
A.
On Windows it has several different event logs,
everything from application to updates to the overall health
of the system to security. When you log into something,
generally that information will appear in the security event
log. So when I did my search using that search string of
teldrin23@icloud, I got hits that didn't surprise me because
they were in the event viewer log of security.
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 43 of 145
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
UNITED STATES DISTRICT COURT - OFFICIAL CERTIFIED TRANSCRIPT
197
Q.
And is this what we're seeing in this exhibit?
A.
I'm sorry, say that again, please?
Q.
Are we seeing that event viewer log match in this
exhibit?
A.
That's correct. So working left to right, you can see
when the event took place, the date, the time, the event ID
number, the computer name, and then the source, and what's
inside that event viewer log file.
Q.
And what time was this event file created?
A.
It's at 12:20 and 45 seconds a.m. on the 22nd of
May, 2020.
Q.
And what you told us earlier about the Yahoo account,
that you can't necessarily see every time that it's been used,
is that also true of the iCloud account?
A.
It is.
Q.
And is it for the same reasons?
A.
Yes.
Q.
So we know that it was logged in on May 22nd of 2020, but
we don't know when else it was used; is that right?
A.
That's correct.
Q.
Let me go back for a second. How did you find this
information? Were you using publicly-available software or
were you using your own custom software?
A.
Well, the software I use is called Forensic Explorer.
And it's written in a programming language called Delphi.
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 44 of 145
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
UNITED STATES DISTRICT COURT - OFFICIAL CERTIFIED TRANSCRIPT
198
I've used Delphi for 20-plus years. And it allows you to
write your own scripts.
Now, sometimes I'll use custom scripts, especially in
cases where I can potentially save the client money or the
court money because the process is streamlined. It's going to
condition the information, without changing it, into something
that we can all see, such as this here in this exhibit.
And that custom script allows it to still run through,
still bookmark and find elements that match the search string
that I'm looking for.
Q.
Okay. And so -- but the results of the custom script,
were you able to confirm that with more publicly-available
software?
A.
Yes. So there's a couple different ways that this can be
done. There are what's called stock scripts, the software
actually comes equipped to do the very same thing that I
detailed to you, it just doesn't look as good or doesn't save
as much time.
But you can also extract what's called the native digital
file. That means the event viewer file itself, you can
extract it from the forensic image and then look at it with a
number of different tools. Microsoft actually has one that
you can download and import into it this event viewer log
file.
Q.
Okay. So regardless of whether you used the custom
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 45 of 145
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
UNITED STATES DISTRICT COURT - OFFICIAL CERTIFIED TRANSCRIPT
199
scripts that you made or the more publicly-available software,
it confirmed that you had found these e-mail addresses used on
this computer; is that accurate?
A.
That's correct. It's kind of a validation. You find it
one way using one tool, you want to see if you can find it
again using a second tool.
Q.
And are you familiar with an IEF report?
A.
I am.
Q.
Tell us what that is.
A.
So the forensic software is called Magnet. It's actually
changed names a couple of times. It's built by a retired
police officer out of Canada that pretty much puts things in
auto pilot. You point it at the forensic drive, it has a
bunch of boxes that are checked, you tell it to run. In about
two days you come back and you've got your results.
Q.
And do you get to select what's in the IEF report? Like
does it include everything on the device or only certain
things that you choose?
A.
It usually ships with everything checked.
Q.
Were you able to briefly look at the IEF report that was
provided in this case?
A.
Briefly, yes.
Q.
About this device?
A.
Yes.
Q.
And were there things that were not included in that IEF
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 46 of 145
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
UNITED STATES DISTRICT COURT - OFFICIAL CERTIFIED TRANSCRIPT
200
report?
A.
Correct.
Q.
What were those things that weren't included?
A.
The primary thing was the event logs. Again, the logs
are kind of a tattletale. It's keeping up with what you're
doing and when you've done it. And the particular report I
looked at did not have that contained.
Q.
I mean, there could be valid reasons for not including
that; is that right?
A.
There could be, yes.
Q.
If you did not have those logs, would you be able to see
the teldrin23@icloud.com?
A.
You could not.
Q.
So that was only in those logs?
A.
That's correct.
Q.
And later have you been able to look at the full event
logs that we were provided in discovery?
A.
Yes. There were two PDFs. One about 2,200 pages and the
one a little over 16,600 pages.
Q.
Did they confirm or deny what you had found in the --
already?
A.
It confirmed. I was able to put in the same e-mail
address and in those log files they were found.
Q.
So you can tell that these e-mail addresses were used,
but just to be clear, can you tell for certain who was using
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 47 of 145
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
UNITED STATES DISTRICT COURT - OFFICIAL CERTIFIED TRANSCRIPT
201
the computer at that time?
A.
No, I cannot.
Q.
Was the information that you saw in the report consistent
with a sort of one-time use or did it look like it was someone
who was using it repeatedly?
A.
I would say had used it more than once.
Q.
And you said, I think, in your opinion that you thought
that it looked like the user was familiar with how to access
the account and having access to the username and password; is
that right?
A.
Correct.
Q.
Why is that your opinion?
A.
Well, the information seemed almost too easy to find.
Putting in the search criteria and getting -- the results came
back didn't tell me that a person struggled with trying to
enter in a username or a password, it was readily available.
Q.
And once the e-mail is logged into the computer, is there
any limitation on who can access it?
A.
Not really. Again, you just have to have physical access
to it, launch the browser, see what the history may say, click
a link. If you have remember me checked, it's going to take
you to it.
Q.
And were you able to -- or did we ask you to review the
metadata from documents on this device?
A.
You did.
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 48 of 145
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
UNITED STATES DISTRICT COURT - OFFICIAL CERTIFIED TRANSCRIPT
202
Q.
And were you able to do that?
A.
I did.
Q.
And --
THE COURT: Ms. Webster, let me interrupt you. I'm
sorry. We've had a request from someone for a comfort break.
So if you get to a stopping point in the next few minutes,
could you do that, please?
MS. WEBSTER: Absolutely. I can ask one more
question.
THE COURT: All right.
BY MS. WEBSTER:
Q.
Did you find documents that had Gena Pyfrom's metadata on
it?
A.
I did.
Q.
And do you remember how many documents?
A.
I don't recall.
MS. WEBSTER: That's fine. Thank you. We can stop
here.
THE COURT: Very well.
Let's try to take a break on the shorter end of our
breaks, everyone, okay? Closer to five than ten, if we can
all kind of hustle?
All right. Thank you. You're reminded of your
instructions for breaks. Thank you.
(The jury exited the courtroom at 3:22 p.m.)
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 49 of 145
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
UNITED STATES DISTRICT COURT - OFFICIAL CERTIFIED TRANSCRIPT
203
(After a recess at 3:23 p.m., the proceedings
continued at 3:31 p.m. as follows:)
THE COURT: You can bring the jury out, Officer.
(The jury entered the courtroom at 3:31 p.m.)
THE COURT: Y'all can be seated. Thank you.
Off the record.
(Off-the-record discussion.)
THE COURT: Back on the record.
MS. WEBSTER: Thank you, Your Honor.
BY MS. WEBSTER:
Q.
Mr. Persinger, are you familiar with the concept of Apple
Continuity?
A.
I am.
Q.
What is that?
A.
So Apple, obviously, came out with Apple Continuity. And
what it does is it allows multiple Apple devices to
communicate with each other so that if you're working on an
iMac, for example, on a Word document and it's at work and you
leave and you go home, well, if you've got a computer at home,
you can resume working on that document. And the idea is to
sync these devices all together so that you don't lose your
connectivity of whatever you're working on.
Q.
Okay. So you gave an example of computers, but does that
also apply between different types of devices?
A.
It is. It includes from the watch to the iPad to the
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 50 of 145
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
UNITED STATES DISTRICT COURT - OFFICIAL CERTIFIED TRANSCRIPT
204
iPod to the cellphone. All the Apple devices.
Q.
So if I'm logged in with the same Apple ID on a phone and
a tablet, for example, what happens?
A.
Well, they're going to sync together. You're going to
have very similar data on one device as the other device.
Q.
And can you receive phone calls on a tablet if it's
linked to your phone?
A.
You can.
Q.
What about on a watch?
A.
You can.
Q.
And can WhatsApp be logged into on a tablet?
A.
It can.
Q.
Do you know how that works?
A.
I'm sorry?
Q.
How would that work, if WhatsApp is logged into a tablet?
A.
So once you do your credentials of logging into it and
leave it running, then if you do something on another device,
that information's going to be on that other device on that
WhatsApp app.
Q.
So is it possible for someone to be messaging to someone
from a tablet on WhatsApp?
A.
Yes.
Q.
What if you have a phone that sort of isn't connected to
a phone number but you have -- you're still logged in on Wi-Fi
to an Apple ID, are you still logged in? Could you still
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 51 of 145
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
UNITED STATES DISTRICT COURT - OFFICIAL CERTIFIED TRANSCRIPT
205
access WhatsApp and other applications that rely on the
Internet?
A.
Yes. And that's the key. As long as it has network
through the Internet connectivity, Apple Continuity is going
to continue to work. Even if it doesn't have an active phone
number, you can still use it to communicate back and forth and
receive information from other sources.
Q.
If you are logged in on a watch, are you required to have
your phone close by in order for that watch to work?
A.
It's an optional thing. As long as the watch has
Internet connection, it will still receive phone calls. It
will still receive text messages. It used to be, before Apple
Continuity, you had to have the two devices together, they
paired. And now, because of Apple Continuity, they can be in
different locations physically and still communicate.
Q.
Is that true for a tablet as well?
A.
It is.
Q.
Like an iPad?
A.
It is.
Q.
Do you know how that type of call would show up on cell
site records?
A.
Usually what the provider requires is to have an active
account, that's what's called the IMEI, International Mobile
Equipment Identifier. It is a unique serial number equivalent
to the provider. As long as there is an active IEMI (sic),
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 52 of 145
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
UNITED STATES DISTRICT COURT - OFFICIAL CERTIFIED TRANSCRIPT
206
then the devices that you allow to connect to your iCloud
account and through Apple Continuity, all the devices are
going to now connect. So if you get a phone call and you want
to answer it on a pad in a different area, as long as they
both have connectivity, you can do that.
Q.
Okay. And so are you able to tell what device the calls
are coming from or being answered on?
A.
Generally, no. Because, again, what the provider cares
about is that active IMEI number. That's the reporting device
to the provider.
Q.
In this case did you have a chance to review the cell
site report that was provided by the government's expert?
A.
I did.
Q.
And are you familiar with cell tower records as well?
A.
I am.
Q.
Have you reviewed these types of records before?
A.
I have.
Q.
About how many times?
A.
I don't know. Low hundreds. 200 times. Just about
every case now has somebody's cellphone records in it.
Q.
And have you done the mapping of cell site pings and
things like that?
A.
I have.
Q.
What is the purpose of this sort of analysis?
A.
Well, the big thing to remember about cellphone tower
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 53 of 145
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
UNITED STATES DISTRICT COURT - OFFICIAL CERTIFIED TRANSCRIPT
207
technology, it wasn't put in place to be a tracking device.
It's not GPS. It is for billing purposes. The cellphone
provider wants you connected. That's the bottom line. And to
keep that connectivity going to the tower, the tower -- the
job of the tower is to do that, to make sure you stay
connected.
Q.
You've reviewed the report; is that right?
A.
I did.
Q.
And so do you remember how it's marked with various
towers on the report?
A.
Yes, I do.
Q.
And are you able to tell from the report whether those
towers are actually working?
A.
No.
Q.
And why not?
A.
Towers are just like everything else electronic. It will
go down. They will have issues. They do one of two things,
either have service updates or maintenance updates done to it,
for that reason, because towers can actually go offline.
Towers can actually be deconstructed and put out of service
permanently and something close by may be built to replace
that tower. So service and maintenance records are
exceedingly important to know the condition of that tower.
Q.
And if they -- I mean, if the tower is pinged on the
report, is that evidence that it's working and everything is
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 54 of 145
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
UNITED STATES DISTRICT COURT - OFFICIAL CERTIFIED TRANSCRIPT
208
going smoothly?
A.
No.
Q.
And why not?
A.
Again, because towers can fail. They can also have a
situation with what we call overcrowded. Remember, the job of
an Internet -- or the cellphone provider is to keep you
connected. And if a tower is overloaded, it's going to put
you on to a completely different tower.
So that tower, that new tower now's job is keep you
connected. And as you move, it may snap you to another tower.
But the thing to remember is that that tower's job has to keep
you connected because what a provider hates more than anything
is for dropped calls to happen, dropped calls, unhappy
customer, customer then goes to another provider.
Q.
We heard earlier that if there was overcrowding on a
tower, that the call would still register or the records would
still reflect the initial tower hit. Is that your opinion or
your understanding?
A.
No, it's not.
Q.
And why not?
A.
So to get in the weeds of this, the tower, once it's
achieved its ultimate capacity, it can't handle any more
callers, it actually goes back to what's called the switch,
the switch is located at the provider, and says I'm full.
Take a glass that holds 16 ounces, it can't take another drop
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 55 of 145
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
UNITED STATES DISTRICT COURT - OFFICIAL CERTIFIED TRANSCRIPT
209
of water. It's full.
So as it reports back to the provider, it says I'm full,
the -- the switch's job now is to find another tower that's
close by. So as a phone call is made and it sees this tower
that's full, it automatically is going to switch over.
Because if you think about if that tower that's full can't
handle you and it redirects you, what happens to billing? We
know that if we use a phone for ten minutes, it's on the tower
that it's talking to, not where it was bounced from. That's
because the switch has redirected that user to use that tower
that has the capabilities to do so.
Q.
Okay. And based on the report, are we able to know which
towers were potentially overloaded or not at the time?
A.
We don't.
Q.
And is that important to know?
A.
It's -- again, yeah, it's important because if we're
relying on the cellphone to be talking to a particular tower
to try to put an individual within the radius of that tower,
we need to have some assurance that that tower is operating
perfectly as it was designed to do.
Q.
Is that a thing that you can know, whether the tower was
overloaded at the time?
A.
Only if you were monitoring the tower at the time.
Q.
What is a secondary tower?
A.
So the secondary tower is the one that actually ends up
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 56 of 145
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
UNITED STATES DISTRICT COURT - OFFICIAL CERTIFIED TRANSCRIPT
210
with the call. It's the one that's handling it.
Q.
So that's the one that would be on the report?
A.
Generally. Because, again, once the tower that's full
puts you to that secondary tower, that's when your minutes
start. We may remember that back in the day the providers
were charging us by the minute because they were -- the towers
were incorporated for billing purposes. So when it bounced
you over to that other tower is what we call snapping, when
you snap over to that other tower, that's when your billing
starts.
Q.
Are you familiar with the mapping software used by the
FBI?
A.
I am.
Q.
Do you have access to it?
A.
It's a commercially available that I think law
enforcement exclusively can only obtain -- I've had it in
cases before, so I don't have a copy. I actually have my own
software.
Q.
Are you able to assess the software to determine if it
was working?
A.
No, I cannot.
Q.
Okay. Are tower records normally produced by the carrier
when cell site information is requested?
A.
I'm sorry, restate the question, please.
Q.
The list of towers, is that normally provided by the
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 57 of 145
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
UNITED STATES DISTRICT COURT - OFFICIAL CERTIFIED TRANSCRIPT
211
carrier or is that something you normally get from somewhere
else?
A.
So generally the job of the provider is, yes, to keep up
with its towers. So when you send a subpoena to the provider
for records, you will get cell tower information that will
provide you latitude and longitude as to where that physical
location of the tower is.
Q.
Okay. Do -- we heard testimony earlier about sectors for
cell site analysis. Do you know what I'm talking about?
A.
I do.
Q.
Can you explain that briefly? Just remind us.
A.
Basic towers have three sectors, each by division of
120 degrees, making a full circle of 360. You have the alpha,
the beta and the gamma. Generally the alpha's job is pointing
more at the 0 or the 360, going northbound. And then it just
takes 120 degree turns to make each one of those sectors.
MS. CHAIKEN: Your Honor, may we approach briefly?
THE COURT: Yes.
(Bench conference commenced with the court reporter
present.)
MS. CHAIKEN: Your Honor, I've given a lot of leeway
on this line of questioning, but these are all undisclosed
opinions. The report was about the device, it's about Darrell
Thomas's device. There's not a single word on it about him
being a rebuttal expert on cell site analysis. None of what
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 58 of 145
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
UNITED STATES DISTRICT COURT - OFFICIAL CERTIFIED TRANSCRIPT
212
he's testifying about, and has been testifying about for the
past ten minutes, has ever been disclosed to us as something
he's going to testify about.
MS. WEBSTER: Well, as you know, Your Honor, we did
not get the report until two weeks before trial. And I don't
think rebuttal testimony is required to be disclosed in the
same way that evidence is. So this report that he testified
to initially was produced on our case-in-chief or was produced
before we even --
THE COURT: Maybe just talk a little bit lower. The
whole idea is that they can't hear us.
MS. WEBSTER: Sorry. Sorry.
So it was part of our -- our report was disclosed
prior to getting the government's report. So obviously it
doesn't include rebuttal testimony because it was disclosed
first. And so I don't think that Rule 16 requires us to
disclose rebuttal opinion, especially given the time frame in
which we received the government's expert.
MS. CHAIKEN: Your Honor, Rule 16 requires disclosure
of expert records, whether they're in rebuttal or not.
Obviously we wouldn't have been able to complain if they gave
it to us three days ago because we gave them our report three
weeks ago. But they've obviously known before ten minutes ago
that their expert was going to offer opinions in response to
our expert.
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 59 of 145
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
UNITED STATES DISTRICT COURT - OFFICIAL CERTIFIED TRANSCRIPT
213
And unlike them, who had an hour to speak to our
expert on the phone earlier this week and find out exactly
what he was going to say and why and how he got there, we
didn't even know that he was planning on even talking about
cell site analysis.
MS. WEBSTER: Rule 16 doesn't require -- he has not
written a report, so there is no report. So it only
requires --
THE COURT: What's that? What were you saying,
Ms. Chaiken?
MS. CHAIKEN: So they're undisclosed opinions. The
fact that he didn't write a report about them, that's the
whole point. Rule 16 requires disclosure of the expert's
opinions.
THE COURT: All right. I want to just sit down where
I can look at the documents and talk to you all about this.
I'm going to send the jury back.
MS. CHAIKEN: Thank you.
(Bench conference complete.)
THE COURT: Ladies and gentlemen of the jury, I just
had a brief bench conference with counsel, but I think it's
something not quick and easy, so I'm going to need to talk
with them, look at all the documents and et cetera. So that's
going to necessitate my sending you back to the jury room.
Okay? Sorry.
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 60 of 145
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
UNITED STATES DISTRICT COURT - OFFICIAL CERTIFIED TRANSCRIPT
214
(The jury exited the courtroom at 3:48 p.m.)
THE COURT: And if I could have the witness step out
of the courtroom, please. Thank you.
(Witness excused from the courtroom.)
THE COURT: Y'all can be seated. Thank you.
All right. We had already started our discussion in
a bench conference, but I just wanted to hear from you in more
detail about this. And it didn't look like it was going to be
a quickie over at the bench conference, so let's expand on it
a little bit.
Ms. Chaiken, what do you think they should have done
and why do you think they should have done it, first off?
MS. CHAIKEN: Your Honor, Ms. Webster has said she's
almost done at this point. We just want to move on and wrap
it up. So if she's close to being done, rather than waste
time, you know, talking --
THE COURT: Okay.
Ms. Webster, how much more do you have on this line
of questioning?
MS. WEBSTER: Not long, Your Honor. Less than five
minutes. Maybe less than three.
THE COURT: All right. Sounds like the government's
withdrawing their objection based on that representation.
Therefore, we'll see where we end up. Okay. Very well.
Officer, if you can please bring back out the jury.
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 61 of 145
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
UNITED STATES DISTRICT COURT - OFFICIAL CERTIFIED TRANSCRIPT
215
Thank you.
(Witness recalled to the witness stand.)
(The jury entered the courtroom at 3:55 p.m.)
THE COURT: All right. Y'all can be seated.
I understand the objection is withdrawn and,
Ms. Webster, you're going to move on. Thank you.
MS. WEBSTER: Thank you.
BY MS. WEBSTER:
Q.
How far -- I want to talk about the distance that the
towers reach. Does that make sense?
A.
It does.
Q.
And so how far out from the tower will it collect phone
calls or receive phone calls? Does that make sense?
A.
Yeah. Generally it's three to seven miles.
Q.
Okay. And how do you know that?
A.
Case experiences.
Q.
Okay.
A.
And part of CATIE, the Capture and Track Investigative
Evidence, I spent a lot of time studying towers.
Q.
And is that what's informed your opinion as to how far
out they reach?
A.
Yes.
Q.
And if other people -- do some other people believe that
the distance is much shorter?
A.
Yes.
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 62 of 145
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
UNITED STATES DISTRICT COURT - OFFICIAL CERTIFIED TRANSCRIPT
216
Q.
And what accounts for that difference in opinion?
A.
I -- I don't know why they have a difference of opinion.
It could be that they just don't know the tower's abilities.
Towers are really kind of regulated by FCC, the Federal
Communications, and if you don't go there, you don't
necessarily learn the output of a tower.
Q.
So you have to go to the FCC to learn their full
capability; is that what you're saying?
A.
That's where a lot of it is kept, yes.
Q.
And is the -- when you have more towers in an area, does
that shorten the range that the tower will reach?
A.
It doesn't necessarily shorten it, it just gives you
better coverage. If you think about watering your lawn, your
sprinklers are designed to water the lawn, but some sprinklers
may actually put out more water than other sprinkler heads
will.
The towers are very similar to that. They do try to
cater to a little heavier populations, so it might have more
output, where something that's more rural may not.
Q.
And does the cell tower analysis, does that provide for
any exact locations?
A.
No. It's approximate at best.
Q.
And is there sort of, like, a radius that it's within or
how do we know?
A.
Well, that's that three- to seven-mile radius that we're
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 63 of 145
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
UNITED STATES DISTRICT COURT - OFFICIAL CERTIFIED TRANSCRIPT
217
talking about. It's generally within that area. It's not
GPS. GPS is certainly going to get you within 50 feet. The
tower is just putting out signal to keep you connected.
Q.
So can we tell exactly where the phone is?
A.
No.
Q.
And can you tell who was in possession of the phone?
A.
No.
Q.
Or any other device that's potentially being used?
A.
No.
MS. WEBSTER: Can I have one second, Your Honor?
THE COURT: Yes.
MS. WEBSTER: We have no further questions at this
time.
THE COURT: Any cross?
MS. CHAIKEN: Yes, Your Honor. Thank you.
THE COURT: Go ahead.
CROSS-EXAMINATION
BY MS. CHAIKEN:
Q.
Good afternoon, Mr. Persinger.
A.
Good afternoon.
Q.
My name is Tal Chaiken, I'm one of the prosecutors. It's
nice to meet you.
A.
Nice to meet you.
Q.
Did you previously prepare a report in this case?
A.
I did.
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 64 of 145
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
UNITED STATES DISTRICT COURT - OFFICIAL CERTIFIED TRANSCRIPT
218
Q.
And as far as your examination of Darrell Thomas's
laptop, did your report contain all of the opinions you formed
in this case?
A.
The best I recall, yes.
Q.
And did you include all of the exhibits that you thought
were important and relevant to your opinion in that report?
A.
I -- I'm sorry. Yes, I did. And I believe, if I recall
correctly, I did a supplemental report as well that included
references to some of those exhibits.
Q.
Just to be clear, you're not giving an opinion in this
case as to who was using Darrell Thomas's device at any given
time; correct?
A.
That's correct.
Q.
You don't know whether Teldrin Foster and Darrell Thomas
worked on that laptop together, do you?
A.
I do not.
Q.
You're not offering an opinion about how Teldrin Foster's
Yahoo account ended up on that device, are you?
A.
I'm only saying I know somebody had the username and
password. Beyond that, no.
Q.
You don't know whether that person who had the username
and password was Teldrin Foster himself; correct?
A.
That's correct.
Q.
You don't know whether Teldrin Foster gave Darrell Thomas
the username and password to log the account in; correct?
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 65 of 145
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
UNITED STATES DISTRICT COURT - OFFICIAL CERTIFIED TRANSCRIPT
219
A.
That's correct.
Q.
You don't know whether Teldrin Foster was there with
Darrell Thomas and they logged into it together; correct?
A.
That's correct.
Q.
Now, in this case your assignment was to examine devices
that were seized from Darrell Thomas's residence; correct?
A.
Correct.
Q.
And how did you determine which devices you would
examine?
A.
I started off by mounting all of them that I could, with
the exception of number 8. And because I had the search
criterias, I put those in on the devices. And when I received
a match, that was the drive that I focused on.
Q.
How many devices did you receive to mount?
A.
Best I recall, about 10. May have been 11.
Q.
And in your report you specifically identified four
devices. You identified 1B8; correct?
A.
That's correct.
Q.
That's Darrell Thomas's laptop?
A.
I believe so, yes.
Q.
And you identified 1B15 as the BitLocker hard drive, the
hard drive that was encrypted using BitLocker; correct?
A.
That was number 8.
Q.
QAT08?
A.
That's correct. The FBI assigns kind of a different
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 66 of 145
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
UNITED STATES DISTRICT COURT - OFFICIAL CERTIFIED TRANSCRIPT
220
numbering sequence.
Q.
And you reviewed QAT09; correct?
A.
I did.
Q.
And you found no evidentiary data there?
A.
Correct.
Q.
And you reviewed QAT10; correct?
A.
That's correct.
Q.
And you reviewed -- you didn't find any evidentiary data
there; correct?
A.
Correct.
Q.
In your work is it important to analyze whatever devices
are available to analyze?
A.
That I can get into, yes.
Q.
And that's because if you don't examine all of the
devices that may have relevant evidence, your analysis would
be incomplete; correct?
A.
Well, it wouldn't be necessarily incomplete. When the
government gives me what they believe are devices that they've
analyzed or made forensic images of, then that's the scope of
my work.
Q.
And you can only offer opinion based on evidence you've
looked at; correct?
A.
Correct.
Q.
And if there's evidence you haven't examined, you don't
know how that evidence would impact your opinions; correct?
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 67 of 145
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
UNITED STATES DISTRICT COURT - OFFICIAL CERTIFIED TRANSCRIPT
221
A.
Correct.
Q.
And in this case you did not review Darrell Thomas's
cellphone, did you?
A.
I did not.
Q.
Why did you not review that cellphone?
A.
I believe I didn't see any evidence that the government
did as well. A lot of times when I'm on the side of defense
it's to analyze what the government believes is its best
evidence.
Q.
Did you ask Ms. Webster whether the government had
analyzed Darrell Thomas's cellphone?
A.
I don't recall if I asked her or not. In the course of
my business, I would ask normally, but I don't know if I did
in this case.
Q.
And you're familiar with Cellebrite; correct?
A.
I'm sorry, say it again, please.
Q.
You're familiar with Cellebrite?
A.
I am.
Q.
And you've used Cellebrite in your work?
A.
I have it, yes.
Q.
And it's a reliable software for extracting data from a
cellphone; correct?
A.
Lately, no. I've actually had four iPhones, I've got
support tickets to support that, that it has failed on. So
I'm now using one of our proprietary tools to try to analyze
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 68 of 145
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
UNITED STATES DISTRICT COURT - OFFICIAL CERTIFIED TRANSCRIPT
222
those.
Q.
Okay. And if Cellebrite does not fail, it extracts data
from a cellphone; correct?
A.
Then it does correctly, yes.
Q.
And in this case you were not given a Cellebrite
extraction for Darrell Thomas's phone?
A.
Correct.
Q.
Did you review any devices belonging to your client,
Teldrin Foster?
A.
I did not.
Q.
You didn't review his cellphone?
A.
I did not.
Q.
You didn't review any of his computers?
A.
I did not.
Q.
Now, you examined Darrell Thomas's laptop; correct?
A.
That's the QAT02, yes.
Q.
And that was a Lenovo laptop; correct?
A.
Best I recall, yes.
Q.
It was not an Apple device; correct?
A.
Correct.
Q.
You offered some opinions about Apple Continuity and how
it works across watches and iPhones and iPods and iPads and
things like that; correct?
A.
Correct.
Q.
But in this case you did not review any device that was
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 69 of 145
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
UNITED STATES DISTRICT COURT - OFFICIAL CERTIFIED TRANSCRIPT
223
an Apple device; correct?
A.
The only things I did were the SIM cards. And they
were -- the best I recall, belonged to an Apple device, but
not the devices themselves.
Q.
And you did not identify any Apple device in this case
that has Apple Continuity on it; correct?
A.
Correct.
Q.
Okay. So you were just generally telling the jury that
Apple Continuity is something that exists, right, and how it
works?
A.
Yes.
Q.
Okay. But that's not something that has any relevance to
any device you looked at in this case?
A.
No.
Q.
Now, when -- I want to be clear that you were asked to
look for two different accounts on Darrell Thomas's device;
correct?
A.
Across all devices.
Q.
And you found those on one device, the laptop; correct?
A.
That's correct.
Q.
So can we limit our conversation now to the laptop?
A.
Yes.
Q.
So you were asked to look for the
teldrin_foster@yahoo.com account; correct?
A.
Yes.
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 70 of 145
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
UNITED STATES DISTRICT COURT - OFFICIAL CERTIFIED TRANSCRIPT
224
Q.
And for the teldrin23@icloud.com account?
A.
That's correct.
Q.
Okay.
MS. CHAIKEN: If you could please publish Defense
Exhibit F23I, Ms. Holland.
BY MS. CHAIKEN:
Q.
This is one of the exhibits that you prepared; correct?
A.
Yes, it is.
Q.
And it shows log-ins or accesses to the Teldrin Foster
Yahoo account on Darrell Thomas's device; correct?
A.
Correct.
MS. CHAIKEN: And if you could go down to page 4,
Ms. Holland.
BY MS. CHAIKEN:
Q.
Do you see there there's -- May 19th, 2020, there is a
log-in to Yahoo? That's the earliest log-in to the Yahoo
account that you found on Darrell Thomas's device; correct?
A.
It appears so, yes.
Q.
So before May 19th of 2020, you didn't find anything on
Darrell Thomas's device related to this Teldrin Foster Yahoo
account; correct?
A.
Correct. But, again, the Internet history that is stored
within the data does what we call FIFO, first-in, first-out.
So it flushes anything that may have been older to get ready
for the newer data that's coming in.
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 71 of 145
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
UNITED STATES DISTRICT COURT - OFFICIAL CERTIFIED TRANSCRIPT
225
Q.
And you just don't know whether it was there or not
before; correct?
A.
That's correct.
Q.
You have no -- you haven't seen anything in the device to
show that it was there before May 19th; correct?
A.
Correct.
Q.
Okay. Now, you -- your examination of Darrell Thomas's
computer didn't identify any evidence of hacking; correct?
A.
It did not.
Q.
You did not identify any evidence that the password for
the account was changed?
A.
I did not.
Q.
You did not identify any evidence that the security
questions were changed?
A.
I did not.
Q.
You did not identify any evidence that the contact
information was changed; correct?
A.
I did not.
Q.
Okay. You found evidence that someone who knew the
username and password logged into the account on Darrell
Thomas's device; correct?
A.
That's correct.
Q.
And, again, you don't know who that was; right?
A.
That's correct.
Q.
For example, if I'm working on a document in my office
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 72 of 145
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
UNITED STATES DISTRICT COURT - OFFICIAL CERTIFIED TRANSCRIPT
226
and you examined my computer, you'll see that I created that
document; right?
A.
Yes.
Q.
You'll see that there's a document on my computer; right?
A.
Correct.
Q.
But that doesn't tell you whether Mr. Kaushal and
Mr. Moore were standing in the office with me and we were
working on it together; right?
A.
That's correct.
Q.
Okay. All you know is it's on the computer but not who
had anything to do with it?
A.
That's correct.
MS. CHAIKEN: Now, if you could go to F23C, please.
BY MS. CHAIKEN:
Q.
This was a bank statement that you attached as an exhibit
to your report; correct?
A.
Yes.
Q.
And can you just tell me again what your opinion is as it
relates to this document?
A.
Well, I found that it was directly related to when an
individual logged into the Yahoo account.
MS. CHAIKEN: Okay. And so if we can publish Defense
Exhibit F23H. And if you could just pull out the content
there. And if you can just pull out the title, sorry, from
the top.
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 73 of 145
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
UNITED STATES DISTRICT COURT - OFFICIAL CERTIFIED TRANSCRIPT
227
BY MS. CHAIKEN:
Q.
Is this a document that you prepared to show the file
being accessed shortly before the e-mail account access?
A.
If you're talking about line item number 1 and 2, I
believe that's the PDF, yes.
Q.
So line items number 1 and 2 are this Bellator Phront
Group Wells Fargo bank statement?
A.
I believe so, yes.
Q.
And based on the proximity and time here, you've
concluded that the person who was accessing this file was
also accessing the Yahoo e-mail account?
A.
Correct.
Q.
And what date was that on?
A.
The Yahoo was on the 19th of May, 2020, at 21:31. And
it's worthy to note that's the LNK. So it's not actually
accessing the Yahoo itself by going to mail.yahoo.com, it's
accessing a LNK file that's on the computer. So it follows
after that. The LNK file is like a physical file that's on
the system.
Q.
And you didn't analyze any other devices to determine
what else was done with this file, this Bellator Phront Group
bank statement; correct?
A.
That's correct.
MS. CHAIKEN: If you could please publish Government
Exhibit 2338 side by side with Defense Exhibit F23H. And if
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 74 of 145
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
UNITED STATES DISTRICT COURT - OFFICIAL CERTIFIED TRANSCRIPT
228
you could pull out the middle message, please, Ms. Holland.
And if you could pull out that file name on Mr. Persinger's
report.
BY MS. CHAIKEN:
Q.
Mr. Persinger, do you recognize the message on the left
as something that looks like it comes out of Cellebrite?
A.
Well, based on that exhibit alone, I can't tell it's
Cellebrite. I can tell that it's part of WhatsApp.
Q.
Okay. I'll represent to you that it was previously
admitted in this case as a WhatsApp message.
Do you see that it says that it's a WhatsApp message from
Darrell Thomas to Teldrin Foster -- to Teldrin?
A.
I'm sorry, which --
Q.
On the left in the message do you see at the top there
where it says, From DJ to Teldrin?
A.
Yes.
Q.
And then do you see the date there at the bottom that
says May 19th?
A.
Yes.
Q.
And that's the same date as the file was downloaded on
Darrell Thomas's laptop; correct?
A.
Correct.
Q.
And if you look at the title.
MS. CHAIKEN: And, Ms. Holland, if you could
highlight the title in the text message.
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 75 of 145
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
UNITED STATES DISTRICT COURT - OFFICIAL CERTIFIED TRANSCRIPT
229
BY MS. CHAIKEN:
Q.
Do you see the title there is
EF1E334B665248A5B5550D63A465C1D9?
A.
Yes, I see that.
Q.
And that's the exact same file name as the file name that
was on Darrell Thomas's laptop; correct?
A.
Correct.
Q.
Okay. So you didn't consider in your opinion in any way
that on the exact same date that this document was downloaded
from Darrell Thomas's -- on Darrell Thomas's device, it was
also messaged via WhatsApp to Teldrin Foster; correct?
A.
Well, that's correct, because I didn't have access to
that phone data.
Q.
Right. Because nobody provided you with the phone;
correct?
A.
Correct. And whoever analyzed it didn't do any kind of
report that I saw that related to that either.
Q.
Right. But you're not testifying a report wasn't
prepared; correct?
A.
Well, no. But, again, part of my job would be to read
reports, if it's a Rule 16 or Rule 26, depending on the venue,
the -- to see if there's an expert report involved. If there
were an expert report, I would have asked to see the data.
Q.
Okay. But did you ask to see the Cellebrite extraction
from Darrell Thomas's phone?
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 76 of 145
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
UNITED STATES DISTRICT COURT - OFFICIAL CERTIFIED TRANSCRIPT
230
A.
I did not.
MS. CHAIKEN: Now, if you could pull out 2338A side
by side with F23C.
BY MS. CHAIKEN:
Q.
So, Mr. Persinger, on the left 2338A is the -- what was
sent in that WhatsApp message that we just looked at from
Darrell to Teldrin on May 19th. And on the right is your
exhibit that you attached to your report; correct?
A.
I believe so, yes.
Q.
And those are the same document; correct?
A.
With the exception of what looks to be the account
redaction, I would agree.
Q.
Does knowing that Darrell Thomas sent this document to
Teldrin Foster on the exact same day as that file was accessed
on the account influence your opinions in any way as to who
may have been using the computer?
A.
No. Because, again, I don't know who had possession of
the cellphone when the document was sent.
Q.
And you're not opining about who was using anything;
right?
A.
That's correct.
Q.
You're just saying what was on Darrell Thomas's device?
A.
Correct.
Q.
So the jury is going to have to look at other evidence to
determine who was actually using any particular device at any
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 77 of 145
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
UNITED STATES DISTRICT COURT - OFFICIAL CERTIFIED TRANSCRIPT
231
particular time; correct?
A.
I would agree with that.
Q.
Now, you also testified very briefly that you found
metadata on Darrell Thomas's laptop; correct?
A.
Correct.
MS. CHAIKEN: And if you could publish Defense
Exhibit F23F.
BY MS. CHAIKEN:
Q.
Is this an exhibit that you prepared and attached to your
report that had some documents with metadata?
A.
Yes.
Q.
And metadata for a file does not necessarily mean a file
was created on the device itself; correct?
A.
I would agree with that, yes.
Q.
So going back to my example, if I'm working in my office
on my computer and I create a document, if I were to then
e-mail that document to Ms. Webster and she downloaded it,
there would now be a document on her computer with my metadata
on it; correct?
A.
That would be correct. As long as she didn't open it and
change it, remove the metadata, yes.
Q.
And that wouldn't be an indication that I used
Ms. Webster's computer; correct?
A.
That you were the author of that document. Not
necessarily using the computer but authored that document.
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 78 of 145
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
UNITED STATES DISTRICT COURT - OFFICIAL CERTIFIED TRANSCRIPT
232
Q.
It would be evidence that Ms. Webster has a document on
her computer that I was the author of; correct?
A.
Not necessarily. Because, again, especially when we're
talking about a Word document in your example. There would be
what's called a cache version of the document that I would
find that would also align that says this document was
actually factually created on this computer.
Q.
Okay. So you've included this list of metadata or
documents with metadata. And some of them don't have
metadata; correct?
A.
That's correct.
Q.
And you identified two documents that were -- that listed
Gena Pyfrom as the author; correct?
A.
Yes.
Q.
And those were documents that were downloaded onto the
device, weren't they?
A.
They were found on the device, yes.
Q.
And they were downloaded to the device, as opposed to
being created on the device; correct?
A.
I can't say the source of where it came from. I only
know that it is found on the computer.
Q.
And you're not opining that they were created on the
computer; correct?
A.
No.
Q.
Okay.
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 79 of 145
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
UNITED STATES DISTRICT COURT - OFFICIAL CERTIFIED TRANSCRIPT
233
MS. CHAIKEN: If you can go down to page 2,
Ms. Holland.
BY MS. CHAIKEN:
Q.
There's a lot of documents that have no metadata on this
computer; correct?
A.
That's correct.
Q.
So that tells you nothing about who had anything to do
with creating them; right?
A.
That's correct.
Q.
And, in fact, Darrell Thomas's name actually doesn't
appear in the metadata; correct?
A.
No. That's correct.
Q.
And you know that this is a device that was seized from
Darrell Thomas; correct?
A.
That's correct. However, you control who you want to
show as the author. Mine shows Peter Pan.
Q.
Exactly. So the metadata really tells us very little
about who had anything to do with the creation of a document;
right?
A.
Well, yeah, to that extent. However, when you're looking
at the document and you've got a person's name that may be
associated with the case, it kind of fits, because most people
don't change metadata.
Q.
Right. But you're not testifying that Darrell Thomas had
nothing to do with any of these files because his name isn't
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 80 of 145
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
UNITED STATES DISTRICT COURT - OFFICIAL CERTIFIED TRANSCRIPT
234
on the metadata; correct?
A.
Correct.
Q.
So the absence of metadata with someone's name doesn't
mean that they were uninvolved in any of these documents;
correct?
A.
Correct.
MS. CHAIKEN: Let's go to page 5 of this exhibit,
please. And if you could pull out file number 294, down at
the very last page.
BY MS. CHAIKEN:
Q.
This is one of the documents that you identified as
having Gena Pyfrom listed as the author; correct?
A.
That's correct.
Q.
And did you do any investigation in your analysis to
determine where that file came from?
A.
No, I did not.
MS. CHAIKEN: If you could please publish Government
Exhibit 2428 -- and, I'm sorry, stay on this one for one
second.
BY MS. CHAIKEN:
Q.
The file name is 2020 Jan-Feb Payroll Report by
Employee.xls; correct?
A.
Yes.
Q.
It's an Excel spreadsheet?
A.
It is.
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 81 of 145
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
UNITED STATES DISTRICT COURT - OFFICIAL CERTIFIED TRANSCRIPT
235
MS. CHAIKEN: And if you could please publish
Government Exhibit 2428.
BY MS. CHAIKEN:
Q.
Do you see that this is an e-mail from
gjpyfrom@gmail.com?
A.
I do.
Q.
And it's an e-mail that was sent to Darrell Thomas and to
teldrin23@icloud.com?
A.
It appears, yes. It doesn't have a header, but based on
the two, yes, I would agree with that.
Q.
And the attachment was a file that was called 2020
Jan-Feb Payroll Report by Employee.xls; correct?
A.
Yes.
Q.
Okay. So this file that you found on Darrell Thomas's
device was e-mailed to Darrell Thomas and to the Teldrin 23
iCloud account; correct?
A.
Based on the two, yes, I would agree with that.
MS. CHAIKEN: Could you go back to F23F, please.
BY MS. CHAIKEN:
Q.
How did you choose which files to include in this listing
of files from the computer?
A.
The best I remember is they were -- I think -- I recall
them being in the downloads folder. And I just basically did
a select all.
Q.
Okay. And looking at these file names, do you see that
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 82 of 145
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
UNITED STATES DISTRICT COURT - OFFICIAL CERTIFIED TRANSCRIPT
236
there are various file names related to PPP loans and tax
documents and things like that?
A.
Yeah. And it appears to have some that have been
deleted, but yes.
Q.
Okay. And did you analyze any other devices to determine
anywhere else these files may have gone?
A.
I did not.
Q.
If you had access to other devices, that could have
helped you see if there was correlation between what was
happening on Darrell Thomas's device and what was happening on
other devices, wouldn't it?
A.
To a degree. Again, my assignment was to look for the
e-mail address, see where I could find a match to it, and that
was that QAT02, and then search that device for any files that
may be, you know, relevant.
Q.
Okay. And your assignment really wasn't to try to figure
out whether Teldrin Foster had access to any of these files;
correct?
A.
Or Darrell Thomas for that matter, yes.
Q.
You just were typing in search terms to see what was on
the laptop?
A.
Correct. Knowing where the device came from and that was
pretty much the limit of it.
MS. CHAIKEN: If you could go to page 6, line 313,
please. And just pull that one out. Just the title is fine.
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 83 of 145
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
UNITED STATES DISTRICT COURT - OFFICIAL CERTIFIED TRANSCRIPT
237
Thank you.
BY MS. CHAIKEN:
Q.
You see that this file name starts with 33B2E3D2?
A.
I do.
Q.
And that file has no metadata associated with it at all;
correct?
A.
Correct.
Q.
Okay. So you don't know who was involved in creating,
accessing, modifying it; correct?
A.
That's correct.
MS. CHAIKEN: And if you could please publish this
side by side with Government Exhibit 2300, page 307. And if
you could just pull out that line 313 again. And if you could
pull it out in that message -- and if you could pull it out in
the message at the top there, please.
BY MS. CHAIKEN:
Q.
Do you see there that Darrell -- Darrell -- DJ sent to
Teldrin a document with the title 33B2E3D2, ending in A166,
that's the exact same file that you've identified on your file
list from Darrell Thomas's laptop?
A.
Yeah. Again, I see that 1243 looks like it was sent to
8218, but I don't know who's behind the devices. But I would
agree with that.
Q.
And you didn't consider in your analysis the fact that
Darrell Thomas sent this -- this same exact file via WhatsApp
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 84 of 145
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
UNITED STATES DISTRICT COURT - OFFICIAL CERTIFIED TRANSCRIPT
238
to Teldrin; correct?
A.
No. I see that it is a file that's on the system that I
analyzed.
Q.
Correct. You see that it's the same file that you
analyzed, correct, same unique string of many numbers?
A.
That's correct.
Q.
If you could take a look at --
MS. CHAIKEN: If we could just do page 8 side by side
with Government Exhibit 2330 -- sorry, let's skip that one.
Let's go to page 7 -- we already did that one.
Page 7 side by side with 2334. And if you could pull
out lines 378, 379 and 381, please. And if you could also
pull out -- is there a way to pull out all three messages?
BY MS. CHAIKEN:
Q.
Here on your file list you've got various files that have
names like backup_image_stamped_01 or 02; correct?
A.
Yes.
Q.
And do you see that Darrell Thomas sent Teldrin via
WhatsApp those same files with those same file names?
A.
Well, again, it seems to be coming from 1243 to 8218,
yes.
Q.
And the jury is just going to have to rely on other
evidence to determine who was controlling that 8218 number;
correct?
A.
Correct.
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 85 of 145
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
UNITED STATES DISTRICT COURT - OFFICIAL CERTIFIED TRANSCRIPT
239
Q.
And you didn't review any phones associated with that
8218 number?
A.
I did not.
Q.
And you didn't review the device associated with the 1243
number that was seized from Darrell Thomas's home; correct?
A.
I did not.
MS. CHAIKEN: If you could look at page 6. If we
could go back to page 6 of F23F side by side with 2339. And
if you could pull out lines 335 and 336, please. They're
down -- thank you.
BY MS. CHAIKEN:
Q.
And this is another set of messages where Darrell Thomas
sent Teldrin Foster a file with the exact same name as the
file name that you put in your file list; correct?
A.
I'm sorry, I don't see the DOC file name.
Q.
I'm looking at the title Abacus Tech August 2018.pdf.
A.
Okay. But the file name says it's DOC-20200421-W,
whiskey, A, Adam, 0012.
Q.
Okay. And are you familiar with the fact that when a
document is sent through WhatsApp, it has a naming convention
that matches up with the date and then WA, WhatsApp, with then
a series of numbers?
A.
So that would be the number that if it's sent through I
would expect to find on the computer.
Q.
Okay. But do you see where it says title, Abacus Tech
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 86 of 145
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
UNITED STATES DISTRICT COURT - OFFICIAL CERTIFIED TRANSCRIPT
240
August 2018.pdf?
A.
I see the title, but I see the name of the file being
different.
Q.
Okay. So would you like to see the documents so that you
can verify they're the same ones you found on the document?
A.
I'm using your exhibits.
MS. CHAIKEN: Okay. Let's please pull up 2339A.
BY MS. CHAIKEN:
Q.
This is the Abacus Technology bank statement that Darrell
Thomas WhatsApped to Teldrin Foster that we just looked at.
Is that the file that you found on Darrell Thomas's device?
A.
I didn't open up the rest of the file. The only one I
did is the one that I made the exhibit of.
Q.
Okay. So you just don't know whether it's the same file?
A.
I don't know the content.
Q.
Okay.
MS. CHAIKEN: Could I have one moment, Your Honor?
THE COURT: Certainly.
MS. CHAIKEN: And if we could go back to F23I,
please.
BY MS. CHAIKEN:
Q.
Mr. Persinger, you testified that you didn't find Yahoo
log-ins earlier than May 19th of 2020 because the Internet
history deletes and writes over itself; correct?
A.
Correct.
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 87 of 145
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
UNITED STATES DISTRICT COURT - OFFICIAL CERTIFIED TRANSCRIPT
241
MS. CHAIKEN: And if you could scroll down,
Ms. Holland, all -- I guess to page 12.
BY MS. CHAIKEN:
Q.
Do you see Internet history there going back to December
of 2018?
A.
Yes, I see that.
Q.
Okay. So at least back to 2018 there's existing Internet
history; correct?
A.
Well, that could be just a bookmark, which would be
totally different than a person's interaction with the web
browser.
Q.
Did you determine that these were all bookmarks from
2018?
A.
I didn't classify them as bookmarks at all, just Internet
history files and references.
Q.
All right. I want to switch gears.
Mr. Persinger, you're familiar with Adobe's products;
correct?
A.
I am.
Q.
You use Adobe in your work?
A.
Illustrator primarily. And the PDF reader.
Q.
And that's -- the PDF reader is through Adobe Acrobat?
A.
I'm sorry, ask it again, please.
Q.
The PDF reader is through Adobe Acrobat?
A.
Correct.
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 88 of 145
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
UNITED STATES DISTRICT COURT - OFFICIAL CERTIFIED TRANSCRIPT
242
Q.
And, in fact, you used Adobe Acrobat to create your
report in this case; correct?
A.
No, I did not.
Q.
Well, it was provided to us as a PDF.
A.
Well, it converted to a PDF, but I use a different
program to do that.
Q.
And then you converted it to a PDF using Adobe; correct?
A.
I did not.
Q.
Okay. Someone else converted it to Adobe?
A.
Yeah. So Adobe is not the only one that creates PDF
files.
Q.
Okay. And the domain www.adobe.com, that's a domain
that's associated with Adobe and its suite of products;
correct?
A.
Correct.
Q.
Okay. And other domains that end with adobe.com, those
are also domains that are associated with Adobe; correct?
A.
Correct.
Q.
Okay. And so the domain auth.services.adobe.com would be
a domain that's associated with Adobe; correct?
A.
I would agree with that.
Q.
Okay. So I'm a little confused, Mr. Persinger, because
I'm looking at your report. And your report says that the
data on the computer supports that the computer user was, in
fact, accessing the teldrin23@icloud.com account. Do you
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 89 of 145
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
UNITED STATES DISTRICT COURT - OFFICIAL CERTIFIED TRANSCRIPT
243
recall saying that in your report?
A.
I do.
Q.
And you said, As shown in Exhibit 9; correct?
A.
Correct.
MS. CHAIKEN: If you could publish F23R, please.
BY MS. CHAIKEN:
Q.
This is your Exhibit 9; correct?
A.
It is, yes.
Q.
This is the one that your report says shows that it
was -- that the user of this laptop logged into the iCloud
account; correct?
A.
Correct.
Q.
And teldrin23@icloud.com is an e-mail address; correct?
A.
It is.
Q.
It's an iCloud-based e-mail address?
A.
It is.
Q.
And all three of these events that you've included here
in your Exhibit 9, they list the resource as https
auth.services.adobe.com, don't they?
A.
I see that, yes.
Q.
So these are not attempts to log into an e-mail account,
are they?
A.
They could be, but it could be that the document was
being checked to see if it was digitally signed.
Q.
Doesn't this look like someone's trying to log into an
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 90 of 145
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
UNITED STATES DISTRICT COURT - OFFICIAL CERTIFIED TRANSCRIPT
244
Adobe account with the username teldrin23@icloud.com?
A.
It shows to me that somebody's trying to access the
teldrin23@icloud.com.
Q.
This isn't happening on www.icloud.com, is it?
A.
No, it's not.
Q.
And this was happening at auth.services.adobe.com;
correct?
A.
It could be simply that somebody was in teldrin23@icloud
and accessing that website while in that iCloud account.
Q.
There is nothing that you found on the device that shows
that this device was ever logged into the teldrin23@icloud.com
account; correct?
A.
It's part of the security log. The security log is
authenticating a user that was using Teldrin 23 and then to
get into the Adobe website that you pointed out.
Q.
This security log doesn't reflect that anybody was ever
logged into the iCloud e-mail account, does it?
A.
My opinion is the identity is that of teldrin23@icloud.
That says that somebody -- because it's in the event viewer
for security that somebody was authenticated.
Q.
So, Mr. Persinger, I can go to my bank's website, right,
chase.com?
A.
Okay.
Q.
Right? And I can -- my username on my bank is my e-mail
address; correct?
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 91 of 145
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
UNITED STATES DISTRICT COURT - OFFICIAL CERTIFIED TRANSCRIPT
245
A.
Okay.
Q.
So I can type in my username, my e-mail address, and then
I can type in my password. And then when I click enter, I'm
going to be inside my bank account; correct?
A.
Yes. And then if you go open up a new tab and go to log
into Adobe, it may assume that you're using the Teldrin 23 or
using your e-mail address.
Q.
There's not a single event in the security log on this
computer that shows the resource as icloud.com; correct?
A.
No. It's saying that the identity was, in fact,
authenticated.
Q.
There's nothing in here that says the identity was
authenticated, is there?
A.
It's part of the security.
Q.
Right. And weren't --
A.
Not the event log.
Q.
Weren't these security logs, in fact, generated because
all three of these were failed attempts to log into Adobe
using the iCloud account, the iCloud identity?
A.
I don't see where it says it failed.
Q.
Well, have you looked at the -- at all of the codes that
were returned in the security event log?
A.
No. I'm only concerned about the identity of the e-mail
address.
Q.
And did you look up these return codes to determine if
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 92 of 145
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
UNITED STATES DISTRICT COURT - OFFICIAL CERTIFIED TRANSCRIPT
246
any of them are associated with a failed log-in attempt?
A.
I did not.
Q.
Okay. So you just don't know whether these were
successful or not?
A.
Well, it's in the log file, so I'm assuming -- I'm making
the opinion that they are, in fact, authenticated.
Q.
So your opinion is that every time something shows up in
the security log, it's a successful log in attempt?
A.
Under this situation, I am.
Q.
Okay. And so your opinion is that there's not security
logs generated when there's a failed attempt to log into an
account?
A.
Well, it wouldn't have the same event ID number.
Q.
You just testified you didn't look into any of these
codes or the event ID numbers.
A.
In the code -- in the event data box you're referring.
I'm referring to the event ID.
Q.
Okay. Well, let me just ask you this, Mr. Persinger: If
one -- if this event was a successful log in, why would there
be two more right afterwards, seconds later?
A.
That's something you'd have to ask the user.
Q.
Okay. And you had --
MS. CHAIKEN: You can go back to F23I, please, real
quick.
BY MS. CHAIKEN:
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 93 of 145
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
UNITED STATES DISTRICT COURT - OFFICIAL CERTIFIED TRANSCRIPT
247
Q.
This was the exhibit that you attached to your report
that showed all of the activity inside of the mail account for
the Yahoo account; correct?
A.
It is.
Q.
It showed access to messages; correct?
A.
Ask that again, please.
Q.
This -- your printout, your exhibit showed that there
were messages being read in the Yahoo account?
A.
That's correct.
Q.
And that the account -- the user was actually interacting
with the Yahoo mail account?
A.
There was human interaction with it, yes.
Q.
You don't have a similar printout for the iCloud account;
correct?
A.
I do not.
Q.
Now, the security event log, that's a log of all
security-related events, like logging into or logging out of
accounts; correct?
A.
Typically, yes.
Q.
And you --
MS. CHAIKEN: If we can go back to F23R, please.
BY MS. CHAIKEN:
Q.
These are the three events that you found that referenced
teldrin23@icloud.com; correct?
A.
Correct.
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 94 of 145
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
UNITED STATES DISTRICT COURT - OFFICIAL CERTIFIED TRANSCRIPT
248
Q.
In your direct testimony you said that you reviewed
2,200, approximately, pages of event logs; correct?
A.
That your office provided, yes.
Q.
When did you review those?
A.
Wednesday I think it was.
Q.
Okay. And before you reviewed that, you did your own
independent analysis of the computer; correct?
A.
That's correct.
Q.
That's how you generated your report?
A.
Correct.
Q.
And you looked at security event logs because that's
where you pulled this data from; correct?
A.
Well, I didn't look at the entire log. I only looked at
what I got the match to the e-mail address of.
Q.
Okay. And at that time what you said in your report was
the event viewer logs are chronologically organized by date
and are set to be quickly purged, didn't you?
A.
That's correct.
Q.
And you later again said -- you said the event viewer
logs -- when you were talking about the iCloud account, Event
viewer logs produced a positive return; however, because these
logs are set to quickly purge, the list is limited; correct?
A.
Correct.
Q.
Okay. So you were saying you just didn't find a lot of
references to the iCloud account because it was purging;
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 95 of 145
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
UNITED STATES DISTRICT COURT - OFFICIAL CERTIFIED TRANSCRIPT
249
correct?
A.
Correct.
Q.
And what was your basis for saying that it was purging?
A.
The event viewer log file is only 20 megs in size. This
particular hard drive was 256 gigs. So you would roughly have
12,800 copies of that event viewer log file if it kept
everything. So because of that, the 20 meg file does quickly
FIFO, first-in, first-out, purges information.
Q.
And, Mr. Persinger, the laptop that you reviewed, it had
a software install update on April 30th of 2020; correct?
A.
I don't recall if it did.
Q.
Would it refresh your recollection to look at your
report?
A.
Yes, it would.
Could you ask the question again now that I've seen that.
Q.
The laptop that you reviewed had new software installed
on April 30th, 2020; correct?
A.
Correct.
Q.
And I just -- I want to make sure this is clear to the
jury with this event viewer issue because, again, your -- what
you said in your report was that the reason there aren't more
iCloud references on this laptop is because they were quickly
purging; correct?
A.
Correct.
MS. CHAIKEN: Your Honor, I'm going to move to admit
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 96 of 145
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
UNITED STATES DISTRICT COURT - OFFICIAL CERTIFIED TRANSCRIPT
250
Government Exhibit 2983, which was previously authenticated by
Candace Hunter.
MS. WEBSTER: No objection.
MR. MARSHALL: No objection.
THE COURT: It's admitted.
BY MS. CHAIKEN:
Q.
Mr. Persinger, I'm going to bring you a physical copy of
it, okay, so that the jury can see the event viewer log.
MS. CHAIKEN: If you could publish 2983 on the Trial
Director as well, please.
BY MS. CHAIKEN:
Q.
2983 is the event -- the security -- just the security
event logs for this computer, okay.
That's what you previously reviewed on Wednesday?
A.
I believe so, yes.
Q.
And you determined that those are the security event logs
from this computer?
A.
Correct.
MS. CHAIKEN: And if you can go to page 1, please,
Ms. Holland. And if you can just pull out that top -- top
line, please, that top entry.
BY MS. CHAIKEN:
Q.
This is the first security event log that's in this
2,200-page document; correct?
A.
Yes. Yes.
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 97 of 145
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
UNITED STATES DISTRICT COURT - OFFICIAL CERTIFIED TRANSCRIPT
251
Q.
And it's dated April 30th of 2020?
A.
That's what's in there, yes.
Q.
And that's the date that the software was installed, the
new software on the computer?
A.
That's correct.
Q.
So this -- the event viewer log goes all the way back to
the very first day that this computer had this software on it;
correct?
A.
It appears so, yes.
Q.
Nothing was purged; right?
A.
Well, I don't know. I'd have to look through and look at
each event log to see, you know, what's being recorded, what's
not because Microsoft may not keep each individual ID, it may
only purge certain portions of that while maintaining the
integrity of the file.
MS. CHAIKEN: If you could go down to 1,134, please.
BY MS. CHAIKEN:
Q.
This is about halfway through the event viewer log;
correct, Mr. Persinger?
A.
I would agree with that.
MS. CHAIKEN: If you can pull out that third entry
down, please.
BY MS. CHAIKEN:
Q.
This is one of those references to the Teldrin 23 iCloud
account in Adobe; correct?
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 98 of 145
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
UNITED STATES DISTRICT COURT - OFFICIAL CERTIFIED TRANSCRIPT
252
A.
Yes.
Q.
This is one of the ones that you found?
A.
It is.
Q.
And it's surrounded by other security event log files,
isn't it?
A.
When you say "surrounded," you mean top and bottom?
Q.
Well, there's about 1,133 pages before it, and, you know,
about 900 pages after it of other event logs; correct?
A.
Correct.
Q.
And looking at this 2,200 pages of event viewer logs, you
don't have a basis to say anything was set to be purged on
this device; correct?
A.
I know that Microsoft does that based on only its file
size, but it could be also based on the event ID number. What
you've given me is the plethora of all the event IDs, not
specific to the ID itself.
Q.
And you also reviewed a 16,000-page event log that was
not just the security events, but other kind of events as
well; correct?
A.
That's correct.
Q.
And those were all also on the computer, just going back
to April 30th; correct?
A.
Correct.
Q.
16,000 pages of event logs?
A.
Correct.
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 99 of 145
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
UNITED STATES DISTRICT COURT - OFFICIAL CERTIFIED TRANSCRIPT
253
Q.
Okay. And despite that, your opinion here is that there
must have been something that was deleted that said iCloud in
it. Am I understanding that?
A.
That's correct, I mean, if we want to make the leap that
a person only tried three times to get into the account and
then stopped, based on what you're saying. I say that the
account was authenticated three times. They could have left
it open, it wouldn't rerecord into the service -- into the
event log.
MS. CHAIKEN: May I have a moment, Your Honor?
THE COURT: Certainly.
MS. CHAIKEN: Can we pull F23F back up, please.
F23F. Nope, not what I meant. Sorry. F23R.
BY MS. CHAIKEN:
Q.
I just want to make sure that this is totally clear to
the jury, Mr. Persinger.
You keep referencing someone being in the account.
Is it your testimony that these event logs here for
auth.services.adobe.com were caused by someone being logged
into the Teldrin 23 iCloud e-mail account?
A.
I'm saying somebody used that e-mail address and was
authenticated.
Q.
You are not saying that someone logged into the e-mail
account teldrin23@icloud.com with that e-mail address and the
password for the e-mail account; correct?
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 100 of 145
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
UNITED STATES DISTRICT COURT - OFFICIAL CERTIFIED TRANSCRIPT
254
A.
Correct. I'm saying it was authenticated. Wherever
you're at, it's -- obviously it's authenticated.
Q.
And it was authenticated on Adobe; correct?
A.
Well, I can't say that. I don't have the Adobe log files
to make that determination.
Q.
So basically what you're saying is that somebody typed in
the letters teldrin23@icloud.com on this computer somewhere
where you don't know; correct?
A.
That part I would agree with, but I'm saying they're
authenticated. Wherever they're at, they're authenticated.
Q.
But you testified you did not look at any of these event
codes to determine if they were actually authenticated;
correct?
A.
That's correct. But it's in the event security log, it's
my opinion that it was authenticated.
MS. CHAIKEN: I have nothing further, Your Honor.
Thank you.
THE COURT: Mr. Marshall, did you have anything?
MR. MARSHALL: No, Your Honor.
THE COURT: Ms. Webster, any redirect?
REDIRECT EXAMINATION
BY MS. WEBSTER:
Q.
Mr. Persinger, can you explain what you mean by it was
authenticated, the iCloud account being authenticated?
A.
Username and password are generally the two elements
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 101 of 145
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
UNITED STATES DISTRICT COURT - OFFICIAL CERTIFIED TRANSCRIPT
255
required to authenticate somebody.
Q.
Okay. So your opinion is that someone logged into -- had
the username teldrin23@icloud.com and then a password for that
e-mail address; is that right?
A.
To get authenticated, yes.
Q.
So the government put this stack of paper in front of you
to talk about the event log; is that correct?
A.
Yes.
Q.
And I think the implication is that the files were not
quickly purging. Is that what you understood that to -- that
line of questioning to be about?
A.
That's correct.
Q.
Explain what you mean by the log files quickly purging,
despite the fact that there are 2,200 pages of it.
A.
Well, it may find an event log ID number and that
information purges simply because if a person's logged in,
stays logged in, the log file doesn't need to rerecord that
information, so slowly it will purge.
Q.
And so you're not saying -- when you say that the log
files purge quickly, you're not saying that there's no record
of all the different log files; right? You're saying that for
the one event ID that that file purges and is re-created so
there's only one of those. Am I understanding that correctly?
A.
That's correct.
Q.
So the fact that there are 2,200 other pages of other log
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 102 of 145
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
UNITED STATES DISTRICT COURT - OFFICIAL CERTIFIED TRANSCRIPT
256
files has nothing to do with your opinion that for this log
file it can quickly purge and so that it would only be there
once?
A.
That's correct.
Q.
Okay. You were also asked about the Internet history
going back to 2018. Do you remember that line of questioning?
A.
I remember.
Q.
And so there was a suggestion, I think, that if there
were prior log-ins from -- from May of 2020, you would see
that; is that right?
A.
That's what the -- yes.
Q.
That was suggested.
A.
Yes.
Q.
And is that accurate?
A.
No, it's not.
Q.
Why not?
A.
FIFO, again, first-in, first-out. Internet history can
purge itself. It can take certain entries and they'd be gone.
Q.
Okay. So, again, because there's -- the fact that there
are other entries on the web history going back to 2018 does
not change your analysis about the Yahoo log-in; is that
right?
A.
That's correct.
Q.
Because even if there were prior -- prior log-ins on that
Yahoo account, then there still may be only the one file even
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 103 of 145
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
UNITED STATES DISTRICT COURT - OFFICIAL CERTIFIED TRANSCRIPT
257
if there are other notations or other logs for other websites;
is that right? Did I explain that correctly?
A.
Right. Other entries.
Q.
Other entries; is that correct?
A.
That's correct.
Q.
Okay. And do you remember a series of questions where
you looked at the files that were on this computer and then
you looked at the WhatsApp messages?
A.
Yes.
Q.
And so do you recall that the files were downloaded on --
or were accessed on the computer and then they were sent via
WhatsApp?
A.
Correct.
Q.
Correct? Okay.
And so does that suggest, though, that you remember that
they were being sent by Darrell Thomas, right, or that's who
had access to the WhatsApp messages?
A.
Correct. That was the inference.
Q.
Okay. And so the fact that those messages -- those files
were being accessed on the computer and then being sent via
WhatsApp, does that suggest to you that Darrell Thomas is the
one using that laptop?
A.
It may suggest it, but it doesn't actually say that
that's the person in the seat at the keyboard.
Q.
Okay. Does the fact that the files, right, are being
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 104 of 145
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
UNITED STATES DISTRICT COURT - OFFICIAL CERTIFIED TRANSCRIPT
258
downloaded and then sent to Teldrin Foster's WhatsApp account,
does that suggest that Teldrin Foster is the one accessing the
computer too?
A.
No.
Q.
It sort of supports the opposite; correct?
A.
Yes.
Q.
Okay. I think you were asked about what sort of devices
that you had looked at; is that right?
A.
Correct.
Q.
And do you recall that when I reached out to you about
working with us on this case, I was concerned about the format
of the materials that had been provided to us?
A.
That's correct.
Q.
Because I could not view them or make sense of them; is
that right?
A.
Correct.
Q.
So I felt like I needed an expert to help me understand
what was on the devices; is that correct?
A.
Correct.
Q.
So you're familiar with Cellebrite; is that right?
A.
I am.
Q.
So the fact that -- and is that program -- are the
reports that you get from Cellebrite, is that easily
accessible, is that something a layperson can use?
A.
A layperson can use.
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 105 of 145
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
UNITED STATES DISTRICT COURT - OFFICIAL CERTIFIED TRANSCRIPT
259
Q.
So is it fair to say that I didn't send you the
Cellebrite report because I could access that?
MS. CHAIKEN: Your Honor, objection. Leading and
calls for speculation.
MS. WEBSTER: I can rephrase the question.
THE COURT: Very well.
BY MS. WEBSTER:
Q.
To your knowledge, did I ask you to look at any devices
that I can view and access?
A.
No, there was no reason to.
Q.
And does anything about what happens on other devices or
anything else change what you found about on this device?
A.
It does not.
Q.
Okay. And if there are other devices out there that have
other information, you don't know about that, right, because
you -- we don't know what else -- what other devices are out
there to be seized; is that right?
A.
Correct.
Q.
So we are limited to the devices that have been provided;
is that right?
A.
That's correct.
Q.
You said something about a LNK file. Can you explain
what that is?
A.
So it's a L-N-K, a .lnk. Just like a Word document might
be .doc or .docx, a .lnk is a shortcut file. So if you
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 106 of 145
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
UNITED STATES DISTRICT COURT - OFFICIAL CERTIFIED TRANSCRIPT
260
double-click on a shortcut file, it opens whatever that
shortcut file is designed to do. But the shortcut file is
actually generated after a person has already done the action
to create the shortcut. So, again, the action is first and
then the shortcut is generated.
Q.
And is that what you were referring to on the exhibit
shown earlier?
A.
Correct.
Q.
So there was a shortcut to the Yahoo log-in, is that what
you were saying?
A.
That's correct.
MS. WEBSTER: Okay. Your Honor, can I have one
second?
THE COURT: Certainly.
MS. WEBSTER: Your Honor, I am -- well, I need to --
I'm sorry. Can we approach or can we take up a matter outside
the presence of the jury?
THE COURT: Sure. Let's try to approach, if it might
be quick. That might save us some time.
(Bench conference commenced with the court reporter
present.)
MS. WEBSTER: Your Honor, in the pretrial motion you
had excluded his testimony about the statement made by Gena
Pyfrom-Foster, that she had access or that she was aware of
his password. I think the government has opened the door to
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 107 of 145
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
UNITED STATES DISTRICT COURT - OFFICIAL CERTIFIED TRANSCRIPT
261
that evidence coming in by suggesting that there was no
information in this case that would be relevant to the Apple
Continuity issue, that it just has no relevance.
That is -- that was the point of that statement. He
relied on it. I can lay a foundation that it is material,
that he relies on it in his expert testimony. And I think the
door has been opened at this point.
MS. CHAIKEN: Your Honor, he has -- he offered an
opinion that has no basis in the evidence that Apple
Continuity is a product that exists. I crossed him on it and
they're now trying to use the fact that I crossed him on an
opinion that was not based on any materials in this case to
say that I opened the door to admission of the hearsay
statement that was what they were trying to back-door in for
that opinion in the first place.
He didn't say anything about reviewing anything about
Apple Continuity. He just said it. I crossed him on it. It
didn't open the door to anything.
MS. WEBSTER: But the whole reason it was in the
report, which everyone knows, is because he had seen the
information because it was provided. And that was the basis
for asking him about it and opining about it. So at this
point, the government was aware of that as we took that up,
and so by saying that there's no basis in the case, there is a
basis in the case because the witness -- there's the interview
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 108 of 145
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
UNITED STATES DISTRICT COURT - OFFICIAL CERTIFIED TRANSCRIPT
262
where she says that she had the password.
MS. CHAIKEN: Your Honor, all she said in the
interview was that his regular password was player34. She
said nothing about having Apple Continuity. She said nothing
about using that password to log in to any Apple devices that
had his information on it, let alone an Apple device that has
Apple Continuity --
MS. WEBSTER: Every --
MS. CHAIKEN: -- on it. It has nothing to do -- it's
just an attempt to get rank hearsay in.
MS. WEBSTER: Which your --
MS. CHAIKEN: It's circular. There's no evidence
that -- there's no evidence that she had Apple Continuity or
that he had Apple Continuity. The only basis for that is the
hearsay statement that his password was player34, which is --
THE COURT: Ms. Webster, anything else?
MS. WEBSTER: That is the evidence. He had an iPhone
and Apple Continuity is on every device. And so she said I
had access to phone -- I had access to every -- to his phone
through this password.
And under 703 an expert can testify to hearsay if he
relied on it. Under 703 you can -- an expert can testify to
hearsay when he relies on it. And I can absolutely lay a
foundation that he would rely on that to make a conclusion.
THE COURT: Just like with the last one, I've got to
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 109 of 145
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
UNITED STATES DISTRICT COURT - OFFICIAL CERTIFIED TRANSCRIPT
263
get underneath this. I'm not going to do it real quick here
at the bench conference. I want to work through it and we'll
see if we can get it done this evening or not.
(Bench conference complete.)
THE COURT: Déjà vu. Just like with the last one, we
were hoping to have a quickie over there and figure it out,
but we weren't able to. So I'm going to have to have you go
to the jury room. I'm cognizant of the hour, but I can't let
you leave yet this evening. I'm sorry. See you hopefully
shortly.
(The jury exited the courtroom at 4:59 p.m.)
THE COURT: If I can have the witness exit the
courtroom, please. Thank you.
(Witness excused from the courtroom.)
THE COURT: You can be seated. Give me a moment.
All right. Let me take a look at the pretrial motion
and go back to the pretrial ruling. Which motion was that in?
I assume it's the government's motion in limine somewhere?
MS. CHAIKEN: It wasn't in the motion in limine, Your
Honor, because we didn't get the report until after the motion
in limine deadline. So it was a stand-alone motion to -- it
was the motion to compel those scripts. And the second part
of that motion was the hearsay issue.
THE COURT: Okay. I'm just -- I was trying to pull
it up. I don't think that has a docket number.
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 110 of 145
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
UNITED STATES DISTRICT COURT - OFFICIAL CERTIFIED TRANSCRIPT
264
MS. CHAIKEN: Yeah, we need to get it.
MS. DURRETT: 829.
MS. CHAIKEN: 829? I'm not sure. I don't have the
docket pulled up. We'll pull it up.
THE COURT: If somebody could find that for me.
And my next question is going to be, what exactly was
my ruling?
MS. CHAIKEN: Your ruling excluded --
THE COURT: And we can go from there.
I mean, I know my ruling was to disallow it, but I'd
like to know what I said about disallowing it.
MS. WEBSTER: You said it was hearsay, Your Honor.
And it is Document 829.
THE COURT: All right. I have a copy of 829. Bear
with me.
All right. I've refreshed my memory about the
motion.
I guess, Ms. Webster, and you've already discussed
it at the bench conference, and Ms. Chaiken has already
responded, but I'm struggling to see how this changes things.
MS. WEBSTER: Because, Your Honor, when we
questioned -- or when I questioned Mr. Persinger about the --
about Apple Continuity, it's clear in the report that it is
based on the -- that it is based on the idea that
Ms. Pyfrom-Foster had access to his phone. Like, that is the
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 111 of 145
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
UNITED STATES DISTRICT COURT - OFFICIAL CERTIFIED TRANSCRIPT
265
reason that we had asked him about it. Or in -- and we know
that she said that she had his password at some point.
And so I had asked him, what would that do. What is
the purpose -- or, like, what would that allow her to access.
And so he made an opinion, based on this testimony, right,
accessing one device can give you access to another device,
especially if Apple Continuity is used or a person used the
same password for all devices.
And so then -- so I did not elicit any opinion about
the underlying facts, right, in accordance with the Court's
order. But then the government stood up and said there's no
basis in this case for concluding that Apple Continuity might
be relevant here.
But there is a basis in this case. It's just that we
haven't been allowed to present it. And so by saying there's
no basis in this case for concluding that it might apply here,
I think they opened the door. I think that it was admissible
under Rule 703 because the law is clear there's -- I can cite
to you United States v. Williams, 447 F.2d 1285. Experts can
rely on hearsay in forming their opinions.
THE COURT: That's never been in dispute. I mean,
that's just a general black letter principle, I think.
But go ahead.
MS. WEBSTER: So I can lay the foundation with
Mr. Persinger on the stand. I can say when you were making
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 112 of 145
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
UNITED STATES DISTRICT COURT - OFFICIAL CERTIFIED TRANSCRIPT
266
expert opinions about the Apple Continuity or the likelihood
that Apple Continuity is an issue, did you have information
from this case to make that -- to make an opinion about that.
And we have information in this case to make an opinion about
that and we had kept it out -- or the Court had kept it out.
And now the Court -- the government stood up and said there's
no evidence in this case about it. But there is evidence in
this case about it. And so we should be able to present that
to the jury at this point.
Because now -- if they had stood up and not said
anything, right, to suggest that there was no evidence that
would support it, then that would be one thing. But they
didn't just not talk about that, they said there is no
evidence when that's not true.
THE COURT: Ms. Chaiken?
MS. CHAIKEN: Your Honor, this is exactly the type of
evidence that Rule 703 is designed to preclude. The statement
at issue here is a fleeting statement by Gena Pyfrom that
Teldrin Foster's regular password was player34. She never
said she logged into an iCloud account, an Apple device, a
phone, an iPad, anything that even has Apple Continuity on it.
So the idea that there's evidence we're trying to
keep the jury from hearing that's somehow relevant to this
opinion is baseless. But Rule 703 has basically three
premises before hearsay can be put before the jury.
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 113 of 145
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
UNITED STATES DISTRICT COURT - OFFICIAL CERTIFIED TRANSCRIPT
267
Number one, the expert must base their opinion on
facts or data in the case the expert has been made aware of or
personally observed. He has not offered an opinion that
anyone had Apple Continuity, that anyone was using Apple
Continuity, that there was Apple Continuity on any of Teldrin
Foster's devices, that Apple Continuity was active and was
being used such that his accounts were on multiple places.
All he has done is opine that Apple Continuity is a
feature that exists. And that was in his report before we
moved to exclude it. He did not offer an opinion that Apple
Continuity was something that Gena Pyfrom used on Teldrin
Foster's accounts.
The second part is that the opinion can be admitted
if the experts in the particular field would reasonably rely
on those kinds of facts or data in forming an opinion on the
subject. And Mr. Persinger has testified repeatedly that what
he looks at is the data on the device. He didn't testify that
any of his opinions in this case were formed based on what
anybody said about who was using the device. In fact, he said
even based on the fact that it was seized from Darrell
Thomas's house, he can't say that it was Darrell Thomas
because he's just looking at the data.
And a statement by someone who has now been convicted
of fraud to a law enforcement officer in an interview about
whether or not they have someone's password is not the type of
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 114 of 145
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
UNITED STATES DISTRICT COURT - OFFICIAL CERTIFIED TRANSCRIPT
268
evidence that a forensic expert relies on in forming opinions
about what may or may not exist on a device that he is
forensically analyzing.
The third part is that a -- the -- if the facts or
data would otherwise be inadmissible, which I think here we
all agree they would be, because it is hearsay, the proponent
of the opinion may disclose them to the jury only if their
probative value in helping the jury evaluate the opinion
substantially outweighs their prejudicial effect.
And here the jury can evaluate Mr. Persinger's
opinion about what Apple Continuity is and how it works
without knowing what Gena Pyfrom-Foster said about the
password. The only reason why they want the jury to hear that
statement is because they don't have any evidence that there
was Apple Continuity operating across any devices. And
it's -- so that's not satisfied either.
And there's obviously a significant prejudicial
effect because Gena Pyfrom-Foster is not here. We can't
cross-examine her. She made a fleeting statement. We have no
idea what she meant, what she was talking about or even if she
was telling the truth.
THE COURT: All right. I agree with the government's
argument. I don't see any reason to change my earlier ruling.
Anything else, Ms. Webster, before we bring the
witness back in, back to the stand, and the jury back in?
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 115 of 145
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
UNITED STATES DISTRICT COURT - OFFICIAL CERTIFIED TRANSCRIPT
269
MS. WEBSTER: No, Your Honor.
THE COURT: All right. Thank you.
Let's do that, Officer, please. Grab the jury for
us. And if someone could grab the witness. Thank you.
MR. MARSHALL: Your Honor, I just have a quick, like,
administrative thing. Ms. Jackson had an issue with, when she
got close to 6:00 last night --
THE COURT: Yes. We'll make sure we get a CSO to
assist her this evening.
MR. MARSHALL: Okay.
THE COURT: Off the record.
(Off-the-record discussion.)
(Witness recalled to the stand.)
MS. WEBSTER: I have no further questions, for the
record.
THE COURT: Sir, they might be a minute or two if you
want to just sit and wait. Thank you. Y'all can.
(The jury entered the courtroom at 5:11 p.m.)
THE COURT: All right. Y'all can be seated. Thank
you.
MS. WEBSTER: I actually do have two more questions,
Your Honor. I'm sorry.
THE COURT: Go ahead, Ms. Webster.
BY MS. WEBSTER:
Q.
Mr. Persinger, to your knowledge, is an iCloud account
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 116 of 145
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
UNITED STATES DISTRICT COURT - OFFICIAL CERTIFIED TRANSCRIPT
270
generally associated with an Apple device?
A.
It is.
Q.
And how common is -- of a feature is Apple Continuity on
Apple devices?
A.
Well, it's becoming more and more common.
Q.
Increasingly common?
A.
Yes.
Q.
Is it in the majority of Apple devices?
A.
Yes.
MS. WEBSTER: No further questions, Your Honor.
THE COURT: Any recross?
MS. CHAIKEN: No, Your Honor. Thank you.
THE COURT: Mr. Marshall?
MR. MARSHALL: No, Your Honor.
THE COURT: All right. Sir, you can step down.
Thank you.
(Witness excused.)
THE COURT: All right, Counsel. I know, you know, we
started off midmorning when I explained to the jury that we
had some short witnesses and then one witness we were going to
take out of order as well, just some scheduling issues.
Have we now exhausted all of those persons, all of
those witnesses?
MS. CHAIKEN: Yes, Your Honor. We're back to Agent
Stites.
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 117 of 145
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
UNITED STATES DISTRICT COURT - OFFICIAL CERTIFIED TRANSCRIPT
271
MS. WEBSTER: I think so, yes.
THE COURT: Okay. All right. How far along are we
with Agent Stites?
MS. WEBSTER: I have a lot more, Your Honor.
THE COURT: I'm sorry?
MS. WEBSTER: I have a lot more.
THE COURT: Okay.
Ladies and gentlemen of the jury, it's not exactly a
democracy, but I just want to take your pulse. Are there any
of you that want to stick around here at 5:15 this evening and
hear more or would you rather just come back on Monday?
All right. No one's raising their hand to stick
around at 5:15 on Friday.
Ladies and gentlemen of the jury, we're concluding
our first week of this trial. We're moving on to the second
week.
Counsel, safe to say we're looking probably at a day
or two more of evidence versus four more days of evidence,
which might have been the earlier prognosis?
MS. CHAIKEN: Yes, Your Honor.
THE COURT: Okay.
So ladies and gentlemen of the jury, counsel had
informed me and I've just confirmed with them that we're
moving a little quicker than they had expected; therefore, it
might be that we're done with the evidence in this case the
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 118 of 145
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
UNITED STATES DISTRICT COURT - OFFICIAL CERTIFIED TRANSCRIPT
272
first part of next week. And then we'll, of course, hear
closing arguments and then you'll start your deliberations.
So things are moving a little bit more quickly, just
for your planning. That's not a promise of anything, but just
so you can kind of plan your lives based on the best available
information.
Thank you for being here. We will see you at 10:00
on Monday. You're reminded of your instructions for breaks,
including weekend breaks. Okay? Thank you.
(The jury exited the courtroom at 5:15 p.m.)
THE COURT: Y'all can be seated.
I've received Docket 912, the US's motion to admit
evidence of co-defendants' guilty pleas. When did we decide
the defense would be in a position to respond to that?
MS. WEBSTER: Your Honor, I think that you asked for
us to respond over the weekend, which we can certainly do. I
just want to propose a solution, but I haven't had a chance to
talk to the government about it. I don't know if you want us
to talk about it now?
THE COURT: Do you need to do that on the record or
do you just want to talk with the government and then report
to me?
MS. WEBSTER: We can talk.
THE COURT: And I understand you want to do that now
so you know if you're going to need to respond or not. So why
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 119 of 145
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
UNITED STATES DISTRICT COURT - OFFICIAL CERTIFIED TRANSCRIPT
273
don't we just go off the record for a moment where y'all can
have that conversation.
(Off-the-record discussion.)
MS. CHAIKEN: I think we're making progress in our
discussions. And it sounds like what we'd like to do is take
some time all to chew on it and talk about it. And by Sunday
at 10:00 Mr. Foster's counsel will either file a response or
we will notify the Court that we have an agreement, if the
Court is amenable to that timing.
THE COURT: That's fine.
MS. WEBSTER: Thank you, Your Honor.
THE COURT: Other than that issue, do we anticipate
anything else we'll need to discuss before we go on the record
with the witness at 10:00?
MS. CHAIKEN: No, Your Honor.
MS. WEBSTER: We have an issue that we would like to
talk about.
THE COURT: Well, I was asking if there were -- I
guess I'm trying to get -- I'm trying to get the index of
issues, not necessarily talk about all the issues right now.
So other than that issue, which y'all know if that's an issue
or not, it sounds like, at 10:00 on Sunday, what other issues
are there? And I'm not entertaining talking about all of them
yet, I'd like to at least know what the list is.
MS. WEBSTER: Okay. Excellent.
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 120 of 145
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
UNITED STATES DISTRICT COURT - OFFICIAL CERTIFIED TRANSCRIPT
274
So it also involves renewing a motion in limine that
we had filed. Yesterday when the government admitted evidence
about the money laundering count, which is the deposit into
the Pyfrom Exclusive Consulting account, the implication I
think was pretty clear that Teldrin Foster was ultimately
responsible for that.
But if you recall, at Ms. Pyfrom-Foster's sentencing
hearing, the government was very clear that she was
responsible for that deposit. Specifically there were
messages between her and Darrell Thomas about that deposit,
coordinating that deposit in the WhatsApp messages that
Mr. Foster didn't know about.
And so at this point I think that we are renewing our
motion to bring in the government's prior statements to show
that Ms. Pyfrom-Foster was responsible for that.
MS. CHAIKEN: My turn? Okay. Thanks, Your Honor.
Your Honor, at Ms. Pyfrom-Foster's sentencing
proceeding, Ms. Pyfrom-Foster had asserted, I can't remember
if it was in her letter or in her sentencing memorandum, that
the account that that money went into, the Pyfrom Exclusive
Consulting account, was opened as a result of identity theft
by Teldrin Foster. And she suggested that she knew nothing of
that account's existence. And we put in evidence to show the
Court that she opened the account and she knew that the
account was opened and she knew that the check was deposited
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 121 of 145
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
UNITED STATES DISTRICT COURT - OFFICIAL CERTIFIED TRANSCRIPT
275
into the account, so it was not identity theft by Mr. Foster.
That's a separate question from what that deposit was
for and who knew about it and who it went to. And Mr. Foster
admitted that in his interview, that that was a payment to him
that went through Gena Pyfrom-Foster's account because his
account got locked.
If Mr. Foster's counsel has a statement they've seen
that I made from Ms. Pyfrom-Foster's sentencing that that
payment was a payment to her that did not ultimately go to
Mr. Foster, I would like to see it. Maybe I'm forgetting it.
I've not reviewed that transcript.
But I know specifically that the reason why I
presented those materials to the Court was because she had
alleged she was a victim of identity theft and I was rebutting
that assertion from her, that she was a victim of identity
theft who knew nothing. And that, of course, went to the
3553(a) arguments related to her credibility.
And I don't think that the case law in the Second
Circuit, which the -- which Ms. Webster has cited in her
brief, which sets out a test that the Eleventh Circuit has not
adopted, but even if it had adopted that test, I don't think
that test is satisfied here because there has to be an actual
fundamental inconsistency where two things cannot be true.
THE COURT: Ms. Webster, anything else? I guess now
we've gotten more than just the headlines.
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 122 of 145
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
UNITED STATES DISTRICT COURT - OFFICIAL CERTIFIED TRANSCRIPT
276
MS. WEBSTER: I was about to say, I thought we
weren't supposed to be discussing it at this point.
I, you know, would like to have the opportunity to
present the -- more from the actual sentencing transcript and
the government's sentencing memo, but the -- I think they were
very clear at that sentencing hearing that she set up that
account for this purpose and communicated with Darrell Thomas
about receiving this specific deposit. And leaving the jury
with the instruction that that -- or with the implication that
did not happen is highly inconsistent with its prior
positions. I think it's a due process issue. And I think
that it is appropriate at this point to renew our motion in
limine.
And I will note that another court in this courthouse
has done something very similar in a very similar situation,
which was in our reply about our motion in limine.
THE COURT: Okay. Well, based on what you've stated
at least here this evening, I don't see any reason to amend my
earlier ruling, but you mentioned you wanted to show me more
specifics and I'd be happy to look at more specifics. Send
that over the weekend or we can address it Monday morning.
Given that we may have at least the motion to admit
the evidence of the guilty pleas to discuss Monday, why don't
we all plan to be here at 9:30. Okay.
Anything else from either side?
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 123 of 145
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
UNITED STATES DISTRICT COURT - OFFICIAL CERTIFIED TRANSCRIPT
277
MS. CHAIKEN: I'm just wondering, Your Honor, with
Juror 14, is he -- he's going to be back at 10:00 a.m. and
he's with us or --
THE COURT: Yes.
MS. CHAIKEN: Okay.
THE COURT: The procedure seems to be -- I think
Ms. Lee, he -- Sunday. And that it turns out Baby Reid goes
to school, so it's not as if he's going to be at the house
with his, perhaps, hopefully newly pregnant mother who can't
lift him up, but instead he goes to school. So he's going to
drop him off at school and be here by 10:00.
MS. CHAIKEN: Perfect.
THE COURT: Who knew? I feel like I haven't gotten
full information several times in that ordeal, but we
certainly all wish Juror 14 and his wife a big weekend.
Okay. Anything else?
(No response.)
THE COURT: No? All right. Y'all have a great
weekend. Take care. Get some rest.
(After a recess at 5:30 p.m., the proceedings were
continued as follows on February 12, 2024.)
- - - - -
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 124 of 145
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
UNITED STATES DISTRICT COURT - OFFICIAL CERTIFIED TRANSCRIPT
278
C E R T I F I C A T E
UNITED STATES DISTRICT COURT
NORTHERN DISTRICT OF GEORGIA
I do hereby certify that the foregoing pages are a true
and correct transcript of the proceedings taken down by me in
the case aforesaid.
This the 9th day of February, 2024.
________________________________
PENNY PRITTY COUDRIET, RMR, CRR
OFFICIAL COURT REPORTER
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 125 of 145
0
0 [2] - 189:6, 211:15
0012 [1] - 239:18
005 [2] - 189:21, 190:1
02 [1] - 238:16
1
1 [6] - 156:3, 158:25, 163:1, 227:4,
227:6, 250:19
1,133 [1] - 252:7
1,134 [1] - 251:16
1,790 [1] - 193:21
10 [3] - 165:2, 189:4, 219:15
100 [1] - 174:12
1001 [1] - 173:12
1003 [1] - 170:25
107 [2] - 193:20, 193:21
10:00 [6] - 272:7, 273:7, 273:14, 273:22,
277:2, 277:11
10:43:06 [1] - 173:10
10:52:43 [1] - 172:22
11 [1] - 219:15
11:43:06 [1] - 173:6
11:52 [1] - 172:15
11:52:43 [1] - 172:18
12 [2] - 241:2, 277:21
12,800 [1] - 249:6
120 [2] - 211:13, 211:16
1243 [3] - 237:21, 238:20, 239:4
1285 [1] - 265:19
12:20 [1] - 197:10
12:30 [1] - 170:9
14 [2] - 277:2, 277:15
14:39:55 [2] - 171:21, 171:25
15 [2] - 165:2, 169:1
16 [6] - 208:25, 212:16, 212:19, 213:6,
213:13, 229:21
16,000 [1] - 252:24
16,000-PAGE [1] - 252:17
16,600 [1] - 200:19
17TH [1] - 171:17
19 [1] - 172:2
19TH [8] - 171:18, 224:15, 224:19,
225:5, 227:14, 228:18, 230:7, 240:23
1:20-CR-00296-JPB [1] - 155:5
1:44 [1] - 157:1
1B15 [1] - 219:21
1B8 [1] - 219:17
2
2 [6] - 156:5, 159:1, 189:5, 227:4, 227:6,
233:1
2,044 [1] - 194:22
2,098 [1] - 194:23
2,200 [5] - 200:18, 248:2, 252:10,
255:14, 255:25
2,200-PAGE [1] - 250:24
20 [3] - 169:2, 249:4, 249:7
20-PLUS [1] - 198:1
200 [1] - 206:19
2000 [2] - 176:2, 178:6
2001 [1] - 178:6
2007 [1] - 176:2
2015 [1] - 176:1
2018 [5] - 241:5, 241:7, 241:13, 256:6,
256:20
2018.PDF [2] - 239:16, 240:1
2020 [19] - 162:6, 171:17, 172:14,
172:21, 173:1, 175:18, 195:8, 197:11,
197:18, 224:15, 224:19, 227:14,
234:21, 235:11, 240:23, 249:10,
249:17, 251:1, 256:9
2021 [1] - 162:6
2024 [4] - 155:11, 174:3, 277:21, 278:9
20TH [3] - 172:14, 172:18, 172:21
21 [1] - 172:13
21:31 [1] - 227:14
22ND [2] - 197:10, 197:18
23 [6] - 186:22, 235:15, 244:14, 245:6,
251:24, 253:20
2300 [1] - 237:12
2330 [1] - 238:9
2334 [1] - 238:11
2338 [1] - 227:25
2338A [2] - 230:2, 230:5
2339 [1] - 239:8
2339A [1] - 240:7
23I [1] - 194:6
2428 [2] - 234:18, 235:2
24TH [1] - 195:8
256 [1] - 249:5
26 [1] - 229:21
2601 [1] - 189:3
294 [1] - 234:8
2954 [2] - 171:5, 171:16
2983 [3] - 250:1, 250:9, 250:12
2:09 [1] - 168:12
2:31 [2] - 168:13, 169:2
2:34 [1] - 170:5
2:39:55 [2] - 171:18, 171:19
3
3 [3] - 161:10, 161:11, 188:11
30 [1] - 172:25
3015 [1] - 168:18
307 [1] - 237:12
30TH [5] - 195:8, 249:10, 249:17, 251:1,
252:22
313 [2] - 236:24, 237:13
31ST [1] - 173:1
32,000 [1] - 181:19
33 [1] - 184:1
335 [1] - 239:9
336 [1] - 239:9
33B2E3D2 [2] - 237:3, 237:18
344 [1] - 190:16
279
35,000-PAGE [1] - 163:13
3500 [1] - 178:11
3553(A [1] - 275:17
360 [2] - 211:13, 211:15
37 [1] - 189:6
378 [1] - 238:12
379 [1] - 238:12
381 [1] - 238:12
3:22 [1] - 202:25
3:23 [1] - 203:1
3:31 [2] - 203:2, 203:4
3:39 [1] - 172:8
3:39:55 [1] - 172:6
3:48 [1] - 214:1
3:55 [1] - 215:3
4
4 [6] - 163:19, 170:18, 170:21, 188:3,
191:14, 224:12
403(B [1] - 158:11
447 [1] - 265:19
45 [2] - 194:24, 197:10
473.43.127.162 [1] - 189:1
4:59 [1] - 263:11
5
5 [4] - 155:6, 165:2, 191:15, 234:7
50 [1] - 217:2
524 [1] - 189:5
5:11 [1] - 269:18
5:15 [3] - 271:10, 271:13, 272:10
5:30 [1] - 277:20
6
6 [3] - 236:24, 239:7, 239:8
650 [1] - 178:18
69D [1] - 189:4
6:00 [1] - 269:7
7
7 [3] - 189:5, 238:10, 238:11
700 [1] - 178:18
703 [5] - 262:21, 262:22, 265:18,
266:17, 266:24
8
8 [4] - 185:4, 219:11, 219:23, 238:8
8200 [1] - 189:4
8218 [4] - 237:22, 238:20, 238:23, 239:2
829 [4] - 264:2, 264:3, 264:13, 264:14
9
9 [4] - 155:11, 243:3, 243:7, 243:18
90 [1] - 1:5
900 [1] - 252:8
902.11 [1] - 173:12
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 126 of 145
911 [1] - 181:12
912 [1] - 272:12
9:30 [1] - 276:24
9TH [2] - 174:3, 278:9
A
A.M [4] - 172:18, 173:6, 197:10, 277:2
A166 [1] - 237:18
ABACUS [3] - 239:16, 239:25, 240:9
ABILITIES [1] - 216:3
ABLE [28] - 158:19, 160:5, 167:20,
183:24, 185:15, 187:19, 187:25,
188:20, 189:9, 190:23, 191:12,
191:24, 192:2, 195:16, 198:12,
199:20, 200:11, 200:16, 200:22,
201:23, 202:1, 206:6, 207:12, 209:12,
210:19, 212:21, 263:7, 266:8
ABSENCE [1] - 234:3
ABSOLUTELY [2] - 202:8, 262:23
ACCESS [23] - 185:1, 195:7, 201:8,
201:9, 201:18, 201:19, 205:1, 210:14,
227:3, 229:12, 236:8, 236:17, 244:2,
247:5, 257:17, 259:2, 259:9, 260:24,
262:19, 264:25, 265:4, 265:6
ACCESSED [9] - 187:5, 191:25, 192:12,
195:14, 195:18, 227:3, 230:14,
257:11, 257:20
ACCESSES [1] - 224:9
ACCESSIBLE [1] - 258:24
ACCESSING [11] - 191:12, 191:23,
227:10, 227:11, 227:16, 227:17,
237:9, 242:25, 244:9, 258:2, 265:6
ACCORDANCE [1] - 265:10
ACCOUNT [66] - 191:16, 192:12, 195:2,
195:14, 195:22, 196:8, 196:16,
197:12, 197:14, 201:9, 205:23, 206:2,
218:18, 218:25, 223:24, 224:1,
224:10, 224:17, 224:21, 225:11,
225:20, 226:21, 227:3, 227:11,
230:11, 230:15, 235:16, 242:25,
243:11, 243:21, 244:1, 244:9, 244:12,
244:17, 245:4, 245:19, 246:12, 247:2,
247:3, 247:8, 247:10, 247:11, 247:13,
248:20, 248:25, 251:25, 253:5, 253:7,
253:17, 253:20, 253:24, 253:25,
254:24, 256:25, 258:1, 266:20,
269:25, 274:4, 274:20, 274:21,
274:24, 274:25, 275:1, 275:5, 275:6,
276:7
ACCOUNT'S [1] - 274:23
ACCOUNTS [5] - 216:1, 223:16, 247:18,
267:7, 267:12
ACCURATE [4] - 175:15, 176:10, 199:3,
256:14
ACHIEVED [1] - 208:22
ACROBAT [3] - 241:22, 241:24, 242:1
ACTION [3] - 192:6, 260:3, 260:4
ACTIVE [5] - 205:5, 205:22, 205:25,
206:9, 267:6
ACTIVITY [2] - 190:6, 247:2
ACTUAL [2] - 275:22, 276:4
ADAM [5] - 189:5, 189:6, 239:18
ADD [1] - 175:16
ADDITIONAL [3] - 163:1, 166:17, 167:7
ADDITIONALLY [1] - 162:17
ADDRESS [37] - 157:7, 168:9, 186:17,
186:18, 187:5, 187:8, 187:25, 188:17,
188:19, 188:23, 189:9, 189:11,
189:16, 190:7, 190:10, 190:13,
190:22, 190:24, 191:4, 191:15, 192:3,
193:2, 193:22, 195:18, 200:23,
236:13, 243:13, 243:15, 244:25,
245:2, 245:7, 245:24, 248:14, 253:21,
253:24, 255:4, 276:21
ADDRESSED [1] - 164:14
ADDRESSES [4] - 186:19, 188:20,
199:2, 200:24
ADEQUATE [1] - 166:5
ADJOURNED [1] - 168:11
ADJUST [1] - 175:15
ADMINISTRATIVE [1] - 269:6
ADMISSIBLE [1] - 265:17
ADMISSION [1] - 261:13
ADMIT [7] - 170:25, 173:11, 183:1,
185:18, 249:25, 272:12, 276:22
ADMITTED [13] - 171:6, 171:15, 173:19,
182:16, 183:5, 185:22, 186:10,
189:19, 228:10, 250:5, 267:13, 274:2,
275:4
ADOBE [17] - 241:20, 241:22, 241:24,
242:1, 242:7, 242:9, 242:10, 242:13,
242:17, 242:20, 244:1, 244:15, 245:6,
245:18, 251:25, 254:3, 254:4
ADOBE'S [1] - 241:17
ADOBE.COM [1] - 242:16
ADOPTED [2] - 275:21
AFFECTED [1] - 175:19
AFORESAID [1] - 278:8
AFTER [1] - 1:7
AFTERNOON [6] - 177:5, 177:6, 177:19,
177:20, 217:19, 217:20
AFTERWARDS [1] - 246:20
AGENT [6] - 157:2, 158:1, 159:10,
159:16, 270:24, 271:3
AGENT [2] - 159:25, 168:19
AGO [5] - 165:2, 178:5, 212:22, 212:23
AGREE [11] - 230:12, 231:2, 231:14,
235:10, 235:17, 237:23, 242:21,
251:20, 254:9, 268:6, 268:22
AGREEMENT [1] - 273:8
AHEAD [5] - 162:3, 175:6, 217:16,
265:23, 269:23
ALBUM [1] - 184:1
ALIGN [1] - 232:6
ALLEGED [1] - 275:14
ALLOW [2] - 206:1, 265:4
ALLOWED [1] - 265:15
ALLOWS [7] - 181:9, 181:12, 181:22,
184:7, 198:1, 198:8, 203:16
280
ALMOST [3] - 194:4, 201:13, 214:14
ALONE [3] - 228:7, 262:6, 263:21
ALPHA [1] - 211:13
ALPHA'S [1] - 211:14
ALPHANUMERIC [1] - 189:7
AMENABLE [1] - 273:9
AMEND [1] - 276:18
AMERICA [1] - 155:4
AN [1] - 1:2
ANALYSIS [15] - 158:11, 176:6, 176:9,
177:23, 192:20, 206:24, 211:9,
211:25, 213:5, 216:20, 220:15,
234:14, 237:24, 248:7, 256:21
ANALYST [2] - 162:9, 164:4
ANALYZE [11] - 180:10, 180:12, 181:22,
184:7, 184:12, 220:11, 220:12, 221:8,
221:25, 227:20, 236:5
ANALYZED [5] - 220:19, 221:11,
229:16, 238:3, 238:5
ANALYZING [1] - 268:3
AND [3] - 1:4, 1:7, 155:6
ANN [1] - 155:18
ANN'S [1] - 160:20
ANSWER [1] - 206:4
ANSWERED [1] - 206:7
ANTICIPATE [1] - 273:12
ANY [1] - 1:9
APOLOGIES [1] - 170:9
APOLOGIZE [1] - 170:11
APP [1] - 204:19
APPEAR [4] - 174:9, 174:13, 196:22,
233:11
APPEARANCES [1] - 155:13
APPEARED [1] - 187:20
APPLE [47] - 203:11, 203:15, 203:16,
204:1, 204:2, 204:25, 205:4, 205:12,
205:14, 206:2, 222:19, 222:21, 223:1,
223:3, 223:5, 223:6, 223:9, 261:2,
261:9, 261:17, 262:4, 262:5, 262:6,
262:7, 262:13, 262:14, 262:18,
264:23, 265:7, 265:12, 266:1, 266:2,
266:20, 266:21, 267:4, 267:5, 267:6,
267:8, 267:10, 268:11, 268:15, 270:1,
270:3, 270:4, 270:8
APPLICATION [1] - 196:20
APPLICATIONS [1] - 205:1
APPLY [2] - 203:24, 265:16
APPROACH [3] - 211:17, 260:16,
260:18
APPROPRIATE [2] - 164:13, 276:12
APPROXIMATE [1] - 216:22
APRIL [4] - 249:10, 249:17, 251:1,
252:22
ARCADEPAINTCO03@GMAIL.COM [1]
- 190:13
ARE [1] - 1:8
AREA [4] - 175:23, 206:4, 216:10, 217:1
AREAS [1] - 176:7
ARGUMENT [1] - 268:23
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 127 of 145
ARGUMENTS [2] - 272:2, 275:17
ARISE [1] - 170:10
AROSE [1] - 159:2
ARTIFACTS [1] - 181:10
ASSERTED [1] - 274:18
ASSERTION [1] - 275:15
ASSESS [1] - 210:19
ASSIGNMENT [3] - 219:5, 236:12,
236:16
ASSIGNS [1] - 219:25
ASSIST [1] - 269:9
ASSISTANT [1] - 155:16
ASSISTED [1] - 180:19
ASSOCIATED [11] - 190:22, 191:20,
233:22, 237:5, 239:1, 239:4, 242:13,
242:17, 242:20, 246:1, 270:1
ASSUME [2] - 245:6, 263:18
ASSUMED [2] - 157:11, 157:25
ASSUMING [1] - 246:5
ASSURANCE [1] - 209:19
AT [1] - 157:1
ATLANTA [2] - 175:18, 175:23
ATLANTA [3] - 155:2, 155:25, 157:1
ATTACHED [4] - 226:15, 230:8, 231:9,
247:1
ATTACHED [1] - 1:6
ATTACHING [1] - 1:9
ATTACHMENT [1] - 235:11
ATTEMPT [4] - 246:1, 246:8, 246:11,
262:10
ATTEMPTS [2] - 243:21, 245:18
ATTORNEY [1] - 178:22
ATTORNEYS [1] - 155:16
AUGUST [2] - 239:16, 240:1
AUTH.SERVICES.ADOBE.COM [4] -
242:19, 243:19, 244:6, 253:19
AUTHENTICATE [1] - 255:1
AUTHENTICATED [17] - 244:20, 245:11,
245:13, 246:6, 250:1, 253:7, 253:22,
254:1, 254:2, 254:3, 254:10, 254:12,
254:15, 254:24, 255:5
AUTHENTICATING [1] - 244:14
AUTHENTICITY [9] - 161:12, 161:25,
162:19, 162:22, 162:24, 163:3,
163:25, 164:2, 173:25
AUTHOR [5] - 231:24, 232:2, 232:13,
233:16, 234:12
AUTHORED [1] - 231:25
AUTHORITY [1] - 181:15
AUTO [1] - 199:13
AUTOMATICALLY [2] - 193:2, 209:5
AVAILABLE [8] - 181:8, 197:22, 198:12,
199:1, 201:16, 210:15, 220:12, 272:5
AWARE [3] - 260:24, 261:23, 267:2
B
BABASIJIBOMI [1] - 155:15
BABY [1] - 277:7
BACK-DOOR [1] - 261:14
BACKUP_IMAGE_STAMPED_01 [1] -
238:16
BANK [1] - 174:9
BANK [8] - 191:6, 191:13, 226:15,
227:7, 227:22, 240:9, 244:24, 245:4
BANK'S [1] - 244:21
BASE [1] - 267:1
BASED [25] - 162:10, 168:24, 169:5,
169:6, 173:4, 175:21, 209:12, 214:23,
220:21, 227:9, 228:7, 235:9, 235:17,
243:15, 252:13, 252:14, 253:6,
261:12, 264:24, 265:5, 267:18,
267:20, 272:5, 276:17
BASELESS [1] - 266:24
BASIC [1] - 211:12
BASIS [11] - 164:23, 249:3, 252:11,
261:9, 261:21, 261:24, 261:25,
262:14, 265:12, 265:14, 265:16
BE [2] - 1:3, 1:4
BEAR [1] - 264:14
BECOMING [1] - 270:5
BEFORE [1] - 155:10
BEHALF [3] - 155:14, 155:17, 155:20
BEHIND [1] - 237:22
BELIEVES [1] - 221:8
BELLATOR [4] - 191:5, 191:13, 227:6,
227:21
BELONGED [1] - 223:3
BELONGING [1] - 222:8
BELOW [1] - 190:8
BENCH [2] - 211:19, 260:20
BENCH [7] - 213:19, 213:21, 214:7,
214:9, 263:2, 263:4, 264:19
BERNI [1] - 156:3
BERNI [2] - 159:16, 173:22
BEST [9] - 196:10, 216:22, 218:4,
219:15, 221:8, 222:18, 223:3, 235:22,
272:5
BETA [1] - 211:14
BETTER [3] - 189:20, 194:14, 216:13
BETWEEN [5] - 180:2, 195:8, 203:24,
236:9, 274:10
BEYOND [1] - 218:20
BIG [3] - 165:9, 206:25, 277:15
BILLING [4] - 207:2, 209:7, 210:7, 210:9
BINDER [3] - 182:18, 182:19, 185:9
BIT [7] - 157:11, 168:21, 189:20, 194:1,
212:10, 214:10, 272:3
BITLOCKER [5] - 184:20, 184:23,
184:25, 219:21, 219:22
BLACK [1] - 265:22
BLURRY [4] - 188:8, 194:2, 194:3,
194:4
BOARD [1] - 179:15
BOOKMARK [2] - 198:9, 241:9
BOOKMARKS [2] - 241:12, 241:14
BORDER [1] - 181:20
BOTTOM [4] - 189:23, 207:3, 228:17,
252:6
281
BOULDER [1] - 180:24
BOULEE [1] - 155:10
BOUNCED [2] - 209:9, 210:7
BOX [3] - 192:18, 192:25, 246:16
BOXES [1] - 199:14
BOY [1] - 189:4
BRAND [2] - 167:23, 167:24
BRAND-NEW [2] - 167:23, 167:24
BREAK [9] - 159:15, 159:20, 159:23,
162:23, 167:9, 170:8, 170:17, 202:5,
202:20
BREAKS [4] - 202:21, 202:24, 272:8,
272:9
BRIEF [3] - 166:4, 213:21, 275:20
BRIEFLY [7] - 175:3, 179:4, 199:20,
199:22, 211:11, 211:17, 231:3
BRING [6] - 169:19, 203:3, 214:25,
250:7, 268:24, 274:14
BROWSER [5] - 192:8, 192:14, 193:2,
201:20, 241:11
BUILT [2] - 199:11, 207:21
BUNCH [1] - 199:14
BUREAU [2] - 176:1, 176:6
BUSINESS [5] - 161:12, 161:25, 173:25,
190:7, 221:13
BUTTON [1] - 181:12
BY [52] - 1:4, 1:6, 155:23, 170:16, 171:4,
171:8, 173:21, 175:8, 177:18, 182:17,
183:7, 185:24, 188:16, 194:15, 196:1,
196:14, 202:11, 203:10, 215:8,
217:18, 224:6, 224:14, 226:14, 227:1,
228:4, 229:1, 230:4, 231:8, 233:3,
234:10, 234:20, 235:3, 235:19, 237:2,
237:16, 238:14, 239:11, 240:8,
240:21, 241:3, 243:6, 246:25, 247:22,
250:6, 250:11, 250:22, 251:17,
251:23, 253:14, 254:22, 259:7, 269:24
C
CACHE [1] - 232:5
CALIFORNIA [1] - 182:2
CALLERS [1] - 208:23
CANADA [1] - 199:12
CANADIAN [1] - 181:20
CANDACE [1] - 250:2
CANNOT [3] - 201:2, 210:21, 275:23
CAPABILITIES [1] - 209:11
CAPABILITY [1] - 216:8
CAPACITY [1] - 208:22
CAPTURE [2] - 181:7, 215:18
CARD [2] - 172:2, 172:7
CARDS [2] - 183:16, 223:2
CARE [1] - 277:19
CARES [1] - 206:8
CARLA [2] - 155:6, 155:20
CARRIER [2] - 210:22, 211:1
CASE [48] - 158:3, 158:20, 162:6,
174:11, 178:19, 183:8, 184:13, 185:5,
186:1, 186:8, 186:15, 188:1, 190:6,
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 128 of 145
199:21, 206:11, 206:20, 212:8,
215:16, 217:24, 218:3, 218:11, 219:5,
221:2, 221:14, 222:5, 222:25, 223:5,
223:13, 228:10, 233:22, 242:2,
258:11, 261:2, 261:12, 261:24,
261:25, 265:12, 265:14, 265:16,
266:3, 266:4, 266:7, 266:8, 267:2,
267:18, 271:25, 275:18, 278:8
CASE [1] - 181:11
CASE-IN-CHIEF [1] - 212:8
CASES [8] - 178:9, 178:15, 178:17,
179:2, 179:4, 179:8, 198:4, 210:17
CATACLYSMIC [1] - 162:3
CATALOGING [1] - 195:1
CATER [1] - 216:18
CATIE [2] - 181:7, 215:18
CAUSED [1] - 253:19
CELL [12] - 161:21, 175:25, 205:20,
206:11, 206:14, 206:21, 210:23,
211:5, 211:9, 211:25, 213:5, 216:20
CELLEBRITE [11] - 221:15, 221:17,
221:19, 222:2, 222:5, 228:6, 228:8,
229:24, 258:20, 258:23, 259:2
CELLPHONE [18] - 174:13, 177:22,
180:4, 183:14, 183:15, 204:1, 206:20,
206:25, 207:2, 208:6, 209:17, 221:3,
221:5, 221:11, 221:22, 222:3, 222:11,
230:18
CELLPHONES [2] - 178:14, 178:17
CELLULAR [1] - 182:13
CENTRAL [8] - 162:11, 163:7, 163:24,
164:4, 165:3, 174:24, 175:9
CERTAIN [5] - 165:1, 199:17, 200:25,
251:14, 256:18
CERTAINLY [6] - 217:2, 240:18, 253:11,
260:14, 272:16, 277:15
CERTIFICATE [15] - 161:12, 161:25,
162:19, 162:20, 162:21, 162:24,
163:3, 163:6, 163:24, 164:2, 173:25,
174:6, 174:7, 174:10, 174:20
CERTIFICATION [1] - 159:22
CERTIFIED [1] - 179:18
CERTIFY [1] - 278:6
CETERA [1] - 213:23
CHAIKEN [93] - 155:14, 163:14, 182:14,
183:3, 185:20, 211:17, 211:21,
212:19, 213:11, 213:18, 214:13,
217:15, 217:18, 224:4, 224:6, 224:12,
224:14, 226:13, 226:14, 226:22,
227:1, 227:24, 228:4, 228:24, 229:1,
230:2, 230:4, 231:6, 231:8, 233:1,
233:3, 234:7, 234:10, 234:17, 234:20,
235:1, 235:3, 235:18, 235:19, 236:24,
237:2, 237:11, 237:16, 238:8, 238:14,
239:7, 239:11, 240:7, 240:8, 240:17,
240:19, 240:21, 241:1, 241:3, 243:5,
243:6, 246:23, 246:25, 247:21,
247:22, 249:25, 250:6, 250:9, 250:11,
250:19, 250:22, 251:16, 251:17,
251:21, 251:23, 253:10, 253:12,
253:14, 254:16, 259:3, 261:8, 262:2,
262:9, 262:12, 263:19, 264:1, 264:3,
264:8, 266:16, 270:12, 270:24,
271:20, 273:4, 273:15, 274:16, 277:1,
277:5, 277:12
CHAIKEN [6] - 157:23, 213:10, 214:11,
217:21, 264:19, 266:15
CHANCE [2] - 206:11, 272:17
CHANGE [7] - 171:19, 187:17, 231:21,
233:23, 256:21, 259:12, 268:23
CHANGED [6] - 162:10, 180:10, 199:11,
225:11, 225:14, 225:17
CHANGES [1] - 264:20
CHANGING [2] - 194:19, 198:6
CHARGING [1] - 210:6
CHARLES [1] - 189:3
CHART [2] - 164:24, 168:18
CHASE.COM [1] - 244:22
CHECK [3] - 175:4, 192:25, 274:25
CHECKED [4] - 199:14, 199:19, 201:21,
243:24
CHEW [1] - 273:6
CHIEF [1] - 212:8
CHILD [3] - 179:6, 180:25, 181:12
CHOOSE [2] - 199:18, 235:20
CHRISTIAN [1] - 157:10
CHRONOLOGICALLY [1] - 248:16
CIRCLE [2] - 157:8, 211:13
CIRCUIT [2] - 275:19, 275:20
CIRCULAR [1] - 262:12
CITE [1] - 265:18
CITE [1] - 1:5
CITED [2] - 158:21, 275:19
CIVIL [1] - 178:12
CLAIM [1] - 159:23
CLARIFY [1] - 168:17
CLARIFYING [1] - 167:8
CLASSIFY [1] - 241:14
CLAYTON [1] - 182:4
CLEAR [19] - 161:7, 162:5, 163:11,
168:21, 168:23, 169:8, 169:20, 188:6,
195:16, 200:25, 218:10, 223:15,
249:19, 253:15, 264:23, 265:18,
274:5, 274:8, 276:6
CLEARLY [1] - 158:11
CLERK [1] - 167:19
CLERK [4] - 161:4, 161:10, 177:7,
177:14
CLICK [3] - 201:20, 245:3, 260:1
CLICKING [1] - 193:10
CLIENT [2] - 198:4, 222:8
CLOSE [5] - 205:9, 207:21, 209:4,
214:15, 269:7
CLOSELY [1] - 180:23
CLOSER [1] - 202:21
CLOSES [1] - 192:14
CLOSING [1] - 272:2
CM/ECF [2] - 1:3, 1:5
CO [1] - 272:13
282
CO-DEFENDANTS' [1] - 272:13
COBB [2] - 179:11, 182:4
CODE [1] - 246:16
CODES [4] - 245:21, 245:25, 246:15,
254:12
COGNIZANT [1] - 263:8
COLLECT [2] - 181:10, 215:12
COLLECTED [1] - 187:22
COLLECTING [1] - 181:14
COLLEGE [1] - 179:23
COLON [7] - 189:3, 189:4, 189:5, 189:6
COLORADO [1] - 180:24
COMCAST [6] - 188:19, 188:21, 189:2,
189:8, 189:11, 189:14
COMFORT [1] - 202:5
COMING [5] - 183:15, 206:7, 224:25,
238:20, 261:1
COMMENCED [2] - 211:19, 260:20
COMMERCIALLY [1] - 210:15
COMMON [3] - 270:3, 270:5, 270:6
COMMUNICATE [3] - 203:17, 205:6,
205:15
COMMUNICATED [2] - 157:7, 276:7
COMMUNICATIONS [1] - 216:5
COMPANY [4] - 178:1, 178:3, 178:7,
179:12
COMPEL [1] - 263:22
COMPLAIN [1] - 212:21
COMPLETE [4] - 168:15, 189:13,
213:19, 263:4
COMPLETELY [3] - 157:24, 158:9,
208:8
COMPUTER [43] - 181:2, 183:13,
189:15, 192:5, 192:9, 192:16, 192:19,
197:7, 199:3, 201:1, 201:17, 203:19,
225:8, 226:1, 226:4, 226:10, 227:17,
230:16, 231:16, 231:18, 231:23,
231:25, 232:2, 232:7, 232:21, 232:23,
233:5, 235:21, 239:24, 242:24, 245:9,
248:7, 250:13, 250:17, 251:4, 251:7,
252:21, 254:7, 257:7, 257:11, 257:20,
258:3
COMPUTERS [3] - 186:25, 203:23,
222:13
CONCEPT [1] - 203:11
CONCERNED [2] - 245:23, 258:11
CONCLUDED [1] - 227:10
CONCLUDING [3] - 265:12, 265:16,
271:14
CONCLUSION [4] - 166:12, 184:8,
262:24
CONDITION [2] - 198:6, 207:23
CONDUCTED [1] - 178:14
CONFERENCE [9] - 211:19, 213:19,
213:21, 214:7, 214:9, 260:20, 263:2,
263:4, 264:19
CONFIGURATIONS [1] - 180:2
CONFIRM [2] - 198:12, 200:20
CONFIRMED [3] - 199:2, 200:22,
271:23
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 129 of 145
CONFIRMS [1] - 166:3
CONFUSED [1] - 242:22
CONFUSING [1] - 158:12
CONFUSION [5] - 162:23, 164:12,
164:16, 164:17, 164:20
CONNECT [2] - 206:1, 206:3
CONNECTED [7] - 204:23, 207:3, 207:6,
208:7, 208:10, 208:12, 217:3
CONNECTION [2] - 189:14, 205:11
CONNECTIVITY [4] - 203:22, 205:4,
206:5, 207:4
CONSIDER [3] - 183:25, 229:8, 237:24
CONSIDERED [1] - 158:10
CONSISTED [1] - 183:12
CONSISTENT [1] - 201:3
CONSULTING [2] - 274:4, 274:21
CONT'D [1] - 170:15
CONT'D).................170 [1] - 156:4
CONTACT [1] - 225:16
CONTAIN [1] - 218:2
CONTAINED [1] - 200:7
CONTENT [4] - 181:3, 193:15, 226:23,
240:15
CONTENTIOUS [2] - 157:15
CONTESTING [1] - 179:7
CONTEXT [1] - 165:5
CONTINUE [5] - 157:20, 170:13, 192:6,
192:17, 205:5
CONTINUED [3] - 168:13, 203:2, 277:21
CONTINUITY [32] - 203:12, 203:15,
205:4, 205:13, 205:14, 206:2, 222:21,
223:6, 223:9, 261:3, 261:10, 261:17,
262:4, 262:7, 262:13, 262:14, 262:18,
264:23, 265:7, 265:12, 266:1, 266:2,
266:21, 267:4, 267:5, 267:6, 267:8,
267:11, 268:11, 268:15, 270:3
CONTRADICT [1] - 160:11
CONTROL [1] - 233:15
CONTROLLING [1] - 238:23
CONVENTION [1] - 239:20
CONVERSATION [2] - 223:21, 273:2
CONVERTED [4] - 164:1, 242:5, 242:7,
242:9
CONVERTS [1] - 163:23
CONVICTED [1] - 267:23
COORDINATING [1] - 274:11
COPIED [2] - 160:22, 160:24
COPIES [1] - 249:6
COPY [6] - 160:19, 182:23, 182:24,
210:17, 250:7, 264:14
CORPORATIONS [1] - 179:14
CORRECT [242] - 159:24, 165:8, 168:7,
169:21, 171:11, 172:8, 172:9, 172:11,
173:2, 175:16, 176:5, 178:20, 178:21,
179:1, 179:3, 184:21, 184:23, 186:13,
186:14, 187:23, 187:24, 190:10,
190:11, 191:21, 194:20, 195:4,
195:19, 197:5, 197:20, 199:4, 200:2,
200:15, 201:11, 218:12, 218:13,
218:22, 218:23, 218:25, 219:1, 219:3,
219:4, 219:6, 219:7, 219:17, 219:18,
219:22, 219:25, 220:2, 220:5, 220:6,
220:7, 220:9, 220:10, 220:16, 220:22,
220:23, 220:25, 221:1, 221:15,
221:22, 222:3, 222:7, 222:15, 222:17,
222:19, 222:20, 222:23, 222:24,
223:1, 223:6, 223:7, 223:17, 223:19,
223:20, 223:24, 224:2, 224:7, 224:10,
224:11, 224:17, 224:21, 224:22,
225:2, 225:3, 225:5, 225:6, 225:8,
225:17, 225:21, 225:22, 225:24,
226:5, 226:9, 226:12, 226:16, 227:12,
227:22, 227:23, 228:21, 228:22,
229:6, 229:7, 229:11, 229:12, 229:15,
229:16, 229:19, 230:8, 230:10,
230:21, 230:23, 231:1, 231:4, 231:5,
231:13, 231:19, 231:20, 231:23,
232:2, 232:10, 232:11, 232:13,
232:19, 232:23, 233:5, 233:6, 233:9,
233:11, 233:12, 233:14, 233:15,
234:1, 234:2, 234:5, 234:6, 234:12,
234:13, 234:22, 235:12, 235:16,
236:18, 236:22, 237:6, 237:7, 237:9,
237:10, 238:1, 238:4, 238:5, 238:6,
238:16, 238:24, 238:25, 239:5,
239:14, 240:24, 240:25, 241:8,
241:18, 241:25, 242:2, 242:7, 242:14,
242:15, 242:17, 242:18, 242:20,
243:3, 243:4, 243:7, 243:11, 243:12,
243:13, 244:7, 244:12, 244:25, 245:4,
245:9, 247:3, 247:5, 247:9, 247:14,
247:18, 247:24, 247:25, 248:2, 248:7,
248:8, 248:10, 248:12, 248:18,
248:22, 248:23, 249:1, 249:2, 249:10,
249:17, 249:18, 249:23, 249:24,
250:18, 250:24, 251:5, 251:8, 251:19,
251:25, 252:8, 252:9, 252:12, 252:19,
252:20, 252:22, 252:23, 252:25,
253:4, 253:25, 254:1, 254:3, 254:8,
254:13, 254:14, 255:7, 255:12,
255:24, 256:4, 256:23, 257:4, 257:5,
257:13, 257:14, 257:18, 258:5, 258:9,
258:13, 258:16, 258:18, 258:19,
259:18, 259:21, 260:8, 260:11, 278:7
CORRECTLY [4] - 218:8, 222:4, 255:23,
257:2
CORRELATED [1] - 191:15
CORRELATION [1] - 236:9
COUDRIET [2] - 155:24, 278:15
COUNSEL [5] - 213:21, 271:17, 271:22,
273:7, 275:7
COUNSEL [1] - 270:18
COUNT [2] - 187:16, 274:3
COUNTY [6] - 179:11, 182:4, 182:5
COUPLE [3] - 165:22, 198:14, 199:11
COURSE [3] - 221:12, 272:1, 275:16
COURT [9] - 159:17, 166:8, 177:21,
266:5, 266:6, 273:8, 273:9, 274:24,
275:13
COURT [7] - 166:13, 182:6, 189:24,
283
198:5, 211:19, 260:20, 276:14
COURT [119] - 1:4, 1:7, 1:10, 155:1,
155:24, 155:25, 157:1, 157:2, 157:5,
159:7, 159:14, 160:13, 160:21,
160:24, 161:6, 161:11, 161:18,
162:19, 163:8, 163:16, 164:6, 164:19,
165:4, 165:9, 165:12, 165:17, 166:7,
166:16, 166:21, 167:13, 167:24,
168:4, 168:10, 168:14, 168:23,
169:13, 169:17, 169:23, 170:6,
173:17, 173:19, 175:4, 175:6, 176:14,
176:16, 176:18, 176:22, 177:1, 177:4,
182:16, 183:5, 185:22, 202:4, 202:10,
202:19, 203:3, 203:5, 203:8, 211:18,
212:10, 213:9, 213:15, 213:20, 214:2,
214:5, 214:17, 214:22, 215:4, 217:11,
217:14, 217:16, 240:18, 250:5,
253:11, 254:18, 254:20, 259:6,
260:14, 260:18, 262:16, 262:25,
263:5, 263:12, 263:15, 263:24, 264:5,
264:9, 264:14, 265:21, 266:15,
268:22, 269:2, 269:8, 269:11, 269:16,
269:19, 269:23, 270:11, 270:13,
270:15, 270:18, 271:2, 271:5, 271:7,
271:21, 272:11, 272:20, 272:24,
273:10, 273:12, 273:18, 275:24,
276:17, 277:4, 277:6, 277:13, 277:18,
278:3, 278:15
COURT'S [2] - 163:10, 163:12
COURT'S [6] - 161:9, 161:11, 163:19,
170:18, 170:21, 265:10
COURTHOUSE [1] - 276:14
COURTROOM [4] - 161:4, 161:10,
177:7, 177:14
COURTROOM [17] - 157:3, 157:4,
159:8, 159:13, 159:21, 170:5, 202:25,
203:4, 214:1, 214:3, 214:4, 215:3,
263:11, 263:13, 263:14, 269:18,
272:10
COURTS [2] - 182:3, 182:6
COVERAGE [1] - 216:13
CREATE [5] - 179:25, 180:8, 231:16,
242:1, 260:4
CREATED [9] - 160:7, 162:14, 197:9,
226:1, 231:13, 232:7, 232:19, 232:22,
255:22
CREATES [1] - 242:10
CREATING [2] - 233:8, 237:8
CREATION [1] - 233:18
CREDENTIALS [1] - 204:16
CREDIBILITY [1] - 275:17
CRIMINAL [1] - 178:12
CRITERIA [1] - 201:14
CRITERIAS [1] - 219:12
CROSS [12] - 160:9, 164:13, 164:18,
165:5, 165:7, 165:24, 167:4, 169:5,
169:15, 170:13, 217:14, 268:19
CROSS [4] - 156:4, 156:7, 170:15,
217:17
CROSS-EXAMINATION [4] - 160:9,
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 130 of 145
164:18, 165:5, 165:24
CROSS-EXAMINATION [3] - 156:4,
170:15, 217:17
CROSS-EXAMINATION........................
..217 [1] - 156:7
CROSS-EXAMINE [1] - 268:19
CROSS-EXAMINED [2] - 164:13, 167:4
CROSS-EXAMINING [1] - 165:7
CROSSED [3] - 261:10, 261:11, 261:17
CRR [2] - 155:24, 278:15
CSO [1] - 269:8
CULL [1] - 195:24
CULL-OUT [1] - 195:24
CURRENT [3] - 157:6, 159:3, 195:11
CUSTOM [5] - 197:23, 198:3, 198:8,
198:11, 198:25
CUSTOMER [2] - 208:14
CYBERCRIME [2] - 177:22, 182:12
CYBERSPACE [1] - 161:20
D
DARRELL [52] - 187:22, 211:23, 218:1,
218:11, 218:14, 218:24, 219:3, 219:6,
219:19, 221:2, 221:11, 222:6, 222:15,
223:16, 224:10, 224:17, 224:20,
225:7, 225:20, 228:12, 228:21, 229:6,
229:10, 229:25, 230:7, 230:13,
230:22, 231:4, 233:10, 233:14,
233:24, 235:7, 235:14, 235:15,
236:10, 236:19, 237:17, 237:20,
237:25, 238:18, 239:5, 239:12, 240:9,
240:11, 257:16, 257:21, 267:20,
267:21, 274:10, 276:7
DATA [30] - 162:9, 162:15, 164:10,
171:9, 175:25, 179:8, 180:10, 181:18,
182:13, 184:7, 190:5, 204:5, 220:4,
220:8, 221:21, 222:2, 224:23, 224:25,
229:13, 229:23, 242:24, 246:16,
248:12, 267:2, 267:15, 267:17,
267:22, 268:5
DATAS [1] - 183:14
DATE [11] - 174:2, 174:18, 195:6, 197:6,
227:13, 228:17, 228:20, 229:9,
239:21, 248:16, 251:3
DATED [1] - 251:1
DATES [1] - 195:13
DAVID [1] - 155:20
DAVID [2] - 189:4, 189:5
DAYS [1] - 1:5
DAYS [3] - 199:15, 212:22, 271:18
DEADLINE [1] - 263:21
DEAL [3] - 165:9, 170:10, 179:24
DEALING [1] - 180:25
DEALT [1] - 190:6
DECEMBER [1] - 241:4
DECIDE [1] - 272:13
DECONSTRUCTED [1] - 207:20
DEFENDANT [2] - 155:17, 155:20
DEFENDANT'S [2] - 173:12, 183:2
DEFENDANTS [1] - 155:8
DEFENDANTS' [1] - 272:13
DEFENSE [6] - 158:18, 158:21, 168:18,
178:22, 221:7, 272:14
DEFENSE [5] - 170:25, 224:4, 226:22,
227:25, 231:6
DEGREE [2] - 211:16, 236:12
DEGREES [1] - 211:13
DELETED [2] - 236:4, 253:2
DELETES [1] - 240:24
DELIBERATIONS [1] - 272:2
DELPHI [2] - 197:25, 198:1
DEMOCRACY [1] - 271:9
DENIED [1] - 165:17
DENY [3] - 167:13, 167:14, 200:20
DEPARTMENTS [2] - 180:17
DEPENDENT [1] - 192:13
DEPOSIT [6] - 274:3, 274:9, 274:10,
274:11, 275:2, 276:8
DEPOSITED [1] - 274:25
DEPRESSED [1] - 181:13
DEPUTY [4] - 161:4, 161:10, 177:7,
177:14
DESCRIBE [3] - 180:7, 180:22, 181:6
DESIGNED [4] - 209:20, 216:14, 260:2,
266:17
DESKTOP [1] - 183:14
DESPITE [2] - 253:1, 255:14
DETAIL [1] - 214:8
DETAILED [2] - 160:2, 198:17
DETERMINATION [1] - 254:5
DETERMINATIONS [1] - 187:19
DETERMINE [13] - 184:16, 187:25,
191:12, 210:19, 219:8, 227:20,
230:25, 234:15, 236:5, 238:23,
241:12, 245:25, 254:12
DETERMINED [1] - 250:16
DEVELOPMENT [2] - 179:14, 181:4
DEVICE [63] - 184:20, 184:24, 185:3,
186:24, 188:1, 189:10, 195:21,
199:17, 199:23, 201:24, 204:5,
204:17, 204:18, 206:6, 206:9, 207:1,
211:23, 211:24, 217:8, 218:11,
218:18, 222:19, 222:25, 223:1, 223:3,
223:5, 223:13, 223:16, 223:19,
224:10, 224:17, 224:20, 225:4,
225:21, 229:10, 230:22, 230:25,
231:13, 232:16, 232:17, 232:18,
232:19, 233:13, 235:15, 236:10,
236:14, 236:22, 239:4, 240:11,
244:10, 244:11, 252:12, 259:12,
262:6, 262:18, 265:6, 266:20, 267:17,
267:19, 268:2, 270:1
DEVICES [41] - 180:1, 183:8, 183:11,
184:15, 186:18, 203:16, 203:21,
203:24, 204:1, 205:13, 206:1, 206:2,
219:5, 219:8, 219:12, 219:14, 219:17,
220:11, 220:15, 220:18, 222:8, 223:4,
223:18, 227:20, 236:5, 236:8, 236:11,
237:22, 258:7, 258:18, 259:8, 259:11,
284
259:14, 259:16, 259:19, 262:5, 265:8,
267:6, 268:15, 270:4, 270:8
DIFFERENCE [5] - 167:25, 168:25,
172:23, 216:1, 216:2
DIFFERENT [26] - 159:18, 164:11,
168:8, 169:7, 169:9, 175:9, 179:24,
180:17, 182:3, 183:12, 184:5, 188:24,
196:6, 196:19, 198:14, 198:22,
203:24, 205:15, 206:4, 208:8, 219:25,
223:16, 240:3, 241:10, 242:5, 255:21
DIFFICULT [2] - 163:20, 184:23
DIGITAL [6] - 177:22, 178:9, 180:4,
182:12, 186:5, 198:19
DIGITALLY [1] - 243:24
DIMINISHED [1] - 175:22
DIRECT [1] - 248:1
DIRECT [2] - 156:6, 177:17
DIRECTLY [3] - 190:22, 191:15, 226:20
DIRECTOR [2] - 194:8, 250:10
DISALLOW [1] - 264:10
DISALLOWING [1] - 264:11
DISCLOSE [2] - 212:17, 268:7
DISCLOSED [5] - 162:15, 212:2, 212:6,
212:13, 212:15
DISCLOSURE [2] - 212:19, 213:13
DISCOVERY [4] - 171:13, 183:9,
189:17, 200:17
DISCUSS [3] - 159:4, 273:13, 276:23
DISCUSSED [2] - 168:16, 264:18
DISCUSSING [1] - 276:2
DISCUSSION [4] - 203:7, 214:6, 269:12,
273:3
DISCUSSIONS [1] - 273:5
DISPUTE [1] - 265:21
DISTANCE [2] - 215:9, 215:24
DISTRICT [6] - 155:1, 155:1, 155:10,
155:25, 278:3, 278:4
DISTRICT [1] - 182:1
DIVISION [1] - 155:2
DIVISION [1] - 211:12
DIVORCE [1] - 179:8
DJ [2] - 228:15, 237:17
DOC [1] - 259:25
DOC [1] - 239:15
DOC-20200421-W [1] - 239:17
DOCKET [1] - 272:12
DOCKET [2] - 263:25, 264:4
DOCKET [2] - 1:6, 155:5
DOCUMENT [43] - 161:7, 161:13,
163:13, 163:25, 167:5, 167:7, 170:18,
170:19, 170:23, 170:24, 171:1,
188:22, 190:14, 191:20, 193:16,
203:18, 203:20, 225:25, 226:2, 226:4,
226:19, 227:2, 229:9, 230:10, 230:13,
230:18, 231:16, 231:17, 231:18,
231:24, 231:25, 232:1, 232:4, 232:5,
232:6, 233:18, 233:21, 237:18,
239:20, 240:5, 243:23, 250:24, 259:24
DOCUMENT [1] - 1:10
DOCUMENT [1] - 264:13
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 131 of 145
DOCUMENTS [24] - 160:16, 161:24,
165:21, 165:22, 167:7, 169:21,
180:19, 191:1, 191:3, 193:8, 201:24,
202:12, 202:15, 213:16, 213:23,
231:10, 232:9, 232:12, 232:15, 233:4,
234:4, 234:11, 236:2, 240:4
DOCX [1] - 259:25
DOMAIN [4] - 242:12, 242:19, 242:20
DOMAINS [2] - 242:16, 242:17
DONE [19] - 158:6, 176:9, 181:3,
191:22, 198:15, 200:6, 206:21,
207:18, 214:11, 214:12, 214:14,
214:15, 227:21, 260:3, 263:3, 267:8,
271:25, 276:15
DOOR [6] - 260:25, 261:7, 261:13,
261:14, 261:18, 265:17
DOT [1] - 174:9
DOUBLE [1] - 260:1
DOUBLE-CLICK [1] - 260:1
DOWN [15] - 176:18, 182:5, 194:23,
207:17, 213:15, 224:12, 233:1, 234:8,
239:10, 241:1, 251:16, 251:22,
270:15, 278:7
DOWNLOAD [1] - 198:23
DOWNLOADED [7] - 228:20, 229:9,
231:17, 232:15, 232:18, 257:10, 258:1
DOWNLOADS [1] - 235:23
DR [1] - 180:23
DRIVE [8] - 183:18, 184:5, 184:10,
199:13, 219:13, 219:21, 219:22, 249:5
DROP [2] - 208:25, 277:11
DROPPED [2] - 208:13
DUE [2] - 166:19, 276:11
DULY [1] - 177:11
DURING [4] - 164:18, 165:23, 175:18,
175:22
DURRETT [33] - 155:18, 159:6, 159:15,
160:18, 161:16, 164:20, 165:8,
165:10, 165:16, 166:6, 166:8, 166:19,
167:11, 167:17, 168:2, 169:16,
169:22, 170:2, 170:4, 170:14, 170:16,
170:25, 171:2, 171:4, 171:7, 171:8,
173:11, 173:15, 173:20, 173:21,
175:1, 176:15, 264:2
DURRETT [8] - 162:2, 164:19, 166:7,
168:11, 169:3, 169:14, 169:20, 170:13
DURRETT'S [1] - 164:7
DÉJÀ [1] - 263:5
E
E-MAIL [44] - 157:6, 159:1, 161:16,
186:17, 186:18, 186:19, 187:5, 187:7,
190:7, 190:22, 190:24, 191:4, 191:15,
192:2, 192:24, 193:2, 193:22, 195:14,
195:18, 199:2, 200:22, 200:24,
201:17, 227:3, 227:11, 231:17, 235:4,
235:7, 236:13, 243:13, 243:15,
243:21, 244:17, 244:24, 245:2, 245:7,
245:23, 248:14, 253:20, 253:21,
253:23, 253:24, 253:25, 255:4
E-MAILED [3] - 160:18, 164:23, 235:15
E-MAILS [6] - 160:23, 187:11, 187:18,
191:2, 194:19, 194:25
EARLIEST [1] - 224:16
EASIER [1] - 163:20
EASILY [1] - 258:23
EASTERN [6] - 162:12, 163:24, 164:5,
172:9, 175:10, 175:12
EASY [2] - 201:13, 213:22
EDGE [2] - 184:1, 184:5
EDUCATION [1] - 179:21
EF1E334B665248A5B5550D63A465C
1D9 [1] - 229:3
EFFECT [7] - 157:16, 157:19, 158:15,
192:16, 192:19, 268:9, 268:18
EITHER [9] - 157:21, 160:25, 168:24,
181:13, 207:18, 229:17, 268:16,
273:7, 276:25
ELECTRONIC [1] - 207:16
ELEMENTS [2] - 198:9, 254:25
ELEVENTH [1] - 275:20
ELICIT [1] - 265:9
ELMO [1] - 186:9
EMERGENCY [1] - 181:11
EMPLOYEE.XLS [2] - 234:22, 235:12
ENCRYPTED [2] - 184:20, 219:22
ENCRYPTION [1] - 185:1
ENCYCLOPEDIA [1] - 160:17
END [3] - 202:20, 214:24, 242:16
ENDED [1] - 218:18
ENDING [1] - 237:18
ENDS [1] - 209:25
ENFORCEMENT [9] - 177:23, 179:20,
180:8, 180:9, 180:12, 180:13, 181:8,
210:16, 267:24
ENTER [2] - 201:16, 245:3
ENTERED [4] - 170:5, 203:4, 215:3,
269:18
ENTERPRISES [1] - 179:12
ENTERTAINING [1] - 273:23
ENTIRE [1] - 248:13
ENTRIES [4] - 256:18, 256:20, 257:3,
257:4
ENTRY [4] - 171:18, 172:20, 250:21,
251:21
ENTRY [1] - 1:6
ENVELOPE [1] - 190:17
EQUALED [1] - 186:8
EQUIPMENT [1] - 205:24
EQUIPPED [1] - 198:16
EQUIVALENT [2] - 190:4, 205:24
ERROR [1] - 158:13
ESPECIALLY [4] - 198:3, 212:17, 232:3,
265:7
ESQ [6] - 155:14, 155:15, 155:15,
155:18, 155:18, 155:20
ESTABLISHED [1] - 157:12
ESTABLISHES [1] - 189:14
285
ET [1] - 213:23
EVALUATE [2] - 268:8, 268:10
EVENING [5] - 263:3, 263:9, 269:9,
271:10, 276:18
EVENT [1] - 248:20
EVENT [51] - 196:19, 196:22, 196:25,
197:3, 197:6, 197:8, 197:9, 198:20,
198:23, 200:4, 200:16, 244:19, 245:8,
245:16, 245:22, 246:13, 246:15,
246:16, 246:17, 246:19, 247:16,
248:2, 248:11, 248:16, 248:19, 249:4,
249:6, 249:20, 250:8, 250:12, 250:13,
250:16, 250:23, 251:6, 251:12,
251:18, 252:4, 252:8, 252:10, 252:14,
252:15, 252:17, 252:24, 253:9,
253:18, 254:11, 254:14, 255:7,
255:15, 255:22
EVENTS [5] - 243:17, 247:17, 247:23,
252:18
EVIDENCE [2] - 181:8, 215:19
EVIDENCE [41] - 160:10, 167:23,
167:24, 167:25, 180:11, 207:25,
212:7, 220:15, 220:21, 220:24,
220:25, 221:6, 221:9, 225:8, 225:10,
225:13, 225:16, 225:19, 230:24,
232:1, 238:23, 261:1, 261:9, 262:12,
262:13, 262:17, 266:7, 266:11,
266:14, 266:17, 266:22, 268:1,
268:14, 271:18, 271:25, 272:13,
274:2, 274:23, 276:23
EVIDENTIARY [2] - 220:4, 220:8
EXACT [7] - 216:21, 229:5, 229:9,
230:14, 237:19, 237:25, 239:13
EXACTLY [8] - 193:14, 195:17, 213:2,
217:4, 233:17, 264:6, 266:16, 271:8
EXAMINATION [6] - 160:9, 164:18,
165:5, 165:24, 218:1, 225:7
EXAMINATION [6] - 156:4, 170:15,
175:7, 177:17, 217:17, 254:21
EXAMINATION..........................217 [1] -
156:7
EXAMINATION.........................177 [1] -
156:6
EXAMINATION.......................254 [1] -
156:7
EXAMINE [4] - 219:5, 219:9, 220:14,
268:19
EXAMINED [6] - 164:13, 167:4, 177:12,
220:24, 222:15, 226:1
EXAMINER [3] - 160:7, 180:4, 181:21
EXAMINING [1] - 165:7
EXAMPLE [7] - 192:8, 203:18, 203:23,
204:3, 225:25, 231:15, 232:4
EXCEEDINGLY [1] - 207:23
EXCEL [6] - 159:25, 160:6, 161:14,
162:15, 193:12, 234:24
EXCELLENT [1] - 273:25
EXCEPTION [2] - 219:11, 230:11
EXCHANGED [1] - 191:2
EXCLUDE [2] - 166:10, 267:10
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 132 of 145
EXCLUDED [3] - 166:9, 260:23, 264:8
EXCLUSIVE [2] - 274:4, 274:20
EXCLUSIVELY [1] - 210:16
EXCUSED [6] - 157:4, 159:13, 176:21,
214:4, 263:14, 270:17
EXECUTION [1] - 174:2
EXHAUSTED [1] - 270:22
EXHIBIT [26] - 163:10, 163:12, 170:20,
171:15, 173:13, 173:22, 173:23,
186:10, 188:10, 189:21, 189:23,
191:9, 195:5, 196:15, 197:1, 197:4,
198:7, 226:15, 228:7, 230:8, 231:9,
234:7, 240:13, 247:1, 247:7, 260:6
EXHIBIT [26] - 161:9, 161:11, 163:19,
170:18, 170:21, 170:25, 171:5,
173:12, 183:2, 188:3, 189:21, 190:1,
191:14, 224:5, 226:23, 227:25, 231:7,
234:18, 235:2, 237:12, 238:9, 243:3,
243:7, 243:18, 250:1
EXHIBITS [9] - 185:7, 185:12, 185:15,
193:7, 194:8, 218:5, 218:9, 224:7,
240:6
EXHIBITS [2] - 185:10, 185:18
EXIST [1] - 268:2
EXISTENCE [1] - 274:23
EXISTING [1] - 241:7
EXISTS [3] - 223:9, 261:10, 267:9
EXIT [1] - 263:12
EXITED [4] - 202:25, 214:1, 263:11,
272:10
EXPAND [1] - 214:9
EXPECT [1] - 239:24
EXPECTED [2] - 170:8, 271:24
EXPERIENCE [1] - 179:9
EXPERIENCES [1] - 215:16
EXPERT [24] - 159:3, 162:13, 164:10,
169:12, 181:23, 182:7, 182:13,
206:12, 211:25, 212:18, 212:20,
212:24, 212:25, 213:2, 229:22,
229:23, 258:17, 261:6, 262:21,
262:22, 266:1, 267:1, 267:2, 268:1
EXPERT'S [1] - 213:13
EXPERTISE [1] - 183:22
EXPERTS [1] - 265:19
EXPERTS [1] - 267:14
EXPLAIN [6] - 164:4, 211:11, 254:23,
255:13, 257:2, 259:22
EXPLAINED [1] - 270:19
EXPLAINS [3] - 162:25, 165:13, 166:2
EXPLORER [1] - 197:24
EXTENT [1] - 233:20
EXTRACT [2] - 198:19, 198:21
EXTRACTING [1] - 221:21
EXTRACTION [2] - 222:6, 229:24
EXTRACTS [1] - 222:2
EYE [1] - 194:4
F
F.2D [1] - 265:19
F23A [2] - 182:20, 183:2
F23B [3] - 185:10, 185:19, 186:10
F23C [2] - 226:13, 230:3
F23E [1] - 193:5
F23F [5] - 231:7, 235:18, 239:8, 253:12,
253:13
F23H [2] - 226:23, 227:25
F23I [4] - 194:1, 224:5, 240:19, 246:23
F23N [2] - 189:20, 189:23
F23O [1] - 191:8
F23R [4] - 196:13, 243:5, 247:21, 253:13
F23T [1] - 185:19
FACT [23] - 162:10, 164:21, 169:9,
187:12, 188:21, 213:12, 233:10,
237:24, 239:19, 242:1, 242:25,
245:10, 245:17, 246:6, 255:14,
255:25, 256:19, 257:19, 257:25,
258:22, 261:11, 267:19, 267:20
FACTS [4] - 265:10, 267:2, 267:15,
268:4
FACTUALLY [2] - 191:25, 232:7
FAIL [2] - 208:4, 222:2
FAILED [5] - 221:24, 245:18, 245:20,
246:1, 246:11
FAIR [2] - 158:22, 259:1
FAIRLY [1] - 165:18
FAITH [1] - 166:1
FAMILIAR [10] - 199:7, 201:8, 203:11,
206:14, 210:11, 221:15, 221:17,
239:19, 241:17, 258:20
FAR [5] - 215:9, 215:12, 215:20, 218:1,
271:2
FARGO [1] - 227:7
FBI [3] - 180:16, 210:12, 219:25
FCC [2] - 216:4, 216:7
FEATURE [2] - 267:9, 270:3
FEB [2] - 234:21, 235:12
FEBRUARY [1] - 155:11
FEBRUARY [3] - 174:3, 277:21, 278:9
FEDERAL [1] - 216:4
FEET [1] - 217:2
FELT [1] - 258:17
FEW [2] - 171:14, 202:6
FI [1] - 204:24
FIELD [4] - 179:16, 180:20, 181:4,
267:14
FIELD [1] - 181:19
FIFO [3] - 224:23, 249:8, 256:17
FIGURE [2] - 236:16, 263:6
FILE [60] - 190:15, 197:8, 197:9, 198:20,
198:24, 227:2, 227:10, 227:17,
227:18, 227:21, 228:2, 228:20, 229:5,
230:14, 231:12, 234:8, 234:15,
234:21, 235:11, 235:14, 235:25,
236:1, 237:3, 237:5, 237:19, 237:25,
238:2, 238:4, 238:15, 238:19, 239:13,
239:14, 239:15, 239:17, 240:2,
240:11, 240:12, 240:14, 246:5, 249:4,
249:6, 249:7, 251:15, 252:13, 255:17,
255:22, 256:2, 256:25, 259:22,
286
259:25, 260:1, 260:2, 273:7
FILED [1] - 274:2
FILED [3] - 1:3, 1:8, 1:10
FILES [24] - 184:6, 193:24, 200:23,
233:25, 235:20, 235:21, 236:6,
236:14, 236:17, 238:15, 238:19,
241:15, 242:11, 252:4, 254:4, 255:9,
255:13, 255:20, 255:21, 256:1, 257:7,
257:10, 257:19, 257:25
FINANCIAL [2] - 170:19, 174:13
FINE [5] - 165:12, 188:13, 202:17,
236:25, 273:10
FIREWALL [1] - 181:16
FIRST [29] - 160:15, 161:7, 164:18,
173:24, 174:7, 177:11, 181:7, 181:12,
184:11, 186:1, 186:3, 186:7, 186:23,
188:18, 195:6, 212:16, 214:12,
224:23, 249:8, 250:23, 251:7, 256:17,
260:4, 261:15, 271:15, 272:1
FIRST-IN [3] - 224:23, 249:8, 256:17
FIRST-OUT [3] - 224:23, 249:8, 256:17
FIT [1] - 163:14
FITS [1] - 233:22
FIVE [2] - 202:21, 214:20
FLAVORS [1] - 188:24
FLEETING [2] - 266:18, 268:19
FLUSHES [1] - 224:24
FOCUS [1] - 171:14
FOCUSED [1] - 219:13
FODDER [1] - 165:23
FOLDER [1] - 235:23
FOLLOWING [1] - 1:2
FOLLOWS [5] - 168:13, 177:12, 203:2,
227:17, 277:21
FONTS [2] - 196:6
FOR [2] - 1:5, 155:1
FORCED [1] - 192:14
FOREGOING [1] - 278:6
FORENSIC [23] - 160:7, 178:10, 180:4,
181:10, 182:12, 183:13, 183:20,
183:25, 184:4, 184:10, 184:12,
184:25, 186:3, 186:6, 186:13, 187:5,
190:3, 198:21, 199:10, 199:13,
220:19, 268:1
FORENSIC [1] - 197:24
FORENSICALLY [1] - 268:3
FORENSICS [2] - 177:22, 180:13
FORGETTING [1] - 275:10
FORM [1] - 185:1
FORMAT [1] - 258:11
FORMED [2] - 218:2, 267:18
FORMING [3] - 265:20, 267:15, 268:1
FORTH [1] - 205:6
FORWARD [1] - 160:20
FORWARDED [2] - 161:15, 161:17
FOSTER [2] - 155:7, 155:17
FOSTER [30] - 171:11, 177:2, 178:19,
186:21, 218:14, 218:22, 218:24,
219:2, 222:9, 224:9, 224:20, 228:12,
229:11, 230:14, 236:17, 239:13,
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 133 of 145
240:10, 258:2, 260:24, 264:25,
268:12, 268:18, 274:5, 274:12,
274:15, 274:18, 274:22, 275:1, 275:3,
275:10
FOSTER'S [13] - 162:16, 176:23,
218:17, 258:1, 266:19, 267:6, 267:12,
273:7, 274:7, 274:17, 275:5, 275:7,
275:8
FOUNDATION [6] - 157:19, 158:18,
158:23, 261:5, 262:24, 265:24
FOUR [3] - 219:16, 221:23, 271:18
FOXTROT [2] - 189:5, 189:6
FRAME [1] - 212:17
FRANKLY [1] - 167:1
FRAUD [1] - 267:24
FRIDAY [1] - 271:13
FRIENDLY [1] - 193:1
FROM [1] - 1:9
FRONT [4] - 182:19, 185:9, 194:6, 255:6
FUGITIVES [1] - 176:4
FULL [1] - 1:9
FULL [14] - 165:6, 165:21, 166:11,
166:23, 200:16, 208:24, 209:1, 209:2,
209:5, 209:6, 210:3, 211:13, 216:7,
277:14
FULTON [1] - 182:4
FUNDAMENTAL [1] - 275:23
G
GAME [1] - 158:22
GAMMA [1] - 211:14
GBI [1] - 180:16
GEARS [1] - 241:16
GENA [9] - 202:12, 232:13, 234:12,
260:23, 266:18, 267:11, 268:12,
268:18, 275:5
GENERAL [1] - 265:22
GENERALLY [12] - 158:21, 184:24,
196:22, 206:8, 210:3, 211:3, 211:14,
215:14, 217:1, 223:8, 254:25, 270:1
GENERATED [5] - 245:17, 246:11,
248:9, 260:3, 260:5
GENTLEMEN [5] - 170:7, 213:20, 271:8,
271:14, 271:22
GEORGIA [4] - 155:1, 155:25, 157:1,
278:4
GEORGIA [1] - 182:1
GIGS [1] - 249:5
GIVEN [8] - 167:4, 167:5, 211:21,
212:17, 218:11, 222:5, 252:15, 276:22
GJPYFROM@GMAIL.COM [1] - 235:5
GLASS [1] - 208:25
GLOBAL [2] - 175:18, 175:22
GLYNN [1] - 182:5
GOVERNMENT [6] - 227:24, 234:17,
235:2, 237:12, 238:9, 250:1
GOVERNMENT [1] - 155:14
GOVERNMENT [23] - 159:3, 159:21,
161:8, 161:24, 162:1, 163:17, 165:24,
166:16, 167:8, 186:3, 220:18, 221:6,
221:8, 221:10, 255:6, 260:25, 261:23,
265:11, 266:6, 272:18, 272:21, 274:2,
274:8
GOVERNMENT'S [9] - 168:4, 206:12,
212:14, 212:18, 214:22, 263:18,
268:22, 274:14, 276:5
GPS [3] - 207:2, 217:2
GRAB [2] - 269:3, 269:4
GRANT [2] - 166:8, 166:25
GREAT [1] - 277:18
GREEN [1] - 174:9
GROUP [4] - 191:6, 191:13, 227:7,
227:21
GUESS [12] - 157:6, 160:15, 161:6,
161:8, 168:23, 170:20, 171:12,
172:12, 241:2, 264:18, 273:19, 275:24
GUILTY [2] - 272:13, 276:23
GUN [1] - 157:11
GWINNETT [2] - 182:4, 182:5
H
HACKING [2] - 179:7, 225:8
HALF [1] - 194:9
HALFWAY [2] - 160:9, 251:18
HAND [2] - 177:8, 271:12
HANDED [1] - 161:8
HANDLE [2] - 208:22, 209:7
HANDLES [1] - 181:18
HANDLING [1] - 210:1
HAPPY [7] - 157:18, 158:17, 164:16,
167:3, 167:5, 169:17, 276:20
HARD [6] - 183:18, 184:5, 184:10,
219:21, 219:22, 249:5
HARDCOPY [1] - 163:18
HARDER [1] - 194:1
HARDWARE [2] - 180:1, 180:3
HAS [1] - 1:8
HASH [5] - 186:2, 186:3, 186:5, 186:7
HASHING [3] - 184:9, 185:25
HATES [1] - 208:12
HEADER [1] - 235:9
HEADLINES [1] - 275:25
HEADS [1] - 216:15
HEALTH [1] - 196:20
HEAR [8] - 161:23, 176:23, 194:8,
212:11, 214:7, 268:13, 271:11, 272:1
HEARD [3] - 157:23, 208:15, 211:8
HEARING [3] - 266:23, 274:8, 276:6
HEARSAY [11] - 157:14, 261:13,
262:10, 262:15, 262:21, 262:23,
263:23, 264:12, 265:20, 266:25, 268:6
HEAVIER [1] - 216:18
HELD [1] - 157:1
HELP [6] - 164:4, 180:12, 180:24,
185:15, 188:3, 258:17
HELPED [1] - 236:9
HELPING [1] - 268:8
HEREBY [1] - 278:6
287
HEREIN [1] - 177:11
HIGH [2] - 176:7, 179:23
HIGH-STAKES [1] - 176:7
HIGHLIGHT [1] - 228:25
HIGHLY [2] - 194:24, 276:10
HIMSELF [1] - 218:22
HISTORY [12] - 189:13, 193:10, 195:9,
201:20, 224:22, 240:24, 241:4, 241:8,
241:15, 256:5, 256:17, 256:20
HIT [3] - 161:21, 187:4, 208:17
HITS [1] - 196:24
HITTING [1] - 161:20
HOLDS [1] - 208:25
HOLLAND [8] - 194:7, 224:5, 224:13,
228:1, 228:24, 233:2, 241:2, 250:20
HOME [4] - 181:13, 203:19, 239:5
HOMELAND [1] - 180:16
HONOR [75] - 159:6, 159:12, 159:15,
160:4, 160:8, 161:2, 162:4, 164:9,
164:20, 165:16, 166:6, 166:19,
167:11, 167:17, 168:2, 168:7, 168:15,
168:16, 169:7, 169:16, 169:22,
170:14, 173:11, 173:16, 173:20,
175:2, 175:3, 175:5, 176:13, 176:15,
176:17, 176:20, 176:25, 182:14,
183:1, 185:18, 203:9, 211:17, 211:21,
212:4, 212:19, 214:13, 214:20,
217:10, 217:15, 240:17, 249:25,
253:10, 254:16, 254:19, 259:3,
260:12, 260:15, 260:22, 261:8, 262:2,
263:20, 264:12, 264:21, 266:16,
269:1, 269:5, 269:22, 270:10, 270:12,
270:14, 270:24, 271:4, 271:20,
272:15, 273:11, 273:15, 274:16,
274:17, 277:1
HONORABLE [1] - 155:10
HOPEFULLY [2] - 263:9, 277:9
HOPING [1] - 263:6
HOUR [17] - 159:2, 159:20, 164:8,
164:15, 165:23, 165:24, 166:23,
168:1, 168:8, 169:5, 172:23, 175:9,
175:15, 175:16, 175:17, 213:1, 263:8
HOURS [1] - 165:22
HOUSE [5] - 187:23, 190:18, 190:21,
267:21, 277:8
HOWEVER [1] - 1:8
HTTPS [1] - 243:18
HUMAN [2] - 195:4, 247:12
HUNDREDS [1] - 206:19
HUNTER [1] - 250:2
HUSTLE [1] - 202:22
I
ICIE [1] - 181:11
ICLOUD [22] - 186:22, 195:22, 196:7,
197:14, 206:1, 235:16, 243:10,
243:15, 244:9, 244:17, 245:19,
247:13, 248:20, 248:25, 249:22,
251:24, 253:2, 253:20, 254:24,
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 134 of 145
266:20, 269:25
ICLOUD-BASED [1] - 243:15
ICLOUD.COM [2] - 196:10, 245:9
ID [11] - 197:6, 204:2, 204:25, 246:13,
246:15, 246:17, 251:13, 252:14,
252:16, 255:15, 255:22
IDEA [7] - 160:24, 175:21, 203:20,
212:11, 264:24, 266:22, 268:20
IDENTIFIED [6] - 219:16, 219:17,
219:21, 232:12, 234:11, 237:19
IDENTIFIER [1] - 205:24
IDENTIFY [6] - 189:9, 223:5, 225:8,
225:10, 225:13, 225:16
IDENTITY [9] - 244:18, 245:10, 245:12,
245:19, 245:23, 274:21, 275:1,
275:14, 275:15
IDS [1] - 252:15
IEF [4] - 199:7, 199:16, 199:20, 199:25
IEMI [1] - 205:25
ILLUSTRATOR [1] - 241:21
IMAC [1] - 203:18
IMAGE [9] - 183:13, 183:20, 183:25,
184:8, 184:10, 186:3, 186:6, 186:13,
198:21
IMAGED [1] - 183:15
IMAGES [4] - 184:11, 184:12, 187:6,
220:19
IMAGINE [2] - 165:14, 165:18
IMAGING [1] - 184:4
IMEI [2] - 205:23, 206:9
IMPACT [1] - 220:25
IMPLICATION [3] - 255:9, 274:4, 276:9
IMPORT [1] - 198:23
IMPORTANT [5] - 207:23, 209:15,
209:16, 218:6, 220:11
IMPOSE [1] - 163:17
IN [3] - 1:3, 1:4, 157:1
INADMISSIBLE [1] - 268:5
INC [1] - 177:25
INCLUDE [6] - 174:16, 183:14, 199:17,
212:15, 218:5, 235:20
INCLUDED [9] - 162:16, 172:3, 172:5,
174:18, 199:25, 200:3, 218:8, 232:8,
243:17
INCLUDES [2] - 181:20, 203:25
INCLUDING [3] - 186:17, 200:8, 272:9
INCOMPLETE [2] - 220:16, 220:17
INCONSISTENCIES [1] - 158:4
INCONSISTENCY [1] - 275:23
INCONSISTENT [1] - 276:10
INCORPORATED [2] - 178:6, 210:7
INCREASINGLY [1] - 270:6
INDEPENDENT [1] - 248:7
INDEX [1] - 273:19
INDICATED [1] - 191:3
INDICATION [1] - 231:22
INDIVIDUAL [5] - 187:22, 192:7, 209:18,
226:21, 251:13
INDIVIDUAL'S [1] - 181:1
INFERENCE [1] - 257:18
INFLUENCE [1] - 230:15
INFORMATION [36] - 159:18, 163:5,
168:17, 168:19, 169:11, 174:16,
181:14, 184:6, 184:16, 184:18,
187:21, 190:21, 191:14, 192:5,
193:14, 196:22, 197:22, 198:6, 201:3,
201:13, 205:7, 210:23, 211:5, 225:17,
249:8, 255:16, 255:18, 259:15, 261:2,
261:21, 262:6, 266:2, 266:4, 272:6,
277:14
INFORMATION'S [1] - 204:18
INFORMED [2] - 215:20, 271:23
INITIAL [2] - 162:21, 208:17
INSIDE [3] - 197:8, 245:4, 247:2
INSTALL [1] - 249:10
INSTALLED [2] - 249:16, 251:3
INSTANCE [2] - 195:11
INSTANCES [2] - 195:5, 195:17
INSTEAD [2] - 169:6, 277:10
INSTRUCTION [1] - 276:9
INSTRUCTIONS [2] - 202:24, 272:8
INSTRUCTOR [3] - 179:18, 179:19,
180:5
INTEGRITY [1] - 251:15
INTELLECTUAL [1] - 179:6
INTELLIGENCE [1] - 190:3
INTERACTING [2] - 190:24, 247:10
INTERACTION [3] - 195:4, 241:10,
247:12
INTERNAL [2] - 189:21, 191:9
INTERNALLY [1] - 184:6
INTERNATIONAL [1] - 205:23
INTERNET [15] - 181:2, 181:9, 181:11,
195:9, 205:2, 205:4, 205:11, 208:6,
224:22, 240:23, 241:4, 241:7, 241:14,
256:5, 256:17
INTERRUPT [2] - 160:13, 202:4
INTERVIEW [4] - 261:25, 262:3, 267:24,
275:4
INVESTIGATION [5] - 157:24, 158:2,
158:9, 158:16, 234:14
INVESTIGATIONS [2] - 177:25, 179:10
INVESTIGATIONS [1] - 178:14
INVESTIGATIVE [2] - 181:8, 215:18
INVESTIGATOR [3] - 179:17, 179:18,
181:22
INVOLVED [4] - 178:10, 179:5, 229:22,
237:8
INVOLVES [2] - 179:8, 274:1
INVOLVING [1] - 178:17
IP [9] - 187:25, 188:17, 188:19, 188:23,
188:25, 189:9, 189:11, 189:16
IP4 [1] - 188:25
IP6 [2] - 188:25, 189:3
IPAD [3] - 203:25, 205:18, 266:21
IPADS [1] - 222:22
IPHONE [1] - 262:17
IPHONES [2] - 221:23, 222:22
288
IPOD [1] - 204:1
IPODS [1] - 222:22
IPS [1] - 188:24
IRON [1] - 181:16
IS [1] - 1:2
ISSUE [32] - 157:5, 157:9, 157:15,
157:22, 158:25, 159:1, 159:14,
162:25, 164:14, 165:6, 165:14,
165:15, 165:19, 166:22, 166:24,
167:3, 167:6, 167:12, 167:16, 168:16,
169:9, 249:20, 261:3, 263:23, 266:2,
266:18, 269:6, 273:12, 273:16,
273:21, 276:11
ISSUED [2] - 174:1, 174:21
ISSUES [5] - 207:17, 270:21, 273:20,
273:22
IT'LL [2] - 161:21, 163:14
ITEM [1] - 227:4
ITEMS [1] - 227:6
ITSELF [6] - 198:20, 227:16, 231:13,
240:24, 252:16, 256:18
J
J.P [1] - 155:10
JACKSON [1] - 269:6
JACKSON [2] - 155:6, 155:20
JAMES [1] - 156:3
JAN [2] - 234:21, 235:12
JAN-FEB [2] - 234:21, 235:12
JB [1] - 179:12
JIM [2] - 156:5, 177:10
JIM [3] - 177:2, 177:16, 180:23
JOB [9] - 195:9, 207:5, 208:5, 208:9,
208:11, 209:3, 211:3, 211:14, 229:20
JUDGE [3] - 160:22, 161:1, 185:21
JUDGE [1] - 155:10
JUDGE [1] - 161:5
JULY [5] - 171:17, 171:18, 172:14,
172:21, 173:1
JUMPED [1] - 157:11
JUNE [2] - 195:8
JUROR [2] - 277:2, 277:15
JURY [46] - 162:12, 165:13, 166:4,
167:2, 167:6, 169:15, 169:19, 170:5,
170:7, 175:14, 176:9, 185:15, 202:25,
203:3, 203:4, 213:17, 213:20, 213:24,
214:1, 214:25, 215:3, 223:8, 230:24,
238:22, 249:20, 250:8, 253:16,
260:17, 263:8, 263:11, 266:9, 266:23,
266:25, 268:7, 268:8, 268:10, 268:13,
268:25, 269:3, 269:18, 270:19, 271:8,
271:14, 271:22, 272:10, 276:8
JURY [1] - 155:9
K
KAUSHAL [1] - 226:6
KAUSHAL [5] - 155:15, 168:15, 169:7,
169:25, 170:3
KEEP [12] - 158:11, 192:16, 195:10,
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 135 of 145
207:4, 208:6, 208:9, 208:11, 211:3,
217:3, 251:13, 253:17, 266:23
KEEPING [1] - 200:5
KEEPS [1] - 193:9
KEPT [4] - 216:9, 249:6, 266:5
KEY [2] - 185:2, 205:3
KEYBOARD [1] - 257:24
KIND [13] - 167:5, 174:8, 179:7, 179:15,
199:4, 200:5, 202:22, 216:4, 219:25,
229:16, 233:22, 252:18, 272:5
KINDS [1] - 267:15
KNOWING [3] - 230:13, 236:22, 268:12
KNOWLEDGE [3] - 175:21, 259:8,
269:25
KNOWN [1] - 212:23
KNOWS [3] - 190:17, 193:13, 261:20
KYLE [1] - 158:20
L
LABELED [1] - 193:20
LADIES [5] - 170:7, 213:20, 271:8,
271:14, 271:22
LAID [3] - 157:21, 158:23
LANGUAGE [1] - 197:25
LAPTOP [20] - 183:14, 183:20, 187:20,
218:2, 218:15, 219:19, 222:15,
222:17, 223:19, 223:21, 228:21,
229:6, 231:4, 236:21, 237:20, 243:10,
249:9, 249:16, 249:22, 257:22
LARGE [1] - 162:15
LAST [12] - 157:9, 157:13, 157:18,
160:23, 164:22, 168:16, 168:17,
169:6, 234:9, 262:25, 263:5, 269:7
LATE [1] - 178:6
LATELY [1] - 221:23
LATITUDE [1] - 211:6
LAUNCH [1] - 201:20
LAUNDERING [1] - 274:3
LAW [11] - 177:23, 179:19, 180:8, 180:9,
180:12, 180:13, 181:8, 210:15,
265:18, 267:24, 275:18
LAWN [2] - 216:13, 216:14
LAY [5] - 157:19, 158:18, 261:5, 262:23,
265:24
LAYER [1] - 157:16
LAYERS [1] - 157:14
LAYPERSON [3] - 183:21, 258:24,
258:25
LEADING [2] - 159:17, 259:3
LEAP [1] - 253:4
LEARN [2] - 216:6, 216:7
LEARNED [1] - 186:23
LEAST [5] - 181:21, 241:7, 273:24,
276:18, 276:22
LEAVE [4] - 192:8, 203:19, 204:17,
263:9
LEAVING [1] - 276:8
LEE [8] - 157:6, 159:2, 160:20, 161:9,
161:15, 161:17, 163:18, 277:7
LEEWAY [1] - 211:21
LEFT [6] - 193:16, 197:5, 228:5, 228:14,
230:5, 253:7
LEIGH [1] - 155:18
LEIGH [1] - 160:20
LENOVO [1] - 222:17
LESS [3] - 175:24, 214:20, 214:21
LETTER [4] - 190:15, 190:16, 265:22,
274:19
LETTERS [1] - 254:7
LICENSED [2] - 179:17
LICENSING [1] - 179:15
LIFT [1] - 277:10
LIKELIHOOD [1] - 266:1
LIMINE [6] - 263:18, 263:19, 263:21,
274:1, 276:13, 276:16
LIMIT [2] - 223:21, 236:23
LIMITATION [1] - 201:18
LIMITED [3] - 192:4, 248:22, 259:19
LINE [13] - 158:21, 163:1, 167:10, 207:3,
211:22, 214:18, 227:4, 227:6, 236:24,
237:13, 250:21, 255:11, 256:6
LINE [1] - 1:7
LINES [2] - 238:12, 239:9
LINK [1] - 201:21
LINKED [1] - 204:7
LIST [9] - 193:23, 210:25, 232:8, 237:20,
238:15, 239:14, 243:18, 248:22,
273:24
LISTED [4] - 172:16, 195:13, 232:12,
234:12
LISTENER [2] - 157:17, 157:19
LISTENING [1] - 184:2
LISTING [1] - 235:20
LISTS [1] - 168:8
LIVE [1] - 190:16
LIVES [1] - 272:5
LNK [5] - 227:15, 227:17, 227:18,
259:22, 259:24
LNK [2] - 259:24, 259:25
LOAD [1] - 193:14
LOANS [1] - 236:1
LOCATED [1] - 208:24
LOCATION [1] - 211:7
LOCATIONS [4] - 168:9, 174:18,
205:15, 216:21
LOCKED [1] - 275:6
LOG [59] - 192:11, 192:15, 193:3,
196:21, 196:23, 196:25, 197:3, 197:8,
198:23, 200:23, 218:25, 224:9,
224:16, 240:23, 243:21, 243:25,
244:13, 244:16, 245:5, 245:8, 245:16,
245:18, 245:22, 246:1, 246:5, 246:8,
246:11, 246:19, 247:16, 248:13,
249:4, 249:6, 250:8, 250:23, 251:6,
251:12, 251:18, 252:4, 252:17, 253:9,
254:4, 254:14, 255:7, 255:13, 255:15,
255:17, 255:19, 255:21, 255:25,
256:1, 256:9, 256:21, 256:24, 260:9,
262:5
289
LOG-IN [5] - 224:16, 246:1, 256:21,
260:9
LOG-INS [4] - 224:9, 240:23, 256:9,
256:24
LOGGED [25] - 187:13, 192:18, 192:19,
192:22, 195:1, 197:18, 201:17, 204:2,
204:11, 204:15, 204:24, 204:25,
205:8, 219:3, 225:20, 226:21, 243:10,
244:11, 244:17, 253:19, 253:23,
255:2, 255:16, 255:17, 266:20
LOGGING [3] - 204:16, 247:17
LOGS [21] - 196:19, 200:4, 200:11,
200:14, 200:17, 245:17, 246:11,
248:2, 248:11, 248:16, 248:20,
248:21, 248:22, 250:13, 250:16,
252:8, 252:10, 252:24, 253:18, 257:1
LONGITUDE [1] - 211:6
LOOK [42] - 158:20, 165:10, 167:20,
167:22, 169:21, 172:19, 173:7, 181:9,
182:18, 183:8, 183:22, 185:9, 186:20,
194:22, 195:20, 198:17, 198:21,
199:20, 200:16, 201:4, 213:16,
213:23, 214:8, 223:16, 223:23,
228:23, 230:24, 236:12, 238:7, 239:7,
243:25, 245:25, 246:14, 248:13,
249:12, 251:11, 254:11, 259:8,
263:16, 276:20
LOOKED [18] - 158:5, 158:6, 164:25,
166:1, 167:21, 167:22, 200:7, 201:8,
220:22, 223:13, 230:6, 240:10,
245:21, 248:11, 248:13, 257:7, 257:8,
258:8
LOOKING [12] - 161:7, 166:14, 171:17,
191:17, 198:10, 233:20, 235:25,
239:16, 242:23, 252:10, 267:22,
271:17
LOOKS [6] - 161:25, 174:2, 228:6,
230:11, 237:21, 267:17
LOOKUP [2] - 188:20, 189:7
LOSE [1] - 203:21
LOW [1] - 206:19
LOWER [1] - 212:10
LUNCH [5] - 159:2, 164:8, 165:24,
169:5, 170:8
M
MAGNET [1] - 199:10
MAIL [47] - 157:6, 159:1, 161:16,
186:17, 186:18, 186:19, 187:5, 187:7,
190:7, 190:17, 190:22, 190:24, 191:4,
191:15, 192:2, 192:24, 193:2, 193:22,
195:14, 195:18, 199:2, 200:22,
200:24, 201:17, 227:3, 227:11,
231:17, 235:4, 235:7, 236:13, 243:13,
243:15, 243:21, 244:17, 244:24,
245:2, 245:7, 245:23, 247:2, 247:11,
248:14, 253:20, 253:21, 253:23,
253:24, 253:25, 255:4
MAIL.YAHOO.COM [1] - 227:16
MAILED [3] - 160:18, 164:23, 235:15
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 136 of 145
MAILS [6] - 160:23, 187:11, 187:18,
191:2, 194:19, 194:25
MAINTAIN [1] - 180:25
MAINTAINING [1] - 251:14
MAINTENANCE [2] - 207:18, 207:22
MAJOR [1] - 179:14
MAJORITY [1] - 270:8
MANNER [2] - 166:11, 181:10
MAPPING [2] - 206:21, 210:11
MARK [2] - 163:9, 163:12
MARKED [6] - 170:17, 186:9, 191:8,
193:4, 193:25, 207:9
MARSHALL [5] - 173:17, 175:4, 176:16,
254:18, 270:13
MARSHALL [17] - 155:20, 160:22,
161:1, 173:18, 175:5, 176:17, 182:15,
183:4, 185:21, 188:10, 188:12,
188:15, 250:4, 254:19, 269:5, 269:10,
270:14
MATCH [8] - 186:6, 186:7, 186:13,
197:3, 198:9, 219:13, 236:13, 248:14
MATCHES [3] - 184:10, 190:4, 239:21
MATERIAL [1] - 261:5
MATERIALS [3] - 258:12, 261:12,
275:13
MATTER [2] - 236:19, 260:16
MAY [2] - 1:3, 1:5
MEAN [16] - 161:24, 165:14, 165:20,
168:24, 173:24, 192:11, 200:8,
207:24, 231:12, 234:4, 252:6, 253:4,
254:23, 255:13, 264:10, 265:21
MEANING [1] - 193:1
MEANS [1] - 198:20
MEANT [2] - 253:13, 268:20
MEDIA [1] - 186:5
MEET [2] - 217:22, 217:23
MEG [1] - 249:7
MEGS [1] - 249:4
MEMBERSHIP [1] - 179:16
MEMO [1] - 276:5
MEMORANDUM [1] - 274:19
MEMORY [1] - 264:16
MENTIONED [2] - 194:18, 276:19
MENTIONS [1] - 191:14
MESSAGE [9] - 228:1, 228:5, 228:10,
228:11, 228:14, 228:25, 230:6,
237:14, 237:15
MESSAGED [1] - 229:11
MESSAGES [10] - 205:12, 238:13,
239:12, 247:5, 247:8, 257:8, 257:17,
257:19, 274:10, 274:11
MESSAGING [1] - 204:20
METADATA [17] - 201:24, 202:12,
231:4, 231:10, 231:12, 231:18,
231:21, 232:8, 232:9, 232:10, 233:4,
233:11, 233:17, 233:23, 234:1, 234:3,
237:5
MICROSOFT [3] - 198:22, 251:13,
252:13
MIDDLE [5] - 182:1, 182:3, 184:2,
194:23, 228:1
MIDMORNING [1] - 270:19
MIGHT [9] - 216:18, 259:24, 260:18,
260:19, 265:12, 265:16, 269:16,
271:19, 271:25
MILE [1] - 216:25
MILES [1] - 215:14
MILITARY [4] - 171:19, 171:24, 176:2,
181:20
MINE [1] - 233:16
MINOR [3] - 166:24, 167:2, 168:25
MINUTE [2] - 210:6, 269:16
MINUTES [8] - 165:2, 169:2, 202:6,
209:8, 210:4, 212:2, 212:23, 214:21
MISSING [1] - 176:4
MISTRIAL [7] - 160:8, 164:7, 165:15,
165:18, 166:9, 166:25, 167:15
MOBILE [1] - 205:23
MODIFYING [1] - 237:9
MOMENT [7] - 160:21, 161:18, 161:19,
240:17, 253:10, 263:15, 273:1
MONDAY [4] - 271:11, 272:8, 276:21,
276:23
MONEY [4] - 198:4, 198:5, 274:3,
274:20
MONITOR [1] - 181:1
MONITORING [1] - 209:23
MOORE [12] - 155:15, 162:4, 162:21,
164:2, 164:9, 168:7, 171:1, 173:13,
173:16, 175:3, 175:8, 176:12
MOORE [4] - 163:22, 168:6, 175:6,
226:7
MORNING [5] - 157:9, 157:12, 157:22,
165:5, 276:21
MOST [4] - 193:9, 193:23, 195:11,
233:22
MOTHER [1] - 277:9
MOTION [18] - 167:13, 167:14, 260:22,
263:16, 263:17, 263:18, 263:19,
263:20, 263:21, 263:22, 263:23,
264:17, 272:12, 274:1, 274:14,
276:12, 276:16, 276:22
MOUNT [2] - 184:11, 219:14
MOUNTING [1] - 219:10
MOVE [10] - 160:8, 170:25, 173:11,
182:11, 183:1, 185:18, 208:10,
214:14, 215:6, 249:25
MOVED [1] - 267:10
MOVING [3] - 271:15, 271:24, 272:3
MR [31] - 160:22, 161:1, 162:4, 162:21,
164:2, 164:9, 168:7, 168:15, 169:7,
169:25, 170:3, 171:1, 173:13, 173:16,
173:18, 175:3, 175:5, 175:8, 176:12,
176:17, 182:15, 183:4, 185:21,
188:10, 188:12, 188:15, 250:4,
254:19, 269:5, 269:10, 270:14
MRU [1] - 193:9
MRUS [1] - 193:8
MS [187] - 159:6, 159:15, 160:18,
161:14, 161:16, 163:14, 164:20,
290
165:8, 165:10, 165:16, 166:6, 166:8,
166:19, 167:11, 167:17, 168:2,
169:16, 169:22, 170:2, 170:4, 170:14,
170:16, 170:25, 171:2, 171:4, 171:7,
171:8, 173:11, 173:15, 173:20,
173:21, 175:1, 176:15, 176:25, 177:2,
177:18, 182:11, 182:14, 182:17,
183:1, 183:3, 183:6, 183:7, 185:18,
185:20, 185:23, 185:24, 188:11,
188:14, 188:16, 194:7, 194:12,
194:15, 195:24, 196:1, 196:13,
196:14, 202:8, 202:11, 202:17, 203:9,
203:10, 211:17, 211:21, 212:4,
212:12, 212:19, 213:6, 213:11,
213:18, 214:13, 214:20, 215:7, 215:8,
217:10, 217:12, 217:15, 217:18,
224:4, 224:6, 224:12, 224:14, 226:13,
226:14, 226:22, 227:1, 227:24, 228:4,
228:24, 229:1, 230:2, 230:4, 231:6,
231:8, 233:1, 233:3, 234:7, 234:10,
234:17, 234:20, 235:1, 235:3, 235:18,
235:19, 236:24, 237:2, 237:11,
237:16, 238:8, 238:14, 239:7, 239:11,
240:7, 240:8, 240:17, 240:19, 240:21,
241:1, 241:3, 243:5, 243:6, 246:23,
246:25, 247:21, 247:22, 249:25,
250:3, 250:6, 250:9, 250:11, 250:19,
250:22, 251:16, 251:17, 251:21,
251:23, 253:10, 253:12, 253:14,
254:16, 254:22, 259:3, 259:5, 259:7,
260:12, 260:15, 260:22, 261:8,
261:19, 262:2, 262:8, 262:9, 262:11,
262:12, 262:17, 263:19, 264:1, 264:2,
264:3, 264:8, 264:12, 264:21, 265:24,
266:16, 269:1, 269:14, 269:21,
269:24, 270:10, 270:12, 270:24,
271:1, 271:4, 271:6, 271:20, 272:15,
272:23, 273:4, 273:11, 273:15,
273:16, 273:25, 274:16, 276:1, 277:1,
277:5, 277:12
MULTIPLE [2] - 203:16, 267:7
MURDER [1] - 179:6
MUST [2] - 253:2, 267:1
N
NAME [18] - 177:15, 187:22, 197:7,
217:21, 228:2, 229:5, 233:10, 233:21,
233:25, 234:3, 234:21, 237:3, 239:13,
239:14, 239:15, 239:17, 240:2
NAMERK [1] - 190:7
NAMES [5] - 199:11, 235:25, 236:1,
238:16, 238:19
NAMING [1] - 239:20
NATIVE [1] - 198:19
NECESSARILY [8] - 197:13, 216:6,
216:12, 220:17, 231:12, 231:25,
232:3, 273:20
NECESSITATE [1] - 213:24
NEED [16] - 159:4, 167:1, 168:10,
170:10, 175:15, 175:16, 180:12,
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 137 of 145
192:9, 209:19, 213:22, 255:17,
260:15, 264:1, 272:20, 272:25, 273:13
NEEDED [2] - 164:5, 258:17
NEEDLE [1] - 184:1
NETWORK [1] - 205:3
NEVER [4] - 165:1, 182:9, 265:21,
266:19
NEW [13] - 159:14, 160:10, 160:15,
163:5, 167:23, 167:24, 169:9, 173:14,
192:15, 208:9, 245:5, 249:16, 251:4
NEW [1] - 182:2
NEWER [1] - 224:25
NEWLY [1] - 277:9
NEXT [3] - 202:6, 264:6, 272:1
NICE [2] - 217:22, 217:23
NIGHT [7] - 157:9, 157:13, 157:18,
164:22, 168:17, 169:6, 269:7
NO [1] - 155:5
NOBODY [1] - 229:14
NON [1] - 171:24
NON-MILITARY [1] - 171:24
NONE [2] - 158:9, 211:25
NORMAL [1] - 183:21
NORMALLY [6] - 166:20, 169:10,
210:22, 210:25, 211:1, 221:13
NORTHBOUND [1] - 211:15
NORTHERN [2] - 155:1, 278:4
NORTHERN [1] - 182:1
NOTATIONS [1] - 257:1
NOTE [2] - 227:15, 276:14
NOTES [1] - 163:6
NOTHING [13] - 176:13, 233:7, 233:25,
244:10, 245:12, 251:10, 254:16,
256:1, 262:4, 262:9, 274:22, 275:16
NOTIFIED [1] - 167:19
NOTIFY [2] - 181:14, 273:8
NOW'S [1] - 208:9
NUMBER [2] - 1:6, 1:7
NUMBER [31] - 163:1, 179:24, 185:4,
187:16, 188:10, 189:1, 189:7, 189:21,
189:24, 191:17, 197:7, 198:22,
204:24, 205:6, 205:24, 206:9, 219:11,
219:23, 227:4, 227:6, 234:8, 238:23,
239:2, 239:5, 239:23, 246:13, 252:14,
255:15, 263:25, 267:1
NUMBER [1] - 191:14
NUMBERING [1] - 220:1
NUMBERS [4] - 190:19, 238:5, 239:22,
246:15
NUMERIC [1] - 193:16
O
OBJECTION [13] - 173:16, 173:18,
182:14, 182:15, 183:3, 183:4, 185:20,
185:21, 214:23, 215:5, 250:3, 250:4,
259:3
OBSERVED [1] - 267:3
OBTAIN [1] - 210:16
OBVIOUSLY [7] - 187:9, 203:15,
212:14, 212:21, 212:23, 254:2, 268:17
OCCUPATION [1] - 177:21
OCCUR [1] - 173:4
OF [10] - 1:2, 1:5, 1:6, 155:1, 155:4,
155:9, 155:14, 155:17, 155:20, 278:4
OFF-THE-RECORD [3] - 203:7, 269:12,
273:3
OFFER [3] - 212:24, 220:21, 267:10
OFFERED [4] - 157:14, 222:21, 261:8,
267:3
OFFERING [1] - 218:17
OFFERS [1] - 181:17
OFFICE [4] - 225:25, 226:7, 231:15,
248:3
OFFICER [5] - 179:11, 179:19, 199:12,
214:25, 267:24
OFFICER [2] - 203:3, 269:3
OFFICIAL [6] - 1:2, 1:3, 1:4, 1:8, 155:24,
278:15
OFFLINE [1] - 207:19
OFFSET [1] - 190:15
OFTEN [3] - 175:23, 192:2, 193:13
OHIO [1] - 182:2
OLD [1] - 167:25
OLDER [1] - 224:24
ON [3] - 155:14, 155:17, 155:20
ONCE [6] - 201:6, 201:17, 204:16,
208:21, 210:3, 256:3
ONE [68] - 157:14, 160:5, 160:18,
160:21, 160:23, 161:25, 163:14,
163:23, 164:15, 164:21, 167:24,
168:8, 173:14, 175:9, 175:15, 176:23,
181:21, 184:19, 184:20, 184:22,
186:22, 187:5, 193:7, 195:23, 198:22,
199:5, 200:18, 200:19, 201:4, 202:8,
204:5, 207:17, 209:25, 210:1, 210:2,
211:16, 217:10, 217:21, 221:25,
223:19, 224:7, 234:11, 234:18,
236:25, 238:9, 238:10, 240:12,
240:13, 240:17, 242:10, 243:9,
246:19, 251:24, 252:2, 255:22,
255:23, 256:25, 257:22, 258:2,
260:12, 262:25, 263:5, 265:6, 266:12,
267:1, 270:20
ONE'S [1] - 271:12
ONE-TIME [1] - 201:4
ONES [3] - 180:11, 240:5, 252:2
ONLY [2] - 1:3, 1:7
OPEN [11] - 191:2, 192:7, 192:8, 192:16,
192:17, 193:1, 231:20, 240:12, 245:5,
253:8, 261:18
OPEN [1] - 157:1
OPENED [11] - 187:11, 192:10, 193:18,
193:24, 260:25, 261:7, 261:13,
265:17, 274:21, 274:24, 274:25
OPENING [3] - 187:18, 193:12, 194:25
OPENS [1] - 260:1
OPERATING [2] - 209:19, 268:15
OPINE [1] - 267:8
OPINING [3] - 230:19, 232:22, 261:22
291
OPINION [37] - 201:7, 201:12, 208:17,
212:17, 215:20, 216:1, 216:2, 218:6,
218:10, 218:17, 220:21, 226:18,
229:8, 244:18, 246:6, 246:7, 246:10,
253:1, 254:15, 255:2, 256:1, 261:9,
261:12, 261:15, 265:5, 265:9, 266:3,
266:4, 266:24, 267:1, 267:3, 267:10,
267:13, 267:15, 268:7, 268:8, 268:11
OPINIONS [12] - 211:23, 212:24,
213:11, 213:14, 218:2, 220:25,
222:21, 230:15, 265:20, 266:1,
267:18, 268:1
OPPORTUNITY [1] - 276:3
OPPOSE [1] - 164:9
OPPOSED [1] - 232:18
OPPOSITE [1] - 258:5
OPTIONAL [1] - 205:10
OR [1] - 1:9
ORDEAL [1] - 277:14
ORDER [5] - 183:24, 193:17, 205:9,
265:11, 270:21
ORDERED [1] - 160:4
ORGANIZATIONAL [1] - 171:3
ORGANIZED [1] - 248:16
ORIGINAL [5] - 163:3, 163:4, 170:19,
171:13, 184:10
ORIGINALLY [1] - 164:3
OTHERWISE [2] - 158:12, 268:5
OUNCES [1] - 208:25
OUTER [2] - 184:1, 184:5
OUTPUT [2] - 216:6, 216:19
OUTSIDE [2] - 186:25, 260:16
OUTWEIGHS [1] - 268:9
OVERALL [1] - 196:20
OVERCROWDED [1] - 208:5
OVERCROWDING [1] - 208:15
OVERLOADED [3] - 208:7, 209:13,
209:22
OWN [4] - 197:23, 198:2, 210:17, 248:6
OWNER [1] - 178:7
P
P-E-R-S-I-N-G-E-R [1] - 177:16
P.M [15] - 168:12, 168:13, 170:5, 172:6,
172:8, 202:25, 203:1, 203:2, 203:4,
214:1, 215:3, 263:11, 269:18, 272:10,
277:20
PAD [1] - 206:4
PAGE [18] - 156:2, 163:15, 172:2,
172:13, 172:25, 224:12, 233:1, 234:7,
234:9, 236:24, 237:12, 238:8, 238:10,
238:11, 239:7, 239:8, 241:2, 250:19
PAGE [1] - 1:7
PAGES [10] - 200:18, 200:19, 248:2,
252:7, 252:8, 252:10, 252:24, 255:14,
255:25, 278:6
PAINTING [1] - 190:7
PAIRED [1] - 205:14
PAN [1] - 233:16
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 138 of 145
PANDEMIC [2] - 175:19, 175:22
PAPER [1] - 255:6
PARALEGAL [1] - 163:18
PARENTHESES [1] - 193:21
PART [20] - 157:16, 158:2, 158:10,
171:10, 178:15, 190:14, 193:23,
193:25, 195:24, 212:13, 215:18,
228:8, 229:20, 244:13, 245:14, 254:9,
263:22, 267:13, 268:4, 272:1
PARTIAL [1] - 1:9
PARTICULAR [7] - 190:5, 200:6,
209:17, 230:25, 231:1, 249:5, 267:14
PASSWORD [25] - 184:24, 187:10,
192:23, 201:9, 201:16, 218:20,
218:22, 218:25, 225:10, 225:20,
245:3, 253:25, 254:25, 255:3, 260:25,
262:1, 262:3, 262:5, 262:15, 262:20,
265:2, 265:8, 266:19, 267:25, 268:13
PAST [1] - 212:2
PATENTED [2] - 181:12, 181:16
PATTERNS [1] - 175:19
PAUSE [1] - 171:3
PAY [1] - 164:24
PAY [5] - 172:17, 173:4, 173:7, 174:10,
174:16
PAYCARD [1] - 162:18
PAYCARDS [1] - 162:17
PAYMENT [3] - 275:4, 275:9
PAYROLL [2] - 234:21, 235:12
PDF [9] - 1:2, 227:5, 241:21, 241:22,
241:24, 242:4, 242:5, 242:7, 242:10
PDFS [1] - 200:18
PEACHTREE [1] - 190:16
PENNY [2] - 155:24, 278:15
PEOPLE [4] - 196:2, 215:23, 233:22
PER [1] - 189:11
PERCENT [1] - 174:12
PERFECT [1] - 277:12
PERFECTLY [1] - 209:20
PERHAPS [1] - 277:9
PERIOD [1] - 1:5
PERIOD [1] - 187:10
PERMANENTLY [1] - 207:21
PERSINGER [2] - 156:5, 177:10
PERSINGER [23] - 177:2, 177:16,
177:19, 182:12, 189:9, 203:11,
217:19, 228:5, 230:5, 240:22, 241:17,
242:22, 244:21, 246:18, 249:9, 250:7,
251:19, 253:16, 254:23, 264:22,
265:25, 267:16, 269:25
PERSINGER'S [2] - 228:2, 268:10
PERSON [10] - 183:21, 187:9, 190:23,
201:15, 218:21, 227:10, 253:5,
257:24, 260:3, 265:7
PERSON'S [4] - 193:9, 233:21, 241:10,
255:16
PERSONAL [1] - 175:21
PERSONALLY [1] - 267:3
PERSONS [2] - 176:4, 270:22
PETER [1] - 233:16
PHONE [26] - 160:4, 183:16, 204:2,
204:6, 204:7, 204:23, 204:24, 205:5,
205:9, 205:11, 206:3, 209:4, 209:8,
213:2, 215:12, 215:13, 217:4, 217:6,
222:6, 229:13, 229:14, 229:25,
262:19, 264:25, 266:21
PHONES [1] - 239:1
PHONETIC/SIC [1] - 186:21
PHRONT [4] - 191:5, 191:13, 227:6,
227:21
PHYSICAL [4] - 201:19, 211:6, 227:18,
250:7
PHYSICALLY [1] - 205:15
PIECES [3] - 160:10, 180:11, 181:9
PILOT [1] - 199:13
PINGED [1] - 207:24
PINGS [1] - 206:21
PLACE [3] - 197:6, 207:1, 261:15
PLACES [1] - 267:7
PLAN [2] - 272:5, 276:24
PLANNING [2] - 213:4, 272:4
PLAYER34 [3] - 262:3, 262:15, 266:19
PLEAS [2] - 272:13, 276:23
PLETHORA [1] - 252:15
PM [4] - 155:6, 157:1, 177:25, 179:10
POINT [16] - 160:9, 176:23, 182:11,
192:17, 199:13, 202:6, 213:13,
214:14, 261:4, 261:7, 261:23, 265:2,
266:9, 274:13, 276:2, 276:12
POINTED [1] - 244:15
POINTING [1] - 211:14
POLICE [5] - 179:11, 179:19, 180:17,
181:21, 199:12
POPULATIONS [1] - 216:18
PORNOGRAPHERS [1] - 180:25
PORNOGRAPHY [1] - 179:6
PORTION [1] - 195:25
PORTION [1] - 1:5
PORTIONS [1] - 251:14
POSITION [1] - 272:14
POSITIONS [1] - 276:11
POSITIVE [3] - 187:4, 196:12, 248:21
POSSESSION [2] - 217:6, 230:17
POSSIBLE [1] - 204:20
POST [1] - 179:18
POTENTIALLY [3] - 198:4, 209:13,
217:8
PPP [1] - 236:1
PRECLUDE [1] - 266:17
PREGNANT [1] - 277:9
PREJUDICE [1] - 167:4
PREJUDICIAL [2] - 268:9, 268:17
PREMISES [1] - 266:25
PREPARATION [2] - 158:1, 168:20
PREPARE [2] - 185:7, 217:24
PREPARED [7] - 185:12, 191:9, 196:15,
224:7, 227:2, 229:19, 231:9
PRESENCE [1] - 260:17
PRESENT [5] - 211:20, 260:21, 265:15,
292
266:8, 276:4
PRESENTED [1] - 275:13
PRETRIAL [3] - 260:22, 263:16, 263:17
PRETTY [4] - 158:11, 199:12, 236:23,
274:5
PREVENTS [1] - 185:1
PREVIOUSLY [4] - 217:24, 228:9,
250:1, 250:14
PRIMARILY [1] - 241:21
PRIMARY [1] - 200:4
PRINCIPLE [1] - 265:22
PRINT [4] - 163:10, 163:11, 163:18,
163:21
PRINTOUT [2] - 247:7, 247:13
PRITTY [2] - 155:24, 278:15
PRIVATE [2] - 179:17
PROBATION [1] - 181:1
PROBATIVE [1] - 268:8
PROBLEM [3] - 166:15, 166:17, 167:18
PROCEDURE [1] - 277:6
PROCEEDING [1] - 274:18
PROCEEDINGS [4] - 168:12, 203:1,
277:20, 278:7
PROCEEDINGS [2] - 155:9, 157:1
PROCESS [9] - 180:24, 184:4, 184:8,
184:9, 185:25, 193:11, 193:13, 198:5,
276:11
PRODUCED [5] - 181:3, 210:22, 212:8,
248:21
PRODUCT [2] - 162:8, 261:10
PRODUCTS [2] - 241:17, 242:13
PROFESSIONAL [1] - 179:15
PROGNOSIS [1] - 271:19
PROGRAM [2] - 242:6, 258:22
PROGRAMMING [1] - 197:25
PROGRESS [1] - 273:4
PROHIBITED [1] - 1:9
PROMISE [1] - 272:4
PROPERTY [1] - 179:7
PROPONENT [1] - 268:6
PROPOSE [1] - 272:17
PROPRIETARY [1] - 221:25
PROSECUTION [1] - 178:25
PROSECUTORS [1] - 217:21
PROTECTED [1] - 184:24
PROTECTION [1] - 181:17
PROVIDE [5] - 169:10, 183:18, 186:4,
211:6, 216:20
PROVIDED [31] - 159:22, 160:3, 160:6,
160:10, 160:12, 162:8, 162:9, 162:13,
163:4, 163:6, 166:11, 167:8, 169:10,
170:17, 182:24, 183:9, 184:15, 187:6,
187:21, 188:20, 199:21, 200:17,
206:12, 210:25, 229:14, 242:4, 248:3,
258:12, 259:19, 261:21
PROVIDER [13] - 188:19, 205:22,
205:25, 206:8, 206:10, 207:3, 208:6,
208:12, 208:14, 208:24, 209:2, 211:3,
211:4
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 139 of 145
PROVIDERS [1] - 210:5
PROXIMITY [1] - 227:9
PUBLICLY [3] - 197:22, 198:12, 199:1
PUBLICLY-AVAILABLE [3] - 197:22,
198:12, 199:1
PUBLISH [9] - 224:4, 226:22, 227:24,
231:6, 234:17, 235:1, 237:11, 243:5,
250:9
PULL [23] - 194:7, 194:9, 196:13,
226:23, 226:24, 228:1, 228:2, 230:2,
234:8, 236:25, 237:13, 237:14,
238:11, 238:13, 239:9, 240:7, 250:20,
251:21, 253:12, 263:24, 264:4
PULLED [2] - 248:12, 264:4
PULSE [1] - 271:9
PURE [1] - 181:10
PURGE [7] - 195:10, 248:22, 251:14,
255:18, 255:20, 256:2, 256:18
PURGED [3] - 248:17, 251:10, 252:11
PURGES [3] - 249:8, 255:16, 255:22
PURGING [5] - 248:25, 249:3, 249:23,
255:10, 255:13
PURPOSE [3] - 206:24, 265:4, 276:7
PURPOSES [2] - 207:2, 210:7
PURSUANT [1] - 173:12
PUSH [1] - 181:13
PUT [17] - 187:1, 188:5, 190:2, 190:16,
190:20, 192:23, 200:22, 207:1,
207:20, 208:7, 209:18, 216:15,
219:12, 239:14, 255:6, 266:25, 274:23
PUTS [2] - 199:12, 210:4
PUTTING [2] - 201:14, 217:3
PYFROM [16] - 232:13, 234:12, 260:24,
264:25, 266:18, 267:11, 268:12,
268:18, 274:4, 274:7, 274:15, 274:17,
274:18, 274:20, 275:5, 275:8
PYFROM'S [1] - 202:12
PYFROM-FOSTER [6] - 260:24, 264:25,
268:12, 268:18, 274:15, 274:18
PYFROM-FOSTER'S [4] - 274:7,
274:17, 275:5, 275:8
Q
QAT02 [2] - 222:16, 236:14
QAT08 [1] - 219:24
QAT09 [1] - 220:2
QAT10 [1] - 220:6
QUALIFIED [4] - 157:16, 181:23, 182:7,
182:9
QUALIFY [1] - 182:12
QUESTIONED [2] - 264:22
QUESTIONING [6] - 158:22, 159:16,
211:22, 214:19, 255:11, 256:6
QUESTIONS [9] - 164:15, 175:2, 175:5,
217:12, 225:14, 257:6, 269:14,
269:21, 270:10
QUICK [7] - 165:13, 213:22, 246:24,
260:19, 263:1, 269:5
QUICKER [1] - 271:24
QUICKIE [2] - 214:9, 263:6
QUICKLY [11] - 181:22, 193:14, 248:17,
248:22, 249:7, 249:22, 255:10,
255:13, 255:20, 256:2, 272:3
R
RADIUS [3] - 209:18, 216:23, 216:25
RAISE [1] - 177:7
RAISED [1] - 164:17
RAISING [1] - 271:12
RANGE [1] - 216:11
RANK [1] - 262:10
RAPID [10] - 162:16, 162:18, 164:24,
172:2, 172:7, 172:17, 173:4, 173:7,
174:10, 174:16
RATHER [2] - 214:15, 271:11
RE [1] - 255:22
RE-CREATED [1] - 255:22
REACH [3] - 215:10, 215:21, 216:11
REACHED [1] - 258:10
READ [6] - 174:22, 187:11, 192:24,
194:1, 229:20, 247:8
READER [3] - 241:21, 241:22, 241:24
READILY [1] - 201:16
READING [2] - 158:15, 194:25
READY [2] - 169:3, 224:24
REAL [2] - 246:23, 263:1
REALIZED [3] - 165:25, 166:14, 166:17
REALLY [10] - 165:15, 184:4, 188:7,
189:11, 192:6, 192:21, 201:19, 216:4,
233:17, 236:16
REASON [9] - 207:19, 249:21, 259:10,
261:19, 265:1, 268:13, 268:23,
275:12, 276:18
REASONABLY [1] - 267:14
REASONS [2] - 197:16, 200:8
REASSEMBLED [1] - 184:7
REBUTTAL [5] - 211:25, 212:6, 212:15,
212:17, 212:20
REBUTTING [1] - 275:14
RECALLED [3] - 169:24, 215:2, 269:13
RECEIVE [6] - 204:6, 205:7, 205:11,
205:12, 215:13, 219:14
RECEIVED [6] - 162:21, 164:3, 187:4,
212:18, 219:12, 272:12
RECEIVING [1] - 276:8
RECENT [1] - 193:8
RECENTLY [2] - 193:9, 193:23
RECESS [4] - 168:12, 169:1, 203:1,
277:20
RECOGNIZE [5] - 170:18, 170:19,
170:23, 170:24, 228:5
RECOGNIZED [1] - 165:21
RECOLLECTION [1] - 249:12
RECORD [22] - 162:5, 168:15, 168:22,
169:1, 169:3, 177:15, 184:1, 192:8,
192:15, 192:17, 203:6, 203:7, 203:8,
255:20, 269:11, 269:12, 269:15,
272:20, 273:1, 273:3, 273:13
293
RECORD'S [1] - 161:7
RECORDED [1] - 251:12
RECORDED [1] - 155:23
RECORDS [34] - 159:19, 159:22,
161:12, 162:1, 162:5, 163:4, 163:7,
164:3, 164:21, 164:22, 164:24,
165:11, 166:14, 166:18, 168:18,
169:10, 173:25, 174:8, 174:9, 174:13,
174:14, 174:17, 174:21, 184:6, 192:5,
205:21, 206:14, 206:16, 206:20,
207:22, 208:16, 210:22, 211:5, 212:20
RECROSS [2] - 176:14, 270:11
REDACTION [1] - 230:12
REDIRECT [3] - 156:7, 175:7, 254:21
REDIRECT [1] - 254:20
REDIRECTED [1] - 209:10
REDIRECTS [1] - 209:7
REFERENCE [1] - 195:22
REFERENCED [1] - 247:23
REFERENCES [6] - 196:3, 218:9,
241:15, 248:25, 249:22, 251:24
REFERENCING [1] - 1:7
REFERENCING [1] - 253:17
REFERRING [3] - 246:16, 246:17, 260:6
REFLECT [4] - 168:22, 169:1, 208:17,
244:16
REFLECTED [5] - 171:22, 171:24,
172:10, 172:20, 173:8
REFLECTS [1] - 173:1
REFRESH [1] - 249:12
REFRESHED [1] - 264:16
REGARDING [2] - 157:9, 159:2
REGARDLESS [1] - 198:25
REGISTER [1] - 208:16
REGULAR [2] - 262:3, 266:19
REGULATED [1] - 216:4
REHASH [2] - 186:2, 186:6
REID [1] - 277:7
RELATED [11] - 160:10, 162:5, 188:21,
190:20, 191:4, 224:20, 226:20,
229:17, 236:1, 247:17, 275:17
RELATES [1] - 226:19
RELEASED [1] - 170:8
RELEVANCE [3] - 158:8, 223:12, 261:3
RELEVANT [10] - 162:12, 175:14,
184:16, 184:18, 218:6, 220:15,
236:15, 261:2, 265:13, 266:23
RELIABLE [1] - 221:21
RELIED [6] - 159:25, 164:10, 168:19,
171:10, 261:5, 262:22
RELIES [4] - 176:6, 261:6, 262:23,
268:1
RELY [5] - 205:1, 238:22, 262:24,
265:20, 267:14
RELYING [1] - 209:17
REMEMBER [16] - 185:3, 192:22,
196:10, 201:21, 202:15, 206:25,
207:9, 208:5, 208:11, 210:5, 235:22,
256:6, 256:7, 257:6, 257:15, 274:18
REMIND [1] - 211:11
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 140 of 145
REMINDED [2] - 202:23, 272:8
REMOVE [1] - 231:21
RENEW [1] - 276:12
RENEWING [2] - 274:1, 274:13
REPEAT [1] - 192:9
REPEATEDLY [2] - 201:5, 267:16
REPETITIVE [1] - 192:6
REPHRASE [1] - 259:5
REPLACE [1] - 207:21
REPLY [1] - 276:16
REPORT [2] - 234:21, 235:12
REPORT [75] - 157:10, 159:16, 159:19,
159:24, 160:1, 160:2, 162:14, 168:20,
171:10, 172:1, 172:3, 172:7, 172:13,
172:25, 173:1, 173:2, 173:5, 174:16,
185:5, 185:7, 185:13, 188:3, 191:10,
199:7, 199:16, 199:20, 200:1, 200:6,
201:3, 206:12, 207:7, 207:10, 207:12,
207:25, 209:12, 210:2, 211:23, 212:5,
212:7, 212:13, 212:14, 212:22, 213:7,
213:12, 217:24, 218:2, 218:6, 218:8,
219:16, 226:16, 228:3, 229:17,
229:18, 229:22, 229:23, 230:8,
231:10, 242:2, 242:23, 243:1, 243:9,
247:1, 248:9, 248:15, 249:13, 249:21,
259:2, 261:20, 263:20, 264:23, 267:9,
272:21
REPORTER [4] - 1:4, 1:8, 155:24,
278:15
REPORTER [2] - 211:19, 260:20
REPORTING [1] - 206:9
REPORTS [3] - 209:2, 229:21, 258:23
REPRESENT [2] - 190:19, 228:9
REPRESENTATION [1] - 214:23
REPRESENTED [1] - 168:5
REQUEST [5] - 163:17, 164:7, 169:6,
169:11, 202:5
REQUESTED [2] - 168:17, 210:23
REQUESTS [2] - 169:8
REQUIRE [2] - 193:3, 213:6
REQUIRED [3] - 205:8, 212:6, 255:1
REQUIRES [5] - 205:22, 212:16,
212:19, 213:8, 213:13
RERECORD [2] - 253:8, 255:17
RESEARCH [2] - 179:13, 180:19
RESIDENCE [1] - 219:6
RESOURCE [2] - 243:18, 245:9
RESPECT [1] - 166:19
RESPOND [3] - 272:14, 272:16, 272:25
RESPONDED [1] - 264:20
RESPONSE [4] - 169:11, 212:24, 273:7,
277:17
RESPONSIBLE [3] - 274:6, 274:9,
274:15
REST [2] - 240:12, 277:19
RESTATE [1] - 210:24
RESTRICTED [1] - 1:4
RESULT [1] - 274:21
RESULTS [3] - 198:11, 199:15, 201:14
RESUME [2] - 182:23, 203:20
RETAINED [1] - 178:19
RETIRED [2] - 179:11, 199:11
RETURN [2] - 245:25, 248:21
RETURNED [1] - 245:22
RETURNS [2] - 187:1, 196:12
REVIEW [14] - 165:22, 183:22, 183:24,
201:23, 206:11, 221:2, 221:5, 222:8,
222:11, 222:13, 222:25, 239:1, 239:4,
248:4
REVIEWED [13] - 158:1, 206:16, 207:7,
220:2, 220:6, 220:8, 248:1, 248:6,
249:9, 249:16, 250:14, 252:17, 275:11
REVIEWING [2] - 184:15, 261:16
RF23I [1] - 194:7
RMR [2] - 155:24, 278:15
ROOM [2] - 213:24, 263:8
ROUGHLY [2] - 178:9, 249:5
ROUTERS [1] - 180:1
ROW [2] - 193:19, 194:22
RULE [8] - 173:12, 212:16, 212:19,
229:21, 265:18, 266:17, 266:24
RULE [2] - 213:6, 213:13
RULING [8] - 157:12, 158:17, 263:17,
264:7, 264:8, 264:10, 268:23, 276:19
RUN [2] - 198:8, 199:14
RUNNING [1] - 204:17
RURAL [1] - 216:19
RUSH [1] - 175:17
S
SAFE [2] - 181:10, 271:17
SAMIR [1] - 155:15
SARALIENE [1] - 170:1
SARALIENE [1] - 155:18
SATISFIED [2] - 268:16, 275:22
SAVE [3] - 198:4, 198:17, 260:19
SAW [3] - 191:19, 201:3, 229:17
SCHEDULING [1] - 270:21
SCHOOL [5] - 179:23, 181:14, 277:8,
277:10, 277:11
SCOPE [2] - 192:4, 220:19
SCREEN [3] - 172:20, 173:8, 194:16
SCRIPT [2] - 198:8, 198:11
SCRIPTS [5] - 198:2, 198:3, 198:15,
199:1, 263:22
SCROLL [1] - 241:1
SE [1] - 189:11
SEARCH [1] - 181:19
SEARCH [12] - 186:16, 187:1, 190:5,
190:20, 196:9, 196:23, 198:9, 201:14,
219:11, 236:14, 236:20
SEARCHING [2] - 196:2, 196:5
SEAT [1] - 257:24
SEATED [8] - 168:14, 170:6, 203:5,
214:5, 215:4, 263:15, 269:19, 272:11
SECOND [1] - 275:18
SECOND [12] - 161:13, 174:22, 191:16,
195:23, 197:21, 199:6, 217:10,
234:19, 260:13, 263:22, 267:13,
294
271:15
SECONDARY [3] - 209:24, 209:25,
210:4
SECONDS [2] - 197:10, 246:20
SECRET [2] - 157:10, 180:16
SECTORS [3] - 211:8, 211:12, 211:16
SECURITY [1] - 180:16
SECURITY [24] - 196:21, 196:22,
196:25, 225:13, 244:13, 244:16,
244:20, 245:8, 245:14, 245:17,
245:22, 246:8, 246:10, 247:16,
247:17, 248:11, 250:12, 250:16,
250:23, 252:4, 252:18, 254:14
SECURITY-RELATED [1] - 247:17
SEE [92] - 157:18, 158:18, 158:23,
159:9, 160:15, 162:1, 162:2, 165:20,
166:22, 167:5, 171:1, 172:2, 173:13,
173:24, 174:2, 174:6, 185:15, 186:2,
186:17, 187:4, 187:10, 188:6, 188:21,
189:12, 189:13, 189:20, 190:14,
191:1, 191:5, 191:15, 192:4, 193:7,
193:15, 193:21, 194:2, 194:16,
194:18, 195:9, 195:12, 196:2, 196:4,
197:5, 197:13, 198:7, 199:5, 200:11,
201:20, 214:24, 221:6, 224:15, 226:1,
226:4, 228:11, 228:14, 228:17, 229:2,
229:4, 229:22, 229:23, 229:24, 235:4,
235:25, 236:9, 236:13, 236:20, 237:3,
237:17, 237:21, 238:2, 238:4, 238:18,
239:15, 239:25, 240:2, 240:4, 241:4,
241:6, 243:20, 243:24, 245:20, 250:8,
251:12, 256:9, 263:3, 263:9, 264:20,
268:23, 272:7, 275:10, 276:18
SEEING [7] - 173:24, 187:12, 187:13,
188:3, 195:13, 197:1, 197:3
SEEM [2] - 162:2, 166:25
SEES [2] - 192:10, 209:4
SEIZED [6] - 187:23, 219:6, 233:13,
239:5, 259:17, 267:20
SELECT [2] - 199:16, 235:24
SELECTION [1] - 190:15
SEND [7] - 161:4, 161:5, 190:15, 211:4,
213:17, 259:1, 276:20
SENDING [1] - 213:24
SENSE [3] - 215:10, 215:13, 258:14
SENT [22] - 157:6, 159:24, 165:25,
166:1, 166:2, 169:5, 191:3, 230:6,
230:13, 230:18, 235:7, 237:17,
237:21, 237:25, 238:18, 239:13,
239:20, 239:23, 257:11, 257:16,
257:20, 258:1
SENTENCING [7] - 274:7, 274:17,
274:19, 275:8, 276:4, 276:5, 276:6
SEPARATE [3] - 157:24, 158:9, 275:2
SEQUENCE [1] - 220:1
SERIAL [1] - 205:24
SERIES [2] - 239:22, 257:6
SERVERS [1] - 180:2
SERVICE [5] - 188:19, 207:18, 207:20,
207:22, 253:8
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 141 of 145
SERVICE [2] - 157:10, 180:16
SESSION [1] - 155:6
SET [5] - 239:12, 248:17, 248:22,
252:11, 276:6
SETS [1] - 275:20
SEVEN [2] - 215:14, 216:25
SEVEN-MILE [1] - 216:25
SEVERAL [5] - 180:16, 182:2, 182:6,
196:19, 277:14
SHEET [1] - 162:15
SHERIFF'S [1] - 180:17
SHIELD [1] - 181:16
SHIPS [1] - 199:19
SHORT [3] - 159:1, 179:21, 270:20
SHORTCUT [7] - 259:25, 260:1, 260:2,
260:4, 260:5, 260:9
SHORTEN [2] - 216:11, 216:12
SHORTER [2] - 202:20, 215:24
SHORTLY [2] - 227:3, 263:10
SHOW [17] - 171:5, 171:7, 172:1,
172:13, 172:25, 173:22, 189:19,
190:12, 193:4, 193:25, 205:20, 225:5,
227:2, 233:16, 274:14, 274:23, 276:19
SHOWED [3] - 247:2, 247:5, 247:7
SHOWING [3] - 172:11, 186:10, 191:8
SHOWN [3] - 175:17, 243:3, 260:7
SHOWS [13] - 189:20, 190:1, 190:6,
190:7, 190:9, 196:18, 224:9, 233:16,
243:9, 244:2, 244:10, 245:9, 246:7
SIC [1] - 205:25
SIDE [14] - 221:7, 227:25, 230:2, 230:3,
237:12, 238:8, 238:11, 239:8, 276:25
SIDES [1] - 179:2
SIGNAL [1] - 217:3
SIGNED [1] - 243:24
SIGNIFICANT [1] - 268:17
SIM [3] - 183:16, 223:2
SIMILAR [5] - 204:5, 216:17, 247:13,
276:15
SIMPLE [2] - 165:18, 166:24
SIMPLY [3] - 193:10, 244:8, 255:16
SINGLE [2] - 211:24, 245:8
SIT [2] - 213:15, 269:17
SITE [8] - 175:25, 205:21, 206:12,
206:21, 210:23, 211:9, 211:25, 213:5
SITUATION [3] - 208:5, 246:9, 276:15
SIZE [2] - 249:4, 252:14
SKIP [1] - 238:9
SLIGHT [1] - 163:1
SLIM [1] - 158:8
SLOWLY [1] - 255:18
SMALL [2] - 163:9, 163:15
SMOOTHLY [1] - 208:1
SNAP [2] - 208:10, 210:9
SNAPPING [1] - 210:8
SOFTWARE [26] - 177:23, 179:12,
179:24, 179:25, 180:2, 180:8, 181:3,
184:12, 190:3, 197:22, 197:23,
197:24, 198:13, 198:15, 199:1,
199:10, 210:11, 210:18, 210:19,
221:21, 249:10, 249:16, 251:3, 251:4,
251:7
SOLUTION [1] - 272:17
SOMEONE [21] - 161:4, 166:20, 183:21,
187:13, 192:12, 192:18, 195:2,
195:13, 201:4, 202:5, 204:20, 225:19,
242:9, 253:17, 253:19, 253:23, 255:2,
267:23, 269:4
SOMETIMES [2] - 163:20, 198:3
SOMEWHERE [3] - 211:1, 254:7,
263:18
SONGS [1] - 184:3
SORRY [30] - 160:21, 161:1, 161:2,
161:15, 170:21, 171:18, 178:2, 182:5,
188:6, 197:2, 202:5, 204:14, 210:24,
212:12, 213:25, 218:7, 221:16,
226:24, 228:13, 234:18, 238:9,
239:15, 241:23, 253:13, 260:16,
263:9, 269:22, 271:5
SORT [9] - 179:4, 179:21, 194:9, 201:4,
204:23, 206:24, 216:23, 258:5, 258:7
SOUNDS [5] - 166:2, 169:18, 214:22,
273:5, 273:22
SOURCE [2] - 197:7, 232:20
SOURCES [1] - 205:7
SPECIAL [3] - 157:2, 157:25, 159:9
SPECIALIST [1] - 178:10
SPECIALISTS [1] - 184:25
SPECIFIC [2] - 252:16, 276:8
SPECIFICALLY [3] - 219:16, 274:9,
275:12
SPECIFICS [2] - 276:20
SPECULATION [1] - 259:4
SPED [1] - 193:11
SPELL [1] - 177:15
SPENT [1] - 215:19
SPONGE [1] - 192:5
SPREADSHEET [21] - 159:25, 160:6,
161:14, 162:20, 162:22, 163:8, 163:9,
163:12, 163:23, 164:25, 167:18,
171:2, 171:13, 171:23, 172:11,
172:19, 173:7, 193:12, 193:13, 234:24
SPREADSHEETS [1] - 163:20
SPRINKLER [1] - 216:15
SPRINKLERS [2] - 216:14
STACK [1] - 255:6
STAKES [1] - 176:7
STAND [10] - 159:4, 168:11, 169:24,
177:3, 215:2, 263:21, 265:25, 268:25,
269:13
STAND-ALONE [1] - 263:21
STANDARD [1] - 174:24
STANDARD [1] - 179:19
STANDING [1] - 226:7
STANDS [1] - 181:7
START [6] - 165:23, 171:17, 178:1,
178:3, 210:5, 272:2
STARTED [5] - 169:15, 179:12, 214:6,
219:10, 270:19
295
STARTS [4] - 184:1, 184:5, 210:10,
237:3
STATE [3] - 177:14, 181:21, 182:6
STATEMENT [20] - 165:13, 166:4,
167:2, 167:6, 191:6, 191:13, 226:15,
227:7, 227:22, 240:9, 260:23, 261:4,
261:14, 262:15, 266:17, 266:18,
267:23, 268:14, 268:19, 275:7
STATEMENTS [2] - 157:10, 274:14
STATES [3] - 174:24, 182:3, 182:6
STATES [2] - 180:18, 265:19
STATES [6] - 155:1, 155:4, 155:10,
155:16, 155:25, 278:3
STAY [4] - 192:19, 192:21, 207:5,
234:18
STAYS [2] - 192:18, 255:17
STENOGRAPHICALLY [1] - 155:23
STEP [8] - 157:2, 159:5, 159:6, 159:7,
164:17, 176:18, 214:2, 270:15
STICK [2] - 271:10, 271:12
STILL [18] - 179:13, 180:10, 192:10,
194:2, 194:4, 198:8, 198:9, 204:24,
204:25, 205:6, 205:11, 205:12,
205:15, 208:16, 208:17, 256:25
STITES [5] - 157:2, 158:1, 159:10,
270:25, 271:3
STOCK [1] - 198:15
STOOD [3] - 265:11, 266:6, 266:10
STOP [1] - 202:17
STOPPED [1] - 253:6
STOPPING [1] - 202:6
STORE [1] - 189:11
STORED [1] - 224:22
STREAMLINED [1] - 198:5
STRIKE [1] - 167:14
STRING [6] - 190:4, 190:5, 190:20,
196:23, 198:9, 238:5
STRUGGLED [1] - 201:15
STRUGGLING [1] - 264:20
STUDYING [1] - 215:19
SUBJECT [1] - 267:16
SUBPOENA [1] - 211:4
SUBSTANTIAL [1] - 166:22
SUBSTANTIALLY [1] - 268:9
SUCCESSFUL [3] - 246:4, 246:8,
246:19
SUGGEST [5] - 257:15, 257:21, 257:23,
258:2, 266:11
SUGGESTED [2] - 256:12, 274:22
SUGGESTING [1] - 261:1
SUGGESTION [1] - 256:8
SUGGESTIVE [1] - 194:24
SUITE [1] - 242:13
SUMMARY [3] - 164:23, 168:18, 179:21
SUNDAY [3] - 273:6, 273:22, 277:7
SUPERIOR [2] - 182:3, 182:6
SUPPLEMENTAL [1] - 218:8
SUPPORT [4] - 159:23, 221:24, 266:12
SUPPORTS [2] - 242:24, 258:5
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 142 of 145
SUPPOSED [1] - 276:2
SURPRISE [1] - 196:24
SURROUNDED [2] - 252:4, 252:6
SWITCH [5] - 208:23, 208:24, 209:5,
209:10, 241:16
SWITCH'S [1] - 209:3
SWITCHES [1] - 180:1
SWORN [1] - 177:11
SYNC [2] - 203:21, 204:4
SYSTEM [7] - 181:22, 191:24, 193:1,
195:10, 196:21, 227:19, 238:2
T
TAB [2] - 192:16, 245:5
TABLET [6] - 204:3, 204:6, 204:11,
204:15, 204:21, 205:16
TAL [1] - 217:21
TAL [1] - 155:14
TALKS [1] - 172:14
TANNER [1] - 180:23
TATTLETALE [1] - 200:5
TAUGHT [2] - 180:13, 180:15
TAX [1] - 236:1
TEACH [1] - 180:9
TECH [2] - 239:16, 239:25
TECHNOLOGY [1] - 207:1
TECHNOLOGY [1] - 240:9
TEDLIN [2] - 186:21, 186:22
TELDRIN [34] - 162:16, 171:10, 218:14,
218:17, 218:22, 218:24, 219:2, 222:9,
224:9, 224:20, 228:12, 228:15,
229:11, 230:7, 230:14, 235:15,
236:17, 237:18, 238:1, 238:18,
239:13, 240:10, 244:14, 245:6,
251:24, 253:20, 258:1, 258:2, 266:19,
267:5, 267:11, 274:5, 274:22
TELDRIN [2] - 155:7, 155:17
TELDRIN23 [1] - 196:10
TELDRIN23@ICLOUD [3] - 196:24,
244:8, 244:18
TELDRIN23@ICLOUD.COM [13] -
196:16, 200:12, 224:1, 235:8, 242:25,
243:13, 244:1, 244:3, 244:11, 247:24,
253:24, 254:7, 255:3
TELDRIN_FOSTER@YAHOO [1] -
190:2
TELDRIN_FOSTER@YAHOO.COM [4]
- 187:2, 190:9, 193:22, 223:24
TEN [4] - 202:21, 209:8, 212:2, 212:23
TENDER [1] - 169:25
TERMS [3] - 186:16, 187:1, 236:20
TEST [4] - 194:4, 275:20, 275:21,
275:22
TESTIFIED [7] - 177:12, 212:7, 231:3,
240:22, 246:14, 254:11, 267:16
TESTIFY [6] - 174:12, 176:3, 212:3,
262:21, 262:22, 267:17
TESTIFYING [5] - 185:16, 212:1,
229:18, 233:24
TESTIMONY [13] - 160:11, 162:6, 166:9,
166:10, 167:14, 211:8, 212:6, 212:15,
248:1, 253:18, 260:23, 261:6, 265:5
TEXT [2] - 205:12, 228:25
THAT'D [1] - 162:3
THE [129] - 1:2, 1:4, 1:6, 1:7, 1:8, 1:10,
155:1, 155:10, 155:14, 155:17,
155:20, 157:2, 157:5, 159:7, 159:12,
159:14, 160:13, 160:21, 160:24,
161:6, 161:11, 161:18, 162:19, 163:8,
163:16, 164:6, 164:19, 165:4, 165:9,
165:12, 165:17, 166:7, 166:16,
166:21, 167:13, 167:24, 168:4,
168:10, 168:14, 168:23, 169:13,
169:17, 169:23, 170:6, 173:17,
173:19, 175:4, 175:6, 176:14, 176:16,
176:18, 176:20, 176:22, 177:1, 177:4,
177:6, 177:16, 182:16, 183:5, 185:22,
194:11, 194:14, 202:4, 202:10,
202:19, 203:3, 203:5, 203:8, 211:18,
212:10, 213:9, 213:15, 213:20, 214:2,
214:5, 214:17, 214:22, 215:4, 217:11,
217:14, 217:16, 240:18, 250:5,
253:11, 254:18, 254:20, 259:6,
260:14, 260:18, 262:16, 262:25,
263:5, 263:12, 263:15, 263:24, 264:5,
264:9, 264:14, 265:21, 266:15,
268:22, 269:2, 269:8, 269:11, 269:16,
269:19, 269:23, 270:11, 270:13,
270:15, 270:18, 271:2, 271:5, 271:7,
271:21, 272:11, 272:20, 272:24,
273:10, 273:12, 273:18, 275:24,
276:17, 277:4, 277:6, 277:13, 277:18
THEFT [5] - 179:7, 274:21, 275:1,
275:14, 275:16
THEMSELVES [1] - 223:4
THEREAFTER [1] - 191:25
THEREFORE [3] - 158:10, 214:24,
271:24
THEY'VE [3] - 212:23, 220:18, 275:7
THIRD [2] - 251:21, 268:4
THOMAS [20] - 187:22, 218:14, 218:24,
219:3, 228:12, 230:13, 233:14,
233:24, 235:7, 235:15, 236:19,
237:25, 238:18, 239:12, 240:10,
257:16, 257:21, 267:21, 274:10, 276:7
THOMAS'S [29] - 211:24, 218:1, 218:11,
219:6, 219:19, 221:2, 221:11, 222:6,
222:15, 223:16, 224:10, 224:17,
224:20, 225:7, 225:21, 228:21, 229:6,
229:10, 229:25, 230:22, 231:4,
233:10, 235:14, 236:10, 237:20,
239:5, 240:11, 267:21
THREATENED [1] - 181:13
THREE [14] - 183:12, 211:12, 212:22,
214:21, 215:14, 216:25, 238:13,
243:17, 245:18, 247:23, 253:5, 253:7,
266:24
THROUGHOUT [1] - 180:17
TICKETS [1] - 221:24
296
TIMING [2] - 159:23, 273:9
TITLE [9] - 226:24, 228:23, 228:25,
229:2, 236:25, 237:18, 239:16,
239:25, 240:2
TO [2] - 1:5, 1:9
TODAY [9] - 163:5, 163:6, 164:18,
165:2, 169:9, 174:4, 176:9, 179:13,
184:23
TOGETHER [6] - 203:21, 204:4, 205:13,
218:15, 219:3, 226:8
TOOK [4] - 159:20, 162:9, 197:6, 261:23
TOOL [2] - 199:5, 199:6
TOOLS [4] - 180:9, 181:1, 198:22,
221:25
TOP [11] - 190:14, 190:19, 194:9,
194:22, 226:25, 228:14, 237:15,
250:20, 250:21, 252:6
TOTALLY [3] - 181:17, 241:10, 253:15
TOWER [42] - 161:21, 183:17, 206:14,
206:25, 207:4, 207:5, 207:22, 207:23,
207:24, 208:7, 208:8, 208:9, 208:10,
208:16, 208:17, 208:21, 209:3, 209:4,
209:6, 209:8, 209:10, 209:17, 209:18,
209:19, 209:21, 209:23, 209:24,
209:25, 210:3, 210:4, 210:8, 210:9,
210:22, 211:5, 211:7, 215:12, 216:6,
216:11, 216:20, 217:3
TOWER'S [2] - 208:11, 216:3
TOWERS [16] - 207:10, 207:13, 207:16,
207:19, 207:20, 208:4, 209:13, 210:6,
210:25, 211:4, 211:12, 215:10,
215:19, 216:4, 216:10, 216:17
TRACE [1] - 189:1
TRACK [1] - 180:25
TRACK [2] - 181:7, 215:18
TRACKING [1] - 207:1
TRAFFIC [5] - 175:17, 175:19, 175:22,
175:24, 181:2
TRAINING [3] - 179:19, 179:22, 180:1
TRANSACTION [8] - 172:2, 172:7,
172:14, 172:16, 172:17, 173:1, 173:4,
173:9
TRANSACTIONS [6] - 162:16, 162:17,
171:15, 173:8, 174:10, 174:18
TRANSCRIPT [5] - 1:3, 1:6, 1:8, 1:9,
155:9
TRANSCRIPT [3] - 275:11, 276:4, 278:7
TRANSCRIPTS [1] - 1:3
TREATS [1] - 192:25
TRIAL [1] - 155:9
TRIAL [2] - 194:8, 250:9
TRIAL [3] - 158:1, 212:5, 271:15
TRIED [1] - 253:5
TRUE [5] - 197:14, 205:16, 266:14,
275:23, 278:6
TRUTH [2] - 157:15, 268:21
TRY [6] - 202:20, 209:18, 216:17,
221:25, 236:16, 260:18
TRYING [10] - 159:17, 201:15, 243:25,
244:2, 261:11, 261:14, 263:24,
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 143 of 145
266:22, 273:19
TURN [2] - 182:19, 274:16
TURNED [2] - 170:20, 171:13
TURNS [2] - 211:16, 277:7
TWO [24] - 157:13, 160:10, 160:15,
161:24, 162:7, 163:23, 163:24,
188:24, 192:21, 199:15, 200:18,
205:13, 207:17, 212:5, 223:16,
232:12, 235:10, 235:17, 246:20,
254:25, 269:16, 269:21, 271:18,
275:23
TYPE [5] - 205:20, 245:2, 245:3, 266:16,
267:25
TYPED [1] - 254:6
TYPES [3] - 183:12, 203:24, 206:16
TYPICALLY [1] - 247:19
TYPING [1] - 236:20
U
ULTIMATE [1] - 208:22
ULTIMATELY [2] - 274:5, 275:9
UNCLEAR [1] - 168:21
UNDER [5] - 196:2, 246:9, 262:21,
262:22, 265:18
UNDERLYING [7] - 162:14, 162:20,
162:22, 164:10, 168:18, 169:11,
265:10
UNDERNEATH [1] - 263:1
UNDERSTOOD [2] - 164:16, 255:10
UNDISCLOSED [2] - 211:22, 213:11
UNHAPPY [1] - 208:13
UNINVOLVED [1] - 234:4
UNIQUE [3] - 181:17, 205:24, 238:5
UNITED [2] - 180:18, 265:19
UNITED [6] - 155:1, 155:4, 155:10,
155:16, 155:25, 278:3
UNLIKE [1] - 213:1
UNREAD [4] - 187:16, 187:17, 193:21,
194:19
UNTIMELY [1] - 166:11
UP [39] - 157:23, 159:17, 168:23, 169:4,
169:9, 180:24, 182:2, 189:20, 190:4,
193:9, 193:11, 193:12, 194:7, 195:10,
196:13, 200:5, 205:20, 209:25, 211:3,
214:15, 214:24, 218:18, 239:21,
240:7, 240:12, 245:5, 245:25, 246:7,
253:12, 260:16, 261:23, 263:25,
264:4, 265:11, 266:6, 266:10, 276:6,
277:10
UPDATE [3] - 164:3, 164:5, 249:10
UPDATED [2] - 162:24, 164:12
UPDATES [3] - 196:20, 207:18
US'S [1] - 272:12
USAGE [1] - 181:2
USER [9] - 192:14, 201:8, 209:10,
242:24, 243:10, 244:14, 246:21,
247:10
USERNAME [13] - 187:9, 192:23, 201:9,
201:16, 218:19, 218:21, 218:25,
225:20, 244:1, 244:24, 245:2, 254:25,
255:3
USERS [1] - 181:19
V
VALID [1] - 200:8
VALIDATION [1] - 199:4
VALUE [6] - 186:5, 186:7, 190:4,
193:17, 268:8
VARIOUS [3] - 207:9, 236:1, 238:15
VENDORS [1] - 179:24
VENUE [1] - 229:21
VERIFICATION [2] - 184:9, 186:4
VERIFY [1] - 240:5
VERSION [1] - 232:5
VERSIONS [1] - 192:21
VERSUS [1] - 271:18
VIA [6] - 184:20, 229:11, 237:25,
238:18, 257:11, 257:20
VICTIM [2] - 275:14, 275:15
VIEW [2] - 258:14, 259:9
VIEWER [16] - 196:25, 197:3, 197:8,
198:20, 198:23, 244:19, 248:16,
248:19, 248:21, 249:4, 249:6, 249:20,
250:8, 251:6, 251:18, 252:10
VOLUME [1] - 155:6
VS [1] - 155:5
VU [1] - 263:5
W
WA [1] - 239:21
WAIT [3] - 165:3, 188:12, 269:17
WANTS [1] - 207:3
WASTE [1] - 214:15
WATCH [5] - 203:25, 204:9, 205:8,
205:9, 205:10
WATCHES [1] - 222:22
WATER [3] - 209:1, 216:14, 216:15
WATERING [1] - 216:13
WAYS [1] - 198:14
WEB [2] - 241:10, 256:20
WEBSITE [3] - 244:9, 244:15, 244:21
WEBSITES [1] - 257:1
WEBSTER [64] - 155:18, 161:14,
176:25, 177:2, 177:18, 182:11,
182:17, 183:1, 183:6, 183:7, 185:18,
185:23, 185:24, 188:11, 188:14,
188:16, 194:7, 194:12, 194:15,
195:24, 196:1, 196:13, 196:14, 202:8,
202:11, 202:17, 203:9, 203:10, 212:4,
212:12, 213:6, 214:20, 215:7, 215:8,
217:10, 217:12, 250:3, 254:22, 259:5,
259:7, 260:12, 260:15, 260:22,
261:19, 262:8, 262:11, 262:17,
264:12, 264:21, 265:24, 269:1,
269:14, 269:21, 269:24, 270:10,
271:1, 271:4, 271:6, 272:15, 272:23,
273:11, 273:16, 273:25, 276:1
WEBSTER [14] - 202:4, 214:13, 214:18,
297
215:6, 221:10, 231:17, 232:1, 254:20,
262:16, 264:18, 268:24, 269:23,
275:19, 275:24
WEBSTER'S [1] - 231:23
WEDNESDAY [2] - 248:5, 250:14
WEEDS [1] - 208:21
WEEK [5] - 160:4, 213:2, 271:15,
271:16, 272:1
WEEKEND [5] - 272:9, 272:16, 276:21,
277:15, 277:19
WEEKS [2] - 212:5, 212:23
WELCOME [1] - 159:10
WELLS [1] - 227:7
WHATSAPP [20] - 204:11, 204:15,
204:19, 204:21, 205:1, 228:8, 228:10,
228:11, 229:11, 230:6, 237:25,
238:19, 239:20, 239:21, 257:8,
257:12, 257:17, 257:21, 258:1, 274:11
WHATSAPPED [1] - 240:10
WHISKEY [1] - 239:18
WHITLEY [1] - 158:20
WHOLE [3] - 212:11, 213:13, 261:19
WI [1] - 204:24
WI-FI [1] - 204:24
WIFE [1] - 277:15
WILL [1] - 1:4
WILLIAMS [1] - 265:19
WINDOWS [3] - 186:25, 189:12, 196:19
WISH [1] - 277:15
WITH [1] - 1:10
WITHDRAW [2] - 158:7, 158:17
WITHDRAWING [1] - 214:23
WITHDRAWN [1] - 215:5
WITNESS [6] - 159:12, 176:20, 177:6,
177:16, 194:11, 194:14
WITNESS [1] - 270:17
WITNESS [25] - 156:2, 157:4, 157:6,
159:3, 159:13, 160:11, 169:24,
176:21, 177:1, 177:11, 181:23, 182:8,
214:2, 214:4, 215:2, 261:25, 263:12,
263:14, 268:25, 269:4, 269:13,
270:20, 273:14
WITNESSES [3] - 176:24, 270:20,
270:23
WONDERING [1] - 277:1
WORD [1] - 211:24
WORD [3] - 203:18, 232:4, 259:24
WORKS [6] - 161:22, 184:2, 204:13,
222:22, 223:10, 268:11
WORLDWIDE [1] - 181:20
WORTHY [1] - 227:15
WRAP [1] - 214:14
WRITE [4] - 177:23, 185:5, 198:2,
213:12
WRITES [1] - 240:24
WRITING [1] - 180:19
WRITTEN [2] - 197:25, 213:7
WROTE [1] - 171:10
WWW.ADOBE.COM [1] - 242:12
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 144 of 145
298
WWW.ICLOUD.COM [1] - 244:4
Y
Y'ALL [12] - 157:6, 168:14, 170:6, 203:5,
214:5, 215:4, 269:17, 269:19, 272:11,
273:1, 273:21, 277:18
YAHOO [23] - 186:21, 190:22, 190:24,
192:2, 192:12, 196:3, 197:12, 218:18,
224:10, 224:16, 224:20, 226:21,
227:11, 227:14, 227:16, 240:22,
247:3, 247:8, 247:11, 256:21, 256:25,
260:9
YEARS [2] - 162:7, 198:1
YESTERDAY [2] - 166:13, 274:2
YORK [1] - 182:2
YOU [2] - 1:5, 1:8
Z
ZEROS [1] - 180:11
ZONE [6] - 162:10, 162:23, 162:25,
163:1, 164:12, 174:21
ZONE [9] - 162:11, 162:12, 163:7,
164:4, 174:25, 175:9, 175:10, 175:12
ZONES [3] - 167:7, 167:8, 175:14
Case 1:20-cr-00296-JPB-CMS Document 1028 Filed 06/14/24 Page 145 of 145File and source
- File
- gov.uscourts.gand.279866.1028.0.pdf
- Size
- 1,147,586 bytes
- SHA-256
- 707af05ef85c194c77dfbe8a59c66c25de7e975d29b89ca4898e00832daf9261
- Original
- PACER (login required)