03.21.11 Hearing Transcript

1
1
UNITED STATES DISTRICT COURT
2 WESTERN DISTRICT OF WASHINGTON
IN SEATTLE
3
----------------------------------------------------------
4
LONDI K. LINDELL, )
5 )
Plaintiff, ) No. C08-1827JLR
6 )
v. )
7 )
CITY OF MERCER ISLAND, et )
8 al, )
)
9 Defendants.
10
----------------------------------------------------------
11
HEARING
12
----------------------------------------------------------
13
14 BEFORE THE HONORABLE JAMES L. ROBART

15
16 March 21, 2011

17
18 APPEARANCES:
19 For the Plaintiff: Scott Blankenship
Rick Goldsworthy
20 Nazik Youssef
THE BLANKENSHIP LAW FIRM
21
For the Defendant: Stephanie Alexander
22 Suzanne K. Michael
Thomas P. Holt
23 MICHAEL & ALEXANDER
24
25
Barry L. Fanning, RMR, CRR - Official Court Reporter

Suite 17205 - 700 Stewart St. - Seattle, WA 98101
2
1 EXAMINATION INDEX
2 EXAMINATION OF PAGE
RICHARD CONRAD DIRECT EXAMINATION 6
3 By Ms. Michael:
KATIE KNIGHT DIRECT EXAMINATION 9
4 By Ms. Michael:
CROSS-EXAMINATION 11
5 By Mr. Blankenship:
REDIRECT EXAMINATION 16
6 By Ms. Michael:
MIKE KASER DIRECT EXAMINATION 17
7 By Ms. Michael:
JONATHAN YEH DIRECT EXAMINATION 27
9 By Ms. Michael:
ALAN MUCHMORE DIRECT EXAMINATION 53
11 By Ms. Michael:
13
14
15 EXHIBIT INDEX
16 EXHIBITS ADMITTED PAGE
17
18
19
20
21
22
23
24
25
3
1 THE COURT: The clerk will call this matter.

2 THE CLERK: Case C08-1827, Londi Lindell versus
3 City of Mercer Island. Counsel, please make your
4 appearance.
5 MR. BLANKENSHIP: Scott Blankenship for
6 Ms. Lindell.
7 THE COURT: Do you want to introduce the other
8 people at the table?
9 MR. BLANKENSHIP: Yes. Nazik Youssef, Allison
10 Goodman, Londi Lindell and Rick Goldsworthy.
11 MS. MICHAEL: Your Honor, Suzanne Michael for the
12 defendants, along with Stephanie Alexander and Tom Holt.
13 THE COURT: Thank you. Counsel, we are here on
14 the defendant's motion to dismiss for spoliation of
15 evidence, found in our docket at 319. I can tell you that
16 I have had an opportunity at this point to read all of the
17 material that both of you have filed. That would be the
18 motion filed by the City, and the supporting materials
19 that go with it. And I have reviewed the plaintiff's
20 opposition to the motion, and the supporting materials
21 that accompany it.
22 As is my usual practice in these matters, I will
23 accept as evidence all of the declarations which have been
24 filed. That would be much more Mr. Holt. I am not sure I
25 will get all of these. Mr. Weibling, Ms. Goodwin,

4
1 Ms. Youssef, Ms. Lindell and Mr. Goldsworthy. I may have

2 left one back in chambers.
3 I will ask you, if we call live witnesses, not to
4 repeat the testimony which is found in the declarations,
5 but to proceed to cross-examination, or if you have
6 additional material that is not in the declaration that
7 you want to present in connection with the motion. So
8 that will hopefully speed us up some.
9 The second thing I would like to say is to once
10 again just ask you to remember your decorum. It is really
11 not good advocacy, and yet both sides are guilty of it,
12 because you obviously feel very passionately about this.
13 Not everything is a misrepresentation, not everything is
14 incredibly inflammatory, not everything is conclusory, not
15 everything is pure fiction. You know, lying, thieving,
16 malfeasance, bad faith, particularly when you are talking
17 to me, they don't help you. They make me to think less of
18 all of you. You can do it, but it just causes me think
19 less of all of you. When you get to a jury, they are
20 really going to toast you for it because they don't think
21 adults behave that way.
22 I thought about ways to control that. The best I
23 came up with was to start a list of banned words and fine
24 you $25 every time you use one of those banned words. And
25 at least my tentative list includes: Incredibly

5
1 inflammatory, conclusory, pure fiction, bad faith. We

2 will just not do that. And, frankly, at some point, if
3 need be, in front of the jury I will sanction both of you
4 for just that kind of behavior. It doesn't have a place
5 in the courtroom.
6 Having said that, this is the City's motion.
7 Ms. Michael, you are taking the lead?
8 MS. MICHAEL: Yes, your Honor, I am.
9 THE COURT: Please call your first witness.
10 MS. MICHAEL: May I ask that witnesses that are
11 going to be testifying be excluded while others are
12 testifying?
13 THE COURT: Yes.
14 MS. MICHAEL: Anybody that expects to be a
15 witness, please step outside.
16 MR. BLANKENSHIP: My only concern with that, your
17 Honor, is these are technical computer issues, and I would
18 like to have Ms. Goodman here just so if something comes
19 up that is new that I don't understand, she would be able
20 to help me respond to it.
21 THE COURT: Do you want to respond to that?
22 MS. MICHAEL: Your Honor, we have had about four
23 hours to review all of the materials they filed this
24 morning. So we are already playing on an unlevel playing
25 field, I guess I would say. To have their expert witness

6
1 get to listen to our expert witness and tailor testimony

2 as a result I think would be unfair.
3 THE COURT: I will permit Ms. Goodman to stay. I
4 will invite your witness to come in, although he may be
5 called first, which we will get to anyway. That way we
6 will attempt to have somewhat more of a level playing
7 field. It seems this would be more expedient, if each
8 side hears what the other says about it. Your first
9 witness is?
10 MS. MICHAEL: Mr. Richard Conrad.
11 THE COURT: Thank you.
12 Whereupon,
13 RICHARD CONRAD
14 called as a witness, having been first duly sworn, was
15 examined and testified as follows:
16 THE CLERK: State your name for the record and
17 spell your last name.
18 THE WITNESS: Richard N. Conrad, C-O-N-R-A-D.
19 MS. MICHAEL: Your Honor, before I start with
20 Mr. Conrad, I know the court has allowed Ms. Goodman to
21 stay. May I ask that the other computer tech people --
22 THE COURT: The other tech people are out.
23 MS. MICHAEL: Thank you, Judge.
24 DIRECT EXAMINATION
25 By Ms. Michael:

7
1 Q. Would you state your name and spell your last name for
2 the court reporter?
3 A. Richard M. Conrad, C-O-N-R-A-D.
4 Q. And what is your address, sir?
5 A. 4418 77nd Avenue Southeast, Mercer Island, Washington.
6 Q. And what is your job with the City of Mercer Island?
7 A. I am the city manager of the City of Mercer Island.
8 Q. Was that your position throughout Ms. Londi Lindell's
9 tenure?
10 A. Yes.
11 Q. I want to discuss the laptop computer that remains in
12 Ms. Lindell's possession. How did she come to get that
13 laptop, sir?
14 A. The specific laptop that we have been talking about
15 was purchased by the City at Ms. Lindell's initiation to
16 be a laptop that she would use in the course of doing
17 business for the City.
18 Q. As I understand, she had a previous laptop, but it
19 needed to be replaced; is that right?
20 A. That's correct. There was another laptop that she had
21 sought, and actually I required that she have in
22 connection with some time off that she took in 2005, 2006.
23 Q. In order --
24 MR. BLANKENSHIP: Your Honor, my understanding
25 was that you didn't want us to be addressing the ownership

8
1 of the laptop at the hearing. It seems like that is

2 exactly what we are doing right now.
3 THE COURT: I am assuming this is going to be
4 some foundation, and then we will cut it off. As I have
5 said from the start, the question of who owns the laptop
6 isn't in federal court.
7 MS. MICHAEL: Your Honor, we can short circuit it
8 if Ms. Lindell will acknowledge she has used the laptop
9 for both City purposes as well as information with regard
10 to her lawsuit and her claims.
11 MR. BLANKENSHIP: She has already declared that.
12 THE COURT: That is in her declaration.
13 MS. MICHAEL: Fair enough. Sometimes it has been
14 denied.
15 THE COURT: We don't need those rejoinders.
16 Let's stay on the facts.
17 MS. MICHAEL: I apologize, your Honor. The next
18 witness -- Mr. Blankenship might have some cross.
19 MR. BLANKENSHIP: I don't have anything, if it
20 was about the ownership of the laptop, which is about all
21 I heard.
22 THE COURT: Mr. Conrad, you may step down.
23 MS. MICHAEL: The City would call Katie Knight.
24 Your Honor, I have an exhibit to mark.
25 THE COURT: Why don't we wait until we get the

9
1 witness sworn in.

2 Whereupon,
3 KATIE KNIGHT
6 THE COURT: You have an exhibit you wish to give
7 the clerk?
8 MS. MICHAEL: I do.
9 THE COURT: You may approach.
10 THE CLERK: Would you state your name for the
11 record and spell your last name?
12 THE WITNESS: Katie Knight, K-N-I-G-H-T.
14 By Ms. Michael:
15 Q. Ms. Knight, can you tell us your address?
16 A. 12950 297th Place Northeast, Duvall, Washington,
17 98019.
18 Q. What is your title at the City of Mercer Island?
19 A. I am the city attorney for Mercer Island.
20 Q. Was there a period of time in 2008 where you came to
21 have access to Londi Lindell's desktop computer?
22 A. Yes.
23 Q. Can you tell us what period of time that was?
24 A. Approximately mid-February to about mid-April.
25 Q. And what was your purpose in accessing her desktop

10
1 computer?
2 A. There was ongoing concern that Ms. Lindell was
3 continuing her campaign, so to speak, against the city
4 manager. The need was felt to observe what she was doing.
5 Q. And in your ability to access the laptop -- I'm sorry,
6 the desktop computer, what did you discover?
7 A. I learned that she was having frequent conversations
8 and forwarding e-mails to Pete Mayer. She was also
9 preparing her case essentially against the City on the
10 desktop computer.
11 Q. Was there anything else about the desktop that caused
12 you any concern?
13 A. In reviewing the documentation, obviously I was
14 concerned that she was preparing her mediation and her
15 briefing and structuring what appeared to be a case
16 against the City. There was also missing documentation on
17 there.
18 Q. What do you mean by "missing documentation"?
19 A. She had some files located on it. I think she had a
20 mediation folder. And there would be certain -- I don't
21 know if they were shortcuts. I am not very techie, but
22 there would be certain shortcuts to a file, where if you
23 clicked onto it, the information would not be located
24 there, even though it indicated it should be there.
25 Q. Did you ever receive any sort of message from the

11
1 desktop when you accessed it, and, if so, what kind of

2 message?
3 A. To the best of my recollection, it was something like
4 "shortcut not found" or some sort of shortcut to another
5 file. And I believe I determined or learned somehow that
6 there probably needed to be a CD or a DVD or a flash drive
7 put in to access additional information that might be
8 located with the shortcut.
9 Q. So there was information that had been on the desktop
10 that you were not able to access; is that right?
11 A. Correct.
12 MS. MICHAEL: I have no further questions. Thank
13 you. I did want to ask the one question about the exhibit
14 I marked, which is the e-mail policy.
15 By Ms. Michael:
16 Q. Showing you Exhibit Number 1. As the City Attorney,
17 can you tell us what employees are told with regard to
18 their right to privacy with regard to City-provided
19 material?
20 A. That they will not have any expectation of privacy in
21 the use of the City-provided computers, materials and
22 software.
23 MS. MICHAEL: Thank you.
24 THE COURT: Mr. Blankenship.
25 CROSS-EXAMINATION

12
2 Q. Good afternoon, Ms. Knight.
3 A. Hello, Mr. Blankenship.
4 Q. If I understand your testimony, you were basically
5 secretly going into Ms. Lindell's computer and removing
6 information without notifying her; is that right?
7 A. I was not removing any information.
8 Q. You were searching it without telling her; isn't that
9 right?
10 A. I was reviewing the work that she was doing on her
11 City computer, correct.
12 Q. What was your role at this time? Had you become the
13 City Attorney?
14 A. I was the acting City Attorney.
15 Q. Had you received your $40,000 raise yet for replacing
16 Bob Sterbank?
17 A. I don't think I ever got a $40,000 raise, counsel.
18 Q. You got a significant raise, though, didn't you?
19 MS. MICHAEL: I would object, your Honor. It is
20 beyond the scope.
21 MR. BLANKENSHIP: It goes to credibility.
22 THE COURT: I will permit the question. I think
23 we need to move on.
25 Q. You got a significant raise when you went from

13
1 assistant attorney to City Attorney, didn't you?

2 A. I got a series of steps over a period of three years.
3 And I was doing two jobs.
4 Q. Can you give me an approximate about what the change
5 was in your pay?
6 A. I think as the acting City Attorney I might have been
7 bumped up $10,000 or so.
8 Q. So were you aware of a time when Mike Bolasina
9 provided Ms. Lindell with documents in order for her to
10 prepare for her mediation?
11 A. Yes.
12 Q. And you have been -- Are you aware that the documents
13 that were in the mediation file have been produced to
14 you -- to the City?
15 MS. MICHAEL: Object, your Honor. That is not
16 completely accurate.
17 THE COURT: We will take that up on redirect
18 examination.
20 Q. Are you aware that any documents that were saved under
21 a folder that says "mediation" were actually produced
22 through discovery?
23 A. Through discovery? I'm sorry, discovery in the
24 mediation itself or discovery subsequently after the
25 lawsuit was filed?

14
1 Q. In this case.
2 A. I believe that -- I'm not sure I understand what
3 you're asking. The documents that were in the body of
4 what I was reviewing?
5 Q. Right. You referenced a mediation folder. I guess my
6 questions to you is, are you aware that all the documents
7 that were in the mediation folder were documents that were
8 produced by Ms. Lindell?
9 A. I don't know if I can answer. There were tens of
10 thousands of pieces of paper that were produced. I know
11 there were some from Ms. Lindell. But I think we
12 received -- Some of them are drafts. I would say, no, I
13 don't believe that all of those were produced, frankly.
14 Q. Were you aware that Mike Bolasina told Ms. Lindell to
15 prepare for the mediation?
16 A. I believe so. He knew I was going through these.
17 Q. But he also told Ms. Lindell that she should prepare
18 for the mediation?
19 A. I don't know if he told her that or not. You would
20 have to ask him.
21 Q. You basically identified this e-mail and internet use
22 policy document, correct?
23 A. Correct.
24 Q. You would agree that an expectation of privacy -- that
25 somebody would have an expectation of privacy in a

15
1 computer that they used after their employment ended,

2 wouldn't you?
3 A. It depended on who owned the computer. If it was a
4 City-owned computer, no.
5 Q. So your personal computer, do you think you have a
6 right to privacy with respect to it, or should I be free
7 to go through everything on your personal laptop?
8 MS. MICHAEL: Object, your Honor. This is far
9 afield.
10 THE COURT: I will sustain the objection. It is
11 also argumentative, counsel.
13 Q. Isn't it true, though, that you have and you had
14 access to all of the e-mails that Ms. Lindell sent from
15 her Mercer Island e-mail account, right?
16 A. From everything she had on the desktop.
17 Q. It is not only on the desktop. The City of Mercer
18 Island has a server, don't they?
19 A. Correct.
20 Q. And the server would keep track of e-mails, would it
21 not?
22 A. As far as I understand it, yes.
23 Q. So to the extent there were e-mails that were sent
24 from Ms. Lindell's City e-mail, the City would have access
25 to it, correct?

16
1 A. Correct.
2 Q. And as you sit there, you have no knowledge or
3 information that Ms. Lindell had any other e-mail accounts
4 that she was using, other than the City e-mail account, do
5 you?
6 A. I believe she was using Bill Hansen's e-mail account.
7 There were e-mails she sent from the City server to Bill
8 Hansen, which was her home account. And I had received
9 some from her in the past from that account.
10 Q. Other than Hansen, though, do you agree with
11 Ms. Lindell's declaration that she wasn't using a personal
12 e-mail account at all until after she was fired?
13 A. I didn't have a chance to review her declaration.
14 MR. BLANKENSHIP: Thank you, Ms. Knight.
15 REDIRECT EXAMINATION
16 By Ms. Michael:
17 Q. Are you familiar with the Llindell at live dot com
18 account?
19 A. No.
20 MS. MICHAEL: I have no further questions. Thank
21 you.
22 THE COURT: Anything further, Mr. Blankenship?
23 MR. BLANKENSHIP: No, your Honor. Thank you.
24 THE COURT: You may step down.
25 MS. MICHAEL: The City would call Mike Kaser.

17
1 Whereupon,
2 MIKE KASER
5 THE CLERK: Please state your name and spell your
6 last name.
7 THE WITNESS: Mike Kaser, K-A-S-E-R.
9 By Ms. Michael:
10 Q. Good afternoon, Mr. Kaser. Would you tell us your
11 address, please?
12 A. 7030 Carmichael Avenue Southeast, Snoqualmie,
13 Washington 98065.
14 Q. And what is your position with the City of Mercer
15 Island?
16 A. I am the information services manager.
17 Q. And how long have you been the information services
18 manager?
19 A. Since 2006.
20 Q. I am going to short circuit a lot of what you and I
21 discussed, because the court has ruled that the issue of
22 Ms. Lindell utilizing -- getting the laptop from the City
23 and utilizing it is not going to be part of this hearing.
24 So I will move right into another area. The area I want
25 to move into is, in your work with the City are there

18
1 occasions where users will have a bug or a virus or some

2 issue with the operation of their computer?
3 A. Yes.
4 Q. What do they do if they have an issue with a virus or
5 a bug or something? What is your role?
6 A. Typically we will get the help desk to help them, or
7 our antivirus system will let us know whether they do or
8 not, if it has detected something. Depending on the issue
9 specifics, we will either do a simple scan or go grab the
10 computer and do some more troubleshooting to solve the
11 problem.
12 Q. Have you ever in your work operated, because someone
13 reports a virus or a bug, something like CCleaner, that
14 selectively destroys or removes data?
15 A. No.
16 Q. At the City of Mercer Island, are there ever times
17 that you do intentionally destroy data on a computer, and,
18 if so, when?
19 A. Yes, there is. Through our standard surplus cycle, as
20 we replace computers, bring computers in, we completely
21 wipe the hard drives, and/or we send the hard drives off
22 to a Shred-It type company that will destroy the hard
23 drive for us before we deliver the computer to recycling.
24 Q. Why do you do that?
25 A. So no City data leaves the City and falls into someone

19
1 else's hands. We don't do anything that exciting at the

2 City of Mercer Island, but kind of standard practice.
3 Q. Why is it you don't selectively remove data from
4 computers that have viruses or bugs?
5 THE COURT: Counsel, we are going to need you to
6 slow down. You will need to pause periodically to
7 breathe.
8 Ms. Michael
9 Q. Mr. Kaser, why is it that at the City of Mercer
10 Island, when you are troubleshooting and trying to find
11 out if there is a virus and whatnot that you do not
12 selectively remove data from a computer with a program
13 such as CCleaner?
14 MR. BLANKENSHIP: Your Honor, I would object to
15 foundation, that this witness even knows what CCleaner is.
16 There is a presumption to the question.
17 THE COURT: I will sustain the objection. Lay
18 the foundation.
19 By Ms. Michael:
20 Q. Can you describe your knowledge with regard to
21 products such as CCleaner and what they are designed to
22 do?
23 A. Sure. We are not specifically -- I am not
24 specifically familiar with CCleaner itself. I am familiar
25 with a large variety of computer software and things that

20
1 are used to either wipe a computer or clear a cache or how

2 to work with the registry and that type of stuff, just out
3 of general computer knowledge or working in this industry
4 for ten years now. So not CCleaner specifically, but from
5 what I have read about CCleaner, it is not the only type
6 of software out there like that.
7 Q. And is that the type of software that you have some
8 general familiarity with? If not the specific CCleaner
9 product, other types?
10 A. Yes. We don't use anything like CCleaner in our
11 troubleshooting or wiping of data at the City.
12 Q. And why is it that you don't use anything like
13 CCleaner or any other data destruction type device?
14 A. Our purpose in getting rid of data is to completely
15 wipe the hard drive. We write zeros to it, meaning there
16 is nothing recoverable on it, including the operating
17 system, because we are delivering it off to be recycled.
18 MS. MICHAEL: I don't have any other questions.
19 Thank you.
22 Q. Hello, Mr. Kaser.
23 A. Hello.
24 Q. How long have you worked for the City of Mercer
25 Island?

21
1 A. About seven years now.

2 Q. And I want to go back to some of your testimony when
3 you were talking about wiping hard drives. Do you
4 remember that testimony?
5 A. I do.
6 Q. If I understand your testimony, if you wipe a hard
7 drive, you cannot recover data from it after that; is that
8 correct?
9 A. In theory. The way that we wipe them, yes.
10 Q. So you would expect if a hard drive was wiped, that
11 you wouldn't be able to recover data from it the way you
12 wipe it, right?
13 A. Yes. In the way that we wipe them, yeah.
14 Q. And what program do you use to wipe computers at
15 Mercer Island?
16 A. We have used -- it is called DOD Wipe. Essentially it
17 stands for Department of Defense Wipe. But it is a
18 product that's -- I think it was developed by Symantec,
19 and it essentially goes in and writes zeros to the hard
20 drive.
21 Q. Basically it overwrites all of the data on the hard
22 drive, right?
23 A. It writes zeros to the hard drive.
24 Q. Which would eliminate all of the data in the free
25 space, correct?

22
1 A. Essentially it writes zero to every sector on the hard

2 drive. Not just the free space, but all space.
3 Q. So you wouldn't be able to recover documents from
4 Mercer Island on that laptop, for example, right?
5 A. We have not gone through the practice of forensically
6 trying to rebuild any of these hard drives, so I couldn't
7 conclusively say that. But in theory, yes, you would not
8 be able to recover any data off of the drive that we wiped
9 with --
10 Q. Is that based on your personal knowledge as you sit
11 there, and based on your understanding of how things work,
12 once something is wiped, it is not recoverable, correct?
13 A. Using the software that we use, yes.
14 Q. And you have never used CCleaner, right?
15 A. No.
16 Q. About how much of your work entails repairing
17 computers for people, employees?
18 A. Are you looking for a percentage of time?
19 Q. Sure.
20 A. Roughly, maybe 30 percent.
21 Q. So you don't send out the computers at Mercer Island
22 to a place like PC Doctor; is that correct?
23 A. No. We do all of our work in-house.
24 Q. Did you ever work with Londi Lindell?
25 A. Yes.

23
1 Q. Did you ever work with her and the laptop?

2 A. Yes.
3 Q. Do you recall transferring data from one laptop to the
4 other for her?
5 A. Yes.
6 Q. And do you recall that data including personal
7 information, such as family things and stuff with her
8 kids?
9 A. I don't really recall all of the contents of that
10 data. We transfer data from people's old computers to
11 their new computers in our standard process all the time.
12 Q. You would agree, sir, that it was more than just work
13 data? There was personal data on there, too, wasn't
14 there?
15 A. I don't recall exactly what was on there.
16 Q. Does Mercer Island use like a remote desktop program
17 that allows somebody to log on from home and log into
18 their desktop at work?
19 A. We do.
20 Q. Isn't it true that Ms. Lindell had a desktop at work,
21 right?
22 A. It is.
23 Q. And that she used the laptop computer to remote access
24 into the desktop, right?
25 A. I couldn't say that. Normally people who have laptops

24
1 don't remote control their desktops. It is people who

2 don't have laptops from home that will remote control
3 their desktops at work.
4 Q. It is your testimony -- When I use remote desktop, I
5 am actually on my desktop computer. Is it your testimony
6 that Mercer Island doesn't log on remotely to their
7 desktop computer?
8 A. Most of the time people don't have a laptop and a
9 desktop; they have one or the other. So for those who
10 don't have a laptop, they will remote control their work
11 desktop from whatever home computer they are using. For
12 the users that have a laptop, typically it is also their
13 work station, and they have a dock station, which wasn't
14 in this case. I wouldn't recommend to somebody who has a
15 laptop, per se, to necessarily connect to their desktop at
16 work, because their work laptop may also already have the
17 software that they need or the access to the network that
18 they need. There might not be a reason to connect to the
19 work desktop also.
20 Q. Wouldn't it make more sense to log into the server?
21 You would agree that in any case Ms. Lindell would be
22 logging into the server when she was accessing work
23 through her laptop, correct?
24 A. To the first part of your question, I wouldn't say it
25 would make more sense, because her laptop would be part of

25
1 our network anyway, meaning it is joined to our domain and

2 has access to all of the stuff. All she would need to do
3 is establish a connection to our network, and then her
4 laptop would behave just as a desktop might. I'm not
5 quite sure what you mean by connecting to the server.
6 Q. I could be mistaken about how it works. I appreciate
7 your information on that. Did you ever search
8 Ms. Lindell's laptop? Did you ever remove data from it or
9 inspect it?
10 A. No.
11 Q. Were you doing that with her desktop?
12 A. There may have been a time where we scanned her
13 workstation, after she left, for anything. I don't
14 recall.
15 Q. Do you know in this case that there are allegations
16 that Ms. Lindell wiped her hard drive?
17 A. Yes, I do.
18 Q. And would you expect that she would be able to recover
19 data from a hard drive that was wiped?
20 A. Using a computer software program like CCleaner, my
21 understanding is that it does not wipe the computer. It
22 simply wipes selective things, like your registry, keys
23 that are no longer used, browser cache, that type of
24 stuff. I was not aware that she wiped the computer in,
25 say, the same sense that I am describing for the City's

26
1 practice of recycling the computers.

2 MR. BLANKENSHIP: Thank you, sir.
3 MS. MICHAEL: No additional questions, your
4 Honor.
6 MS. MICHAEL: We would call Jonathan Yeh.
7 Whereupon,
8 JONATHAN YEH
11 THE CLERK: Will you state your name for the
12 record and spell your last name, please?
13 THE WITNESS: Jonathan Yeh, spelled Y-E-H.
14 MS. MICHAEL: Your Honor, I have a series of
15 documents I would like to have marked as either one
16 exhibit or each separately, if the court has a preference.
17 I don't. These are from Mr. Yeh's file with regard to his
18 communications with the Blankenship Law Firm.
19 THE COURT: Mr. Blankenship, have you seen these
20 documents?
21 MR. BLANKENSHIP: Counsel, are these the
22 documents that were produced by this witness?
23 MS. MICHAEL: They are. They are a selection of
24 them. I have all of them, but I will only be asking about
25 a selection.

27
1 MR. BLANKENSHIP: If those are the documents,

2 your Honor, then I have seen them. I don't have them with
3 me.
4 THE COURT: All right. You may mark them as one
5 exhibit.
6 MS. MICHAEL: Thank you, your Honor. I will go
7 ahead and give Mr. Blankenship -- I ended up with extra
8 copies, but each one I will be talking about is in there.
9 So there are three copies of each one I have been talking
10 about.
12 By Ms. Michael:
13 Q. Mr. Yeh, would you tell us your address, please?
14 A. Our business address is 157 Yesler Way, Third Floor,
15 Seattle, Washington 98104.
16 Q. And what is your profession, sir?
17 A. I am an attorney.
18 Q. And do you have a special expertise in computer work?
19 A. The firm specializes in electronic discovery and
20 computer forensics work.
21 Q. Are you the technical person that gets in and does
22 that kind of work?
23 A. It depends. Mostly not. We have a computer software
24 technician and engineers that do most of the actual
25 hands-on work. Depending on staffing issues, sometimes I

28
1 will perform some of the functions.

2 Q. And have you had a chance to review the file in this
3 case that Blank Law & Technology has on this matter?
4 A. I have.
5 Q. When was Blank Law & Technology retained?
6 A. I believe in early November 2010.
7 Q. And by whom were they retained?
8 A. By the Blankenship Law Firm.
9 Q. Would you look, please, sir, at your Bates number 1 of
10 Exhibit A-2. It appears that you might have been retained
11 on or about November 8th by the Blankenship Law Firm; is
12 that correct?
13 A. I believe so, yes.
14 Q. When was it that you came to understand that you were
15 actually supposed to be the independent third-party
16 forensic examiner the court had ordered?
17 MR. BLANKENSHIP: Object to foundation.
18 THE COURT: Overruled. I think I will be able to
19 track what I did.
20 THE WITNESS: I believe that was made aware to me
21 somewhere around just prior to Christmas time via a letter
22 from your firm.
23 By Ms. Michael:
24 Q. And we sent a letter November 15th of 2010, indicating
25 that we believed you were the independent forensic firm.

29
1 That is not part of Exhibit A-2 because that is not part

2 of your communications with the Blankenship Law Firm.
3 Does that refresh your memory about when you were notified
4 that in fact you were supposed to be the independent
5 expert?
6 A. Sure. I don't have that letter in front of me, but it
7 is a dated letter.
8 Q. Fair enough. I understand you entered into an
9 engagement agreement with the Blankenship Law Firm; is
10 that correct?
11 A. Yes.
12 Q. Would you please look at your Bates number 8? That is
13 an e-mail from you, dated November 8th of 2010. When you
14 say, "We will then begin extracting the active files,"
15 what were you telling Mr. Goldsworthy?
16 A. Basically, when you have a computer hard drive, there
17 are files that are sort of, I guess, active versus deleted
18 and fragmented space. So we were extracting just the sort
19 of active files for processing into a database.
20 Q. Do you typically as a forensic examiner get asked to
21 extract only the active files?
22 A. It sort of depends on the project. Sometimes yes,
23 sometimes no.
24 Q. So as a forensic examiner, sometimes somebody will
25 actually ask you to clone the hard drive and only pull

30
1 active files?
2 A. Yes.
3 Q. How often does that happen?
4 A. It is hard for me to say percentage wise. It does
5 vary from case to case.
6 Q. Active files are something I personally can pull off
7 without any special expertise; isn't that right?
8 A. It depends how you mean "pull off." A lot of times
9 people will copy off active files themselves. But it
10 changes what we call the metadata on the files a lot of
11 times. Even just pulling off the active files, people
12 will engage our firm to make sure these things remain
13 intact.
14 Q. But "active files," you don't require any special
15 software to get the active files, do you?
16 A. No.
17 Q. So I could do it at my desktop at work?
18 A. Yes.
19 Q. At some point, as I understand it, the Blankenship Law
20 Firm gave you a list of search terms that they had come up
21 with; is that right?
22 A. Yes.
23 Q. And then later on you were given far more search terms
24 that we did in collaboration with the Blankenship firm?
25 Is that your understanding?

31
1 A. Yes.
2 Q. I would like to ask you to look, please, at Exhibit --
3 Bates Stamp 17 of Exhibit A-2. It is an e-mail dated
4 November 9th of 2010. Down at the bottom you were telling
5 Mr. Goldsworthy of the Blankenship Law Firm in the second
6 paragraph, "I have been told that there is very little
7 e-mail on the laptop. I don't know if that is relevant or
8 surprising to you or not, but many of these kinds of
9 matters focus on e-mail, so I thought I would mention it
10 in case it was a surprising fact." Do you see that?
11 A. Yes, I do.
12 Q. Do you recall talking with Mr. Goldsworthy about that?
13 A. I recall writing this e-mail. I do not recall that we
14 had any additional discussion on that subject.
15 Q. At this point in time had the technician that was
16 actually searching the Lindell laptop had conversations
17 with you about what he was or was not finding?
18 A. Yes.
19 Q. And are they memorialized in writing anywhere?
20 A. Not other than the sort of general description here in
21 this e-mail.
22 Q. One surprising fact you are finding is there is very
23 little e-mail; is that right?
24 A. Sure. Yes.
25 Q. If you would next look at your Bates number 21,

32
1 please, an e-mail dated November 9th? And it indicates

2 that "they," which I assume means the Blankenship firm,
3 and please correct me if I'm wrong, "would like the
4 following tagging buttons." And they list four, which are
5 "produce, responsive, nonresponsive, privileged slash work
6 product." What does this mean, "tagging buttons," with
7 those four categories?
8 A. Basically we had been asked to create a database of
9 the files from Ms. Lindell's laptop. Once that is up
10 there, the reason you create that database is for the
11 attorneys to review the various documents that are in
12 response to search terms.
13 And once they do, they usually have some sort of
14 tagging function. The online display has these little
15 buttons so you can say this document is responsive, this
16 document should be produced, and that tells us what to do
17 with the documents later.
18 Q. And so they were going to tag these as produced,
19 responsive, nonresponsive or privileged?
20 A. Yes.
21 Q. To your knowledge, did that occur?
22 A. I wasn't there, but I believe so.
23 Q. Do you have any way of knowing if the City was
24 provided with all of those documents?
25 A. All of which documents?

33
1 Q. Produce, nonresponsive, responsive or a privilege log

2 for the privilege?
3 A. No.
4 Q. I want to ask you to please look at Bates number 27
5 from the documents that you provided. My copy has a
6 slight handwritten note I have covered up. This is an
7 e-mail down at the bottom, November 10th, to Rick
8 Goldsworthy from you. It indicates, "I notice your review
9 team has marked some files for production and just wanted
10 to give you a heads up on production time lines." Do you
11 see that?
12 A. Yes, I do.
13 Q. My question is, do you recall discussing what files
14 they didn't want you to produce?
15 A. No. Our job is just whatever gets marked "produce,"
16 we produce. I wasn't given any instructions about what
17 specifically was not to be produced.
18 Q. Do you still have records that would establish what
19 you did produce to the Blankenship firm -- in what format
20 all the documents were produced?
21 A. I believe the database that we set up for them is
22 still sitting there.
23 Q. Would you please look next, sir, at Bates number 29?
24 It is an e-mail, November 14th, from I guess -- Is
25 Mr. Tsuji a technician?

34
1 A. No, he is another attorney in the firm.

2 Q. Is he another technical person as well?
3 A. It is a small firm, so we sort of have mixed roles,
4 all of us. Mr. Tsuji is sort of the head of the technical
5 department.
6 Q. And Mr. Tsuji indicates he wants to give you an update
7 on this case. "Come find me first thing in the morning."
8 Do you remember what his update was on November 14th?
9 A. Not just off the top of my head, no.
10 Q. Do you recall having any discussions at any time with
11 the Blankenship firm about things that you were either
12 puzzled by, other than the lack of e-mails? Anything that
13 you were puzzled by or found intriguing or wanted to bring
14 to their attention?
15 A. No.
16 Q. If you would look next, please, at Bates number 45?
17 Down at the bottom is an e-mail from you to Rick
18 Goldsworthy. You are asking him, "How would you like us
19 to produce the new data set for review? We can just turn
20 over a CD with the native files or we can process the
21 files and upload them to your existing database. We can
22 upload them as a separate subdatabase." And then
23 Mr. Goldsworthy responds, "I think having the documents
24 uploaded to the database would be more expedient and
25 transparent and efficient, especially considering the

35
1 review process we previously engaged in."

2 What exactly did you do for the Blankenship Law Firm
3 on January 5th?
4 A. I believe the reason I sent this e-mail is at this
5 point it became a little vague as to who was paying our
6 bills for what, and therefore who I needed obtain
7 authorization from for what. So basically I consulted
8 Mr. Goldsworthy and Mr. Youssef to sort of determine how
9 they wanted to review this new set of files.
10 After I sent this e-mail, I believe I recall sending
11 an e-mail to your firm and you sort of describing the same
12 process, and whether or not you authorized the payment,
13 the cost of this. If I remember correctly, you didn't.
14 So what we ended up doing was just producing a CD with
15 just the native files, instead of doing the database.
16 Q. Isn't it accurate to say that the Blankenship firm had
17 access to your database and the City was not offered that?
18 A. The database of the original documents that we had
19 processed, yes.
20 Q. And if we can look at the next page of that document,
21 the same date, the same e-mail. It says, "So, for
22 instance, if you already marked a large number of
23 documents, responsive, nonresponsive or privileged,
24 et cetera, and those identical documents are also in the
25 new set, we can port over the tags to the new subdatabase

36
1 so that you would not have to re-review those documents."

2 What are you telling Mr. Goldsworthy would occur?
3 A. Originally when we had the database and pulled off the
4 active files, they reviewed them and tagged them however
5 they would have tagged them. So once we had this new set
6 of native files -- Because the search terms, some of them
7 overlapped, some of them didn't, probably some of these
8 search results from the two sets. If we had uploaded them
9 into another sub-database, we would have been able to
10 match up which ones they already reviewed and which ones
11 they already tagged, and just sort of copy over those
12 designations to the new database, just to save the time of
13 reviewing those documents again.
14 Q. Again, this is directed only to the Blankenship Law
15 Firm, the City was not involved in this?
16 A. At this point, no.
17 Q. If you would look next, please, at Bates number 55, an
18 e-mail from Mr. Goldsworthy to you, dated Monday,
19 January 24th. That states, "I just wanted to follow up
20 with you regarding when you think you will be able to send
21 us a spreadsheet listing all of the withheld files. Will
22 you be able to send that over today?" Do you see that?
23 A. Yes.
24 Q. Did you send them a spreadsheet of all of the withheld
25 files?

37
1 A. Yes, we did.
2 Q. Does the spreadsheet indicate which ones they had
3 tagged as responsive, nonresponsive, privileged, or do you
4 recall?
5 A. I believe the spreadsheet was just a straight export
6 of the metadata fields, and FTK, the program we were using
7 at that point to search the data for those files. At that
8 point, they weren't in a database. You wouldn't have been
9 able to tag anything specifically.
10 Q. So what are the "withheld files" you are referencing
11 in this e-mail?
12 A. I believe at this point, when we didn't do the
13 database for the second time around, we produced all of
14 the files that had been responsive, the native files, just
15 on a CD. And so they then came back and identified a list
16 of files that they just designated as withheld. And we
17 found those files, pulled them from the set that was from
18 the CD. And then using FTK, extracted -- produced a
19 spreadsheet of the metadata of that subset of files.
20 Q. Do you still have the withheld files or are those in
21 the Blankenship possession?
22 A. They were produced to the Blankenship firm, but we
23 keep an archive copy.
24 Q. You do have an archive copy?
25 A. Yes.

38
1 Q. If you would look, please, at Bates number 56 of A-2,

2 an e-mail thread dated January 26th, at the bottom, from
3 you to Mr. Goldsworthy. It starts, "When you confirm that
4 you are asking me to produce these three files," and you
5 list three files, "the LKL chronology, the Egger's short
6 report," and then something that has some numbers and
7 letters. And you are told up above, "Those are the
8 correct documents that we want you to produce." Do you
9 see that?
10 A. Yes.
11 Q. So they had been withheld initially, and then you were
12 allowed to produce those to us; is that right?
13 A. I believe so, yes.
14 Q. Were you told why those particular ones, out of all
15 the withheld documents, were allowed to be produced?
16 A. No.
17 Q. If you would look, please, at Exhibit 58 of Exhibit
18 A-2, a February 25th e-mail thread, from Alex Harmon to
19 you. Who is Alex Harmon?
20 A. He is a computer technician in our firm.
21 Q. And Mr. Harmon indicates, "Under USB storage
22 device --" First of all, what is a USB storage device?
23 A. Basically your computer has what are called USB ports.
24 It is a little slot on the side you can connect various
25 devices to it. So it is like a thumb drive or any of

39
1 these portable data storage devices.

2 Q. So if I wanted to download information from my
3 computer, I could put in a USB drive, download some
4 information and maybe take it to another computer?
5 A. Or vice versa.
6 Q. Or download information into the computer from the
7 thumb drive?
8 A. Yes.
9 Q. And did it used to be more prevalent to do CD burning
10 techniques rather than thumb drives or USB drives?
11 A. I don't know what you mean by "used to be more
12 prevalent."
13 Q. Have USB drives or thumb drives become more popular in
14 the last few years?
15 A. I don't know. In my own personal usage, yes. But
16 other than that, I can't say industry-wide. I don't
17 really have an opinion on that.
18 Q. Do people sometimes burn information to CDs?
19 A. Yes.
20 Q. So you can do the same type process, where you take
21 information off a computer, burn it to a CD, and then you
22 take the CD to another computer?
23 A. Yes.
24 Q. And so that way you have arguably removed obvious
25 evidence of documents that were on the computer by

40
1 downloading them to either a thumb drive or a CD? I say

2 "obvious evidence," to a nonforensic examiner person.
3 A. Sure. Let me make sure I am getting your question.
4 Are you saying it is obvious when you do that or --
5 Q. For example, if I download a file from my computer to
6 a thumb drive, then there is no obvious evidence that the
7 file was there because now it has been removed?
8 A. I wouldn't really say that is true. Usually people --
9 Not usually. I mean, the process can be, you can copy
10 things over, you can move things over, you can cut and
11 paste things over. Depending on what method you use, you
12 will either leave the original copy on your computer as it
13 is, or you will move it off, but at that point usually
14 what the computer does is it just tags that as being
15 deleted, and it is still there, but it is hidden from
16 view.
17 Q. Hidden from view. Right. And so in this e-mail from
18 Mr. Harmon to you, he is looking at USB storage devices.
19 He indicates, "I found multiple results, including USB
20 thumb drives and iPods." Do you see that?
21 A. Yes, I do.
22 Q. So he is just reporting to you the findings of his
23 research?
24 A. Yes.
25 Q. And he goes on to say down below, "I identified

41
1 multiple instances that may indicate CD burning activity

2 from February to November of 2010." Do you see that?
3 A. Yes.
4 Q. Did you discuss that with anyone at the Blankenship
5 firm?
6 A. I sent sort of a condensed version of this e-mail to
7 both Blankenship, and then eventually to your firm.
8 Q. I see that you sent it to Blankenship's firm on
9 February 28th, where you are identifying essentially what
10 Mr. Harmon told you. And that is Bates number 62.
11 A. Yes.
12 Q. I don't see that we are on that e-mail.
13 A. No. At this point the process that we agreed on is we
14 would provide that information first to the Blankenship
15 firm, in the case it revealed anything that was privileged
16 or otherwise -- basically privileged, so that they would
17 have a chance to review it first before we produced it to
18 you.
19 Q. Under "CD burning," you are indicating that you
20 examined the Windows system event log for evidence of IMAP
21 CD burning events, and identified multiple instances that
22 could indicate burning activity from February to
23 November 2010. Do you see that?
24 A. Yes.
25 Q. Do you have any reason to believe the fellow that told

42
1 you that was the case was inaccurate?

2 A. No.
3 Q. If you would look, please, at number 59. This is
4 dated March 1st, the date that we got the third and final
5 CD from your office. Do you remember that?
6 A. I do.
7 Q. And on this one, again, from Mr. Goldsworthy to
8 Mr. Yeh. It indicates they have removed the information
9 that you sent to them, and they would like you to now
10 produce the following documents and files from
11 Ms. Lindell's laptop computer that were previously
12 withheld by Ms. Lindell. And then there is a listing of
13 several files numbers. Do you see that?
14 A. Yes.
15 Q. Did they tell you why they were authorizing you to
16 release that group of files from the withheld files?
17 A. No.
18 Q. Again, it is not your concern what they are
19 withholding and why; is that right?
20 A. Yes.
21 Q. At this point in time, on March 1st, did you perceive
22 that you were the independent forensic examiner retained
23 by the court, or did you perceive that you were an expert
24 hired by the plaintiff?
25 A. At this point we believed we were sort of a neutral

43
1 party that was basically subject to instruction from both

2 sides.
3 Q. Although you would check with the other side if we
4 made a request, correct?
5 A. Yes.
6 Q. And in the past, if the Blankenship firm had made a
7 request, you didn't check with us, did you?
8 A. That would be before your letter.
9 Q. Is this the first time that you have been in a
10 situation where you were first retained by a party, and
11 then put in the spot where you perceive yourself as
12 neutral, or do you do that on other occasions?
13 A. It has happened before. It is not that common, but
14 yes, it has happened before.
15 Q. And do you see any issues with ethical -- Strike
16 that. Never mind.
17 I have just a couple more of these documents to ask
18 you about, and then a few follow up questions and I will
19 be finished, Mr. Yeh.
20 These seem to be a bit out of order, but this is the
21 Bates number order I got. This is Bates number 78, an
22 e-mail from Mr. Goldsworthy to you, dated January 21st.
23 It states, "Attached are two lists containing the files we
24 are withholding from defendants. The only two files that
25 are not on the attached lists that we also want to exclude

44
1 are the two I reviewed yesterday and I asked you to pull."

2 And there are two files listed. "Please withhold those
3 files as well. Also, please generate an Excel spreadsheet
4 of the withheld files, including the file names and paths,
5 and produce the rest of the files to the City." Do you
6 see that?
7 A. Yes.
8 Q. And did you do as they instructed?
9 A. Yes.
10 Q. And if you would look at number 79, an e-mail thread
11 from Mr. Goldsworthy to you, Tuesday, January 18th. It
12 says, "I am attaching five separate documents containing
13 separate lists of files we have reviewed from plaintiff's
14 laptop computer that should not," underscore not, "be
15 produced to defendant City at this time. The attached
16 lists contain approximately 339 files we wish to exclude
17 from production. Once you have excluded these files,
18 please produce the balance of the 'produced' files to the
19 defendant." Do you see that?
20 A. Yes.
21 Q. Do you know why they were withholding some of the,
22 quote, "produced files" from the defendant?
23 A. No, nothing was explained to me.
24 Q. I would like to ask you about one of these
25 spreadsheets that was provided that Mr. Muchmore will talk

45
1 a bit more about. I have copies.

2 MS. MICHAEL: Your Honor, may I have a document
3 marked?
4 THE COURT: Yes. You may approach.
5 THE CLERK: A-3.
6 By Ms. Michael:
7 Q. Do you have A-3 in front of you, sir?
8 A. Yes, I do.
9 Q. I would like you to look at the section I am about to
10 highlight from the screen, "French art presentation
11 66923." Do you see that?
12 A. Yes.
13 Q. That number is 66926 in the log that we were given.
14 Do you know why that would be -- why the numbers would be
15 out of sequence like that?
16 A. Which set of documents is this?
17 Q. This is from the Lindell laptop native production.
18 And Mr. Muchmore will have testimony about this as well.
19 I am wondering if you know why there is a gap in the
20 numbering.
21 A. I'm sorry. Can you tell me again what you are asking?
22 Q. You bet. The one that I have highlighted that says
23 "French art presentation," and then it has the number
24 669226 -- I'm sorry, the number is 669223 on your
25 document. On the spreadsheet that we have got, the number

46
1 is 66926 (sic). Do you know why that would be?

2 A. I don't. The number itself is something that is added
3 by FTK. It is not in the original file. They should
4 match up between the spreadsheet that goes with this list
5 of files and the file name here.
6 Q. And if they don't, what are the explanations for why
7 they don't match up?
8 A. It could be a lot of different things, particularly
9 with this particular production. Prior to the production,
10 we had a software crash internally. I don't know if you
11 recall my mentioning that to you. And so we did end up
12 having to reindex the drive. And so when we pulled some
13 of the things out, the original numbers might have been
14 changed. I don't know if that applies to this situation.
15 Other explanations for why sometimes the numbers
16 differ, sometimes there are different fragments of the
17 same document that might have the same file name but have
18 different numbers. Again, as to this particular file,
19 whether either of those explanations apply or not, I can't
20 tell you just right off the top of my head.
21 Q. Can you confirm that 669223 represents the forensic
22 toolkit ID number; is that right?
23 A. Yes.
24 Q. We found, and Mr. Muchmore will talk about this, the
25 numbers after approximately 520,000 do not match the

47
1 produced slash privilege log and the file listing. Other

2 than the fact that you had an issue with your hard drive
3 or something, why would that be?
4 A. I really can't speculate without looking at what is
5 going on.
6 Q. There are documents in the production and privilege
7 log that Mr. Muchmore will address that do not appear on
8 the file listing. Why would that be?
9 A. There are documents here in the production --
10 Q. In the production that we have received and the
11 privilege log that do not appear on the file listing. Why
12 would that be?
13 A. Again, without being able to compare the two, I can't
14 explain that right now.
15 Q. What do shortcut files tell a forensic examiner such
16 as yourself?
17 A. It depends. For instance -- It depends on where they
18 are located, it depends on what they are a shortcut to.
19 Q. What kinds of information can you obtain as a forensic
20 examiner from shortcut files?
21 A. Well, basically that the document at some point was
22 linked to that shortcut. Whatever the destination of that
23 shortcut link is, was at some point accessed using this
24 computer.
25 Q. And let me know if I get over your head in any way

48
1 here. Can you not tell when a document was created?

2 A. I don't believe so.
3 Q. Can you tell when it was accessed?
4 A. Again, I think you are a little beyond what I would be
5 qualified to testify on.
6 Q. So this is beyond your scope of expertise?
7 A. Yes.
8 MS. MICHAEL: Your Honor, I don't think I have
9 anything else for Mr. Yeh at this time. Thank you.
12 Q. Good afternoon. I want to just ask you about this
13 database and see if I can clear up what the database is
14 for. Why in the first instance -- What would be the
15 reason for creating a database for online access?
16 A. It just simplifies the review process. There are all
17 sorts of reasons you would create a database.
18 Q. Is it fair to say it would make the search more
19 efficient and the ability to go through the documents
20 easier?
21 A. The documents that you have, yes, in the database.
22 Q. And did you understand that part of what you were
23 charged to do by the court was to work with my office to
24 make certain that we didn't produce privileged documents
25 and privileged files?

49
1 A. At what point are you talking about?

2 Q. I am talking about once you became an independent
3 forensic examiner.
4 A. Yes. Part of our role is to help you identify what is
5 privileged and what should and should not be produced for
6 that reason.
7 Q. At any point, did anyone from my office ask you to
8 improperly withhold something or express concerns to you
9 about anything relating to your job or what you did?
10 MS. MICHAEL: Object to the form, your Honor.
11 THE COURT: Overruled.
12 THE WITNESS: To whether or not anything was
13 withheld improperly, I can't tell you. I was just told to
14 withhold a certain set of documents based on ID numbers,
15 and based on file names, and we did.
16 Mr. Blankenship:
17 Q. Is it fair to say you weren't involved in the
18 decision-making as to whether something was privileged or
19 not privileged?
20 A. No, we weren't involved.
21 Q. I want to go to the issue of e-mail. And there was
22 some testimony about not seeing a lot of e-mail. Do you
23 remember that testimony or the e-mail that reflected that?
24 A. Yes, I do.
25 Q. Isn't it true that, unless you have Outlook or Outlook

50
1 Express, web-based e-mail wouldn't be captured or

2 downloaded on the computer?
3 A. That is true.
4 Q. If, for example, Ms. Lindell had used Hotmail, and she
5 just used it on the web, would you expect or not expect to
6 find her e-mails on the computer?
7 A. Normally you would not expect to find that much
8 e-mail. Sometimes you will find little bits and pieces
9 here and there. As a whole -- I guess in my previous
10 e-mail when I said it was surprising, I mean, it is just
11 that there wasn't e-mail on there. It didn't account for
12 the fact whether she used Outlook. I wasn't aware of any
13 sort of behavior she engaged in.
14 Q. At any point did someone say, hey, here is what this
15 case is about, here is what the issues are, here is what
16 we expect to be on the e-mail, or did we basically ask you
17 to mine information from the computer?
18 A. Basically we were asked to pull off certain kinds of
19 files, and then search them.
20 Q. And if I understand your testimony, there was only one
21 database, right?
22 A. Yes.
23 Q. But whatever you would have put in a database the
24 second time, which would have made things more efficient,
25 you produced in the CD-ROM, correct?

51
1 A. I may have misspoke just now. There were in fact two

2 databases. There is only one via Relativity, the online
3 platform. The other is an FTK database that is in a
4 separate, more forensically-geared software. There are
5 two databases. The first one we did for your firm was in
6 a product called Relativity. And this had the online
7 functionality.
8 Q. So if there weren't -- If I understand what you are
9 saying, you had your own internal database, and then when
10 we hired you to make sure that we had located all the
11 active files on the computer, you made a database so we
12 could quickly and efficiently find things that were
13 responsive and privileged, and not have to open and close
14 each one of them with special software? Is that fair to
15 say?
16 A. Yes.
17 Q. Since there wasn't a third database, you know, with
18 respect to the documents that you were doing the broader
19 search that involved the City, there were no tags because
20 there was no third database, correct?
21 A. I guess the second database I was talking about, the
22 one in the FTK software, that is the one we used to do the
23 searches for the City's requests after the 15th or
24 whatever. So in that database -- That software does not
25 have that kind of functionality. Well, it does, but it

52
1 wasn't utilized.
2 Q. I know that earlier you testified that anybody could
3 get on a computer and find active files. I kind of want
4 to understand. When you said that, do you mean without
5 any type of forensic software? Is that what you mean?
6 A. I believe so. You have files on your computer on your
7 desktop that you can click to them and copy them to
8 anything you want to. You obviously don't need any
9 special forensic software for that. I mean, Windows has a
10 search tool that you can click on and ask for it to find
11 files under certain terms. It is slow and it is clunky,
12 but it is possible to find.
13 Q. You have to know, though, that it is there and how to
14 use it, correct?
15 A. Yes.
16 Q. And just to let you know, you found stuff that we
17 hadn't found. I mean, we did our best.
18 MR. BLANKENSHIP: I don't have any further
19 questions. Thank you.
20 MS. MICHAEL: I have no further questions, your
21 Honor.
23 MS. MICHAEL: We would call Alan Muchmore as our
24 next witness.
25 Whereupon,

53
1 ALAN MUCHMORE
4 MS. MICHAEL: May Mr. Muchmore have a moment to
5 set up his laptop? He has a PowerPoint presentation.
6 THE COURT: Yes.
7 THE WITNESS: Is there a place for me to plug
8 this in? Would it be possible for me to testify from
9 another location?
10 THE COURT: You will have to be able to manually
11 manipulate it.
12 MS. MICHAEL: If I can just take a moment with my
13 paralegal, your Honor?
14 THE COURT: Counsel, we are running long. I
15 expect this witness is going to be here for a while.
16 While you sort through this, we will take a break. We
17 will be in recess.
18 (At this time a short break was taken.)
19 THE COURT: You may proceed.
20 MS. MICHAEL: Thank you, your Honor.
22 By Ms. Michael:
23 Q. Mr. Muchmore, would you state your address for the
24 record?
25 A. 5518 17th Avenue Northeast, Seattle, Washington 98105.

54
1 Q. Would you please tell us about your background and

2 credentials?
3 A. I have been working in the field of computers and IT
4 since about 1986, professionally. At the time, it would
5 be summer jobs or jobs while I was in school, until I got
6 out. And then I worked in the IT department in Houston.
7 And in 1991, I moved to Austria to write antivirus
8 software in the emerging field of antivirus. When I came
9 back and went to law school, I again worked in IT during
10 the summers and during the school year for extra money.
11 When I came to Seattle, I started working for law firms.
12 So starting in about the year 2000, I formed Muchmore
13 Consulting, where I began working for a number of
14 different law firms, that for my business included
15 providing IT support, networks, but also at that time
16 helping them with their cases when they touched upon
17 computer issues, performing forensic evaluations. And
18 then starting about six years ago, I started working as an
19 expert witness.
20 Q. And in the materials we received today, the
21 plaintiff's expert, I believe her last name is Goodman,
22 indicated that you have referred work to her. Do you
23 recall referring work to her, and, if so, can you tell us
24 the circumstances?
25 A. There have been circumstances where we have referred

55
1 work to each other. I can think of two circumstances in

2 which there were drives or computers that needed to be
3 analyzed in a very timely fashion that just fell right
4 when I was on vacation, and I asked her to help with
5 those. I can think of a couple of other instances,
6 including one very recently, in which the attorney asking
7 for an expert was very close to me and decided that I
8 would not work well as an independent expert. So I
9 referred that to her. There have also been instances
10 recently in which there were items, say, extracting
11 e-mails from a server, that Alice has referred to me.
12 Q. Do you think she is more or less qualified than you in
13 the field of forensic examination of computers?
14 A. The work together -- We worked together in one
15 particular case in which she analyzed drives. And
16 everything -- my work with her has indicated she is
17 completely competent and knowledgeable enough to be a
18 forensic examiner. But I wouldn't have any knowledge that
19 would say she is more or less so than I.
20 Q. Thank you. Your resume is already in front of the
21 court, so I don't want to go into any more detail. I
22 would like to ask you -- And I know you have a PowerPoint
23 presentation. Can we talk about CCleaner and what it
24 does?
25 A. Certainly. When I first noticed the CCleaner software

56
1 on this machine it caught my eye because I had heard of,

2 but I was not particularly familiar with it. So, of
3 course, one of the first items that I did is go to their
4 website and read about how they describe the software.
5 The company that creates it is called Piriform.
6 Q. Before we go any further -- I don't mean to interrupt
7 you, but let me ask you this: How did it come to
8 your attention -- I think I left out a little
9 foundational information. Would you describe the three
10 disks that you got and how you ultimately came to realize
11 that CCleaner had been used?
12 A. Of course. So the initial two CDs that were received
13 from the Blank Law Firm contained individual documents
14 that had been -- or other files that had been exported
15 from their forensic toolkit software. So those were the
16 initial two. But then the third CD, that I believe was
17 March 1st, included what I understood to be a complete
18 file listing of all the different objects in their
19 forensic toolkit database, which represents what it found.
20 Now, that listing did not include the contents of the
21 files or the contents of anything, just the metadata about
22 the files.
23 We were also provided with the registry information
24 from that computer. The registry is the database that
25 Windows maintains that lists settings. It lists the color

57
1 of your background, it lists the positions of your icons,

2 but also individual software programs that run on it, not
3 by Microsoft, but Adobe Acrobat, or in this case,
4 CCleaner, can actually store their settings in that
5 registry.
6 Q. So it wasn't until March 1st that you were provided
7 any information that gave you the knowledge that CCleaner
8 had been utilized; is that right?
9 A. No. Yes. Excuse me. That is right, I had not.
10 Q. Let's talk first, and use your PowerPoint as you need
11 to to discuss CCleaner, what it does and why it was of
12 concern to you?
13 A. What I determined about CCleaner was first by looking
14 at their website and how the software company described
15 the software. I also read some third-party reviews. And
16 then I conducted a number of tests where I actually ran
17 CCleaner on a test computer to see how it behaved. As the
18 company describes it, it is a free program designed to --
19 they mention to protect your privacy by removing
20 information from the computer. And basically removing
21 information is what it does. It is all that it does.
22 MR. BLANKENSHIP: Your Honor, are we going to go
23 over old ground with the witness? This is all in his
24 declaration about what CCleaner is, how it works.
25 THE COURT: I think on both of these witnesses I

58
1 would like to hear the whole story.

2 MR. BLANKENSHIP: Okay. Sounds good.
3 THE WITNESS: So three of the items that caught
4 my attention are the ones that are discussed in this case,
5 and we will discuss more, are the first items where it
6 removes the shortcut files.
7 By Ms. Michael:
8 Q. And why is that important?
9 A. The shortcut files --
10 Q. I am going out of order. Just tell me how you get to
11 it.
12 A. Shortcut files -- I will discuss that more in just a
13 moment. But basically those can include information about
14 when documents were accessed and where they were accessed
15 from, and also information about documents no longer on
16 the computer. It also, "it" being CCleaner, removes the
17 internet cache files that has information about websites
18 that someone on the computer has visited, and usually the
19 contents of those websites.
20 Q. For example, if I wanted to research how to -- what a
21 forensic examination of a computer means, and then used
22 CCleaner, would there be evidence that I had in fact done
23 that research?
24 A. Before running CCleaner, there is a great likelihood
25 that the evidence of which sites you visited you could

59
1 read about and the contents on there. After CCleaner --

2 As I said, the purpose of CCleaner is to remove
3 information of that type. So web mail, such as use of
4 Hotmail or Yahoo Messages, where a person reads the e-mail
5 through a web browser as opposed downloading in a program
6 like Outlook or Outlook Express, the temporary internet
7 files are usually the primary source of information about
8 usage of that e-mail or what e-mails were accessed.
9 Q. So all of the Llindell at live dot com e-mails, if
10 CCleaner was used, what happens to those?
11 A. I'll have a more detailed description of that in just
12 a moment. The third option that we have discussed is that
13 it has the option to wipe information about files that
14 have already been deleted from the free space of a
15 computer. And I will show some more information about
16 that also.
17 So the first item is the shortcut files. So basically
18 what a shortcut file is, as Mr. Yeh testified, it is just
19 a file in the background that has a dot LNK. You usually
20 never see that. It just refers to another file on the
21 computer or a file that was accessed from that computer.
22 It shows -- I think I just mentioned this, it can show
23 to a forensic examiner documents that had been on the
24 computer, but no longer are on the computer. It can show
25 oftentimes documents that were accessed from a USB drive

60
1 or a CD drive, and instances, including times and dates,

2 about when a document that is still on the computer might
3 have been actually accessed that would otherwise be lost.
4 Each case is different, each examination is different,
5 but there have been examinations in which the shortcut
6 files that I am referring to were the primary piece of
7 evidence that was useful in conducting time lines about
8 documents and what was added when.
9 Just to show what these shortcut files are, why they
10 are there: They are not in Windows, as far as I know, to
11 assist a forensic examiner. That is just a side benefit.
12 So on this particular test computer, I just created a Word
13 document. At the very top you can see that I actually
14 called the document -- This is another Word document, and
15 wrote that in the body. So if you would advance?
16 I am logged on in this case as User1. In the folder,
17 "My Documents," which is just a predefined folder that
18 Windows sets up as a convenient place to put documents, I
19 have saved the Word document. And this is another Word
20 document. And you can see it has information about when
21 these files were created and when they were modified. So
22 the first document was both created and modified at 7:36.
23 This is another document created at 7:37, and last
24 saved -- modified at 7:38.
25 Now, if you click the start button, which is missing

61
1 off of this screen, by default Windows XP has a little

2 section here that says "My Recent Documents." And if you
3 click on that, then you can see these two documents.
4 In this case it is a pristine test computer that I had
5 just loaded Windows on. So there were no other documents
6 here. But you can see these two particular documents that
7 I had opened up in Word. And this is the reason that the
8 shortcut files are here. Again, it is not to assist me as
9 an examiner, as far as I know, but to allow the user to
10 see what documents. So, say, you had -- say, both
11 documents weren't just in the "My Documents" folder, say
12 they were in different locations or different areas, it
13 can kind of nicely put all in one location where those
14 documents are so that someone can go back and pull them up
15 again.
16 In this case, I held down the shift button and pressed
17 delete to delete the document. And the significance of
18 the shift button is it bypasses the recycle bin, so it
19 actually deletes it. At that point the document has been,
20 in the parlance I would use, deleted from the computer.
21 There are no normal means that just a normal user without
22 using specialized software could use to get that document
23 back.
24 But when I click the start button you can see that
25 that reference to "this is another Word document" is still

62
1 there. The shortcut file that provided that documentation

2 about the recently used documents did not go away when I
3 deleted the document.
4 Now, this folder is a little different. It is a
5 folder that is normally hidden from the user. But you can
6 see that it is referring to User1, which is the person
7 that -- the user name that I was logged in as. And then I
8 went to the hidden folder of "recent." And in this case,
9 it shows the shortcut file. This is another Word
10 document.
11 It also shows the date -- not the date the document
12 was created or the date that the document was modified,
13 but the shortcut file itself. So, unfortunately, in this
14 example they mirror what was there for the document. But
15 say I created the document yesterday, and then I opened
16 the document today, the shortcut file might have
17 information about it.
18 Now, you can see here that the little icon has this
19 little arrow. It is showing Windows as hiding the dot LNK
20 extension, but you can see from this little arrow that
21 this is not a Word document, it is one of these LNK files.
22 Go ahead. When I clicked "file" in the properties
23 option, we can see some of the data that is contained
24 inside this recent document file. And that data is this
25 target. It is cut off at the end here, but you can see

63
1 that the "My Documents" folder is where that file

2 originally was located. So even though we are looking at
3 a shortcut file that is in this "Recent" folder, the
4 original Word document was located in my documents. So
5 that is a piece of information we can tell.
6 If that document of the same name had been located on
7 a USB drive or a CD drive, there likely would be other
8 shortcut files there that would indicate that that same
9 document of the same name was located in those other
10 places.
11 So when we are doing a forensic examination, I don't
12 click on these one by one, but we have software that can
13 basically find all of these files, and in some cases it is
14 going to be hundreds or thousands, and just very
15 automatically create a spreadsheet that tells all these
16 documents -- dates that they were created, modified,
17 accessed and also the locations. Again, as I was saying,
18 in some cases I have been able to create a time line based
19 almost exclusively on these shortcut files.
20 As I just alluded to, generally what I will find is --
21 on a computer that has been continually in service for
22 four or five years, I will generally find hundreds of
23 these files. There will be more of these for the recent
24 weeks or months, but they will usually go back to the
25 beginning of the computer usage.

64
1 I actually just tested this over the weekend. I

2 logged on to a number of my clients' computers, found some
3 that were several years old, and confirmed my recollection
4 that there were cases where I found 800, 900 different
5 shortcut files.
6 In this case, I started up the CCleaner software on
7 this test computer. And you can see on the left the
8 CCleaner software actually shows the different options
9 that by default are checked. And I will go over this a
10 little bit more. One of the items is the recent
11 documents. That is checked by default.
12 So I clicked on the button here. So the actual
13 starting of the program did not clean anything. When I
14 start the program, it just shows these settings. It shows
15 what the options are, but it is actually when you click
16 this "run cleaner" button that it actually starts removing
17 information off and it pops up this little warning box
18 warning you this process will permanently delete files
19 from your system.
20 So in this case, there wasn't very much information on
21 this machine, but the circled area I have shows under
22 "Recent Documents" there were two files, and that those
23 were removed.
24 Q. The two files you had created that day?
25 A. Excuse me. The recent documents referring to those

65
1 two files. So one of those documents was deleted, one of

2 those documents was still on the hard drive, but those
3 shortcut links to refer to them were gone. And this is
4 the same folder we were looking at before, and those two
5 shortcut files were gone.
6 So this is a spreadsheet that includes information
7 from the file listing that was provided from the Lindell
8 laptop. What I had done is asked for -- I think, as was
9 alluded to, there were over 700,000 different lines on
10 this spreadsheet. So to find information I would need to
11 run queries that would allow me to draw up the pertinent
12 information.
13 So what I asked for in this case was link files that
14 were in a folder called "Recent" in the Lindell profile.
15 What I found were about 254 different shortcut files.
16 What I noticed was the earliest of these shortcut
17 files was created on August 23rd, which I had previously
18 found, and stated in my declaration, that I had found
19 evidence that CCleaner program had been run on August
20 21st.
21 When I say "the program had been run," at that point
22 in my analysis I could tell from the registry, and I will
23 get into this more, that someone had brought up the
24 CCleaner program. Initially I couldn't tell that anyone
25 had pressed the button to clean. But to me, the fact that

66
1 abruptly these link files that are 250 and roughly two and
2 a half months of use, and they abruptly end just within
3 two days of running that software, suggests that CCleaner
4 or another program of the same functionality had been run
5 at that time.
6 Q. And so there were no link files that predate 8/21 of
7 2010 or 8/23 of 2010 on the laptop; is that right?
8 A. Well, link files, as we said, are used for other
9 purposes. They are used to show the programs in your
10 start menus. But there were not any located in the
11 Lindell profile under these recent folders, which
12 indicated to me that they had been cleaned.
13 So this is just the bottom part of the spreadsheet
14 showing many of the lines were skipped. But it actually
15 goes down to 253. The two is cut off there. It just
16 shows in that short period of time there was a great deal
17 of information generated about documents that were
18 accessed on the computer. But, again, all of that
19 information prior to that date --
20 Q. August 23rd?
21 A. August 23rd, exactly.
22 So moving on to the next point that I mentioned about
23 CCleaner, which is the temporary internet net files. So
24 as you are using your web browser -- By default most web
25 browsers, including Internet Explorer, which is built into

67
1 Windows, actually store a copy of most of the information

2 that is downloaded over the internet.
3 Again, the purpose of this is not to assist the
4 forensic examiner; the purpose is to speed up your access
5 to a web page. In most cases accessing information over
6 the internet can be hundreds of times slower than off the
7 hard drive. So when you go to Hotmail and it shows you
8 graphics and information, it downloads those once, and
9 then saves that information in this cache file.
10 So this information for use of the forensic examiner
11 does show information about what websites you visited.
12 And there is other information that helps with that. It
13 shows information about the contents of the web pages that
14 you visited.
15 So, again, in some cases -- Whereas, in some cases
16 the shortcut files were the primary piece of evidence,
17 there have been cases I have been involved in in which
18 these temporary internet cache contains a picture of what
19 websites were visited or what e-mails were visited that
20 was the primary piece of information.
21 So in this case, as you discussed with Mr. Yeh, there
22 did not seem to be many e-mails stored on the computer in
23 a program such as Outlook or Outlook Express.
24 After talking with you, our understanding was that the
25 web mail was the primary source for the plaintiff to

68
1 access e-mail. So in that case, we did turn our attention

2 to what might be showed by these temporary internet files.
3 And, again, we found that they were discontinued. But I
4 will discuss that more.
5 Q. So the Llindell at live dot com, that would be a
6 web-based e-mail?
7 A. That is my understanding.
8 Q. And it would be in the temporary internet files?
9 A. Well, information -- Think of the temporary internet
10 files as just a snapshot of what you are seeing on the
11 screen. So live mail dot com or Hotmail dot com might
12 have thousands of messages there, but each time you look
13 at either a directory listing of e-mails or an individual
14 e-mail, then it is just taking -- think of it as a
15 snapshot or a picture in time of what you saw on the
16 screen. So if there is a thousand e-mails there, and you
17 have browsed through 30 of them recently, those 30 e-mails
18 would be, most likely, snapshots of those on the computer.
19 So it can store the messages, the contents.
20 It very often also includes the attachments to files,
21 because if you double click on the attachment to a file to
22 open it up, say, in Word, it has to download it first,
23 store it on your hard drive, and then open it up. So it
24 will usually keep that information.
25 So I created just for illustration purposes a Hotmail

69
1 account. I logged in. It was AH Muchmore at Hotmail

2 dot com. And then I sent myself 2 e-mail messages. There
3 was a third e-mail message that was already there that was
4 a nice little welcome.
5 So I opened those -- I didn't get screenshots, but I
6 opened those e-mails and viewed them on the screen. And
7 in doing so, when I went to look at the temporary internet
8 files, I found that just that activity had created 138
9 different files. Now, most of these files didn't contain
10 any words or text from it, but some of them did.
11 The place these were located, again, you can see these
12 are stored in the user profile for User1. So all of this
13 activity that is being stored is being stored in my User1
14 profile and in folders underneath. You can see the
15 folders are local settings, temporary internet files, the
16 content IE5, IE standing for Internet Explorer, and then
17 there is a folder that has sort of an eight-character
18 pseudo random number. So this is a snippet of these
19 files; not a complete listing, but just shows what they
20 look like.
21 This is a little harder to read. But this is a
22 snippet of the temporary internet files from the Lindell
23 laptop. Again, what I -- the method I used to extract
24 these was to look for files that were in a folder under
25 Llindell, and also under a folder that had temporary

70
1 internet files.
2 Q. If I could interrupt you now. I wanted to ask you
3 about Exhibits 2 and 3 to Ms. Goodman's declaration.
4 Would this be an appropriate time?
5 A. Let me finish the one note. It shows here creation
6 dates and modify dates. It shows that this folder,
7 temporary internet files, was created in 2006, which was
8 probably around the time the laptop was put in service.
9 But it also shows that some of these were recreated on
10 August 21st, which to me, in the tests I ran, was
11 consistent with the operation of CCleaner.
12 When I ran it on my test computer I found that some of
13 these same files were dated at the time. Not that
14 CCleaner actually popped up on the screen to look at the
15 options that I showed you, but when the actual button to
16 run the CCleaner program and remove files was run.
17 And then I noticed that it was down on -- basically a
18 little bit on the 28th, but on August 31st and later we
19 started seeing a rather complete listing of these
20 temporary internet files. That suggested to me that web
21 browsing was taken up in earnest on this computer again
22 starting at that date, August 31st, and appeared to
23 continue until the computer was turned over to Blank.
24 Q. Is this a good time for the Goodman declaration?
25 THE WITNESS: Yes.

71
1 MS. MICHAEL: Your Honor, may I have exhibits

2 marked?
3 THE COURT: Yes.
4 By Ms. Michael:
5 Q. Which page would you like to start with, Mr. Muchmore,
6 of Exhibit 2?
7 A. I think the page marked 3 of 4.
8 MS. MICHAEL: I think I need to hand a copy up to
9 the court. May I approach?
10 THE COURT: What is it?
11 MS. MICHAEL: This is Exhibits 2 and 3 to
12 Ms. Goodman's declaration, filed this morning.
13 THE COURT: I have it. Thank you.
14 By Ms. Michael:
15 Q. All right. Mr. Muchmore.
16 A. The page that I have shows 19 of 22 and Page 3 of 4.
17 Basically it shows a folder listing from a Hotmail
18 account. As I said, this isn't most likely a folder
19 listing of the account as it exists now, but a snapshot in
20 time of the moment it was viewed.
21 It shows the dates of August 2009, and then
22 August 25th, and yesterday, and then another day, which
23 suggests to me that it was probably viewed in August
24 of 2009.
25 So you can see here, if you go down about ten items, I

72
1 just picked a random item, there is one that says it was

2 from TicketMaster, and your ticket order, and gives a
3 ticket order. And then there are several orders before
4 and after that, other messages.
5 Now, two pages later, maybe three pages later, there
6 is a snapshot of this same Hotmail account, which I
7 understand was just taken a few days ago. And one of
8 those messages is highlighted. But what I noticed is
9 several of these other messages that were on the previous
10 page I showed you are also on this page. And that
11 basically means that they were not deleted.
12 What I was able to -- at least it appeared, it is not
13 a very rigorous analysis, but this seems to show that
14 there was an e-mail from TicketMaster that existed in that
15 e-mail box in August of 2009, that does not now.
16 Q. And this is in the B. Hansen e-mail account; is that
17 right?
18 A. Correct. So there is no reason -- I am not
19 suggesting that deletion is relevant to this case, but I
20 just think that is a good illustration of the way that we
21 can use this, that is, can be a way to find out if there
22 was an e-mail that someone forgot about or who knows what
23 that had been deleted from that account, is no longer
24 there. But it is important evidence that can be found
25 that indicates that file -- that message was there once.

73
1 So what happened is, since these temporary internet

2 files had been cleaned off of this machine, we lost
3 potentially a tremendous amount of information about which
4 items had been in that e-mail address and were no longer
5 there.
6 So the third point goes to kind of a description. You
7 have heard of descriptions of deleted files, wiped files,
8 free space and such. What I am trying to do here is just
9 give a little bit of information about what this all
10 means.
11 Basically what you are looking at is a simplified
12 version of a hard drive. It is just a platter, like an LP
13 or 45 record. And the information is actually on that
14 disk, and it has a hole in the middle. A hard drive could
15 hold billions, dozens of billions, and modern drives
16 trillions of pieces of information. That is too much even
17 for a modern computer to deal with individually. So the
18 information is gathered together into sectors and
19 clusters, which are units of data, in which a file might
20 be stored. So in this case, I think I have 32 different
21 sectors of data, and that is each of these items, each of
22 these little blocks.
23 So in this case, a Word document might be in this
24 block. The Word document itself might only occupy half of
25 it, and the rest of it is extra. Windows will still

74
1 allocate this whole block to the Word document so it

2 doesn't have to keep track of too much information.
3 So here the dark blocks indicate areas that have files
4 on it, the light blocks are empty or free space.
5 This black box, and I am simplifying a little bit, but
6 basically this one box is containing the information about
7 all the files stored on the computer. So this is our file
8 table. I am mimicking the "My Documents" folder that I
9 showed you a few slides ago. There was a hidden file
10 called "desktop" and then "Word document." This is
11 another Word document.
12 Basically what is contained here is the titles of the
13 documents that are on the machine. And that is where the
14 information about the create date and modified date is
15 stored. It also is pointing to the location on the drive
16 where the contents are stored.
17 This black box that I told you about that has this
18 listing, it doesn't have the contents of any Word
19 documents. It doesn't have the contents of any web caches
20 or the target or link files. All it does is tell that
21 information about where the computer can find it.
22 Just as I illustrate here, the contents of the Word
23 document are in that little yellow box.
24 So what happens when I deleted an item, it didn't
25 remove any of this information that we are looking at

75
1 right now. It just drew a little virtual line through

2 that listing, which told Windows that, first, that
3 document is now designated deleted, and, second, that
4 yellow spot which was dark and actually used is now a
5 light spot that is available for wiping.
6 So if I deleted my file, and then at the moment I
7 deleted it I yanked the power cord out and didn't do
8 anything else, that is probably fully recoverable. The
9 information about when it is created, when it is modified
10 and the title is probably recoverable, and the free space,
11 just because it hadn't had the opportunity to override it.
12 But then what starts to happen is, as you use your
13 computer, even if you don't create a document or save it,
14 Windows will start to create files in the background,
15 temporary internet files, shortcuts, log files, other
16 information. It is just going to pick a place to store
17 the file information. And the next one that is created
18 might overwrite. This is another Word document. Or it
19 might overwrite a different one. Likewise, it might
20 overwrite this area of the hard drive or it might
21 overwrite this area. There are no certainties about which
22 ones will be overwritten. There is just -- We know that
23 they will be overwritten, and the more you use the
24 computer, the more activity there is, the more this
25 information is going to be overwritten.

76
1 So what we were discussing in wiping free space is not

2 the same type of free space wiping or the same type of
3 wiping operation that was discussed by Mr. Kaser for
4 wiping those hard drives. So that is, if you want a hard
5 drive, and have absolutely nothing else, you need a
6 relatively unsophisticated program to just write zeros
7 over the whole hard drive.
8 As far as I can tell, what is a little more -- what is
9 a little more tricky for software is to have a program
10 that just overwrites the free space without overwriting
11 the other information.
12 When the free space option is checked, what the
13 CCleaner purports to do -- I have not tested -- I have
14 tested the operation of some cleaning software, but I did
15 not do this one. What it purports to do is actually go in
16 and just take the contents of all these files. So,
17 whereas, if the wipe free space had not been run, I would
18 definitely expect, after a bit of time, much of it, most
19 of it, some amount of it would have been overwritten. The
20 wipe free space just takes it a step further and says all
21 of it is going to be overwritten. At least that is how it
22 is designed to work.
23 Q. We will talk about the two purposes of CCleaner, the
24 regular options, and then the wipe free space very
25 shortly. What is next?

77
1 A. This section just goes more to what I found, both in

2 the way the CCleaner operates and what I found on the
3 computer. So basically it is software that can be easily
4 downloaded, displays these options and we will see how it
5 is used.
6 What I did was actually -- I actually downloaded it
7 onto this computer. I didn't download the newest version,
8 I downloaded what appeared to be the version that was on
9 the laptop at the time that it was turned over to Blank.
10 I actually ran some of the other versions just to test
11 it out, but this is version 2.33.1184. And when you first
12 run it, what it shows you is, as I mentioned before, the
13 information that it is proposing to clean. And these are
14 the Windows options. Some of these are checked.
15 And I believe the next slide shows some other
16 applications. It can remove information regarding
17 Microsoft Office, such as Word or Excel, and other
18 information from Yahoo, Adobe, etcetera.
19 Now, what has happened when we have installed this
20 software is -- I am showing you something that people
21 would normally never see when using their computer; and
22 that is the registry. And this is using the registry
23 editor, which is just a program that is built into
24 Windows.
25 And as I was saying, the registry is a database of

78
1 information just about the computer, the setup, the way

2 programs run and operate. Typically it doesn't store
3 content or data, but just information about the program.
4 And what happened on my computer is it created this
5 CCleaner section in software, which is generally -- that
6 section is reserved for -- not Windows to write to, but a
7 program to write to about itself.
8 Q. And that's how you could tell that CCleaner was used
9 on Ms. Lindell's computer; is that right?
10 A. That's how I could tell it was installed.
11 That was in the machine section, which is common to
12 all users.
13 And then in this section there is an area called H key
14 current user. The way that is designed, starting with
15 Windows XP, for different people to log onto a computer
16 using a different account. In this case I had User1 or
17 admin. But you can see different wallpaper, you can have
18 different Outlook e-mail, you can have different settings.
19 And that is -- You can also -- If you go to the "My
20 Documents" folder, you can see different documents. That
21 is accomplished by having these different user profiles.
22 The heart of this is having this section of the
23 registry that shows current user. Any settings here apply
24 to that user, but not the other users on the computer.
25 Q. Are you talking about the use of CCleaner only

79
1 applying to the user profile?

2 A. Well, I am mentioning that this folder for Piriform,
3 and the one under it for CCleaner, this is generated under
4 this user profile. The other user on this computer did
5 not contain any information. What we can use this for is
6 to tell some information about what user -- the person
7 that was logged into the computer, when they were running
8 the CCleaner software.
9 So in this case, before I had even run -- when I first
10 run it, before I had done anything with it, it shows me
11 the language I selected, the installation, which is 1033,
12 which is the Windows code for English. It shows this
13 update key information. In my testing I wasn't able to
14 see what that update key referred to, but when I installed
15 or used it under a profile for the first time, it did list
16 that update key with the date and time. So in this case I
17 was on March 19th at 2:46 p.m.
18 It also created -- This is where -- That was the
19 database of information about the software. It also
20 created a folder. It shows the date and time that folder
21 was created. It shows when the CCleaner folder and
22 program files were copied onto that machine.
23 MR. BLANKENSHIP: Your Honor, I can shortcut this
24 a little bit. We are not disputing that CCleaner was run
25 in the most basic form. All of this is stuff we have

80
1 stipulated to. What we are disputing is whether or not

2 the free space was wiped. None of this is disputed, what
3 is being said so far.
4 THE COURT: I think it goes beyond the free space
5 was wiped. We have got shortcuts, temporary internet
6 files. I am going to hear this, because it goes to the
7 very heart of the dispute.
8 MS. MICHAEL: Thank you, your Honor. It does.
9 Go ahead, Mr. Muchmore.
10 THE WITNESS: I will try to speed it up here. I
11 went back to CCleaner and clicked on the option for old
12 prefetched data. What happened is, at that time, under
13 the user profile for User1, it created that entry for old
14 prefetched data.
15 In several tests I ran what appeared to happen
16 is, under a particular user profile, when someone changed
17 one of those default options, either by turning one off or
18 turning one on, it created a registry key of that name,
19 and showed true if it was checked or false if it was not
20 checked.
21 By Ms. Michael:
22 Q. What is prefetch data?
23 A. Prefetch data is information about what programs have
24 been run on the computer and when. It contains
25 information about how often I run Paint versus Adobe

81
1 Acrobat versus Angry Birds or some other program. The

2 reason it is there, again, is not to help a forensic
3 examiner, but it can tell information about what and how a
4 computer was used.
5 So I went through and clicked on all of these advanced
6 options. And then what happened is it showed all of these
7 advanced options, and it showed that I checked them all as
8 true.
9 So in my test case I clicked on the run cleaner
10 button, and it popped up a warning to let me know this
11 will permanently delete files from your system. Again,
12 removing data from the system, as far as I can tell, is
13 what CCleaner does. That's all it does. It is just
14 giving you that warning. I clicked okay. It started to
15 give me a progress bar. And since in this case I had
16 selected wipe free space, it took a few minutes to wipe
17 the free space.
18 So when it was done, you can see that on this test
19 computer, it removed 451 temporary internet files, some
20 temporary files. I am not sure if there are any shortcut
21 files at this time. And that process, including wiping
22 this computer, took six minutes and 45 seconds.
23 So the time taken to wipe a computer, six minutes is
24 on the fast time. It can take hours to do. But there
25 have certainly been instances, say, for a case I remember

82
1 a couple of years ago, I was requested to wipe the free

2 space on eight different computers because people had
3 copied information they shouldn't have. And the time it
4 took to wipe these actual drives for these people ranged
5 from a few hours to, in a couple of the cases, less than
6 ten minutes, to actually wipe the free space. It just
7 depends on how much empty space -- It is not how big the
8 hard drive is, but how much empty space is on that
9 computer.
10 So I unchecked the option to wipe free space. I think
11 I have it slightly out of order here. But basically at
12 that point it changed the wipe free space to false. I can
13 tell at some point I clicked on that wipe free space
14 option because it appeared. The appearance of that entry
15 showed me it had once been clicked and then it had been
16 unclicked.
17 I am now looking at some of the same registry
18 information, not through the Windows program but through a
19 forensic software, the access data software. And the two
20 things that it does that the Windows software doesn't do
21 is allow me to view registry information from another
22 computer, but it also tells me this last written time.
23 This last written time for this CCleaner key in the
24 machine section seems to correspond with when CCleaner was
25 first installed. In this case, it was 21:45 Universal

83
1 Time.
2 One thing that bears keeping track of is, a lot of
3 these stamps are created with Universal Time, which is
4 seven hours ahead of Seattle in Daylight Savings Time, and
5 eight hours otherwise. So in this case it was seven hours
6 ahead.
7 Now, this portion of the computer registry is the
8 registry -- it shows it at a different name, but it is the
9 registry for the user in which I was logged in.
10 It shows that this key for the Piriform software -- it
11 again shows that essentially in my test, but usually
12 within a second or two of the other one, the other key for
13 the entire machine.
14 So now we are going back to looking at the final
15 version of my registry after doing the operations of which
16 I showed the screen save. Again, it shows this wipe free
17 space had been clicked on, and then I unclicked it. So
18 basically from all the tests I ran, it appears -- and this
19 is not inconsistent with other software I had seen, that
20 if no one ever clicked that option, that option just
21 doesn't appear. If someone clicked on it and then
22 unclicked it, it shows it as false.
23 Go back one. Lastly, is this -- This time, for the
24 CCleaner, seems to like -- I don't know that it pins it
25 down exactly, but it doesn't seem to correspond with the

84
1 installation of CCleaner, but seems to correspond with its

2 actual usage.
3 So this is the Lindell laptop. Again, this is showing
4 on the machine portion of the computer the CCleaner was
5 created. And this is showing at March 11th. And it is
6 showing 8:40 Universal Time, which would correspond to
7 12:40 Seattle time. I put a little footnote in my
8 declaration that these times -- saying this indicated to
9 me that this was done at 12:40 was resting on assumptions
10 that oftentimes I can verify, but I could not at this
11 time, that the forensic toolkit software that Blank used
12 was set certain ways, that the computer was set with the
13 correct time zone, et cetera. But that's what it seems to
14 be showing me.
15 So this is the administrator profile of the Lindell
16 laptop. And, again, the creation of this registry
17 information was -- on the administrator profile seems to
18 match up to the time that the CCleaner was first
19 installed. So from this information, it appeared to me
20 that the person who was installing the CCleaner software
21 was logged in as -- when they went to log into the
22 computer, were logged in as administrator.
23 And this is what I based my -- based the portion of my
24 declaration -- where I mentioned at that time on March
25 11th, someone had selected all of these advanced options,

85
1 and then unselected the wipe option.

2 Now, what I thought was interesting is that -- I don't
3 have a screenshot here, but there was information in the
4 program files that showed that the CCleaner was later
5 updated. But in the Llindell profile in August, this time
6 someone logging in -- these keys were first created on
7 August 21st by someone logging in as Llindell.
8 Q. So in March, somebody logged in as administrator and
9 ran CCleaner, and in August, somebody logged in as
10 Llindell and ran CCleaner?
11 A. That is what it appears to me. Go ahead. Do one
12 more.
13 The one item that I thought was very interesting is,
14 in all of my tests, the settings -- if you set up CCleaner
15 while logged in as one user, and then run it as another,
16 none of those settings as to which boxes were checked or
17 unchecked seemed to carry over from one user to another.
18 So the fact that these show the same options suggested
19 to me that, independently, when someone logged in as the
20 other account in August, they went through the same
21 routine of checking all the advanced options, and at some
22 point after that was checked, unchecking it again. So
23 basically twice the election was made to check that
24 option, and then to uncheck it again the next time.
25 Q. And so if there were more than one user on this

86
1 laptop, what is your understanding of what would happen if

2 logged in as Llindell when the boxes are checked? What
3 happens to the other user's information?
4 A. I will show you that in a moment. I think it is the
5 next slide. That was a question that came up. I went to
6 their website and looked at the CCleaner "frequently asked
7 questions." It showed -- it had the question, "Does it,"
8 being CCleaner, "clean all the user accounts on the
9 computer?" So the question being: If you are logged in
10 as administrator or M. Kaser, does it clean the
11 information from those subfolders for the other users? It
12 says, "At the moment CCleaner supports cleaning the
13 current user's account only." Basically what that is
14 telling me is that CCleaner doesn't clean the information
15 from the other account.
16 But I didn't trust it, so I ran a test. I logged into
17 my test computer as administrator, ran CCleaner, and see
18 that it cleaned 146 temporary internet files. So I went
19 to the temporary internet files for administrator, and I
20 found that the files that were there were in fact gone,
21 and what I had found before, that some of these files that
22 track information were created. But then I found under
23 that User1, the temporary internet files were still there.
24 So basically my takeaway from that is that in March,
25 when it was -- when the CCleaner was run under the

87
1 administrator profile, it would not have likely removed

2 the temporary internet files or the shortcuts for the
3 Lindell log-on or the Llindell log-on, but when that was
4 run in August, it most likely did.
5 Q. So if Ms. Lindell on March 11th or March 12th had
6 advised the court that CCleaner had been run on part of
7 the computer, and then thereafter not used the computer
8 any further, what is your expectation of what kind of
9 information we would have today?
10 A. My expectation is, just from what I have seen, is that
11 those temporary internet files, those shortcut files, that
12 information would have been, just under the normal usage
13 of the computer, as if the CCleaner essentially had not
14 been run, at least according to that log-on.
15 Let me just say, it appears that most of the activity
16 over the last two or three years had taken place under
17 that log-on of Llindell.
18 Q. Go ahead.
19 A. That was it.
20 Q. That's your last slide?
21 A. Yes.
22 Q. Do you have any information that indicates to you --
23 Whether or not the free space was wiped or not really
24 isn't the total battle here. Do you have information that
25 tells you whether it was or was not wiped?

88
1 A. From the information we have, it has been hard to see

2 whether it was wiped. In this case, unlike most of the
3 forensic examinations, we did not have access to the
4 actual computer itself. We received these file listings.
5 From the file listings that were received, there were not
6 a large number of data card files or there were not a
7 large number of deleted files, which would be atypical.
8 Now, it is unclear to me at this point whether we just
9 did not receive a complete listing from the Blank Law
10 Firm, or whether there weren't very many files. So
11 basically I tried not to use that information on making
12 this judgment. I put forth the information about the
13 options that were selected, what we were able to tell just
14 from the use of CCleaner, and made inferences from there
15 as to whether someone actually clicked on that wipe option
16 or not.
17 Q. Regardless of whether they wiped it, and we will talk
18 about what information you would need at this point to
19 determine if they actually did wipe the computer, what
20 information was deleted simply by the running of CCleaner
21 in both March and August?
22 A. Particularly after the August, but in the March,
23 again, the way -- from the slide that I showed you that
24 had the picture of the hard drive, as soon as a
25 computer -- as soon as a file is deleted, then that puts

89
1 it available for overwriting.

2 Basically, as I mentioned on the temporary internet
3 files, for example, what I will normally see when I look
4 at a machine are many files from the last few months, and
5 I will see some from older periods of time. I showed you
6 that little subfolder that contains files. Sometimes
7 Windows or Internet Explorer just seems to forget about
8 one of those and leaves it there. So two or three years
9 later I will look at the computer and there might be a
10 very complete record of the web browsing/surfing from two
11 or three years earlier, and it might be spotty from other
12 times.
13 So basically as soon as these files are deleted,
14 whether wiped or not, they put them available for free
15 space where the information about the timing of it can
16 start to be overwritten, the information about the
17 contents of it in free space is much more difficult to
18 access at best, but will start to be overwritten at worst.
19 If you delete a thousand files, and use the computer, and
20 come back three months later, some percentage of those
21 files are going to be irretrievably lost. It just varies
22 under the circumstance how many, but there would be some.
23 Q. And the use of CCleaner did what to that ability?
24 A. It would greatly accelerate, at the very least, the
25 rate at which this information would be lost. Again, had

90
1 CCleaner not been run, I would have expected to find

2 shortcut files going back for four or five years. I would
3 have expected to find these temporary internet files.
4 From what we found, there is very little information
5 there. My expectation is that was due to the effect of
6 CCleaner.
7 Q. I asked Mr. Yeh about the numbers after approximately
8 520,000 in the forensic toolkit ID that we were provided.
9 If they don't match the produced or the privilege log for
10 file listings, do you have any idea why that would be?
11 A. The only explanation I can think of -- the only one
12 from my experience is that once those numbers are created
13 in a case, they don't change. So all I could think of is
14 that case was rescanned, and that somehow the options or
15 the files that it found were different the second time it
16 was scanned from the first time it was scanned, so that
17 there might have been files on one listing that were not
18 on the other listing.
19 Q. There are documents in the production and privilege
20 log that do not appear on the file listings. Do you know
21 why that would be?
22 A. No. The only two explanations that I have been able
23 to think of are, one, the rerunning of the file listing
24 occurred after those files were given to the Blankenship
25 firm for review and did not appear, or that, second, we

91
1 did not get a complete file listing from the forensic

2 toolkit software.
3 Q. If we wanted to determine whether or not the computer
4 actually had the wiping feature activated and utilized,
5 what would you need to do that work?
6 A. It can be hard to determine. Sometimes by giving the
7 full image of the computer to analyze. Sometimes you can
8 just see absolute evidence that this must have been wiped.
9 But in most cases -- It is hard to prove what is not
10 there. Since the wiping removes information -- again, it
11 is not always impossible, but most times it is very
12 difficult to look at that -- to even look at the free
13 space, particularly if it has been used for several weeks
14 afterward, and make that determination.
15 So if you asked me, this computer, was this wiped
16 yesterday before it had been used much, then the answer is
17 probably yes. Whether you could determine whether it was
18 wiped after several more weeks of usage, maybe you could,
19 maybe you couldn't.
20 Q. And if somebody had activated the wipe button, and
21 then a few minutes later decided not to do that and hit
22 the don't activate the wipe button, what would happen?
23 Can you interrupt the wiping process, I guess?
24 A. I tested that out, and did. If I checked the wipe
25 free space, and hit the button to start cleaning the

92
1 computer, it gave that progress bar. In my case, it was

2 only six minutes. But I wasn't able to hit cancel on that
3 option, and then at that point about half of the
4 information in the free space presumably would have been
5 wiped. I was able to uncheck the wipe free space button,
6 run the CCleaner again, and it just removed the
7 information and left that computer half wiped.
8 Q. I've got this document with the small print. Can you
9 tell us, in general, what is this document, and is it
10 useful to you?
11 A. That was a spreadsheet that I created from the file
12 listing that included what seemed to be actual document
13 files, Word document spreadsheets, PDFs and the like, from
14 the user-created areas on the computer.
15 Most of those listings are documents that, if a person
16 turned on the computer and logged in as Llindell, they
17 would see.
18 Q. So these are still available on the computer, but
19 information CCleaner removed is no longer available for
20 review?
21 A. Right.
22 MS. MICHAEL: May I mark this, your Honor, and
23 pass it up to the court?
24 MR. BLANKENSHIP: I object to her passing
25 something up to the court that I can't --

93
1 MS. MICHAEL: I will make a copy.

2 THE COURT: Do you intend to question the witness
3 about it?
4 MS. MICHAEL: I was not going to ask --
5 THE COURT: Why don't we mark it as an exhibit?
6 MS. MICHAEL: I have a copy. Sorry.
7 By Ms. Michael:
8 Q. In browsing through that, did you find evidence that
9 there was a fair amount of work on the computer involving
10 the Lindell lawsuit?
11 A. From my basic understanding of the lawsuit, there did
12 seem to be some folders, such as a folder called
13 "mediation," and several folders underneath it that --
14 again, my understanding of the lawsuit is somewhat basic,
15 but did seem to be related to the legal work or related to
16 the underlying items that the case is about.
17 MS. MICHAEL: I will leave it for the court to
18 peruse to see how much of that does relate. Did I forget
19 anything, Mr. Muchmore?
20 THE WITNESS: Not that I can think of.
21 MS. MICHAEL: Thank you. No more questions.
22 THE COURT: Before you get started, let's take a
23 moment here. May I safely assume you are not going to
24 finish your cross-examination of this witness and put on
25 your expert by 4:30?

94
1 MR. BLANKENSHIP: That is probably safe. I am

2 feeling bad about Blake Weibling, who is sitting outside.
3 I wish we could get him on today before the day ends and
4 he has to miss work again.
5 THE COURT: I am sure you will be handsomely
6 compensating him.
7 MR. BLANKENSHIP: I don't know about
8 "handsomely."
9 THE COURT: Why don't you go ahead and step down
10 for a moment? Mr. Blankenship, why don't you have a seat.
11 We will do this informally. You can talk by sitting down.
12 We are not going to get through today. I think
13 that is obvious at this point. The next opportunity that
14 I have to see you is next Monday at 10:00, which is your
15 pretrial conference. I think you are slotted for an hour
16 for the pretrial conference.
17 Mr. Blankenship, do you know how many witnesses
18 you are going to call?
19 MR. BLANKENSHIP: I had planned on calling three
20 witnesses.
21 THE COURT: When in doubt, always ask the
22 parties. Mr. Blankenship, how would you like to proceed?
23 Do you think we can get Mr. Weibling through your direct
24 examination?
25 MR. BLANKENSHIP: Yes.

95
1 THE COURT: How long will that take?

2 MR. BLANKENSHIP: I don't think it will take --
3 With the court's guidance with respect to the declaration,
4 I can get him on and off pretty quickly.
5 THE COURT: I want to make sure everybody gets a
6 full opportunity. I have looked at the case law again,
7 and none of the options are attractive to the plaintiff's
8 case, and therefore I want to give you every opportunity
9 that you deserve in order to present your case fully. In
10 fairness to the City, I want to make sure they have their
11 opportunity to put on their case.
12 Ms. Michael, how many more witnesses do you have?
13 MS. MICHAEL: No more in our case-in-chief, your
14 Honor.
15 THE COURT: I suspect you would like to examine
16 Mr. Weibling, and you would like to examine Ms. Goodman?
17 MS. MICHAEL: Ms. Lindell and their expert, yes.
18 THE COURT: I don't think we can have
19 Mr. Weibling finished today. I would rather hear him as a
20 block. Why don't we have you start with Mr. Muchmore, and
21 we will go until about 4:15 and adjourn for the day? On
22 Monday we will resume with your examination of
23 Mr. Muchmore, and then go into your case.
24 I am not inclined to try to express any views,
25 because, as I tell all juries, you need to keep an open

96
1 mind until you have heard all of the evidence. It is very

2 important to me that we get this right. If that means
3 vacating your trial date -- I am not going to rush this
4 in order to try and shoehorn you in. I have an extended
5 cocaine importation case starting mid-April. I have two
6 trailing cases that were set for that. Things move
7 around. It is my intention to take you as quickly as we
8 can, as opposed to dropping you to the bottom of the
9 calendar.
10 I am hopeful that we are not looking at a lot of
11 out-of-town witnesses who are going to have availability
12 problems, since these are all local folks. Is that a
13 fairly accurate assumption?
14 MR. BLANKENSHIP: Your Honor, it is. There are
15 people, though, that are having difficulties with
16 April 4th. Like Marcella Reed, for example, I would have
17 to take her very quickly, because she was heading out on
18 the 6th. Bob Sterbank is in Hawaii. He is not available
19 until the 13th. It is spring break, so a lot of people
20 are taking off with their families. That is the extent of
21 the out of state, but that is the kind of issue we have
22 been struggling with with witnesses.
23 THE COURT: Ms. Michael, what is it like in your
24 case?
25 MS. MICHAEL: We can have our witnesses

97
1 available, your Honor.

2 THE COURT: Right now I think your trial date is
3 in real peril. I won't commit to that, but tell
4 Mr. Sterbank to buy another swimsuit.
5 We have your motions for summary judgment, we
6 have your motions in limine. I am not going to have you
7 start the trial until you have answers to those, because
8 you can't. I can't rule on those until I know the answer
9 to this. This string of dominoes is getting ready to fall
10 over.
11 The criminal matter started off at five days, it
12 expanded to ten days, it expanded to twelve days, it
13 expanded to 15 days, and then it shrank to twelve days.
14 The last time they were in here, which was this morning at
15 11:00, it sounded more like eight days. That will put you
16 in early May, which will, I guess, get us out of spring
17 break. I am sure someone is going to say, I have a trial
18 in King County Superior Court, as another reason why we
19 can't go then.
20 No, we are not going to finish today. We are
21 going to start again on Monday at 10:00.
22 Mr. Muchmore, you can retake the stand. We are
23 going to get in 15 minutes of questioning, and I am going
24 to take a hard break at 4:20.

98
2 Q. Mr. Muchmore, hi.
3 A. Hello.
4 Q. Have you ever been in a situation like Blank Law,
5 where you basically were doing a forensic exam of a
6 computer, and the computer was the computer of someone
7 like Ms. Lindell, and you were dealing with their lawyers
8 to figure out which documents were privileged and work
9 product?
10 A. I believe so. I have been in a situation where I ran
11 searches, turned it over to one party for privilege
12 review, and then turned it over to another party, yes.
13 Q. It is pretty standard that that happens, even when you
14 are being hired and paid for by the other side, right?
15 A. These circumstances have not been standard in my
16 personal experience. Usually it has not been a neutral
17 third party. Usually I have been able to have access to
18 the computer, even if I am forwarding it to counsel for
19 privilege review.
20 Q. But it isn't uncommon, in fact it is quite typical,
21 that the person whose laptop is being examined, counsel
22 gets to assist with culling out privileged work product,
23 isn't it?
24 A. To conduct a privilege review?
25 Q. Yes.

99
1 A. In some cases, yes. That has not been in every case I

2 have been in, or even most.
3 Q. About how many times have you done like a forensic
4 examination of a computer, where you went in and carved
5 out drive free space?
6 A. I would say I have done dozens of computers.
7 Q. Ms. Goodman found in the drive free space a document
8 that was created in 2009. You saw that, right?
9 A. I did.
10 Q. And if there had been a wipe of the free space, you
11 wouldn't be able to recover documents from 2009 from the
12 free space, would you? If they were in March, as they
13 alleged occurred, and August of 2010 (sic), you wouldn't
14 be able to go into the free space in 2009 and find
15 documents like the exhibit that she attached to her
16 declaration, would you?
17 A. Do you mean you go into the free space in 2011?
18 Q. Yes.
19 A. And find documents that had been created in 2009?
20 Q. Right.
21 A. Yes, I would expect that you could.
22 Q. Even if it is wiped?
23 A. Absolutely.
24 Q. What is your basis for that?
25 A. It is only wiping the free space. The time the

100
1 document is created is irrelevant to whether it would have

2 been wiped in free space. The time it was deleted is the
3 most important information in that case.
4 Q. The time that it was deleted. In this case, though,
5 did you find that document in your review?
6 A. I found the document in the files that were produced
7 by Blank, yes.
8 Q. And those files -- those documents -- those free space
9 documents were produced January 20th, weren't they, the
10 first batch?
11 A. Correct. No. I think we got those February 20th.
12 Maybe they were January. But, yeah.
13 Q. If you need to check, that's what I have noticed, that
14 they were --
15 A. The first CD batch, yes.
16 THE COURT: Mr. Blankenship you have used the
17 term "free space documents." I want to make sure everyone
18 has a common definition, including me.
20 Q. The drive free space is where all data goes, even if
21 it is deleted, correct?
22 A. From my little diagram -- free space is items that
23 includes parts of the drive where no data has ever been
24 stored or parts of the drive that a file was stored and
25 then that file had been deleted. That's the free space,

101
1 yes.
2 Q. If CCleaner was ran in March and in August, wouldn't
3 the document that was the exhibit have been -- if it had
4 been a temporary internet file, wouldn't it have been
5 deleted when CCleaner was ran, even without checking the
6 box for the drive free space?
7 A. Not necessarily in both cases. That's the point that
8 I was making about the temporary internet files only in
9 the profile in which the CCleaner was run. So if most of
10 this surfing, to use it colloquially, web browsing took
11 place under the Lindell profile, for example, and the
12 CCleaner was run under administrator, then at that time it
13 would not have deleted the temporary internet files from
14 the Lindell profile.
15 So, say, in March it was run and wiped the free space
16 at that time -- This would be one scenario. I can think
17 of several others in which that document would not have
18 been deleted in March. But the free space could have been
19 wiped in March. But since that document had not yet been
20 deleted until August, the wipe of free space would not
21 have removed that document. That's one scenario.
22 Q. Do you know whether or not there were separate
23 profiles on the computer that were set up by the Lindells?
24 A. Yes. That was my testimony in my PowerPoint slides.
25 There were several profiles set up. There were profiles

102
1 for administrator, M. Kaser, others that were used before.

2 It appeared to me Ms. Lindell had been using the computer.
3 So it appeared to me that the Llindell profile had been
4 the one that had been used for most activity since she
5 received the computer, but in March, the CCleaner was run
6 against the administrator profile.
7 So, say, at that time the option to remove temporary
8 internet files and wiped free space was selected, in that
9 case it would have only removed temporary internet files
10 from the administrator account, thus leaving the one that
11 you found, wiped anything else that had been deleted at
12 that time. And then, say, in August, when it was run
13 under the Llindell account, then only at that time, in my
14 hypothetical, after the free space had been wiped, that
15 that particular file was deleted. Again, in that scenario
16 the file would not have been deleted, and thus that would
17 not have been free space when the computer was wiped in
18 March.
19 Q. But it was wiped twice according to you. Not wiped.
20 Let me back up. I will not concede that.
21 MS. MICHAEL: Objection, your Honor. Misstates
22 his testimony.
24 Q. Isn't it true, according to your review, you believe
25 that CCleaner was ran on two different occasions? Right?

103
1 A. CCleaner was run on two different occasions, yes.

2 Q. Wouldn't that have been wiped -- Considering that was
3 the free space, and it was created in 2009, wouldn't the
4 wipe in August have wiped a document that was created in
5 2009?
6 A. Again, that is not what determines what is wiped. It
7 is not when the document is created that is important, it
8 is when it has been deleted that is important.
9 Q. But if I understand -- I mean, I will have to talk to
10 my expert about that. But my understanding -- You are a
11 little bit over my head here. But with respect -- You
12 are saying that even though something was in free space,
13 that was created in 2009, and even though you are
14 testifying it may have been wiped twice, that wouldn't be
15 dispositive of -- a preexisting document wouldn't be
16 dispositive of there being no wipe, as Ms. Goodman
17 declared under oath?
18 A. No. I think she overlooked a number of different
19 scenarios.
20 Q. Like what?
21 A. The first scenario is the one that I mentioned, say,
22 the free space was wiped the first time CCleaner was run,
23 but say the second time the removal of the shortcut files
24 and temporary internet files took place but it was not
25 wiped. A second scenario that seems possible is that the

104
1 wipe might have been started, but then interrupted at some

2 point during its operation.
3 Looking at the information from the declaration of the
4 person at PC Doctor, that sort of seems to reinforce that
5 scenario in my mind. He mentioned that he typically does
6 not wipe the information. It wasn't clear to me exactly
7 why he would not once, but twice, click on the option and
8 then unclick on the option. But say he went through and
9 clicked on all those options, including wipe free space,
10 clicked on the run cleaner button, and then turned and
11 looked at something else and expected after one minute all
12 the CCleaner would have been completed. Say at that point
13 he realized that he had selected the option, and then
14 failed to unselect the option, and then hit the cancel
15 button, that is one scenario in which, even after a few
16 minutes, thousands of documents would have been wiped, but
17 not necessarily every document on the machine. That is
18 the second scenario that occurred to me.
19 THE COURT: All right. We are going to take a
20 break at this time, because I have a couple of questions.
21 When we resume, you are going to resume your examination
22 having had the opportunity to talk to your expert, which
23 probably makes better sense than us lawyers.
24 Is it going to be easier to determine the impact
25 of the CCleaner program if you are looking at the mirrored

105
1 hard drive that exists in this case or looking at the

2 three CDs?
3 THE WITNESS: I think it would definitely be
4 easier. Whether that makes it easy is hard to say. I
5 think, again, in most instances in which I suspect a
6 computer had been wiped, and then it had been continued to
7 be used for several weeks or months, you can't necessarily
8 tell anything for sure. But I think it is certainly
9 possible, by looking at the complete image of it, I could
10 make a determination. It would definitely give both
11 myself or Ms. Goodman more information to work from.
12 There would be fewer hypotheticals, fewer possibilities.
13 THE COURT: If I asked you and Ms. Goodman the
14 question of are there people in Seattle who are
15 technically competent to do that, how would you answer
16 that?
17 THE WITNESS: Technically competent to make a
18 determination about wiping?
19 THE COURT: Yes.
20 THE WITNESS: I think the wiping question can
21 be -- I think the answer is yes. I think the wiping
22 question can be much more of a -- By looking at the free
23 space itself -- It can be hard to have an objective
24 question that has an objective answer. It would be based
25 to a certain extent on hunches or what the person had seen

106
1 before.
2 THE COURT: Let me ask you in a different way.
3 Who is your competition?
4 THE WITNESS: In the --
5 THE COURT: In Seattle. Are there other people
6 that do this besides the two of you?
7 THE WITNESS: Yes.
8 THE COURT: How long would it take?
9 THE WITNESS: I would think that several days
10 would be enough time. Probably less than that.
11 THE COURT: Counsel, we will be in recess in this
12 particular matter until 10:00 a.m. on Monday the 28th. At
13 that time Mr. Blankenship will resume his
14 cross-examination, having had ample time to get ready,
15 which hopefully means that we will be going faster.
16 Counsel, anything further the court can do today
17 to be of assistance?
18 MR. BLANKENSHIP: I guess, your Honor, it would
19 be helpful to know -- Are you saying you don't think it
20 is likely we will go forward on April 4th? Should I be
21 preparing witnesses all next week? Since we go first, it
22 is important to know the answer to that question.
23 THE COURT: Sitting here today, I will tell you
24 that if I am where I am right now, you are not going to
25 have a trial because I think there is a prima facie case

107
1 put forward that something happened to the computer. I

2 don't think you are denying the fact that something
3 happened to the computer. I am not comfortable that I
4 understand what it is. I can't rule on the motions and I
5 can't have the trial until I am comfortable with what
6 happened.
7 The last two questions I asked the witness may
8 suggest one alternative that I am considering, which is to
9 find someone who can have access to the mirrored hard
10 drive and conduct an independent examination on behalf of
11 the court. As Mr. Muchmore just said, that may just give
12 me one more opinion as opposed to an answer. But that
13 would be helpful. The answer is, I don't think you are
14 going.
15 MR. BLANKENSHIP: We have a pretrial lodging date
16 of Wednesday. We all spoke about moving that until
17 Friday, just because --
18 THE COURT: Why don't you not do anything on it.
19 I am going to relieve you of that obligation at this time.
20 You can't do a pretrial order until I rule on these
21 motions. And you can't -- We are back to the same loop,
22 I can't rule on these motions until I have an answer to
23 this question.
24 Counsel, out of fairness, I am not blaming anyone
25 for putting us in this situation. I understand, not

108
1 withstanding protestations in the briefing, this stuff got

2 delivered late. It appears that everyone was diligent in
3 both attacking the problem and responding to the attack
4 since that time. It is just that we have a limited number
5 of hours between when this all started and the very
6 important upcoming dates, including the pretrial
7 conference. We will be in recess. Thank you, counsel.
8 (Adjourned)
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25

109
1 CERTIFICATE
8
I, Barry L. Fanning, Official Court Reporter, do hereby
9 certify that the foregoing transcript is true and correct.
10
11 S/Barry L. Fanning
12 ____________________________
Barry L. Fanning
13
14
15
16
17
18
19
20
21
22
23
24
25

03.21.11 Hearing Transcript

Uploaded by

Document Information

Original Description:

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

03.21.11 Hearing Transcript

Uploaded by

Copyright:

Available Formats

1

14 BEFORE THE HONORABLE JAMES L. ROBART

16 March 21, 2011

Barry L. Fanning, RMR, CRR - Official Court Reporter

16 EXHIBITS ADMITTED PAGE

1 THE COURT: The clerk will call this matter.

Barry L. Fanning, RMR, CRR - Official Court Reporter

1 Ms. Youssef, Ms. Lindell and Mr. Goldsworthy. I may have

Barry L. Fanning, RMR, CRR - Official Court Reporter

1 inflammatory, conclusory, pure fiction, bad faith. We

Barry L. Fanning, RMR, CRR - Official Court Reporter

1 get to listen to our expert witness and tailor testimony

Barry L. Fanning, RMR, CRR - Official Court Reporter

Barry L. Fanning, RMR, CRR - Official Court Reporter

1 of the laptop at the hearing. It seems like that is

Barry L. Fanning, RMR, CRR - Official Court Reporter

1 witness sworn in.

Barry L. Fanning, RMR, CRR - Official Court Reporter

Barry L. Fanning, RMR, CRR - Official Court Reporter

1 desktop when you accessed it, and, if so, what kind of

Barry L. Fanning, RMR, CRR - Official Court Reporter

Barry L. Fanning, RMR, CRR - Official Court Reporter

1 assistant attorney to City Attorney, didn't you?

Barry L. Fanning, RMR, CRR - Official Court Reporter

Barry L. Fanning, RMR, CRR - Official Court Reporter

1 computer that they used after their employment ended,

Barry L. Fanning, RMR, CRR - Official Court Reporter

Barry L. Fanning, RMR, CRR - Official Court Reporter

Barry L. Fanning, RMR, CRR - Official Court Reporter

1 occasions where users will have a bug or a virus or some

Barry L. Fanning, RMR, CRR - Official Court Reporter

1 else's hands. We don't do anything that exciting at the

Barry L. Fanning, RMR, CRR - Official Court Reporter

1 are used to either wipe a computer or clear a cache or how

Barry L. Fanning, RMR, CRR - Official Court Reporter

1 A. About seven years now.

Barry L. Fanning, RMR, CRR - Official Court Reporter

1 A. Essentially it writes zero to every sector on the hard

Barry L. Fanning, RMR, CRR - Official Court Reporter

1 Q. Did you ever work with her and the laptop?

Barry L. Fanning, RMR, CRR - Official Court Reporter

1 don't remote control their desktops. It is people who

Barry L. Fanning, RMR, CRR - Official Court Reporter

1 our network anyway, meaning it is joined to our domain and

Barry L. Fanning, RMR, CRR - Official Court Reporter

1 practice of recycling the computers.

Barry L. Fanning, RMR, CRR - Official Court Reporter

1 MR. BLANKENSHIP: If those are the documents,

Barry L. Fanning, RMR, CRR - Official Court Reporter

1 will perform some of the functions.

Barry L. Fanning, RMR, CRR - Official Court Reporter

1 That is not part of Exhibit A-2 because that is not part

Barry L. Fanning, RMR, CRR - Official Court Reporter

Barry L. Fanning, RMR, CRR - Official Court Reporter

Barry L. Fanning, RMR, CRR - Official Court Reporter

1 please, an e-mail dated November 9th? And it indicates

Barry L. Fanning, RMR, CRR - Official Court Reporter

1 Q. Produce, nonresponsive, responsive or a privilege log

Barry L. Fanning, RMR, CRR - Official Court Reporter

1 A. No, he is another attorney in the firm.

Barry L. Fanning, RMR, CRR - Official Court Reporter

1 review process we previously engaged in."

Barry L. Fanning, RMR, CRR - Official Court Reporter