15.Michael Dillmore — Direct/Cross/Redirect
404 linesMS. NORRIS: State calls Michael Dilmore.
(witness exits.)
MS. CAPPLEMAN: Judge, can we approach while she's getting that witness?
JUDGE HANKINSON: Okay.
(Sidebar discussion held as follows):
MS. CAPPLEMAN: Judge, the State's in a position where we're possibly going to run out of witnesses. I've got two more short witnesses. I can get another one here at 4:45, but that's going to be a lengthy witness. So I'm not sure if you wanted me to get that underway or not.
JUDGE HANKINSON: No. I'd rather break a little bit early than go super late. We have some work after the jury's gone. So --
MS. CAPPLEMAN: Yes, sir.
JUDGE HANKINSON: All right.
(Sidebar concludes.)
COURT CLERK: would you raise your right hand?
whereupon, MIKE DILMORE was called as a witness, having been first duly sworn, was examined and testified as follows:
MS. NORRIS: May I inquire?
JUDGE HANKINSON: You may.
DIRECT EXAMINATION BY MS. NORRIS:
MS. NORRIS: Good afternoon.
MICHAEL DILLMORE: Good afternoon.
MS. NORRIS: Can you introduce yourself to the members of the jury and spell your first and your last name?
MICHAEL DILLMORE: Certainly. My name is Investigator Mike Dilmore with the Tallahassee Police Department. It's Mike, M-I-K-E, Dilmore, D-I-L-M-O-R-E.
MS. NORRIS: And how are you employed at the Tallahassee Police Department?
MICHAEL DILLMORE: I'm an investigator and I do the digital forensics.
MS. NORRIS: Can you give us a little bit of information about your educational background?
MICHAEL DILLMORE: Sure. I have a bachelor's degree in criminology and a bachelor's degree in education, as well.
MS. NORRIS: You said you do digital forensics.
MICHAEL DILLMORE: Correct.
MS. NORRIS: what does that mean?
MICHAEL DILLMORE: Digital forensics is basically the process of acquiring and then examining electronic data with the ultimate goal of preserving the -- any evidence in its original, original form. So without changing any evidence.
MS. NORRIS: And how long have you been doing digital forensics?
MICHAEL DILLMORE: About eight and a half years.
MS. NORRIS: Did you have to receive any kind of specialized training to teach you how to extract data --
MICHAEL DILLMORE: Yes, ma'am.
MS. NORRIS: -- from electronic devices?
MICHAEL DILLMORE: I've had probably about 1400 hours of training in computer-related courses. And a little over a thousand of that has been specifically for digital, digital forensics.
MS. NORRIS: How many of the 1400? I didn't hear you.
MICHAEL DILLMORE: A little over a thousand, I believe.
MS. NORRIS: And are you a member of any professional organizations that deal with dig --
MICHAEL DILLMORE: The International Association of Computer Investigative Specialists. It's called IACIS. Yes, ma'am.
MS. NORRIS: Okay. And if you could just wait until I'm done asking my question so the court reporter can make sure she gets our questions and answers.
MICHAEL DILLMORE: I apologize.
MS. NORRIS: It's okay. In addition to your -- the training that you've received, as well as the memberships you have, do you have any real live, on-the-job experience in digital forensics?
MICHAEL DILLMORE: Yes, ma'am. That's what I do every day, eight anda half years. I don't do anything else but digital forensics at the Police Department.
MS. NORRIS: And have you ever testified in court with respect to that subject matter?
MICHAEL DILLMORE: Yes, ma'am.
MS. NORRIS: About how many times?
MICHAEL DILLMORE: Approximately 20.
MS. NORRIS: Are you familiar with what the Cloud is?
MICHAEL DILLMORE: Yes, ma'am.
MS. NORRIS: what is the Cloud?
MICHAEL DILLMORE: The Cloud, you can kind of consider it -- you know how you have, like, a USB drive for your -- or a hard drive for you computer? It's like that but on the Internet. It's hosted on a network of servers by some company. Things like Google Drive, icloud, Dropbox, those are cloud service providers, where you can store your data on, on the internet so you can access it from somewhere else.
MS. NORRIS: So it's basically just like a backup hard drive you'd have at home but maintained.
MICHAEL DILLMORE: Somewhere else.
MS. NORRIS: Somewhere else in the country.
MICHAEL DILLMORE: Yes, ma'am.
MS. NORRIS: And how do you create the ability to have your own cloud?
MICHAEL DILLMORE: Certainly. You, you create an account with whoever you want to do it, whether it be Google or Apple or Dropbox. And then once you create that account, you can log in from pretty much anywhere and access your data.
MS. NORRIS: where is the -- and you said this is the data you're accessing that's located somewhere else --
MICHAEL DILLMORE: Correct.
MS. NORRIS: -- in the world.
And different companies provide different clouds, you mentioned, like Dropbox, Apple has the iCloud; is that right?
MICHAEL DILLMORE: Yes, ma'am.
MS. NORRIS: And can the Cloud, like, sync amongst all your different devices?
MICHAEL DILLMORE: Yes, ma'am.
MS. NORRIS: And how so?
MICHAEL DILLMORE: So take icloud, for example. If you have an Apple ID, you log in, say, with your iPhone. And then it syncs to icloud. And then let's say you have an iPad, as well. If you log in with the same Apple ID and set it up for syncing, then you can have the same data from iPhone on your tablet, as well.
MS. NORRIS: Can you also then go in and decide what types of data you want synced? For example, if I have a Apple iPhone and I also have a tablet at home, I can choose whether I want to sync photos, for example, or contents or --
MICHAEL DILLMORE: Yes.
MS. NORRIS: -- really anything?
MICHAEL DILLMORE: Yes, ma'am.
MS. NORRIS: And the user can control what is synced and backed up on the Cloud.
MICHAEL DILLMORE: That's correct.
MS. NORRIS: Let's say that law enforcement wants to get ahold of someone's iCloud. How would they go about doing that, getting the contents of their cloud? Excuse me.
MICHAEL DILLMORE: Right. You would have to send legal process to Apple.
MS. NORRIS: what is legal process?
MICHAEL DILLMORE: A search warrant.
MS. NORRIS: Is that a search warrant that, like, a Court would sign off on a probable cause affidavit?
MICHAEL DILLMORE: That's correct.
MS. NORRIS: In this particular case, did TPD issue a legal demand or a search warrant to Apple for the contents of a Charlie Adelson's iCloud?
MICHAEL DILLMORE: Yes, ma'am.
MS. NORRIS: And did icloud -- not iCloud. I'm sorry. Did Apple respond with the contents of Charlie Adelson's icloud?
MICHAEL DILLMORE: Yes, ma'am, they did.
MS. NORRIS: And how does that response get provided to law enforcement?
MICHAEL DILLMORE: In this case, it was provided on a USB drive. And then I -- from there, I took that information onto my computer and started examining it.
MS. NORRIS: Okay. So you received the information on a USB drive, like a flash drive.
MICHAEL DILLMORE: Yes, ma'am.
MS. NORRIS: And then how do you go about -- and you did get that drive in this case.
MICHAEL DILLMORE: Yes, ma'am.
MS. NORRIS: what do you do from there?
MICHAEL DILLMORE: Okay. In this case, when we first got it, I pulled it into a program called FTK, Forensic Toolkit. It's a program that we use, typically for computer forensics. And I was able to extract the -- or decode the information, create a report, and provide that to the investigator.
MS. NORRIS: All right. I'm going to interrupt you because you went ahead of --
MICHAEL DILLMORE: Oh, I'm sorry.
MS. NORRIS: what you get exactly from Apple --
MICHAEL DILLMORE: Right.
MS. NORRIS: -- what does that look like? Can you open it up and read it exactly the way that it is?
MICHAEL DILLMORE: Ah, I see. It's a zipped file.
MS. NORRIS: Okay.
MICHAEL DILLMORE: And it's, it's not typically in a readable, human readable format. You have to use another -- a program to be able to see all of the data.
MS. NORRIS: And the pro -- and I'm sorry. I believe you said the first type of program that you used to try to make it more readable was the FTK report?
MICHAEL DILLMORE: Yes, ma'am.
MS. NORRIS: what is, what is that?
MICHAEL DILLMORE: FTK?
MS. NORRIS: The Forensic, the Forensic Toolkit, what is --
MICHAEL DILLMORE: Right. It's a software program made by access data. And, basically, like I said, we typically use it for computer forensics, but we can also pull in other types of data, such as data from iCloud or other things, as well, to decode the information so that it's easier to read for us.
MS. NORRIS: And what does the Forensic Toolkit give you once you've ran the data originally from Apple through the Toolkit?
MICHAEL DILLMORE: Right. I created a report that contained the data that it decoded.
MS. NORRIS: Okay. Did you perform any other types of extraction or devices or any other programs that you ran this information from Apple through to make it more readable --
MICHAEL DILLMORE: Yes, ma'am.
MS. NORRIS: -- or digestible?
MICHAEL DILLMORE: Yes, ma'am.
MS. NORRIS: what was that?
MICHAEL DILLMORE: Yes, ma'am, I did. I used another program called cellebrite, Physical Analyzer. It's a software made by the company Cellebrite. I pulled the ZIP -- the contents of the zIP file into Cellebrite. It decoded the data. And cellebrite is typically used for mobile forensics, so this was kind of perfect bringing that mobile data from the iCloud into Cellebrite.
MS. NORRIS: And this Cellebrite program, is that something that's commonly -- a commonly used tool by law enforcement?
MICHAEL DILLMORE: Yes, ma'am.
MS. NORRIS: And you know how to use that program?
MICHAEL DILLMORE: Yes, ma'am.
MS. NORRIS: So you have an FTK report, and you also have a Cellebrite report.
MICHAEL DILLMORE: Correct.
MS. NORRIS: Do either of those programs that you're running this original data from Apple through, do they change the contents in any way?
MICHAEL DILLMORE: No, ma'am.
MS. NORRIS: They don't add anything to it or subtract anything from the iCloud?
MICHAEL DILLMORE: That's correct. It decodes what it's programmed to be able to decode, whether it's contacts, call logs, text messages, picture, videos, et cetera.
MS. NORRIS: Do these programs in any way organize the data so that it's -- you can go to a specific category of information you might want to look at and...
MICHAEL DILLMORE: Yes, ma'am. And that's the purpose of them, so that it's, it's a lot easier for us to read. So it -- Cellebrite, in specific, would sort these things into the contacts where we can pull up a tab and see just the contacts or pull open the call logs and see just the call logs all the way through.
(Pause. )
MS. NORRIS: May I approach the witness, Your Honor?
JUDGE HANKINSON: You may.
BY MS. NORRIS:
MS. NORRIS: I'm showing you what I've marked for identification as State's Exhibit 170. Do you recognize that?
MICHAEL DILLMORE: I do.
MS. NORRIS: And how do you recognize it?
MICHAEL DILLMORE: It's a disk that I created, and it has my signature on it.
MS. NORRIS: And what is contained on that particular disk?
MICHAEL DILLMORE: This is the Cellebrite report that I created from the Apple search warrant response for the iCloud.
MS. NORRIS: Okay. And I probably should have started with that one. I will show you next State's Exhibit 171 for identification. Do you recognize that disk?
MICHAEL DILLMORE: I do.
MS. NORRIS: And what's contained on that?
MICHAEL DILLMORE: This is the actual ZIP file that we recovered. we made it -- I made a copy of it, put it on this disk, and it has my signature on it.
MS. NORRIS: The data is the exact response from Apple to your search warrant for Charlie Adelson's iCloud.
MICHAEL DILLMORE: Yes, ma'am.
MS. NORRIS: And then 171 -- 170 -- excuse me, Your Honor -- that we had just looked at, that was after it had been run through the cellebrite report.
MICHAEL DILLMORE: Correct.
MS. NORRIS: And, finally, I'm going to show you State's Exhibit 172. Do you recognize that?
MICHAEL DILLMORE: I do.
MS. NORRIS: what is it?
MICHAEL DILLMORE: This is the FTK report from the Apple search warrant response.
MS. NORRIS: And all of these disks, you've created yourself from the original evidence that you created?
MICHAEL DILLMORE: That's correct.
MS. NORRIS: And you initialed them all with your signature?
MICHAEL DILLMORE: I did.
MS. NORRIS: Now, once you've received that response for the search warrant for the contents of Charlie Adelson's iCloud and then you use your programs and your skills to get the FTK report and the Cellebrite report to make them more readable, then what do you typically do with those CDs with that information on it?
MICHAEL DILLMORE: Right. I would -- CD, DVD, Blu-ray, whatever, I don't typically know all the details of the case. The case investigator does. So I typically give those reports to the case investigator to go through to determine what's relevant to their case.
MS. NORRIS: So you don't typically review them for relevancy or evidence that you think may be of value to a particular investigation.
MICHAEL DILLMORE: That's correct.
MS. NORRIS: Okay. Nevertheless, did I ask you to go through certain areas of Charlie Adelson's iCloud and basically look for certain text messages between Charlie Adelson and Katherine Magbanua?
MICHAEL DILLMORE: Yes, ma'am.
MS. NORRIS: And did you, in fact, do that?
MICHAEL DILLMORE: I did.
MS. NORRIS: May I approach, Your Honor?
JUDGE HANKINSON: You may.
BY MS. NORRIS:
MS. NORRIS: I'm showing you what I've marked for identification purposes as State's Exhibits 68 and 69. Do you recognize those two photographs?
MICHAEL DILLMORE: I do.
MS. NORRIS: And how do you recognize them?
MICHAEL DILLMORE: These are pictures that were in the images. Remember how it decodes it into certain categories under images. These two pictures were in there.
MS. NORRIS: Make sure you leave them down so the jury can't see them.
MICHAEL DILLMORE: sorry.
MS. NORRIS: And those are accurate photographs directly taken from Charlie Adelson's iCloud?
MICHAEL DILLMORE: Yes, ma'am.
MS. NORRIS: They haven't been changed or altered in any way?
MICHAEL DILLMORE: No, ma'am.
MS. NORRIS: Okay. Next I want to show you what I've marked for identification as State's Exhibits 61, 62, 63, 64, 65, 66, and 67.
MR. DECOSTE: Your Honor, if we could see those. There may be an objection.
JUDGE HANKINSON: Show him those documents.
MS. NORRIS: I'll show them, again. Yes, sir.
(off-the-record discussion.)
MR. DECOSTE: We would object to 61, 62...
(off-the-record discussion.)
MS. NORRIS: May I approach the witness, again?
JUDGE HANKINSON: You may.
BY MS. NORRIS:
MS. NORRIS: Okay. Sorry. They get out of order. So State's Exhibit 61 through 67, do you recognize those items?
(Brief pause.)
MICHAEL DILLMORE: Yes, ma'am.
BY MS. NORRIS:
MS. NORRIS: And what do you recognize them to be?
MICHAEL DILLMORE: Text messages from the iCloud search warrant response that I processed.
MS. NORRIS: And those are -- are those text messages between different individuals, directly from Charlie Adelson's iCloud?
MICHAEL DILLMORE: Correct.
MS. NORRIS: And are they accurate as far as what Apple provided in response to the search warrant?
MICHAEL DILLMORE: Yes, ma'am.
MS. NORRIS: Okay. So those text messages threads, are the dates and times on all those accurate?
MICHAEL DILLMORE: From what I gathered from the search warrant response, yes, ma'am.
MS. NORRIS: Based on what they gave you.
MICHAEL DILLMORE: Yes.
MS. NORRIS: Okay. Thank you.
(Brief pause.)
BY MS. NORRIS:
MS. NORRIS: Based on your review of Charlie Adelson's iCcloud contents, did the phone number (786)564-1312 appear in the iCloud?
MR. DECOSTE: Objection, hearsay.
JUDGE HANKINSON: Overruled.
MICHAEL DILLMORE: Yes, ma'am.
BY MS. NORRIS:
MS. NORRIS: And how was that phone number, (786)564-1312, labeled?
JUDGE HANKINSON: How --
MR. DECOSTE: Objection --
JUDGE HANKINSON: -- is it what?
MS. NORRIS: Labeled.
JUDGE HANKINSON: Don't answer the question, please.
MS. NORRIS: Labeled.
MR. DECOSTE: Objection, hear --
JUDGE HANKINSON: we'll go sidebar.
(Sidebar discussion held as follows):
JUDGE HANKINSON: So that's actually objecting before anything was offered, but I guess there was objection to some of the text messages.
Are you offering them, Ms. Norris?
MS. NORRIS: No, sir. Not at this --
JUDGE HANKINSON: You're not.
MS. NORRIS: Not at this time.
JUDGE HANKINSON: Okay. So the only question before the Court at this point is how this phone number is identified on the iCloud.
what is your theory about that's not hearsay, Ms. Norris?
MS. NORRIS: Your Honor, my theory is that it's an assertion. It's not being offered for its truth. And pursuant to Henry v. State, which the citation is 264 So.3d 182. A cell phone list such as a contact log ora contact cell phone are not hearsay when they're being offered to show a link or a connection.
And I'm not offering to prove that Katie -- No. 1, I'd argue not hearsay, there's no assertion. It's a phone number.
But No. 2, in the alternative, it's not being offered for its truth but merely to show a connection between the name Katie and that phone number.
JUDGE HANKINSON: Okay. what do you believe the answer would be from Investigator Dilmore?
MS. NORRIS: Katie.
MR. DECOSTE: I believe that answers the question as to hearsay, because it's identified, and they're trying to prove that the contents from the phone is Katie.
we also have another situation here that she's asking Investigator Dilmore to testify about an item that is not yet in evidence, which is the data from Apple. So he's testifying about something that he saw inside of evidence. So there's another hearsay objection.
If the item goes into evidence and it's also a best evidence argument, because the evidence is going to speak for itself as to what's in there as to it being Katie or not.
Plus, there's no cell phone records as to the identification of the owner of the phone. They're just trying to say that 1312 was saved as Kaddi, K-A-D-D-I, and saying that it must be Katherine Magbanua.
JUDGE HANKINSON: All right. well, are you offering 171 and 172?
MS. NORRIS: No, sir. I had discussed this with defense counsel. This is the icloud that contains all the HIPAA and cli -- the HIPAA-protected information. This is also the icloud that contains numerous statements by Katie about Planned Parenthood and abortions and there's -- that the defense moved in limine. There's still too much to redact. It is thousands and thousands and thousands and thousands of pages of data, which is why I have extracted on State's 61 through 64 the portions that we believe are relevant and he has indicated they're accurate from that. I don't think that I would have to introduce the entire Apple iCcloud in order to introduce excerpts from same.
MR. DECOSTE: We don't object to the authenticity. we would have individual objections as to hearsay. Now, some of the items that were just shown to Investigator Dilmore aren't even conversations between my client and Charles Adelson. They're between a guy named Sully that was a mechanic and Charlie Adelson.
MS. NORRIS: I'm not offering them. I'm not offering Exhibits 61 through 67 at this time. I will offer them with a later witness, at which time the relevance will become clear, and I will make my arguments as to hearsay and relevance. But I'm simply not offering those at this time.
MR. DECOSTE: Humbly, I believe the proper recourse is, once that's entered in, then the evidence can be talked about to have this investigator testify as to what's in the evidence that's later going to be admitted, improper testimony.
JUDGE HANKINSON: So do you want 171 and 172 admitted in their entirety?
MR. DECOSTE: If I can have one moment.
JUDGE HANKINSON: You may.
(off-the-record discussion.)
MR. DECOSTE: Thank you, Your Honor. Our position remains that it -- we don't object to the authentication, but there are hearsay objections to some of the different communications based on who they're with and based on what's in the contents of the communications.
MS. NORRIS: I agree -- I don't agree. I'm saying --
MR. DECOSTE: Possibly it goes in under seal.
JUDGE HANKINSON: All right. There's only one issue, and I know I threw out another issue just to -- for clarification is whether this phone in the records will be identified as connected to Katie. And how are we going to tie that number to Ms. Magbanua? Does the State have evidence to tie that to her?
MS. NORRIS: Yes, sir. There's -- yes.
JUDGE HANKINSON: And how are you going to do that?
MS. NORRIS: We'll do that through additional witnesses when the State -- on Craig Cor -- Sergeant chris Corbitt. I'm just offering it as if it's a call log --
JUDGE HANKINSON: Because, otherwise, there's a relevance issue, also. I'm going to overrule the objection. I find that the fact that Mr. Adelson has her name and phone number in the iCloud suggests a connection between the two. That's not hearsay. So overrule the hearsay objection.
MR. DECOSTE: Okay.
(sidebar discussion concludes.)
JUDGE HANKINSON: Maybe you should re-ask your questions, Ms. Norris.
MS. NORRIS: Yes, sir. Thank you, Your Honor.
BY MS. NORRIS:
MS. NORRIS: I'm going to go back one step. Is the phone number (786)564-1312 in Charlie Adelson's iCloud?
MICHAEL DILLMORE: Yes, ma'am.
MS. NORRIS: And how is that number saved as, the name associated with that number?
JUDGE HANKINSON: And we note there is an objection to that, that I've overruled.
MICHAEL DILLMORE: Kaddie.
BY MS. NORRIS:
MS. NORRIS: And how is that spelled?
MICHAEL DILLMORE: K-A-D-D-I-E.
JUDGE HANKINSON: Do that again. I'm sorry.
MICHAEL DILLMORE: K-A-D-D-I-E.
MS. NORRIS: All right. Thank you. I have no further questions.
JUDGE HANKINSON: Cross. Garcia.
MR. ZANGENEH: Nothing from Mr. Garcia.
JUDGE HANKINSON: Magbanua.
MR. ZANGENEH: Briefly, Your Honor.
CROSS-EXAMINATION BY MR. DECOSTE:
MR. DECOSTE: Investigator, good to see you again.
MICHAEL DILLMORE: You too, sir.
MR. DECOSTE: You're going have to explain this to me like I'ma child. So I've got an iPhone.
MICHAEL DILLMORE: Yes, sir.
MR. DECOSTE: Somewhere up there (indicating) is all my data, my contacts, my e-mails, my text messages, my multimedia messages. Those are ones with the photos and videos?
MICHAEL DILLMORE: They are.
MR. DECOSTE: My notes, my reminders, all of that stuff, right?
MICHAEL DILLMORE: If those are the things that you've chosen to sync on your phone, they're not up there. They're on a network of servers somewhere.
MR. DECOSTE: All right.
MICHAEL DILLMORE: Yes.
MR. DECOSTE: So it's not actually on the phone. It's somewhere -- it's not actually up in a cloud. It's stored somewhere in Cupertino?
MICHAEL DILLMORE: well, it's, it's still on your phone, as well.
MR. DECOSTE: But it's also on the Cloud is what you're saying.
MICHAEL DILLMORE: Correct.
MR. DECOSTE: All right. So I'm able to look at all that data through my phone, because there's software in the phone that will organize it.
MICHAEL DILLMORE: That's correct.
MR. DECOSTE: There's a contacts icon, there's a text message icon, there's a call log icon. That's how I can navigate through it, right?
MICHAEL DILLMORE: Yes, sir.
MR. DECOSTE: Now, these programs, you, you send the subpoena -- now, you didn't send the subpoena in this case, though, did you?
MICHAEL DILLMORE: The search warrants. No, sir, I did not.
MR. DECOSTE: That was Investigator Sherrie Bennett.
MICHAEL DILLMORE: Correct.
MR. DECOSTE: But you get the stuff back.
MICHAEL DILLMORE: Correct.
MR. DECOSTE: You get a dongle, is that the...
MICHAEL DILLMORE: USB drive.
MR. DECOSTE: USB drive. So you get that back and it's got all the data. The data that I get from the Cloud onto my phone, you get that data for Charles Adelson.
MICHAEL DILLMORE: Correct. This -- the data that was synced, yes.
MR. DECOSTE: But you don't have a phone to interpret it.
MICHAEL DILLMORE: Correct. That's why I use my software.
MR. DECOSTE: That's what FTK and Cellebrite does.
MICHAEL DILLMORE: That's correct.
MR. DECOSTE: Cellebrite's a little bit more advanced, though, right?
MICHAEL DILLMORE: In regards to mobile forensics, yes, sir.
MR. DECOSTE: when you say mobile forens -- again, like I'ma child.
MICHAEL DILLMORE: Understood. In regards to mobile devices, such as cell phones, tablets, GPS devices, those type of things, yes.
MR. DECOSTE: You're able to see more information.
MICHAEL DILLMORE: Yes, sir.
MR. DECOSTE: You're able to see deleted whatsApp messages?
MICHAEL DILLMORE: Sometimes, yes, sir, if they're decoded.
MR. DECOSTE: Deleted text messages?
MICHAEL DILLMORE: Yes, sir.
MR. DECOSTE: So if somebody has an iPhone and they delete a chat log, they can't see it on their phone anymore.
MICHAEL DILLMORE: Correct.
MR. DECOSTE: But when you look into Cellebrite, you can see it.
MICHAEL DILLMORE: Sometimes, yes, sir.
MR. DECOSTE: Now, in this case, you received Charles Adelson's information.
MICHAEL DILLMORE: Yes, sir.
MR. DECOSTE: Right? And as you told Ms. Norris, you took a look at it.
MICHAEL DILLMORE: Correct.
MR. DECOSTE: And within there, there was -- and correct me if I'm wrong -- around 300,000 text, MMS, iMessage, whatsApp messages.
MICHAEL DILLMORE: I don't have the numbers in front of me. I have to look at a report to be sure of that. But...
MR. DECOSTE: Do you have that report on you?
MICHAEL DILLMORE: On my computer out in the hallway, I do.
MR. DECOSTE: Your Honor, would you allow the witness to go get his computer to refresh his recollection?
JUDGE HANKINSON: I mean, does it matter whether it's 300,000 or 200,000? I mean, do you have a ballpark figure?
MICHAEL DILLMORE: There were a quite a few, yes, sir. There were a lot.
BY MR. DECOSTE:
MR. DECOSTE: In the hundreds of thousands?
MICHAEL DILLMORE: Probably.
MR. DECOSTE: All right. Fair enough. And again, that included text messages, MMS messages, iMessages, whatsApp messages?
MICHAEL DILLMORE: Yes, sir.
MR. DECOSTE: And it included a bunch of deleted messages.
MICHAEL DILLMORE: I believe it did. Yes, sir.
MR. DECOSTE: Now, the prosecutor asked you to look at select messages between Charles Adelson and Katherine Magbanua.
MICHAEL DILLMORE: Some, yes, sir.
MR. DECOSTE: Let's give a time frame, first. This is years worth of data?
MICHAEL DILLMORE: Correct.
MR. DECOSTE: Actually, all of his icloud data, right?
MICHAEL DILLMORE: Yes, sir.
MR. DECOSTE: There's no limit when you send the subpoena to Apple. They send everything since the inception of the account.
MICHAEL DILLMORE: whatever they still have, correct.
MR. DECOSTE: And correct me if I'm wrong, this went back to the early part of this decade.
MICHAEL DILLMORE: I believe so, yes, sir.
MR. DECOSTE: So around 2010, 2011.
MICHAEL DILLMORE: Again, I don't typically go through and do the analysis of the data. I typically let the investigator do that.
MR. DECOSTE: Now, I'm not going to ask you for the contents of the messages that you've just identified.
MICHAEL DILLMORE: Okay.
MR. DECOSTE: But in all the messages that this government asked you to take a look at, and how many of them does Katherine Magbanua talk about being involved in a murder?
MICHAEL DILLMORE: I don't -- in the ones she asked me to look at?
MR. DECOSTE: Yes.
MICHAEL DILLMORE: None.
MR. DECOSTE: There's only specific conversations that she had you take a look, right?
MICHAEL DILLMORE: Correct.
MR. DECOSTE: Not all of the messages in between Katherine and Charles Adelson.
MICHAEL DILLMORE: That's correct.
MR. DECOSTE: You explained to Ms. Norris how normally you would give -- let's back up to the explaining to me like I'ma child, again.
You run your program. You do a Cellebrite report.
MICHAEL DILLMORE: Yes, sir.
MR. DECOSTE: Then you're able to save that onto a CD.
MICHAEL DILLMORE: Or a DVD or Blu-ray, depending on how big it is, yes, sir.
MR. DECOSTE: Now, whoever has that CD, they can put it in a laptop and then they can navigate the data, just like I would navigate on my cell phone.
MICHAEL DILLMORE: Correct.
MR. DECOSTE: But it's got more advanced search functions, right?
MICHAEL DILLMORE: That's correct.
MR. DECOSTE: You explained to Ms. Norris how you normally give that CD over to a case investigator so that they can take a look at it?
MICHAEL DILLMORE: Correct.
MR. DECOSTE: Did you do that in this case?
MICHAEL DILLMORE: I did.
MR. DECOSTE: who did you give it to?
MICHAEL DILLMORE: I don't know for specific, but I believe I gave it back to Investigator Bennett, but I'm not positive of that.
MR. DECOSTE: what about Special Agent Patrick Sanford?
MICHAEL DILLMORE: I may have. I truly don't recall.
MR. DECOSTE: what about retired Investigator Craig Isom?
MICHAEL DILLMORE: Again, I don't recall who I specifically gave it to.
MR. DECOSTE: what other Apple icloud data were you given in this case to evaluate?
MICHAEL DILLMORE: I believe I was asked to look at Ms. Magbanua's, as well.
MR. DECOSTE: Katherine Magbanua.
MICHAEL DILLMORE: I believe so, yes.
MR. DECOSTE: Same thing, years worth of data?
MICHAEL DILLMORE: Yes, sir.
MR. DECOSTE: Thousands -- hundreds of thousands of messages?
MICHAEL DILLMORE: A lot of data, yes, sir.
MR. DECOSTE: Again, this isn't just text messages; this is call logs, calendar event, contacts --
MICHAEL DILLMORE: Yes, sir.
MR. DECOSTE: -- reminders, Internet searches.
MICHAEL DILLMORE: Correct.
MR. DECOSTE: Basically, anything you do on your cell phone, through Apple, is going to show up --
MICHAEL DILLMORE: If it's synced, yes, sir.
MR. DECOSTE: -- in response to that subpoena.
MICHAEL DILLMORE: Yes, sir.
MR. DECOSTE: And you received that data.
MICHAEL DILLMORE: Yes, sir.
MR. DECOSTE: Did the State Attorney's Office ask you to identify any messages in her phone?
MR. DECOSTE: SO no messages or no information tying her to a murder in the years worth of data off of her cell phone.
MICHAEL DILLMORE: Again, I didn't go through it --
MS. NORRIS: Objection to hearsay and best evidence.
MR. DECOSTE: If I could respond.
JUDGE HANKINSON: well, it's outside the scope of direct examination, also. So move on.
MR. DECOSTE: That's all I have, Your Honor.
JUDGE HANKINSON: I sustain the objection. I sustain the objection.
MR. DECOSTE: That's all, Your Honor. Thank you.
MICHAEL DILLMORE: Yes, Sir.
JUDGE HANKINSON: All right. Redirect.
REDIRECT EXAMINATION BY MS. NORRIS:
MS. NORRIS: Investigator Dilmore, were there many investigators at the Tallahassee Police Department and the FBI working on this case?
MICHAEL DILLMORE: Yes, ma'am.
MS. NORRIS: And did y'all spread the tasks amongst different individuals on different roles you would, you would take on in this homicide investigation?
MICHAEL DILLMORE: Yes, ma'am.
MS. NORRIS: Okay.
MS. NORRIS: Thank you. I have no further questions.
MICHAEL DILLMORE: Thank you.
JUDGE HANKINSON: You can step down. Do we need to keep him further?
MS. NORRIS: Yes, Your Honor.
MR. ZANGENEH: Not from Mr. Garcia.
JUDGE HANKINSON: You want him retained?
MS. NORRIS: Yes, sir.
JUDGE HANKINSON: All right. You remain under the rule of sequestration, Investigator. Can he go about his business, or do you want him to stay?
MS. NORRIS: Yes, sir.