Officer X17, BPD - Deposition Transcript (Federal) - Redacted

Scott Matsudaira, March 13, 2014Paul Murphy v. Whatcom County

3206 Wetmore, Suite 12, Everett, WA 98201BMA Court Reporters 425-252-7277

UNITED STATES OF DISTRICT COURT

WESTERN DISTRICT OF WASHINGTON AT SEATTLE

---------------------------------------------------------------

PAUL MURPHY, together with his ) marital community, ) Plaintiffs, ) ) vs. ) NO. 2:13-CV-00727 ) WHATCOM COUNTY, WASHINGTON, a ) government entity; WHATCOM COUNTY ) SHERIFF'S DEPARTMENT; WILLIAM J. ) ELFO, together with his marital ) community, ) Defendants. ) ---------------------------------------------------------------

DEPOSITION UPON ORAL EXAMINATION OF SCOTT MATSUDAIRA

---------------------------------------------------------------

2:00PM - 2:25PM March 13TH, 2014 Whatcom County Courthouse 311 Grand Avenue Bellingham, Washington 98225

Reported by Kristen M. Uhlig Certified Court Reporter, CCR, CSR Washington CCR #1934

Paul

Highlight

Paul

Highlight



1 A P P E A R A N C E S

2

3 FOR THE PLAINTIFFS:Emily Beschen

4 Law Offices of Robert Butler103 East Holly Street Suite 512

5 Bellingham, Washington 98225360.734.3448

6

7 FOR THE DEFENDANTS WHATCOM COUNTY & SHERIFF'S DEPARTMENT & ELFODale Kamerrer

8 Law Lyman Daniel Kamerrer Bogdanovich2674 RW Johnson Blvd SW

9 Tumwater, Washington 98512360.754.3480

10

11 FOR WHATCOM COUNTY:Elizabeth Gallery

12 Whatcom County Prosecutor's Office311 Grand Avenue

13 Bellingham, Washington 98225

14ALSO PRESENT:

15 William ElfoTara Adrian-Stavik

16

17 I N D E X

18 EXAMINATION: PAGE

19 BY MS. BESCHEN...............................................3

20

21

22 EXHIBIT DESCRIPTION PAGE

23 59....Whatcom County Sheriff's Computer Analysis Report......16

24 60....Bellingham Police Department, Matsudaira File..........18

25

Paul

Highlight

Paul

Highlight



1 SCOTT MATSUDAIRA,

2 having been first duly sworn, was called as a witness herein and

3 was examined and testified as follows:

4

5 DIRECT EXAMINATION

6

7 BY MS. BESCHEN:

8 Q Can you state and spell your name for the record?

9 A Scott Matsudaira. My last name is spelled M-A-T-S-U-D-A-I-R-A.

10 Q And are you aware that you have been listed as a witness by the

11 County in a civil lawsuit brought by Paul Murphy?

12 A Yes.

13 Q Okay. Do you know why you were listed as a witness?

14 A Because I assisted with computer forensics work for Deputy --

15 I'm sorry.

16 Q Cooley?

17 A Cooley. Brain fart. My bad.

18 Q In what way did you assist Deputy Cooley?

19 A He contacted our department, our evidence and identification

20 supervisor, Les Gitts, and asked if the Bellingham Police

21 Department would be able to assist with computer forensics

22 work, looking at or securing a copy of a hard drive.

23 Q Okay. And did you secure a copy of a hard drive?

24 A Yes, I did.

25 Q Just one hard drive or multiple hard drives?

Paul

Highlight

Paul

Highlight

Paul

Highlight

Paul

Highlight



1 A Well, I made one copy of one hard drive.

2 Q What did -- well, did you communicate directly with Cooley or

3 did Cooley communicate directly with Gitts and then Gitts

4 communicated with you?

5 A It was a little bit of both. The first contact was through

6 Detective Rossmiller straight to supervisor Gitts.

7 Q Okay.

8 A And then Gitts contacted me about the work that was requested

9 and then from that point, Cooley was the one that contacted me.

10 Q Okay. How many times have you had contact with Cooley,

11 roughly?

12 A Cooley and I -- just phone calls, 20 second phone calls, kind

13 of thing?

14 Q About the case, yeah.

15 A Oh, four or maybe five.

16 Q What was the initial -- was the initial request of you, just to

17 make a copy of this hard drive or was there more requested of

18 you?

19 A The initial request was to make a copy of the hard drive.

20 Q Were there follow-up requests after that?

21 A Yes.

22 Q What were the follow-up requests?

23 A To look for encrypted files on the hard drive and to see if I

24 can get past the encryption to see what the files were.

25 Q Any other requests that were made of you?

Paul

Highlight



1 A No.

2 Q Okay. Did they ask you to look at other contents of what was

3 present on the hard drive?

4 A Yeah. Cooley and I spoke on the phone a lot of times and

5 mostly it was him asking questions or -- while I was looking at

6 the computer. It wasn't a formal, can you do this and look at

7 this, and then me do an examination on it. It was, what was

8 this, and I could quickly do a preview and say, this is kind of

9 what I found. It wasn't a structured full forensic exam, if

10 that's...

11 Q Yeah. That makes sense.

12 A Okay.

13 Q What questions did he ask of you?

14 A Well, one was about the encrypted files.

15 Q Mm-hm.

16 A One was about the, I believe, the internet history. Those are

17 the only two specific things that I can remember.

18 Q Related to the internet history, do you -- what specifically

19 did he want to know about the internet history?

20 A I can't remember. I think that it had something to do with

21 where he's been or what he's been doing on the internet. I

22 don't know if there was a specific -- I don't remember there

23 being a specific point or target to what he was asking for.

24 Q Okay. Do you remember if he mentioned Facebook at all?

25 A No. I remember that I found parts that he had gone to

Paul

Highlight



1 Facebook.

2 Q Okay.

3 A When I started this examination, it was -- it was -- how would

4 you say it -- I didn't know what I was looking for kind of. I

5 didn't know what the case was about. I didn't know what the

6 subjects of the investigation were. It was just, here's a hard

7 drive and...

8 Is there this? I would look, yes. Is there this? I

9 would look, yes. It's kind of hard doing an investigation or

10 examination on something when you have absolutely no idea of

11 what you're looking for.

12 Q Right. Did you answer questions for him about a -- well, at

13 any point, did you ever examine a different hard drive or was

14 it only ever one hard drive?

15 A I made a forensic copy of one.

16 Q Okay.

17 A But I believe that I looked at some other ones.

18 Q How many other ones did you look at that you recall?

19 A Maybe -- I think two maybe.

20 Q On those two others, do you recall what you were tasked to look

21 for?

22 A Based on the report that I read, I looked at -- tried to look

23 at one hard drive and I couldn't read it, because it wouldn't

24 render, part of the operating system was damaged. And the

25 other one was the partitions on the hard drive.

Paul

Highlight



1 Q When you looked at those two other hard drives, how did you

2 look at them? I mean, did you put the hard drive into another

3 computer? Did they bring over a computer for you? How did

4 that happen?

5 A All of these hard drives, the two different hard drives and the

6 primary hard drive, like I said, I wasn't privy to any

7 particulars about the investigation.

8 Q Mm-hm.

9 A So I would open them up and make them viewable on my computer

10 screen and then Cooley would come and sit at my desk and look

11 through things. I made myself available in the room or in the

12 hallway if he had a question about, how do I look at this or

13 what does this mean? He would ask those specific questions and

14 I would come in and explain those and then I would walk away.

15 Q Okay. Didn't he have the hard drive though too? Why did he

16 need to look at the one on your computer?

17 A Because when I get a forensic image of a hard drive, it's

18 basically a bit stream copy of the data on the original source,

19 the original hard drive.

20 Q Okay.

21 A I can look at it in such a way where I don't have to boot the

22 computer up. I can pull up the file system on my computer and

23 see everything, deleted files, or I can sort by types of files

24 or look at the file structure.

25 It is much like the Windows Explorer on your computer.

Paul

Highlight



1 You can look at the files and go to folders and see what's in

2 those. It's pretty much like that. Without being able to boot

3 the computer up, with my forensic image, I would just mount

4 that or load that into my forensic software and it would show a

5 directory tree.

6 Q Okay.

7 A Where he would go through and click through the directories and

8 see what files are on there.

9 Q Does it also protect that image so that it can't be altered?

10 And by that -- I'm not sure if I'm using the right terminology.

11 So what I mean by that is, there's going to be certain

12 properties for certain documents and those document properties

13 can't be altered, re-saved, edited -- that sort of thing?

14 A Correct. Yeah.

15 Q Okay.

16 A It preserves the integrity of the data that you're looking at.

17 Q Okay. How long after you made the first image of the hard

18 drive did you then come to look at the other two hard drives?

19 A I don't remember.

20 Q Did you take notes or write any reports or anything like that

21 about any of the work that you were doing on these?

22 A I wrote a report on the initial forensic image and the initial

23 restore.

24 Q Okay.

25 A But like I said, the things that we looked at were more of an

Paul

Highlight



1 informal type of thing where he would be looking through things

2 and ask a question and I would answer it. Or it was a, hey, is

3 this here? And I would look in the computer and say yes or no.

4 It wasn't ever a structured formal computer forensic

5 examination.

6 Q Right.

7 A So a structured formal computer forensics examination report

8 wasn't written. I would, I guess, akin it to taking a vehicle

9 to a shop and having the mechanic look at the engine and

10 saying, hey, is the oil okay? And he looks and, yeah, it's

11 fine. But it's not necessarily something that he would --

12 Q Was Cooley aware that it wasn't a full formal structural

13 forensics investigation?

14 A Yeah. I told him that I would -- that was the idea. I would

15 bring up the computer for him on the screen and he would be

16 able to look through it at his whim and look for whatever he

17 needed to look for. And I would be there to answer questions

18 about what he was looking at or if he needed help navigating

19 around or how to open a certain file.

20 Q Okay. Did you get a sense of what he was looking for?

21 A No. From the initial request from investigator Gitts, it was

22 pretty clear that we weren't to look at it. We weren't to get

23 involved. So I was very careful in staying distant from

24 whatever was occurring.

25 Q And you mentioned that you found two encrypted files on the

Paul

Highlight



1 computer; correct?

2 A I believe so.

3 Q Okay. Do you know why or how those files came to be encrypted?

4 A I don't.

5 Q Okay.

6 A I mean, I couldn't -- I know that they were encrypted. I

7 couldn't tell if the program Adobe -- it was a PDF file. Are

8 you familiar with PDF files?

9 Q I am.

10 A I didn't know if the program in Adobe encrypted it or it was

11 encrypted in some other manner. I just knew that it was

12 encrypted.

13 Q Okay. And --

14 A There's many different ways to encrypt the files.

15 Q Is it true that sometimes you may receive an e-mail with a

16 document that's encrypted just to protect that document;

17 correct?

18 A Yes.

19 Q And that's fairly common these days; correct?

20 A Yes.

21 Q Okay.

22 A There's also files on the computer that naturally come

23 encrypted that need the log-in for the operating system to

24 decrypt it on the fly. But if you were to look at the file

25 without looking into the computer, it would be encrypted.

Paul

Highlight



1 Q Okay.

2 A Did that make sense?

3 Q It did.

4 A Okay.

5 Q How many times did Cooley come over to take a look at the hard

6 drive or the image of the hard drive?

7 A Three. There was the first time that he brought the extra hard

8 drive over to do another restore and then he came over to look

9 at the data after that was done, and then he brought over

10 another -- no. I think that it was around three. I can't be

11 sure or certain on that.

12 Q Okay. You said that you looked at a hard drive that was

13 damaged where you couldn't see the information; correct?

14 A I believe so.

15 Q Do you know what the size of that hard drive was?

16 A I don't.

17 Q Okay. Was there any way to determine the size of that hard

18 drive?

19 A There probably was, but at the time, I didn't. It was more of

20 a, here's a hard drive, look at it, what's on it? I couldn't

21 read it and, okay, and we put it away.

22 Q Do you know what a migration is?

23 A A data migration?

24 Q Correct.

25 A Yes.

Paul

Highlight



1 Q Can you explain to me what a data migration is?

2 A Well, the way that I understand it is a data migration would be

3 -- there's a couple different definitions. One would be to do

4 it intentionally where you want to migrate data from one source

5 onto the other.

6 Q Mm-hm.

7 A There's another source where it's inadvertent where you,

8 through using the computer or connecting the hard drive to

9 something, data automatically gets migrated without the user's

10 knowledge.

11 Q Okay. Could the damage to the damaged hard drive that you took

12 a look at occur due to migration?

13 MR. KAMERRER: I just want to insert an objection that

14 it calls for speculation as to what he looked at.

15 Q (By Ms. Beschen) Well, do you understand what my question is?

16 Do you want me to repeat it?

17 A I understand your question.

18 Q Okay. Go ahead.

19 A I don't know.

20 Q Okay.

21 A There are many different ways or reasons why a hard drive could

22 become corrupt.

23 Q Okay.

24 A It could be intentional. It could be a hiccup in the operating

25 system. It could be something as simple as a power outage. It

Paul

Highlight



1 could be a virus. There's many different reasons why a hard

2 drive would be unreadable.

3 Q Okay. Do you recall indicating to Cooley in looking at the

4 damaged drive, that there was a missing master file table that

5 could mean that someone had begun some sort of process to

6 overwrite the contents of the drive, but had not finished doing

7 so?

8 A I don't recall that specifically. I remember finding or not

9 being able to find parts of the master file table that would

10 enable the hard drive to mount, and discussing with him

11 different reasons why that would happen. I don't believe that

12 I -- it is a possibility, but I don't think that I gave him an

13 indication of what I thought happened. Like I said, there's

14 many different reasons why that would happen.

15 Q Okay. Did you also look at a hard drive that had been

16 partitioned?

17 A Well, yes. All hard drives are partitioned, yeah.

18 Q Okay. Were you asked by Cooley questions about the

19 partitioning of a particular hard drive?

20 A According to the report, I have -- I did.

21 Q Okay. Is that report a report that you wrote or -- a report

22 that someone else wrote?

23 A That was a report that Cooley wrote.

24 Q Okay. Do you recall doing that independently of reading that

25 in the report?

Paul

Highlight



1 A I don't. Like I said, a lot of work that I did after the fact

2 was pretty informal.

3 Q Mm-hm.

4 A It was two years ago. It's unfortunate that a report wasn't

5 written to refresh my memory. I can assume that I did that

6 since that's what he wrote in the report, but I don't

7 specifically remember doing that.

8 Q Okay. Can you tell me what a partition is?

9 A Yes. A hard drive -- a bare bones hard drive is a bunch of

10 data, ones and zeros, from beginning to end. In order for an

11 operating system to be installed in it, you have to in a sense

12 create a container to house that operating system.

13 It's like a refrigerator without any shelves or

14 containers or anything in there. If you want to put your

15 leftover turkey in there, you put it in a container or put that

16 in the fridge. Or you have a freezer and a refrigerator that

17 would be two partitions on the same fridge.

18 Partitioning a hard drive is a way for the operating

19 system or the file system to -- or the system to indicate what

20 type of file system is on the hard drive. So the computer is

21 able to read it and install or copy or delete or place files

22 onto that partition.

23 Q Okay. Can a partition be created by a virus?

24 A I'm not aware of one being able to do that.

25 Q Okay. Can you determine, when looking at a hard drive, when

Paul

Highlight



1 the partition was created?

2 A Sometimes.

3 Q Okay. Can you determine who created the partitions by looking

4 at the hard drive?

5 A You can speculate by certain aspects of the files and folders

6 that are on that hard drive but, no, you can't pinpoint who was

7 sitting at the keyboard when that was done, if that's what you

8 mean.

9 Q Okay. Let me -- have you ever met Dale Kamerrer, who is

10 sitting to your right?

11 A No.

12 Q What about Liz Gallery who is sitting to his right?

13 A Yes.

14 Q How many times have you met Liz?

15 A Numerous times over the past 22 years.

16 Q Okay.

17 A Too many times to count.

18 Q Have you spoken with Liz about this case in particular?

19 A Yes.

20 Q How many times?

21 A In total, starting about a year ago -- no. If I had to put a

22 guess on it, I would say, six times.

23 Q Okay. What -- did she ask you questions or provide you with

24 information?

25 A No. A lot of that was asking for copies of the report or

Paul

Highlight



1 notifying me that there would be a deposition or asking

2 particular questions. A lot of -- half of the time it was

3 through Tara, her assistant.

4 Q Okay.

5 (Marked Deposition Exhibit No. 59)

6 Q (By Ms. Beschen) Did you provide Liz with any reports that you

7 had written?

8 A I believe so. I let her know that the reports existed. I

9 assume that through her job, she will be able to get copies of

10 those reports through our records department.

11 Q Okay. The court reporter has just handed you what's been

12 marked as Exhibit 59.

13 A Yes.

14 Q Did you have an opportunity prior to today to review these

15 pages?

16 A Yes.

17 Q Okay. Other than what you just indicated to me about not

18 recalling, not looking at partitions on the second page, was

19 there anything else that you read in this report that you did

20 not independently recall doing or saying? And you can take

21 your time to go through it and mark it up.

22 A Is this assuming that you have a copy of my reports?

23 Q I do not have a copy of your reports.

24 A Okay.

25 Q Okay.

Paul

Highlight



1 A Okay. So maybe I'm not understanding. There's things that I

2 did that are written in my report that are more in depth than

3 what was written in here.

4 Q Okay.

5 A I mean, I could go and look at the first paragraph and then

6 read you a page-and-a-half of my report that reflects that kind

7 of thing.

8 Q I mean, I'm more interested in if there's anything that you

9 don't recall doing, for example, the partitions that you

10 earlier told me that you did not independently recall doing

11 anything in with regard to partitions. So is there anything

12 else like that that's written in this report by Cooley that you

13 don't recall doing?

14 A Well, the partition thing and the separate hard drive thing. I

15 remember working on other hard drives.

16 Q Mm-hm.

17 A And I remember looking at different things, but I couldn't

18 recall exactly what I was -- what I did with them.

19 Q Right. So yes, I'm not asking you to say that he's lying by

20 putting it in this report or anything like that. I'm just

21 wondering which things you don't have an independent

22 recollection of.

23 A Okay. No. There's details in this report that get into more

24 specifics than I remember, but...

25 Q Do you have a copy of your report with you?

Paul

Highlight



1 A Yes.

2 Q Can I have it?

3 MR. KAMERRER: We can make copies of it.

4 THE WITNESS: I wrote notes on the first page of where

5 I was supposed to go.

6 Q (By Ms. Beschen) Can I have them? Of where you were supposed

7 to go, you said?

8 A Yes. The Whatcom County courthouse, fifth floor.

9 Q Okay.

10 MR. KAMERRER: Can we just make three copies of the

11 whole thing?

12 MS. BESCHEN: Let's go ahead and go off the record for

13 just a moment and just take a quick break.

14 (Short Recess Taken)

15 (Deposition Resumed)

16 MS. BESCHEN: Going back on the record.

17 (Marked Deposition Exhibit No. 60)

18 Q (By Ms. Beschen) The court reporter has just handed you what's

19 been marked as Exhibit No. 60. Going through this, does that

20 appear to be all of the reports that you wrote in connection

21 with this case?

22 A Yes. There is one report that crime scene investigator Gitts

23 wrote.

24 Q Do you know what his report was about?

25 A His report was the initial contact from Rossmiller, from the

Paul

Highlight



1 Whatcom County Sheriff's Office.

2 Q Okay. And that is --

3 A Making the request.

4 Q -- inside the exhibit as well?

5 A Yes.

6 MS. BESCHEN: Okay. I have no further questions. He

7 may have some for you.

8 MR. KAMERRER: I have no questions.

9 MS. BESCHEN: All right. Thank you.

10 (Signature Reserved)

11 (Deposition Adjourned)

12

13

14

15

16

17

18

19

20

21

22

23

24

25

Paul

Highlight



1 C E R T I F I C A T E

2

3 STATE OF WASHINGTON ) ) ss.

4 COUNTY OF ISLAND )

5 I, Kristen M. Uhlig, the undersigned CCR in and for the Stateof Washington, do hereby certify:

6 That the annexed and foregoing deposition of the witness

7 named herein was taken stenographically before me and transcribedby me;

8 I further certify that the witness examined, read, and signed

9 the deposition after the same was transcribed, unless indicated inthe record that the parties and the witness waive the signature;

10 I further certify that all of the objections made at the time

11 of said examination to my qualifications or the manner of takingthe deposition, or to the conduct of any party, have been noted by

12 me upon said deposition;

13 I further certify that I am not a relative or employee orattorney or counsel of any of the parties to said action or

14 counsel, and that I am not financially interested in the saidaction or the outcome thereof;

15 I further certify that the deposition, as transcribed, is a

16 full, true, and accurate transcript of the testimony, including allquestions and answers, and all objections, motions and exceptions

17 of counsel made and taken at the time of the foregoing examination;

18 I further certify that I am sealing the deposition in anenvelope with the title to the above cause thereon and marked

19 "Deposition Upon Oral Examination" of said witness and promptlycausing the same to be delivered or forwarded to Counsel for the

20 Opposing Party;

21 IN WITNESS THEREOF, I have hereunto set my hand and affixedmy official seal this ___ day of____________, 2014.

22

23 __________________________

24 Kristen M. Uhlig, #1934 Certified Court Reporter,

25 Residing in Clinton, Washington.

Paul

Highlight

Officer X17, BPD - Deposition Transcript (Federal) - Redacted

Documents

Transcript of Officer X17, BPD - Deposition Transcript (Federal) - Redacted