Scott Matsudaira, March 13, 2014 Paul Murphy v.

Whatcom County

Page 1

UNITED STATES OF DISTRICT COURT WESTERN DISTRICT OF WASHINGTON AT SEATTLE --------------------------------------------------------------PAUL MURPHY, together with his marital community, Plaintiffs, ) ) ) ) vs. ) NO. 2:13-CV-00727 ) WHATCOM COUNTY, WASHINGTON, a ) government entity; WHATCOM COUNTY ) SHERIFF'S DEPARTMENT; WILLIAM J. ) ELFO, together with his marital ) community, ) Defendants. ) --------------------------------------------------------------DEPOSITION UPON ORAL EXAMINATION OF SCOTT MATSUDAIRA --------------------------------------------------------------2:00PM - 2:25PM March 13TH, 2014 Whatcom County Courthouse 311 Grand Avenue Bellingham, Washington 98225 Reported by Kristen M. Uhlig Certified Court Reporter, CCR, CSR Washington CCR #1934

BMA Court Reporters 425-252-7277 3206 Wetmore, Suite 12, Everett, WA 98201

Scott Matsudaira, March 13, 2014 Paul Murphy v. Whatcom County

Page 2
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 EXHIBIT DESCRIPTION PAGE EXAMINATION: I N D E X PAGE ALSO PRESENT: William Elfo Tara Adrian-Stavik FOR WHATCOM COUNTY: Elizabeth Gallery Whatcom County Prosecutor's Office 311 Grand Avenue Bellingham, Washington 98225 FOR THE DEFENDANTS WHATCOM COUNTY & SHERIFF'S DEPARTMENT & ELFO Dale Kamerrer Law Lyman Daniel Kamerrer Bogdanovich 2674 RW Johnson Blvd SW Tumwater, Washington 98512 360.754.3480 FOR THE PLAINTIFFS: Emily Beschen Law Offices of Robert Butler 103 East Holly Street Suite 512 Bellingham, Washington 98225 360.734.3448 A P P E A R A N C E S

BY MS. BESCHEN...............................................3

59....Whatcom County Sheriff's Computer Analysis Report......16 60....Bellingham Police Department, Matsudaira File..........18

BMA Court Reporters 425-252-7277 3206 Wetmore, Suite 12, Everett, WA 98201

Scott Matsudaira, March 13, 2014 Paul Murphy v. Whatcom County

Page 3
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25

SCOTT MATSUDAIRA, having been first duly sworn, was called as a witness herein and was examined and testified as follows:

DIRECT EXAMINATION

BY MS. BESCHEN: Q A Q Can you state and spell your name for the record? Scott Matsudaira. My last name is spelled M-A-T-S-U-D-A-I-R-A.

And are you aware that you have been listed as a witness by the County in a civil lawsuit brought by Paul Murphy?

A Q A

Yes. Okay. Do you know why you were listed as a witness?

Because I assisted with computer forensics work for Deputy -I'm sorry.

Q A Q A

Cooley? Cooley. Brain fart. My bad.

In what way did you assist Deputy Cooley? He contacted our department, our evidence and identification supervisor, Les Gitts, and asked if the Bellingham Police Department would be able to assist with computer forensics work, looking at or securing a copy of a hard drive.

Q A Q

Okay.

And did you secure a copy of a hard drive?

Yes, I did. Just one hard drive or multiple hard drives?

BMA Court Reporters 425-252-7277 3206 Wetmore, Suite 12, Everett, WA 98201

Scott Matsudaira, March 13, 2014 Paul Murphy v. Whatcom County

Page 4
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25

A Q

Well, I made one copy of one hard drive. What did -- well, did you communicate directly with Cooley or did Cooley communicate directly with Gitts and then Gitts communicated with you?

It was a little bit of both.

The first contact was through

Detective Rossmiller straight to supervisor Gitts. Q A Okay. And then Gitts contacted me about the work that was requested and then from that point, Cooley was the one that contacted me. Q Okay. How many times have you had contact with Cooley,

roughly? A Cooley and I -- just phone calls, 20 second phone calls, kind of thing? Q A Q About the case, yeah. Oh, four or maybe five. What was the initial -- was the initial request of you, just to make a copy of this hard drive or was there more requested of you? A Q A Q A The initial request was to make a copy of the hard drive. Were there follow-up requests after that? Yes. What were the follow-up requests? To look for encrypted files on the hard drive and to see if I can get past the encryption to see what the files were. Q Any other requests that were made of you?

BMA Court Reporters 425-252-7277 3206 Wetmore, Suite 12, Everett, WA 98201

Scott Matsudaira, March 13, 2014 Paul Murphy v. Whatcom County

Page 5
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25

A Q

No. Okay. Did they ask you to look at other contents of what was

present on the hard drive? A Yeah. Cooley and I spoke on the phone a lot of times and

mostly it was him asking questions or -- while I was looking at the computer. It wasn't a formal, can you do this and look at It was, what was

this, and then me do an examination on it.

this, and I could quickly do a preview and say, this is kind of what I found. that's... Q A Q A Q A Yeah. Okay. What questions did he ask of you? Well, one was about the encrypted files. Mm-hm. One was about the, I believe, the internet history. the only two specific things that I can remember. Q Related to the internet history, do you -- what specifically did he want to know about the internet history? A I can't remember. I think that it had something to do with I Those are That makes sense. It wasn't a structured full forensic exam, if

where he's been or what he's been doing on the internet.

don't know if there was a specific -- I don't remember there being a specific point or target to what he was asking for. Q A Okay. No. Do you remember if he mentioned Facebook at all?

I remember that I found parts that he had gone to

BMA Court Reporters 425-252-7277 3206 Wetmore, Suite 12, Everett, WA 98201

Scott Matsudaira, March 13, 2014 Paul Murphy v. Whatcom County

Page 6
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25

Facebook. Q A Okay. When I started this examination, it was -- it was -- how would you say it -- I didn't know what I was looking for kind of. didn't know what the case was about. subjects of the investigation were. drive and... Is there this? would look, yes. I would look, yes. Is there this? I I didn't know what the It was just, here's a hard I

It's kind of hard doing an investigation or

examination on something when you have absolutely no idea of what you're looking for. Q Right. Did you answer questions for him about a -- well, at

any point, did you ever examine a different hard drive or was it only ever one hard drive? A Q A Q A Q I made a forensic copy of one. Okay. But I believe that I looked at some other ones. How many other ones did you look at that you recall? Maybe -- I think two maybe. On those two others, do you recall what you were tasked to look for? A Based on the report that I read, I looked at -- tried to look at one hard drive and I couldn't read it, because it wouldn't render, part of the operating system was damaged. other one was the partitions on the hard drive. And the

BMA Court Reporters 425-252-7277 3206 Wetmore, Suite 12, Everett, WA 98201

Scott Matsudaira, March 13, 2014 Paul Murphy v. Whatcom County

Page 7
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25

When you looked at those two other hard drives, how did you look at them? computer? I mean, did you put the hard drive into another How did

Did they bring over a computer for you?

that happen? A All of these hard drives, the two different hard drives and the primary hard drive, like I said, I wasn't privy to any particulars about the investigation. Q A Mm-hm. So I would open them up and make them viewable on my computer screen and then Cooley would come and sit at my desk and look through things. I made myself available in the room or in the

hallway if he had a question about, how do I look at this or what does this mean? He would ask those specific questions and

I would come in and explain those and then I would walk away. Q Okay. Didn't he have the hard drive though too? Why did he

need to look at the one on your computer? A Because when I get a forensic image of a hard drive, it's basically a bit stream copy of the data on the original source, the original hard drive. Q A Okay. I can look at it in such a way where I don't have to boot the computer up. I can pull up the file system on my computer and

see everything, deleted files, or I can sort by types of files or look at the file structure. It is much like the Windows Explorer on your computer.

BMA Court Reporters 425-252-7277 3206 Wetmore, Suite 12, Everett, WA 98201

Scott Matsudaira, March 13, 2014 Paul Murphy v. Whatcom County

Page 8
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25

You can look at the files and go to folders and see what's in those. It's pretty much like that. Without being able to boot

the computer up, with my forensic image, I would just mount that or load that into my forensic software and it would show a directory tree. Q A Okay. Where he would go through and click through the directories and see what files are on there. Q Does it also protect that image so that it can't be altered? And by that -- I'm not sure if I'm using the right terminology. So what I mean by that is, there's going to be certain properties for certain documents and those document properties can't be altered, re-saved, edited -- that sort of thing? A Q A Q Correct. Okay. It preserves the integrity of the data that you're looking at. Okay. How long after you made the first image of the hard Yeah.

drive did you then come to look at the other two hard drives? A Q I don't remember. Did you take notes or write any reports or anything like that about any of the work that you were doing on these? A I wrote a report on the initial forensic image and the initial restore. Q A Okay. But like I said, the things that we looked at were more of an

BMA Court Reporters 425-252-7277 3206 Wetmore, Suite 12, Everett, WA 98201

Scott Matsudaira, March 13, 2014 Paul Murphy v. Whatcom County

Page 9
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25

informal type of thing where he would be looking through things and ask a question and I would answer it. this here? Or it was a, hey, is

And I would look in the computer and say yes or no.

It wasn't ever a structured formal computer forensic examination. Q A Right. So a structured formal computer forensics examination report wasn't written. I would, I guess, akin it to taking a vehicle

to a shop and having the mechanic look at the engine and saying, hey, is the oil okay? fine. Q And he looks and, yeah, it's

But it's not necessarily something that he would --

Was Cooley aware that it wasn't a full formal structural forensics investigation?

Yeah.

I told him that I would -- that was the idea.

I would

bring up the computer for him on the screen and he would be able to look through it at his whim and look for whatever he needed to look for. And I would be there to answer questions

about what he was looking at or if he needed help navigating around or how to open a certain file. Q A Okay. No. Did you get a sense of what he was looking for?

From the initial request from investigator Gitts, it was We weren't to get

pretty clear that we weren't to look at it. involved.

So I was very careful in staying distant from

whatever was occurring. Q And you mentioned that you found two encrypted files on the

BMA Court Reporters 425-252-7277 3206 Wetmore, Suite 12, Everett, WA 98201

Scott Matsudaira, March 13, 2014 Paul Murphy v. Whatcom County

Page 10
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25

computer; correct? A Q A Q A I believe so. Okay. Do you know why or how those files came to be encrypted?

I don't. Okay. I mean, I couldn't -- I know that they were encrypted. I Are

couldn't tell if the program Adobe -- it was a PDF file. you familiar with PDF files? Q A I am.

I didn't know if the program in Adobe encrypted it or it was encrypted in some other manner. encrypted. I just knew that it was

Q A Q

Okay.

And --

There's many different ways to encrypt the files. Is it true that sometimes you may receive an e-mail with a document that's encrypted just to protect that document; correct?

A Q A Q A

Yes. And that's fairly common these days; correct? Yes. Okay. There's also files on the computer that naturally come encrypted that need the log-in for the operating system to decrypt it on the fly. But if you were to look at the file

without looking into the computer, it would be encrypted.

BMA Court Reporters 425-252-7277 3206 Wetmore, Suite 12, Everett, WA 98201

Scott Matsudaira, March 13, 2014 Paul Murphy v. Whatcom County

Page 11
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25

Q A Q A Q

Okay. Did that make sense? It did. Okay. How many times did Cooley come over to take a look at the hard drive or the image of the hard drive?

Three.

There was the first time that he brought the extra hard

drive over to do another restore and then he came over to look at the data after that was done, and then he brought over another -- no. I think that it was around three. I can't be

sure or certain on that. Q Okay. You said that you looked at a hard drive that was

damaged where you couldn't see the information; correct? A Q A Q I believe so. Do you know what the size of that hard drive was? I don't. Okay. drive? A There probably was, but at the time, I didn't. It was more of I couldn't Was there any way to determine the size of that hard

a, here's a hard drive, look at it, what's on it? read it and, okay, and we put it away. Q A Q A Do you know what a migration is? A data migration? Correct. Yes.

BMA Court Reporters 425-252-7277 3206 Wetmore, Suite 12, Everett, WA 98201

Scott Matsudaira, March 13, 2014 Paul Murphy v. Whatcom County

Page 12
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25

Q A

Can you explain to me what a data migration is? Well, the way that I understand it is a data migration would be -- there's a couple different definitions. One would be to do

it intentionally where you want to migrate data from one source onto the other. Q A Mm-hm. There's another source where it's inadvertent where you, through using the computer or connecting the hard drive to something, data automatically gets migrated without the user's knowledge. Q Okay. Could the damage to the damaged hard drive that you took

a look at occur due to migration? MR. KAMERRER: I just want to insert an objection that

it calls for speculation as to what he looked at. Q (By Ms. Beschen) Well, do you understand what my question is?

Do you want me to repeat it? A Q A Q A I understand your question. Okay. Go ahead.

I don't know. Okay. There are many different ways or reasons why a hard drive could become corrupt.

Q A

Okay. It could be intentional. system. It could be a hiccup in the operating It

It could be something as simple as a power outage.

BMA Court Reporters 425-252-7277 3206 Wetmore, Suite 12, Everett, WA 98201

Scott Matsudaira, March 13, 2014 Paul Murphy v. Whatcom County

Page 13
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25

could be a virus.

There's many different reasons why a hard

drive would be unreadable. Q Okay. Do you recall indicating to Cooley in looking at the

damaged drive, that there was a missing master file table that could mean that someone had begun some sort of process to overwrite the contents of the drive, but had not finished doing so? A I don't recall that specifically. I remember finding or not

being able to find parts of the master file table that would enable the hard drive to mount, and discussing with him different reasons why that would happen. I don't believe that

I -- it is a possibility, but I don't think that I gave him an indication of what I thought happened. Like I said, there's

many different reasons why that would happen. Q Okay. Did you also look at a hard drive that had been

partitioned? A Q Well, yes. Okay. All hard drives are partitioned, yeah.

Were you asked by Cooley questions about the

partitioning of a particular hard drive? A Q According to the report, I have -- I did. Okay. Is that report a report that you wrote or -- a report

that someone else wrote? A Q That was a report that Cooley wrote. Okay. Do you recall doing that independently of reading that

in the report?

BMA Court Reporters 425-252-7277 3206 Wetmore, Suite 12, Everett, WA 98201

Scott Matsudaira, March 13, 2014 Paul Murphy v. Whatcom County

Page 14
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25

I don't.

Like I said, a lot of work that I did after the fact

was pretty informal. Q A Mm-hm. It was two years ago. It's unfortunate that a report wasn't I can assume that I did that

written to refresh my memory.

since that's what he wrote in the report, but I don't specifically remember doing that. Q A Okay. Yes. Can you tell me what a partition is? A hard drive -- a bare bones hard drive is a bunch of In order for an

data, ones and zeros, from beginning to end.

operating system to be installed in it, you have to in a sense create a container to house that operating system. It's like a refrigerator without any shelves or containers or anything in there. If you want to put your

leftover turkey in there, you put it in a container or put that in the fridge. Or you have a freezer and a refrigerator that

would be two partitions on the same fridge. Partitioning a hard drive is a way for the operating system or the file system to -- or the system to indicate what type of file system is on the hard drive. So the computer is

able to read it and install or copy or delete or place files onto that partition. Q A Q Okay. Can a partition be created by a virus?

I'm not aware of one being able to do that. Okay. Can you determine, when looking at a hard drive, when

BMA Court Reporters 425-252-7277 3206 Wetmore, Suite 12, Everett, WA 98201

Scott Matsudaira, March 13, 2014 Paul Murphy v. Whatcom County

Page 15
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25

the partition was created? A Q Sometimes. Okay. Can you determine who created the partitions by looking

at the hard drive? A You can speculate by certain aspects of the files and folders that are on that hard drive but, no, you can't pinpoint who was sitting at the keyboard when that was done, if that's what you mean. Q Okay. Let me -- have you ever met Dale Kamerrer, who is

sitting to your right? A Q A Q A Q A Q A Q A No. What about Liz Gallery who is sitting to his right? Yes. How many times have you met Liz? Numerous times over the past 22 years. Okay. Too many times to count. Have you spoken with Liz about this case in particular? Yes. How many times? In total, starting about a year ago -- no. guess on it, I would say, six times. Q Okay. What -- did she ask you questions or provide you with If I had to put a

information? A No. A lot of that was asking for copies of the report or

BMA Court Reporters 425-252-7277 3206 Wetmore, Suite 12, Everett, WA 98201

Scott Matsudaira, March 13, 2014 Paul Murphy v. Whatcom County

Page 16
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25

notifying me that there would be a deposition or asking particular questions. A lot of -- half of the time it was

through Tara, her assistant. Q Okay. (Marked Deposition Exhibit No. 59) Q (By Ms. Beschen) had written? A I believe so. I let her know that the reports existed. I Did you provide Liz with any reports that you

assume that through her job, she will be able to get copies of those reports through our records department. Q Okay. The court reporter has just handed you what's been

marked as Exhibit 59. A Q Yes. Did you have an opportunity prior to today to review these pages? A Q Yes. Okay. Other than what you just indicated to me about not

recalling, not looking at partitions on the second page, was there anything else that you read in this report that you did not independently recall doing or saying? your time to go through it and mark it up. A Q A Q Is this assuming that you have a copy of my reports? I do not have a copy of your reports. Okay. Okay. And you can take

BMA Court Reporters 425-252-7277 3206 Wetmore, Suite 12, Everett, WA 98201

Scott Matsudaira, March 13, 2014 Paul Murphy v. Whatcom County

Page 17
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25

Okay.

So maybe I'm not understanding.

There's things that I

did that are written in my report that are more in depth than what was written in here. Q A Okay. I mean, I could go and look at the first paragraph and then read you a page-and-a-half of my report that reflects that kind of thing. Q I mean, I'm more interested in if there's anything that you don't recall doing, for example, the partitions that you earlier told me that you did not independently recall doing anything in with regard to partitions. So is there anything

else like that that's written in this report by Cooley that you don't recall doing? A Well, the partition thing and the separate hard drive thing. remember working on other hard drives. Q A Mm-hm. And I remember looking at different things, but I couldn't recall exactly what I was -- what I did with them. Q Right. So yes, I'm not asking you to say that he's lying by I'm just I

putting it in this report or anything like that.

wondering which things you don't have an independent recollection of. A Okay. No. There's details in this report that get into more

specifics than I remember, but... Q Do you have a copy of your report with you?

BMA Court Reporters 425-252-7277 3206 Wetmore, Suite 12, Everett, WA 98201

Scott Matsudaira, March 13, 2014 Paul Murphy v. Whatcom County

Page 18
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25

A Q

Yes. Can I have it? MR. KAMERRER: THE WITNESS: I was supposed to go. We can make copies of it. I wrote notes on the first page of where

(By Ms. Beschen) to go, you said?

Can I have them?

Of where you were supposed

A Q

Yes. Okay.

The Whatcom County courthouse, fifth floor.

MR. KAMERRER: whole thing? MS. BESCHEN:

Can we just make three copies of the

Let's go ahead and go off the record for

just a moment and just take a quick break. (Short Recess Taken) (Deposition Resumed) MS. BESCHEN: Going back on the record.

(Marked Deposition Exhibit No. 60) Q (By Ms. Beschen) The court reporter has just handed you what's Going through this, does that

been marked as Exhibit No. 60.

appear to be all of the reports that you wrote in connection with this case? A Yes. There is one report that crime scene investigator Gitts

wrote. Q A Do you know what his report was about? His report was the initial contact from Rossmiller, from the

BMA Court Reporters 425-252-7277 3206 Wetmore, Suite 12, Everett, WA 98201

Scott Matsudaira, March 13, 2014 Paul Murphy v. Whatcom County

Page 19
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 Q A Q A Whatcom County Sheriff's Office. Okay. And that is --

Making the request. -- inside the exhibit as well? Yes. MS. BESCHEN: may have some for you. MR. KAMERRER: MS. BESCHEN: I have no questions. All right. Thank you. Okay. I have no further questions. He

(Signature Reserved) (Deposition Adjourned)

BMA Court Reporters 425-252-7277 3206 Wetmore, Suite 12, Everett, WA 98201

Scott Matsudaira, March 13, 2014 Paul Murphy v. Whatcom County

Page 20
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25

C E R T I F I C A T E

STATE OF WASHINGTON ) ) COUNTY OF ISLAND )

ss.

I, Kristen M. Uhlig, the undersigned CCR in and for the State of Washington, do hereby certify: That the annexed and foregoing deposition of the witness named herein was taken stenographically before me and transcribed by me; I further certify that the witness examined, read, and signed the deposition after the same was transcribed, unless indicated in the record that the parties and the witness waive the signature; I further certify that all of the objections made at the time of said examination to my qualifications or the manner of taking the deposition, or to the conduct of any party, have been noted by me upon said deposition; I further certify that I am not a relative or employee or attorney or counsel of any of the parties to said action or counsel, and that I am not financially interested in the said action or the outcome thereof; I further certify that the deposition, as transcribed, is a full, true, and accurate transcript of the testimony, including all questions and answers, and all objections, motions and exceptions of counsel made and taken at the time of the foregoing examination; I further certify that I am sealing the deposition in an envelope with the title to the above cause thereon and marked "Deposition Upon Oral Examination" of said witness and promptly causing the same to be delivered or forwarded to Counsel for the Opposing Party; IN WITNESS THEREOF, I have hereunto set my hand and affixed my official seal this ___ day of____________, 2014.

__________________________ Kristen M. Uhlig, #1934 Certified Court Reporter, Residing in Clinton, Washington.

BMA Court Reporters 425-252-7277 3206 Wetmore, Suite 12, Everett, WA 98201