Michael Dillmore — Direct/Cross/Redirect
301 linesJUDGE HANKINSON: Call your next witness.
MS. NORRIS: The State calls Michael Dillmore.
MS. CAPPLEMAN: Judge, can we approach while she's getting that witness?
JUDGE HANKINSON: Okay.
MS. NORRIS: Good afternoon.
MICHAEL DILLMORE: Good afternoon.
MS. NORRIS: Can you introduce yourself to the members of the jury and spell your first and your last name?
MICHAEL DILLMORE: Certainly. My name is Investigator Mike Dillmore, the Tallahassee Police Department.
MICHAEL DILLMORE: It's Mike, M-I-K-E, Dillmore, D-I-L-L-M-O-R-E.
MS. NORRIS: And how are you employed at the Tallahassee Police Department?
MICHAEL DILLMORE: I'm an investigator and I do digital forensics.
MS. NORRIS: Can you give us a little bit of information about your educational background?
MICHAEL DILLMORE: Sure. I have a bachelor's degree in criminology and a bachelor's degree in education as well.
MS. NORRIS: You said you do digital forensics. What does that mean?
MICHAEL DILLMORE: Digital forensics is basically the process of acquiring and then examining electronic data with the ultimate goal of preserving any evidence in its original form — so without changing any evidence.
MS. NORRIS: And how long have you been doing digital forensics?
MICHAEL DILLMORE: About eight and a half years.
MS. NORRIS: Did you have to receive any kind of specialized training to teach you how to extract data from the lifetime?
MICHAEL DILLMORE: Yes, ma'am. I've had probably about 1,400 hours of training in computer-related courses. A little over a thousand of that has been specifically for digital forensics. A little over a thousand, I believe, the —
MS. NORRIS: — International Association of Computer Investigative Specialists? It's called IACIS?
MICHAEL DILLMORE: Yes, ma'am.
MS. NORRIS: And if you could just wait, and slow down, and let me ask my question, so the court reporter can make sure she gets our questions and answers.
MICHAEL DILLMORE: I apologize.
MS. NORRIS: It's okay. In addition to the training that you've received, as well as the memberships you have, do you have any real-life, on-the-job experience in digital forensics?
MICHAEL DILLMORE: Yes, ma'am, that's what I do every day. Eight and a half years. I don't do anything else but digital forensics at the police department.
MS. NORRIS: And have you ever testified in court with respect to that subject matter?
MICHAEL DILLMORE: Yes, ma'am.
MS. NORRIS: About how many times?
MICHAEL DILLMORE: Approximately 20.
MS. NORRIS: Are you familiar with what the cloud is?
MICHAEL DILLMORE: Yes, ma'am.
MS. NORRIS: What is the cloud?
MICHAEL DILLMORE: The cloud — you can kind of consider it, you have like a USB drive or a hard drive for your computer.
MICHAEL DILLMORE: It's like that, but on the internet.
MICHAEL DILLMORE: It's hosted on a network of servers by some company.
MICHAEL DILLMORE: Things like Google Drive, iCloud, Dropbox — those are cloud service providers where you can store your data on the internet so you can access it from somewhere else.
MS. NORRIS: So it's basically just like a backup hard drive you'd have at home, but it's maintained somewhere else in the country?
MICHAEL DILLMORE: Yes, ma'am.
MS. NORRIS: And how do you create the ability to have your own cloud?
MICHAEL DILLMORE: Certainly. You create an account with whoever you want to do it, whether it be Google or Apple or Dropbox, and then once you create that account you can log in from pretty much anywhere and access your data.
MS. NORRIS: Where's the data you're accessing? It's located somewhere else?
MICHAEL DILLMORE: Correct.
MS. NORRIS: And different companies provide different files. You mentioned, like, Dropbox; Apple has the iCloud.
MICHAEL DILLMORE: Yes, ma'am.
MS. NORRIS: And can the cloud, like, sync amongst all your different devices?
MICHAEL DILLMORE: Yes, ma'am.
MS. NORRIS: And how so?
MICHAEL DILLMORE: So take iCloud, for example. If you have an Apple ID, you log in, say, with your iPhone, and then it syncs to iCloud. And then let's say you have an iPad as well — if you log in with the same Apple ID and set it up for syncing, then you can have the same data from your iPhone on your tablet as well.
MS. NORRIS: Can you also then go in and decide what types of data you want synced? For example, if I have an Apple iPhone and I also have a tablet at home, I can choose whether I want to sync photos, for example, or contacts, or really anything?
MICHAEL DILLMORE: Yes, ma'am.
MS. NORRIS: And the user can control what is synced and backed up on the cloud?
MICHAEL DILLMORE: That's correct.
MS. NORRIS: Um, let's say that law enforcement wants to get a hold of someone's iCloud. How would they go about doing that, getting the contents of their cloud?
MICHAEL DILLMORE: Right. You send legal process to Apple.
MS. NORRIS: A search warrant?
MICHAEL DILLMORE: That's correct.
MS. NORRIS: In this particular case, did TPD issue a legal demand or a search warrant to Apple for the contents of Charlie Adelson's iCloud?
MICHAEL DILLMORE: Yes, ma'am.
MS. NORRIS: Did iCloud. Not iCloud, sorry. Did Apple respond with the contents of Charlie Adelson's iCloud?
MICHAEL DILLMORE: Yes, ma'am, they did.
MS. NORRIS: And how does that response get provided to law enforcement?
MICHAEL DILLMORE: In this case it was provided on a USB drive, and then from there I took that information onto my computer and started examining it.
MS. NORRIS: Okay, so you received the information on a USB drive, with a flash drive?
MICHAEL DILLMORE: Yes, ma'am.
MS. NORRIS: And then how do you go about — and you did get that drive in this case?
MICHAEL DILLMORE: Yes, ma'am.
MS. NORRIS: What do you do from there?
MICHAEL DILLMORE: Okay. In this case, when I first got it, I pulled it into a program called FTK — Forensic Toolkit.
MICHAEL DILLMORE: It's a program that we use typically for computer forensics, and was able to extract or decode the information, create a report, and provide it to the investigator.
MS. NORRIS: I'm going to interrupt you, because you went ahead of what you get exactly from Apple.
MICHAEL DILLMORE: Right.
MS. NORRIS: What does that look like? Can you open it up and read it exactly the way that it is?
MICHAEL DILLMORE: I see. It's a zip file, and it's not typically in a readable, human-readable format. You have to use a program to be able to see all of the data.
MS. NORRIS: And I'm sorry, I believe you said that the first type of program that you used to try to make it more readable was the FTK report?
MICHAEL DILLMORE: Yes, ma'am.
MS. NORRIS: What is that?
MICHAEL DILLMORE: FTK? The Forensic Toolkit.
MICHAEL DILLMORE: Right. It's a software program made by AccessData.
MICHAEL DILLMORE: And basically, like I said, we typically use it for computer forensics, but we can also pull in other types of data — such as data from iCloud or other things as well — to decode the information so that it's easier to read for us.
MS. NORRIS: And what does the Forensic Toolkit give you once you ran the data originally from Apple through the toolkit?
MICHAEL DILLMORE: Right. I created a report that contained the data that it decoded.
MS. NORRIS: Did you perform any other type of extraction, or devices, or any other programs that you ran this information from Apple through to make it more readable and digestible?
MICHAEL DILLMORE: Yes, ma'am, I did. I used another program called Cellebrite Physical Analyzer. It's a software made by the company Cellebrite. I pulled the contents of the zip file into Cellebrite, it decoded the data — and Cellebrite's typically used for mobile forensics, so this was kind of perfect, bringing that mobile data from the iCloud into Cellebrite.
MS. NORRIS: And the Cellebrite program — is that something that's a commonly used tool by law enforcement?
MICHAEL DILLMORE: Yes, ma'am.
MS. NORRIS: And you know how to use that program?
MICHAEL DILLMORE: Yes, ma'am.
MS. NORRIS: So you have an FTK report and you also have a Cellebrite report?
MICHAEL DILLMORE: Correct.
MS. NORRIS: Do either of those programs that you're running this original data from Apple through — do they change the contents in any way?
MICHAEL DILLMORE: No, ma'am.
MS. NORRIS: They don't add anything to it or subtract anything from the iCloud?
MICHAEL DILLMORE: That's correct. It decodes what it's programmed to be able to decode — whether that's contacts, call logs, text messages, pictures, videos, et cetera.
MS. NORRIS: Do these programs in any way organize the data so that you can go to a specific category of information you might want to look at?
MICHAEL DILLMORE: Yes, ma'am, and that's the purpose of them, so that it's a lot easier for us to read. So Cellebrite in specific would sort these things into the contacts, where we can pull open a tab and see just the contacts, or pull open the call logs and see just the call logs, all the way through.
MS. NORRIS: May I approach the witness, Your Honor? I'm showing you what I've marked for identification as Exhibit 170. Do you recognize that?
MICHAEL DILLMORE: I do.
MS. NORRIS: And how do you recognize it?
MICHAEL DILLMORE: Um, it's the disc I created. It has my signature on it.
MS. NORRIS: And what is contained on that particular —
MICHAEL DILLMORE: This is the Cellebrite report that I created from the Apple search warrant response.
MS. NORRIS: For —
MICHAEL DILLMORE: This is the actual zip file that we recovered. We made a copy of it and put it on this disc.
MS. NORRIS: So that is the exact response from Apple to your search warrant for Charlie Adelson?
MICHAEL DILLMORE: Yes, ma'am.
MS. NORRIS: And the 171, 172, that we just looked at — that was after it had been run through the Cellebrite?
MICHAEL DILLMORE: Correct.
MS. NORRIS: Finally, I'm going to show you State's Exhibit 172.
MS. NORRIS: Do you recognize that?
MICHAEL DILLMORE: I do.
MS. NORRIS: What is it?
MICHAEL DILLMORE: This is the FTK report from the Apple search warrant response.
MS. NORRIS: And all of these discs you created yourself from the virtual evidence that you created?
MICHAEL DILLMORE: That's correct.
MS. NORRIS: And you initialed them all with your signature?
MICHAEL DILLMORE: I did.
MS. NORRIS: And once you've received that response for the search warrant for the contents of Charlie Adelson's iCloud, and then you use your programs and your skills to get the FTK report and the Cellebrite report to make them more readable — then what do you typically do with those CDs, with that information?
MICHAEL DILLMORE: Right. Whether it's a CD, DVD, Blu-ray, whatever — I don't typically know all the details of the case; the case investigator does. So I typically give those reports to the case investigator to go through, to determine what's relevant to their case.
MS. NORRIS: So you don't typically review them for relevancy, or evidence that you think may be of value to a particular investigator?
MICHAEL DILLMORE: That's correct.
MS. NORRIS: Okay. Nevertheless, did I ask you to go through certain areas of Charlie Adelson's iCloud and basically look for certain text messages between Charlie Adelson and Katherine Magbanua?
MICHAEL DILLMORE: Yes, ma'am.
MS. NORRIS: And did you in fact do that?
MICHAEL DILLMORE: I did.
MS. NORRIS: May I approach, Your Honor? I'm showing you what I've marked for identification purposes, it's — 68 and 69.
MS. NORRIS: Do you recognize those two photographs?
MICHAEL DILLMORE: I do.
MS. NORRIS: And how do you recognize them?
MICHAEL DILLMORE: Uh, these are pictures that were in the images — remember how it decodes it into certain categories? Under images, these two pictures were in there.
MS. NORRIS: Okay. And those are accurate photographs taken directly from Charlie Adelson's iCloud?
MICHAEL DILLMORE: Yes, ma'am.
MS. NORRIS: They haven't been changed or altered in any way?
MICHAEL DILLMORE: No, ma'am.
MS. NORRIS: Next, I want to show you what I've marked for identification as State's — you said it's like 61, 62, 63, 4, 5, 66, and 67.
MR. DECOSTE: Your Honor, could we see those?
MR. DECOSTE: There may be an objection.
JUDGE HANKINSON: Show them the document.
MS. NORRIS: I'll show them again, yes, sir.
MS. NORRIS: 61, 62.
JUDGE HANKINSON: You may.
MS. NORRIS: It's out of order, so it's basically 61 through 67.
MS. NORRIS: Do you recognize those items?
MICHAEL DILLMORE: Yes, ma'am.
MS. NORRIS: And what do you recognize them as?
MICHAEL DILLMORE: Text messages from the iCloud search response that I processed.
MS. NORRIS: And is there any of those text messages between different individuals directly from Charlie Adelson's iCloud?
MICHAEL DILLMORE: Correct.
MS. NORRIS: And are they accurate as far as what Apple provided in response to the search warrant?
MICHAEL DILLMORE: Yes, ma'am.
MS. NORRIS: The text messages threads, are the dates and times on all those accurate?
MICHAEL DILLMORE: From what I gathered from the search response, yes, ma'am.
MS. NORRIS: Based on the...
MICHAEL DILLMORE: Yes.
MS. NORRIS: Yes. Based on your review of Charlie Adelson's iCloud contents, did the phone number 786-564-1312 appear in the iCloud?
MR. DECOSTE: Objection. Hearsay.
JUDGE HANKINSON: Overruled.
MICHAEL DILLMORE: Yes, ma'am.
MS. NORRIS: And How is that phone number, 786-564-1312, labeled?
MR. DECOSTE: Objection.
JUDGE HANKINSON: How is it what?
MS. NORRIS: Label.
JUDGE HANKINSON: Don't answer the question, please.
MS. NORRIS: Label.
MR. DECOSTE: Objection.
JUDGE HANKINSON: We'll go to sidebar.
JUDGE HANKINSON: Maybe you should re-ask your question, Ms. Norris.
MS. NORRIS: Yes, sir. Thank you, Your Honor.
MS. NORRIS: I'm going to go back one step. Is the phone number 786-564-1312 in Charlie Adelson's iCloud?
MICHAEL DILLMORE: Yes, ma'am.
MS. NORRIS: And how is that number saved in Charlie Adelson's iCloud — as the name associated with that?
JUDGE HANKINSON: And we know there's an objection to that that I've overruled.
MICHAEL DILLMORE: Kaddie.
MS. NORRIS: And how is that spelled?
MICHAEL DILLMORE: K-A-D-D-I-E.
MS. NORRIS: Do that again, I'm sorry.
MICHAEL DILLMORE: K-A-D-D-I-E.
MS. NORRIS: All right. Thank you. I have no further questions.
JUDGE HANKINSON: Cross. Garcia.
MR. ZANGENEH: Nothing from Mr. Garcia. Magbanua.
MR. DECOSTE: Briefly, Your Honor.
MR. DECOSTE: Investigator, good to see you again.
MICHAEL DILLMORE: You too, sir.
MR. DECOSTE: You're going to have to explain this to me like I'm a child. I've got an iPhone.
MICHAEL DILLMORE: Yes, sir.
MR. DECOSTE: Somewhere up there is all my data — my contacts, my emails, my text messages, my multimedia messages, those are the ones with photos and videos, my notes, my reminders — all of that stuff, right?
MICHAEL DILLMORE: If those are the things that you've chosen to sync on your phone. They're not up there — they're on a network of servers somewhere.
MR. DECOSTE: So it's not actually on the phone somewhere? It's not actually up in a cloud, it's stored somewhere in Cupertino?
MICHAEL DILLMORE: It's still on your phone as well.
MR. DECOSTE: But it's also on the cloud. Is what you're saying.
MICHAEL DILLMORE: Correct.
MR. DECOSTE: All right. So I'm able to look at all that data through my phone because there's software in the phone that will organize it.
MICHAEL DILLMORE: That's correct.
MR. DECOSTE: There's a contacts icon, there's a text message icon, there's a call log icon. That's how I can navigate through it, right?
MICHAEL DILLMORE: Yes, sir.
MR. DECOSTE: Now, these programs — you send a subpoena. You didn't send the subpoena in this case. Did you do the search warrant, or was that Investigator Sherry Bennett?
MICHAEL DILLMORE: Correct.
MR. DECOSTE: But you get the stuff back.
MICHAEL DILLMORE: Correct.
MR. DECOSTE: You get a dongle. Is that the—
MICHAEL DILLMORE: USB drive.
MR. DECOSTE: USB drive. So you get that back, and it's got all the data. The data that I get from the cloud onto my phone — you get that data for Charlie Adelson.
MICHAEL DILLMORE: Correct. The data that was synced, yes.
MR. DECOSTE: But you don't have a phone to interpret it.
MICHAEL DILLMORE: Correct, that's why I use my software.
MR. DECOSTE: That's what FTK and Cellebrite does.
MICHAEL DILLMORE: That's correct.
MR. DECOSTE: Right. Cellebrite's a little bit more advanced, though, right?
MICHAEL DILLMORE: In regards to mobile forensics. Yes, sir.
MR. DECOSTE: When you say mobile forensics — again, like I'm a child — help me understand.
MICHAEL DILLMORE: In regards to mobile devices such as cell phones, tablets, GPS devices, those type of things. Yes.
MR. DECOSTE: You're able to see more information.
MICHAEL DILLMORE: Yes, sir.
MR. DECOSTE: You're able to see deleted WhatsApp messages.
MICHAEL DILLMORE: Sometimes, yes, sir, if they're decoded.
MR. DECOSTE: Deleted text messages.
MICHAEL DILLMORE: Yes, sir.
MR. DECOSTE: So if somebody has an iPhone and they delete a chat log, they can't see it on their phone anymore, correct? But when you look into Cellebrite, you can see it.
MICHAEL DILLMORE: Sometimes, yes, sir.
MR. DECOSTE: Now, in this case you received Charlie Adelson's information.
MICHAEL DILLMORE: Yes, sir.
MR. DECOSTE: Right. And as you told Ms. Norris, you took a look at it.
MICHAEL DILLMORE: Correct.
MR. DECOSTE: And within there, there was — and correct me if I'm wrong — around 300,000 text, MMS, iMessage, WhatsApp messages.
MICHAEL DILLMORE: I don't have the numbers in front of me. I'd have to look at a report to be sure of that, but...
MR. DECOSTE: Do you have that report on you?
MICHAEL DILLMORE: On my computer out in the hallway, I do.
MR. DECOSTE: Your Honor, would you allow the witness to go get his computer to refresh his recollection?
JUDGE HANKINSON: I mean, does it matter whether it's 300,000?
MR. DECOSTE: Do you have a ballpark figure?
MICHAEL DILLMORE: There were quite a few, yes, sir.
MR. DECOSTE: In the hundreds of thousands?
MICHAEL DILLMORE: Probably.
MR. DECOSTE: All right, fair enough. And again, that included text messages, MMS messages, iMessages, WhatsApp messages.
MICHAEL DILLMORE: Yes, sir.
MR. DECOSTE: And it included a bunch of deleted messages.
MICHAEL DILLMORE: I believe it did, yes, sir.
MR. DECOSTE: Now, the prosecutor asked you to look at select messages between Charlie Adelson and Katherine Magbanua.
MICHAEL DILLMORE: Yes, sir.
MR. DECOSTE: Let's get a time frame first. This is years' worth of data, correct?
MICHAEL DILLMORE: Correct.
MR. DECOSTE: Actually all of his iCloud data, right?
MICHAEL DILLMORE: Yes.
MR. DECOSTE: There's no limit. When you send the subpoena to Apple, they send everything since the inception of the account?
MICHAEL DILLMORE: Whatever they still have, correct.
MR. DECOSTE: And correct me if I'm wrong, this went back to the early part of this decade,
MICHAEL DILLMORE: I believe so.
MR. DECOSTE: So around 2010, 2011.
MICHAEL DILLMORE: No again, I don't typically go through and do the analysis of the data. I let the investigator do that.
MR. DECOSTE: Now, I'm not going to ask you for the contents of the messages that you've just identified, but in all the messages that the government asked you to take a look at, how many of them does Katherine Magbanua talk about being involved in a murder?
MICHAEL DILLMORE: I don't— in the ones that she asked me to look at?
MR. DECOSTE: Yes.
MICHAEL DILLMORE: None.
MR. DECOSTE: There's only specific conversations that she had you take a look at, right?
MICHAEL DILLMORE: Correct.
MR. DECOSTE: Not all of the messages in between Katherine and Charlie Adelson.
MICHAEL DILLMORE: That's correct.
MR. DECOSTE: You explained to Ms. Norris how normally you would give— let's back up to the explaining to me like I'm a child again. You run your program, you do a Cellebrite report, then you're able to save that onto a CD. Now, whoever has that CD, they can put it in a laptop and then they can navigate the data just like I would navigate on my cell phone, but it's got more advanced search functions, right?
MICHAEL DILLMORE: That's correct.
MR. DECOSTE: You explained to Ms. Norris how you normally give that CD over to a case investigator so that they can take a look at it.
MICHAEL DILLMORE: Correct.
MR. DECOSTE: Did you do that in this case?
MICHAEL DILLMORE: I did.
MR. DECOSTE: Who did you give it to?
MICHAEL DILLMORE: I don't know for specific, but I believe I gave it back to Investigator Bennett, but I'm not positive of that.
MR. DECOSTE: What about Special Agent Patrick Sanford?
MICHAEL DILLMORE: I may have. I truly don't recall.
MR. DECOSTE: What about Retired Investigator Craig Isom?
MICHAEL DILLMORE: Again, I don't recall who I specifically gave it to.
MR. DECOSTE: What other Apple iCloud data were you given in this case to evaluate?
MICHAEL DILLMORE: I believe I was asked to look at Ms. Magbanua's as well.
MR. DECOSTE: Katherine Magbanua.
MICHAEL DILLMORE: Yes, sir.
MR. DECOSTE: Same thing, years' worth of data.
MICHAEL DILLMORE: Yes, sir.
MR. DECOSTE: Thousands, hundreds of thousands of messages.
MICHAEL DILLMORE: A lot of data, yes, sir.
MR. DECOSTE: And again, this isn't just text messages. This is call logs, calendar events, contacts.
MICHAEL DILLMORE: Yes, sir.
MR. DECOSTE: Reminders, Internet searches.
MICHAEL DILLMORE: Correct.
MR. DECOSTE: Basically anything you do on your cell phone through Apple is going to show up in response to that subpoena.
MICHAEL DILLMORE: Yes, sir.
MR. DECOSTE: And you received that data.
MICHAEL DILLMORE: Yes.
MR. DECOSTE: Did the State Attorney's Office ask you to identify any messages in her phone?
MR. DECOSTE: So, no messages or no information tying her to a murder in the years' worth of data off of her cell phone?
MS. NORRIS: Objection. Hearsay and best evidence.
MR. DECOSTE: If I could respond.
JUDGE HANKINSON: It's outside the scope of direct examination. Move on. I sustain the objection.
MR. DECOSTE: That's all, Your Honor. Thank you.
JUDGE HANKINSON: Redirect.
MS. NORRIS: Were there many investigators at the Tallahassee Police Department and the FBI working on this case?
MICHAEL DILLMORE: Yes.
MS. NORRIS: And did y'all spread the tasks amongst different individuals, on different roles you would take on in this homicide investigation?
MICHAEL DILLMORE: Yes, ma'am.
MS. NORRIS: Okay. All right. Thank you. I have no further questions.
JUDGE HANKINSON: Can you step down? Do we need to keep him further?
MS. NORRIS: Yes, sir.
JUDGE HANKINSON: Alright, you remain under the rule of sequestration. Can he go about his business?
MS. NORRIS: Yes, sir.