The Eastern District of New York (EDNY) requested David Loveall II, an FBI Senior Computer Scientist, counter the claims made by J. Richard Kiper in his report concerning allegedly manipulated digital photographs of Camila.
Kiper’s “Summary of Technical Findings,” dated April 25, 2022. was used by Keith Raniere in his Rule 33 Motion for a new trial.
Three digital devices are relevant
A Canon EOS camera
A CompactFlash (CF) camera card
A Western Digital Hard Drive
Eleven months after they seized the hard drive, the FBI found 22 illicit pictures of Camila on it.
y analyzing metadata from the digital photos, the FBI deduced Raniere used the Canon camera to photograph a then-15-year-old Camila in 2005.
Part 1 Battle of Experts: Kiper v Loveall on FBI Tampering in Raniere Case
This is Part 2, which relates to “Finding #2” of Kiper’s, which concerns the FBI’s two examinations of the compact flash (CF) card found in the Canon camera.
Dr. J. Richard Kiper PhD….
The government’s argument at trial relied on linking the CF card to the hard drive that received Camila’s backup photos from the CF card. There were no Camila photos found on the CF card. But there were other similar photos of adult women on the CF card found on the hard drive.
What is not in dispute
About a month before the trial, on April 11, 2019, FBI Forensic Examiner Stephen Flatley made a copy of the CF card for analysis, listed the files on it, and made a report using AccessData Forensic Toolkit (FTK).
The report showed four photos, 180-183, [of a woman named Angel] that are common to both the hard drive and the CF card. No other files on the CF Card report matched the “backed up” files on the hard drive.
On June 10, more than a month into the trial, FBI Special Agent Christopher Mills gave the CF card to FBI Forensic Examiner Brian Booth.
FBI Special Agent Michael Lever asked Booth to conduct a second examination and produce a new report on the CF card, which was dated June 11, 2019.
This new report contained 37 new files that were not in the first report, making the connection between the CF card and the hard drive much stronger.
The 37 photos in the new files however couldn’t be viewed.
The original CF Card files (shown in white) could be viewed in both reports.
Kiper raised questions about the arrangement of the n37 ew files in the June 11 report.
Eight of them come before a group of “common” photos and another eight appear just after a range of the alleged Camila photos. He said the placement seems unlikely to be a coincidence. The Camila photos were not included in either of the two CF Card reports.
There’s also a photo labeled 42 which only appears in the June 11 CF Card report and seems to fill a gap in the file names. The file names on the new report are continuous with no missing names or gaps within each group of new files.
This is unlike the Western Digital hard drive report, where there are missing file names and gaps.
2nd Forensic Report on CD Card
The same software was used for both reports, so, according to Kiper, this difference can’t be because of a new tool or method.
Kiper suggests the 37 new files on the second report might not be from the CF card for several reasons:
The actual photos cannot be viewed in the report.
The unique codes (MD5 hashes) for these files do not match the ones on the hard drive.
The second report doesn’t include the file sizes, so we can’t compare the sizes of these files to the ones on the hard drive.
The software was unable to recover any viewable photos from these new files.
There’s not much connecting these new files to the ones on the hard drive, except their names and the dates and times they were created, which can be easily changed.
There’s not much evidence that these new files are real digital photos. There’s no data about them, no viewable images, and no thumbnails. But the new files match the names, dates, and times of files on the hard drive, which makes it look like the hard drive’s files originally came from the CF card.
Kiper says 20 files, labeled 81-100, looks like someone added these, but didn’t bother to put them in the same folders as the hard drive. To believe these files are legitimate, you would have to believe that the user of the CF Card took photos, saved them on a computer, returned to the CF Card, and deleted certain photos.
Kiper thinks the FBI added the 37 new files to the CF card to make it look like there was a stronger connection to the hard drive with the illegal photos.
He says the tamperers messed up the creation and deletion of the new files, which is why they can’t be seen in the report.
Kiper says the deleted files weren’t deleted in a way that would stop the FBI’s tool from recovering them. This tool could recover deleted files and even photos from the CF card.
Kiper wrote: “[I]n my expert opinion all indications of means, motive, and opportunity point to FBI employees creating the appearance of additional files on the CF Card in order to substantiate a relationship between the CF Card and the WD HDD containing the alleged contraband.
Loveall Replies
Lovell rebuts in his report:
Kiper claims that “additional files appeared on the FBI’s forensic report of the CF Card between 4/11/19 and 6/11/19, in an apparent attempt to create a stronger relationship” between the camera card and the hard drive.
This finding is misleading… because the settings used to process and generate the two forensic reports generated on those dates were different.
Although both reports used the same processing tool—AccessData Forensic Toolkit 6.3.1.26—there are numerous configurations and setting options for this tool, which can result in the generation of different reports. The fact that additional files appeared in one report is a result of the use of different settings.
I have examined the disk images created of 1B15 and 1B15a and determined that they are identical.
Process Findings
Loveall does not address Kiper’s process findings on FBI handling of evidence.
Kiper’s report states neither the camera nor the CF Card were sealed when they were given to forensic examiner Booth on June 10th – two days before he testified in court.
The Chain of Custody of who had the CF card shows that at least three FBI employees had control of this evidence from the time a new examination was asked for (June 7th, 2019) to the time it was given to Booth in a package not sealed (June 10th, 2019).
Booth’s notes about his examination don’t mention this Chain of Custody or the fact that he received the evidence in a package that wasn’t sealed, even though he admitted in court that it was unsealed when he got it.
However, the FBI’s policy requires evidence to be secure and sealed, and employees could get in trouble if they don’t follow this policy. Kiper said in his 20 years as an FBI agent, he never got evidence that wasn’t sealed, except in emergency situations.
