June 6th Hearing

[RickyJim]

Kruidbos must have something really bad to say about the prosecution for Bernie to try so hard to undermine K's lawyer.

[RickyJim]

GPS, GPS.  Maybe we will finally learn something about what happened to it.

[cboldt]

Kruidbos sworn in.  The state has a copy of Cellebrite.  Cellebrite is used to extract information from cell phones.  He doesn't know when the state obtained the Cellebrite material.  Kruidbos printed a report for FDLE in late 2012 of early 2013.  The software/hardware system costs about $8,000.  A report from a phone runs about 900 pages.  These 900 pages are human readable materials.  Photos, texts, location data, browser history in part.

O'Mara brings up the existence of GPS information depending on the phone.  Kruidbos confirms, and that the phone may record information about which cell towers are being hit.  Kruidbos says that GPS on a phone is triggered on an "as demanded" basis, and it is not unusual for a GPS-equipped phone to have gaps of days in GPS data.

[RickyJim]

I have never heard of an UFD file.  Is that a Cellebrite file format?

[cboldt]

Kruidbos told O'Steen that he (Kruidbos) was concerned the report was incomplete, and he (Kruidbos) sought the source file BIN file.  Kruidbos refers to it as a UFD file.  Kruidbos says it requires software to read the BIN/UFD file.  Kruidbos hasn't opened such a file - O'Mara is trying to get entered into evidence that the BIN/UFD file is not human readable.

Original report from FDLE was incomplete, in Kruidbos' preliminary opinion.  He expressed this concern to O'Steen.  O'Steen said "let's call Bernie."  This in late 2012 or early 2013 period.  IIRC this sort of lines up with the state sending the phone to California.  Bernie's suggestion was "Call FDLE and request the BIN/UFD file."  Kruidbos got the source file shortly thereafter.  UFD file was 2.3 Gb in size.  The entire folder that FDLE had provided earlier as 100Mb, 1/23rd the size of the source file that Kruidbos now had in hand.

Analysis required use of two plug-ins (software) and FDLE guided Kruidbos in this matter.  All of the information is now available - early January 2013.  Folder of extracted materials was 3.5Gb, vs. initial report of 100Mb.  Reviewed info with O'Steen, told him how to distinguish deleted files and "export to Excel" function to catalog text messages.  Sounds like Kruidbos tried to organize all this material for convenient review.

[cboldt]

I have never heard of an UFD file.  Is that a Cellebrite file format?

It'd be a phone file.  Cellebrite is used to analyze files that are in the UFD format.

[RickyJim]

I wonder just when does the phone decide it needs GPS info.  Would a phone hidden in a pocket be able to get that info?

[cboldt]

I wonder just when does the phone decide it needs GPS info.  Would a phone hidden in a pocket be able to get that info?

The user decides, sort of.  If GPS is enabled for photo tagging, then when you take a photo, the phone will do GPS.  Likely similar if you use the phone/broswer to look for nearby restaurant.  There may be other user activities that benefot from GPS.  A phone in a pocket will get the GPS signal.

[RickyJim]

I get the sinking feeling - there is no useful GPS on either Zimmerman's of Martin's phone.

[cboldt]

While answering RJ, I missed remarking that the phone contained picture of naked underage girls.  This sets aside the issue the photo of Martin in some public place with one (short) girl.

Kruidbos gave Bernardo the 900 page report with a thumb drive of all the reports (3.5 Gb, plus 100 Mb original, etc.), and Bernardo said that the plan was to have FDLE run the report again so that Kruidbos would not have to testify about having this information.  Bernardo was scheming then, to put the onus on FDLE for any shortcoming in forensic analysis, even though SAO had done a better forensic analysis.  I'm thinking this all went down in January.

O'Steen called Kruidbos back to the office with O'Steen, Bernardo, and prosecutor Guy.  All were present as Kruidbos described what he had extracted from the BIN/UFD file.  Kruidbos asked what would be happening.  Bernardo said that SAO could send the source file to defense.  Bernardo asked how much is the Cellebrite, Kruidbos told him $8,000.  "Did Brenardo say anything about the defense can buy their own copy of Cellebrite?" (my paraphrase of question).  Kruidbos does not recall.  Yet another conversation, location services portion of report.  Bernardo was there, maybe O'Steen.  There is an Excel spreadsheet that has holes in the GPS locator activity.  I'm thinking this went down in late January, Maybe February.  All of the analytical activity, copies, meetings, etc. appear to me to have taken place over a few weeks time.

Rich Commando (Edit to add: this is Kruidbos direct supervisor) was told that Kruidbos thought the report (to defense) was incomplete.  Kruidbos was told "good find."  Commando is no longer with SAO.  Is Kruidbos aware of FDLE activity making a new report from the BIN/UFD file.  May 24 meeting with Bernardo.  Asks if FDLE had redone the report from the bigger source file, and Bernardo says "yes."

[cboldt]

Kruidbos notices that what was submitted to defense was missing some text messages.

I think (but wasn't paying attention) that FDLE report of around May was the incomplete version provided to defense.

O'Mara asks why Kruidbos is coming forward.  Kruidbos said he had concerns that the information was not provided.  Bernardo said that FDLE was going to provide a report, and that SAO was going to turn over the source file.  Kruidbos was concerned.  He was not concerned that he would personally be held to account in court (my paraphrase), but might be in trouble if it was ever discovered that the state filed to turnover evidence (good sense - sh*t rolls downhill).

Why did Kruidbos pick White?  Good lawyer.  Any concern that White had an axe to grind? No.  Did you even know if White had an axe to grind?  I suspected he did, based on his departure e-mail.  Did that play into your decision to go to White as opposed to anybody else?  No.  Good questions, great to get this out on direct exam.

Do you, Kruidbos have an axe to grind?  Were you going to be fired?  I had no knowledge of that.  O'Mara says, "I mean, before all this?"  Kruidbos can't identify any unspoken reason to bring this to White's attention?

Kruidbos didn't know if O'Mara had the information until after White contacted O'Mara.

What concerns does Kruidbos have now?  That he'll lose his job.  Was it worth it?  Yes.  All of the information being shared is important to the process of fair trial.

[cboldt]

Bernardo cross exam.  All of the data was turned over to defense?  Kruidbos says he doesn't know.  Bernardo says you were concerned that not all of the data had been turned over.  Kruidbos says he didn't know for sure.

Bernardo says that source file contains everything.  Reports can be generated from the source file.  Kruidbos has no evidence as to whether or not the source file was turned over.

Bernardo says that Kruidbos did not tell Guy, or Bernardo, or Corey.  So, how would O'Mara know this in a deposition of a witness in April 25?  Kruidbos was not aware that a witness was questioned in April re: texts of purchase of a gun.

White objects - argumentative and repetitious.  Nelson calms Bernardo down.  Bernardo says Corey has an open door policy.  Kruidbos says he was not comfortable using that open door.  White objects again, as Bernardo misstates the witness's testimony.  Nelson gets testy with White.  Wants objections in the proper form.

Bernardo says that he told Kruidbos that FDLE / Brenton would analyze the BIN file and forward a report to defense.  Bernardo asks Kruidbos has even said he was going to hide the evidence.  Kruidbos says you said two different things, and he (Kruidbos) wasn't sure what had happened.

None of this passing the evidence around helps the state.  The state is one entity, and any internal issues of communications and competence, etc. do not provide reason for failure to produce evidence.  Anyway, Bernardo is trying to make this "not Kruidbos territory" because Kruidbos is not an expert.

[cboldt]

Kruidbos is doing well.  Bernardo's excitement and accusations aren't fazing Kruidbos at all.

Were you aware that defense had their own IT person? Yes.  Do you have a clue what they were doing, had done?  Nope.

Bernardo wants to know if there is any accusation that Bernado requested any deletions.  Kruidbos says that no such request came from Bernardo.  "Dleted" is just a characterization of the material in the UFD file.  Kruidbos says he never accused Bernardo to do anything wrong.  Did you ever meeting With O'Mara?  Yes, by phone, a few days ago, to describe how the software would work?  Bernardo asks did you ever contact us before contacting O'Mara?  No.  White objects as the question being argumentative.  Nelson overruled.  O'Mara objects as to relevance.  Nelson overrules this too, I think.  Call was yesterday or day before.  Bernardo inquires how the call came to occur.  White called Kruidbos.  Kruidbos did not initiate contact with O'Mara.  Kruidbos never questioned the propriety of this call.  Bernardo again wonders why Kruidbos didn't attempt to discuss this with SAO.

Kruidbos did not transfer any data or files to Kruidbos.

I think Bernardo's argument is that O'Mara was able to extract the information from the BIN file, therefore turnover of the BIN file represents a complete turnover.

After all that, Bernardo asks why would Kruidbos have any concern about being fired.  He hasn't done anything wrong.

[RickyJim]

I suppose Bernie does have a legitimate point of how could O'Mara know things in April if he only had the binary file with that info.  When did O'Mara get the bin file?

[cboldt]

Bernardo tries to make it that Kruidbos doesn't get along with his boss.  Kruidbos says he and his boss have a very cordial working relationship.

Bernardo says that Kruidbos access to drives had been curtailed; that his authority as to purchasing had been curtailed; he had 10 people reporting to him, reduced to 2.  Work hours changes - no short lunch to get out early.  Had to produce a job description, list of projects, had to document when computer equipment was mover or reassigned (that was already done) ... Bernardo is trying to paint Kruidbos as disgruntled.

Kruidbos was questioned on leakage of personal information relating to a health matter of a state employee.  Bernardo asks if Kruidbos was happy or unhappy about that discussion.  Kruidbos doesn't understand.  Next question is whether Bernardo treated him fairly - yes.  What about Ms. Peach (some other player)?  No, she was accusatory.  Stupid question, were you happy about being accused?  White raises a relevance objection, overruled by Nelson.  Materiality?  Same, Bernardo can continue.

Bernardo attempts to connect the accusation about a health leak to Kruidbos informing White of a concern about possible withholding of evidence from Zimmerman.

Bernardo asks if Kruidbos is aware that defense was invited to go to Cellebrite in NJ?  No.  Lots of repetitive questions.  Bernardo chronically cuts off the witness answer.