This is Part 2 of Cami Pics Tampered but True?
See Part 1: Cami Pics Tampered but True?
Perhaps most surprising is that FBI Senior Forensic Examiner Brian Booth trivialized the shocking lapse of competence by the FBI in losing custody of the camera card by saying something that is dubious at best.
He did not believe anything of significance was altered because EXIF data on a camera card is hard to change.
Here are two excerpts from Booth’s testimony. He is being examined by Assistant US Attorney Tanya Hajjar:
Pg 4818 – 4819
Q Is there something unique about EXIF data?
A What’s interesting about JPEG information with EXIF data is that when you move the JPEG, the information stays within the JPEG. So camera models, things of that nature, they go with it wherever it goes.
Q Can you explain that? What do you mean, like, “they go with it,” and they stay the same?
A Well, say you want to put it on a thumb drive and then take it to your friend’s computer. Times and dates change as you move across different kind of computers.
If you take it to an Apple computer, and then take it to, say, a Linux, which is a different type of computer, and then take it to your Windows computer, times and dates can change from that movement, depending on whether or not the computers’ dates are on or off in different ways, or if someone’s backdated a computer, or for some reason, the battery on your computer has been wiped out.
A lot of times we used to turn on old computers and it used to ask us for the date because of the fact that the battery that holds the date and time information had been lost. And then you wind up having to put the new time and date in.
But with EXIF data, once it’s embedded in a picture, it doesn’t matter how many times you move it around. It stays into that photo and it’s very hard to remove. In fact, most commercial software will not touch EXIF data. It will allow you maybe to add data to it, but even in that sense, it’s very — it’s very able to be corrupted.
So if you use, say, Photoshop to touch a photo like a JPEG, chances are Photoshop is gonna remove the metadata completely or it’s gonna add “Edited by Adobe Photoshop,” which is their way of just trying to protect the data from being corrupted.
Q But is EXIF — does EXIF data remain the same when you — even if you tried to open it in an Adobe product?
A In that sense, the photo stays the same. The EXIF data might be modified to let you know that you’ve tried to modify it in an Adobe product.
Q Is there a particular reason why EXIF data is more difficult to alter?
A They purposely designed it that way.
Q Do you know —
A It’s mainly to be able to store information. And they don’t want data to be moved around and changed, especially time and date information. Those things are very hard for the consumer to be able to modify, unless you wind up getting software that’s just developed to do that.
Pg 4830
Context: AUSA Hajjar is asking Booth about why the file system creation dates of the pictures on the hard drive (including the Cami pics) are on July 26, 2003 – which is before the Canon camera had even been manufactured. The camera was manufactured beginning in 2004. Booth explains that those dates are unreliable but that EXIF data is much more reliable.
Q And what accounts — you see the created date is 2003, modified date ’05, access 2010. What accounts for the differences in those dates or what could account for those differences?
A Well, dates, times, and modified dates, they’re all deriving from the operating system, and from the file system of the actual hard drive. As I told you, with our library reference, we have a card catalog that refers back to where we find data. All of this data, that date and times and access times, they’re all derived within the computer file system on where things are on the hard drive.
As you move things from one computer to another, if the times are different and they’re different types of file systems, they’ll get a new created time and if dates are wrong they can be manipulated. So there’s times that things can change going from one computer to another. Usually, if anything, it would be the created time that would be changed. Sometimes you can get a created date that’s after your modified date, which happens when you just happen to move to a different type of file system later on after you’ve had the file.
But in this case, it’s actually reversed. Somehow it got changed to where the date is well, well, before then what might be the first modified date or a modified date.
Q You testified that the EXIF data shows the date and time associated with this image is October 18, 2005?
A Yes.
Q And so between the dates here and the EXIF data, what’s the best evidence of when this photograph was taken?
A Well, the best reference is the EXIF data because that gets put into the JPEG file and it’s not easily modifiable and it moves with the file the same way from device to device, no matter where you place it. It has nothing to do with the bearing of a file system at all or the dates and times associated with it. So it’s on its own, but are created at the same time that you take the picture.
Q And does the EXIF data match roughly one of the dates here?
A Yes, it does.
***
In a nutshell, Booth is saying that the EXIF data is reliable because it is hard to change. But here are some links on tutorials and resources on changing EXIF metadata:
https://www.youtube.com/watch?v=jjaKLXLQS0Q
https://www.youtube.com/watch?v=MOpyNARJgDk
No, EXIF data is not hard to change.
Of course, this does not prove the FBI cheated. But consider the optics:
FBI seizes a device from the defendant.
FBI loses custody of it several months later.
Someone gets on the device after the FBI loses custody of the device.
The FBI says they do not know who got on the device.
FBI regains custody and “finds” the most important evidence in the entire case.
When challenged on the witness stand, the FBI expert witness, while admitting the above, says it is difficult for anyone to change the data on the device.
In reality, a person of average competence in IT could do it.
Raniere was charged with sexual exploitation and child porn possession via a superseding indictment less than 60 days prior to the commencement of trial. All of the codefendants who planned to stand trial with him quickly made plea deals because, as it was clear, no one wanted to go to trial alongside someone who was being accused of having child porn and of being the sexual exploiter of a child.
The original six Nxivm defendants. Sketch by MK10ART.
This bizarre mishandling of the camera card does not mean that the Cami photos were not taken in 2005. Or even if they were not taken in 2005, even if they were altered by the FBI, that doesn’t mean Raniere did not take nude photos of Cami in 2005 when she was 15.
