This is part 1.
David Loveall II is an FBI Senior Computer Scientist.
The EDNY called on him to rebut J. Richard Kiper’s report on the allegedly tampered Camila digital photos.
Loveall has been with the FBI since May 2010 and is currently assigned to the Operational Technology Division (OTD) in Quantico, Virginia. Prior to that, he worked as a forensic examiner for the FBI in Kansas City.
He was not involved in the investigation or prosecution of United States v. Keith Raniere.
Dr. J. Richard Kiper PhD….
Kiper had a 20-year career as an FBI Special Agent from 1999 to 2019. Over half his career was in cybersecurity and digital forensics. Kiper held various roles, including case agent, supervisor, unit chief, forensic examiner, trainer of forensic examiners, and trainer of trainers of forensic examiners.
Review the two technical reports:
Loveall reviewed Kiper’s “Summary of Technical Findings” dated April 25, 2022, which was used by Keith Raniere in his Rule 33 Motion for a new trial.
Loveall had access to the three devices to analyze:
A Western Digital Hard Drive
A Canon EOS camera
A CompactFlash (CF) camera card.
The FBI found 22 contraband pictures of Camila on the hard drive.
Observing the metadata from the digital photos, the FBI determined Raniere took Camila’s photos with a Canon camera. He transferred them to the camera card. Next he transferred them to a Dell computer, which was not found and finally to a hard drive the FBI found in plain sight in Raniere’s library at 8 Hale Dr.
Kiper’s report stated the FBI tampered with the evidence and had several findings.
In this post, we will examine the first finding – giving both Kiper’s allegation and Loveall’s rebuttal.
Kiper’s Finding #1 reveals files on the hard drive do not match the camera card yet have the same file name.
Here is how Kiper explained it:
Finding 1:
Some digital photo files found on the CF card had the same filenames and date/time stamps as their supposed backups on the WD HDD, yet they depicted two different people.
Moreover, these same CF card files contained thumbnail pictures from another existing set of photos, thus proving manual alteration of the CF Card contents.
Kiper goes on to explain the technical aspects of this.
In simple terms, Kiper discusses digital photo files found on a memory card (CF card) and a hard drive (WD HDD).
His says some photo files on the CF card had the same names and timestamps as their supposed backups on the hard drive, but depicted different people.
Additionally, some files on the CF card contained thumbnail pictures from another set of photos, suggesting the contents of the CF card were manually altered.
Photo files 93-97 on the hard drive’s forensic report were not found in first FBI CF card report, but were found in a 2nd FBI CF card report.
However, these files on the 2nd CF card report were not viewable as photos and their “digital fingerprints” did not match, indicating manipulation.
Kiper’s analysis also revealed that photos 93, 94, 96, and 97 on the CF card were different from their namesakes on the hard drive.
However, these CF card files contained the same thumbnail images as 180-183) on the hard drive, suggesting intentional alterations.
Loveall did not find this strange:
He wrote that “Kiper’s conclusion that this proves that the card’s contents must have been intentionally altered is not correct.”
In simple terms Loveall argued that the way the file system in the CF card works is that files are created and deleted over time.
If the CF card does not have enough space to store all the photos taken by the camera, older photos are deleted to make room for new ones.
Metadata is stored separately from the actual photograph and when files are deleted, they are not immediately erased from the CF card; the file system only marks the space as available for reuse.
If a new file is saved in the space previously occupied by a deleted file, the FBI forensic tools can make a partial recovery of the old file, and this can cause metadata from one file to be mistakenly attributed to another.
Kiper’s claim of intentional alteration of the CF card contents is not supported by the photos being different.
It can be the result of how file systems manage data, and it does not necessarily indicate manipulation or wrongdoing.
Keith Raniere in his library where the hard drive with Cami’s photos were allegedly found. Were they tampered with by the FBI?….
