Videos:
Computer expert Brian Neumeister (sp) takes the stand.
Bryan was hired to review the contents of TA’s computer drive.
Bryan talks about his history and knowledge of computer.
Bryan works for prosecutors and defense. He works to bring back deleted or corrupted files.
Neumeister’s company specializes in recovering computer data. His people must have 20 years experience, he says.
TA’s computer was a compaq presario.
Neumeister: First rule is “Change nothing.” It would be “like spitting on DNA.” Says you never turn on the computer at the crime scene.
Expert: anyone who know anything would know to not turn the laptop on. remove the drive, use a write-blocker.
Neumeister: A write blocker makes it so you can read but not modify what’s on the drive. Says you never look at it by firing up computer.
Expert says the laptop was powered on and off twice without a write-blocker.
Neumeister says that as soon as you turn on a computer starts downloading files, updating and deleting cache files.
Alexander’s computer was turned on twice without write blockers, deleting 50 mg of data, Neumeister said.
[ Note: should be 50 MB = 50 Megabytes ]
Def computer expert says TA computer was turned on and shut down twice while in PD custody-says that was completely wrong.
Bryan says 50mg of data was deleted when TA’s computer was turned on and off w/out write blockers
Expert has time stamps from his examination up on the big screen.
[Note : this tweet has wrong time]
On June 10, 10:20 p.m., the computer was turned on and “quite a few files were gone through and modified.”
Neumeister: “It was actually taken out of its sleep mode.” on that day.
Bryan says on 9:27am on June 10th, 2008 the laptop was first turned on.
“The first thing it did was ping Southwest Airlines.” That automatic app left a time stamp of when the computer was turned on.
Laptop also downloaded a new version of itunes. that overwrites some part of the drive that could have been recovered.
TA’s computer started downloading windows and itunes updates.
It found Windows updates on Alexander computer and installed them, as well as an updated version of iTunes, recording over drive space data.
Laptop also downloaded a number of updates. So it wasn’t only on, it was online.
Neumeister notes that deleting data does not completely remove it. Flash back to the camera in the washing machine.
Bryan says the computer was on from 9:27am to 10:13am (AZ time)
Neumeister has the files onscreen in the courtroom, showing when they were accessed, etc. Pages of things “that were not untouched data.”
Neumeister: “The state had it for five years, and we got it one day before the case started.”
Neumeister shows the files modified on June 10. Then it was shut down through regular method, which dumped cache files.
Mike Watkiss @mikewatkiss3tv
Pros. Martinez in interesting position-representing and defending himself against very serious charges of tampering
Expert says when the computer is shut down Windows clears the cache. Says that’s unrecoverable. that’s why you never touch it.
If a computer is on at a crime scene, you do no turn it off, Neumeister said. It will dump everything in the memory.
Expert says “absolutely” this was done in violation of standard computer forensic protocols.
Bryan says #1 rule is to never turn on or off a computer at a crime scene. It will delete memory info.
Mike Watkiss @mikewatkiss3tv
Def. computer expert making it sound like Mesa PD bungled basic protocol in handling TA’s computer
He says all of this was in direct violation of basic forensic practices.
Bryan says computer next turned on June 19, 2009. Again the computer was turned on w/out write blocker.
Expert says June 19th, 2009 the laptop was turned on again and it tried to install the updates it had downloaded a year earlier.
Bryan says that there was an iTunes update, but for apple products, someone has to manually click Yes.
William Pitts @william_pitts
Expert says itunes was installed, which requires a user ok. Says hes never seen an apple product install itself. neither have I.
When the computer was turned on in 2009, it started installing the programs downloaded on June 10, 2008, overwriting other files.
On June 19, expert says the computer had a hard shut down, either unplugged, power button held down, or comp crashed.
Expert says between the two days that the comp was turned on/off, thousands of files were modified w/out write blocker.
Neumeister says it is like picking up evidence with out gloves and destroying fingerprints.
Def computer expert says 2500 plus files on TA computer “modified, accessed or deleted”-”someone was rummaging through”
Expert says the computer was loaded with viruses. Pages of viruses – trojans, malware, downloaders.
Expert says laptop was LOADED with viruses. He has 3 pages of viruses, trojans, etc. Def says pros looked for viruses and didn’t find any.
Expert says a lot of porn links were caused by viruses and trojans, others were physically typed in. Says they ran the check 3X
“There were so many links that weren’t caused by viruses…individually searched by keys.” He had heard there was no porn, per cop testimony
Expert says he was told there was no viruses on laptop based on previous testimony so he cloned the drive 3X to make sure it was right.
Expert says there were 19 separate programs found for debugging, guarding privacy, cleaning registry
Mike Watkiss @mikewatkiss3tv
Despite Mesa PD testimony there were no viruses on TA computer-def expert says “absolutely loaded w/viruses”&”so many porn links”
One program that gets rid of history: “It’s only use is to erase your tracks.” Neumeister
Neumeister “If you don’t want anyone seeing what you’re doing, you would use something like that.” They didn’t work. “It was just loaded.”
Neumeister: Some of the viruses on Alexander’s computer, which came from porn sites, had been removed from the computer several times.
Neumeister: Some of the viruses work when you install special movie player for porn site. That redirects to other sites.
Expert showing a log of porn site access. Timestamp is 6/1/08. says they were typed in, not accessed by virus.
William Pitts @william_pitts
if this is all true, Mesa PD could have a big evidence handling problem on their hands.
Now Neumeister shows a list of porn sites searched on June 1, 2008. They are in viewing history, not from viruses.
Neumeister: “There were also escort sites that I pulled up.”
Expert says other dates where porn sites and escort sites were accessed go back to 9/05/07. This again was manually accessed.
Expert says he was able to find this information using raw data clone.
breaking for lunch now
Back in the courtroom. People are still settling in. Bryan Neumeister back on the stand. #JodiArias seated wearing her stripes and chains.
Rxpert says protocols were not followed and evidence was tampered with by virtue of being changed.
Expert says “technically, yes, evidence was tampered with.”
Expert: about 70,000 files were zeroed out/scrubbed so there were no metadata.
70k files were scrubbed out by a program that was not installed on #TravisAlexander ‘s laptop
William Pitts @william_pitts
Computer forensics guys tell me scrubber programs (permanent delete) leave traces behind when you use them.
Expert says files have metadata attached. No metadata left describing these files.
Expert says they don’t know what program caused the scrubbing. they’re still looking into it.
Computer expert Neumeister says that 70,000 files were scrubbed, zeroed out by a program that is not on Alexander’s computer.
Expert showing links that were user-searched. lots of searches from youporn.
Expert now going through porn links that were physically searched by a user. someone hand-typed/searched.
Neumeister now going through manual searches that are not files downloaded by virus.
Examples include: “Hot girl giving a bl—” “public blow@#% nice t#^$”. Expert says he has 90 pages of links, small type.
Expert pulls up page(s) of porn links from June 1, 2008. Says there are a lot of pornography pages accessed.
Expert says he stopped pulling files at 90 pages — “because what’s the point, there were so many”.
Willmott asks if Spybot will keep the computer from accessing porn (as Martinez said). Neumeister says it is “an after-the-fact cleanup.”
Monica Lindstrom @monicalindstrom
This expert stating that porn was in fact on the computer does cause a prob bc the state testified there was none, #JodiArias said there was.
Neumeister says there were 6,125 hits on the word “teen” during his search. 11,625 hits on “Tween,” though some include “between.”
Monica Lindstrom @monicalindstrom
It comes down to misconduct or calling her a liar in front of jury
William Pitts @william_pitts
Expert seems a little embarrassed to say the bad words
Neumeister says there were lots of porn sites about teens, usually with the word “slut” attached, visited by Alexander’s computer
Neumeister found 90 pages of “stuff” that was in the registry of Alexander’s computer, not just in the history.
Expert says he was also asked to look at cellphones, drives and cameras as well.
Michael Kiefer @michaelbkiefer
Martinez is trying to block defense from asking Neumeister other forensic information in a motion that goes to potential misconduct.
Expert says on cell phone, sim cards were missing. All evidence he saw was at MesaPD except one camera he got from defense.
All of the data cards had been removed from the phones when they were given to Neumeister by the state for analysis, making it impossible.
Expert shows us photos of Motorola Razr and Samsung flip phone. Says the phones didn’t have data cards, sim cards.
Expert: “The sim card is the heart of the matter, and they were gone.”
Expert says he went to look at a video camera and it was smashed.
Sounds like at least three phones were missing cards. A video camera was smashed, but Neumeister was able to extract videos.
The still camera was supposed to have two SIM cards, but only had one.
One external drive had no operating software on it. Neumeister ran tests and said there was not a trace of anything on it.
Monica Lindstrom
This is like #PandorasBox missing files, missing SIM cards, smashed camera…a plethora of issues and questions
Willmott puts transcript onscreen of Det. Melendez testimony saying he checked for virus and found none. Neumeister says they were obvious.
Melendez testimony in transcript onscreen says he went through internet history and registry and just found social media websites.
Neumeister on the computer porn: “You couldn’t miss it.” “It wasn’t the elephant in the room, it was the aircraft carrier in the room.”
Cross
Martinez asking about Lonnie Dworkin, computer forensic guy who reviewed the hard drive previously.
Neumeister understands that the prior expert reviewed the evidence he was given. Martinez says that that expert evaluated it and found none.
Dworkin testified he found nothing either. Neumeister says the drive Dworkin had was bad.
Neumeister says the first guy was not given a raw file to get deep enough into the drive. Or he used clone that Mesa PD did.
Neumeister: “It’s impossible to miss it! There is so much data there Juan!”
Martinez trying to get Neumeister to admit he never examined Dworkin’s copy. Neumeister says he didn’t need to because it was bad.
Martinez wants to know why Neumeister didn’t look at 2008 clone. “There was no need.” “I’m not asking you that.” “Yes or no.”
Neumeister: “It was an incompetent clone.”
Neumeister says he did his own clone of the drive
Martinez: if the cells didn’t have SIM cards then you’re saying the defendant had some shenanigans with them right?
Martinez goes to the missing SIM cards. Asks if the defendant was involved in shenanigans with cell phones. Maybe Mesa found them without.
Neumeister says it is rare that the phone comes to him without SIM cards of data card. “You don’t know, do you?” Martinez says.
Witness tells Judge some files are too vile to pull up. There’s a lot of teen porn.
“That’s hilarious!” Neumeister says to Martinez after one of his questions.
Martinez: “so you’re saying Lonnie Dworkin was incompetent?”
“no i’m saying he was given a bad drive”
“I would say whoever imaged that drive didn’t do it properly and shouldn’t be working in forensics.”
Neumeister says he doesn’t know who looked at what drive earlier. Martinez: “But you don’t know.” Neumeister: “I just said that.”
“You are trying to spin around the fact that there was 166-thousand porn hits” on TA’s computer-def expert to Martinez
Katie Conner @KatieJConner
Witness: “It’s to simple to find this stuff?” to #JuanMartinez — the questioning is getting heated!
“i just think you don’t understand computer juan.” — Neumeister
Martinez keeps trying to get Neumeister to say Dworkin is incompetent. Over and over. Neumeister says he may have been given an incomplete.
Neumeister: “I think you just don’t understand computers, Juan. … Can I explain?” Martinez, “No.”
Expert says it’s a possibility that prior expert reviewed a file not raw enough to get deep enough into a file.
Martinez asking Neumeister if he was incompetent. Says he broke the computer. “Did you do it intentionally or accidentally?”
Now Martinez is claiming Neumeister broke the computer.
Neumeister: “That’s just slimy…that’s just slimy…”
And the hearing takes a recess as witness tells #JuanMartinez his questioning is just slimy
Michael Kiefer @michaelbkiefer
The lawyers just got called back to chambers. Martinez is very angry.
The lawyers just came back from chambers.
Michael Kiefer
Bench conference. Stephens looks angry now.
Carolyn Sung @CarolynSungCNN
It seems people have calmed down during break. Both Martinez and Witness are friendlier.
Carolyn Sung @CarolynSungCNN
#JodiArias seems to be hunched over in chair and writing something.
Martinez is asking about the various programs used in the analysis
William Pitts @william_pitts
Martinez noticeably calmer. Now questioning about which programs were used in data recovery.
Expert says he used autopsy and a colleague used FTK to go over computer.
Neumeister admits he initally sent the wrong drive image to the state.
Here comes the clone identified as “Tony.” They grabbed the wrong image and sent to Martinez. They then sent a correct one. Tony is a tech
We’re breaking for the day. Judge orders Neumeister to provide copies of the clones he made. Hearing will continue Dec 4
The hearing is going to end here. Martinez is demanding copies of other clones. It will reconvene Dec. 4.
Neumeister asks if after having the computer for six years, he wants a copy of everything Neumeister has. N says he already has it.
Neumeister’s saying he already gave the state what they want.
Willmott repeats that Martinez just doesn’t understand.
Wilmott says Martinez’s experts don’t understand that he already has what he’s asking for.
Judge asks if they can just get it. Martinez says it is at Mesa PD. Neumeister asks to see broken computer. Martinez says no.
Martinez says he’s goiing to make two copies of the copy he’s getting. Which by my tally makes 6 copies of this drive out there.
William Pitts @william_pitts · 18 hrs 18 hours ago
Martinez sounds like he’sabout to snap but holding back. Hard
Adjourned until Monday. This hearing continues Dec. 4.
B[ryan] walks over to shake #JodiArias‘ hand & smile at her.
( Assembled from these tweets )
See also:
Trial by Media 
2 thoughts on “Jodi Arias – Bryan Neumeister 21 Nov 2014”