Stephen Marks' Hearing Testimony--01/10/2011

January 10th, 2011

Stephen Marks

Walgren begins by offering a stipulation regarding the iPhone about to be discussed in Marks' testimony. The stipulation is the iPhone which is about to be discussed is the iPhone taken from Murray on July 28th, 2009, with a phone number of (702) ***-0973. This is the same iPhone Murray had with him on June 25th, 2009. The stipulation is granted.

DIRECT EXAMINATION: MR. WALGREN

Marks states he was a computer forensics examiner in July of 2009. He has since retired. He was employed by the DEA (Drug Enforcement Agency)in Norton, Virginia for 7 years. Marks states his job was to extract evidence from digital devices and then organize it for use by investigators. Marks confirms he has testified previously in such regard, testifying as an expert in the field of computer forensic examination.

Marks confirms he conducted an analysis for Murray's iPhone mentioned above. Walgren begins asking Marks about screenshots and how such pertains to an iPhone.

Marks: AS IT RELATES TO AN I-PHONE, THE OPERATING SYSTEM OF AN I-PHONE WILL SAVE WHAT'S DISPLAYED ON THE SCREEN INTO MEMORY FOR REASONS OF POSSIBLY RECALLING IT. IT'S A TEMPORARY SAVING OF AN IMAGE OF WHAT'S ON THE SCREEN.

Walgren clarifies that "an image" pertains to what someone physically sees when looking at their iPhone, and this image is saved to the memory of the phone.

Marks confirms this image in typically saved in a .jpeg format, as many photos are in this same format.

Walgren: OKAY. AND IS IT PLACED SOMEWHERE SPECIFICALLY ON THE I-PHONE, OR IS IT JUST FLOATING AROUND IN AN OPEN MEMORY SPACE? OR WHERE IS IT?

Marks: BOTH. IT DEPENDS UPON WHETHER THE OPERATING SYSTEM IS MAKING IT AVAILABLE FOR RECALL OR WHETHER IT'S AN IMAGE WHICH HAS BEEN SAVED PREVIOUSLY BUT IS NO LONGER IN USE.

Marks is asked about "allocated space" and states he is familiar with the term.

Marks: YES. ALLOCATED SPACE IS SPACE ON A DIGITAL DEVICE WHICH THE OPERATING SYSTEM IS ACTIVELY USING. IN OTHER WORDS, IF YOU HAVE A STORAGE AREA, THE OPERATING SYSTEM WILL KEEP TRACK OF WHAT'S STORED IN PARTICULAR AREAS WITHIN THAT. AND IT WILL RECALL THAT DATA. UNALLOCATED SPACE IS SPACE WHERE THE OPERATING SYSTEM HAS DETERMINED THAT IT NO LONGER NEEDS THE DATA WHICH IS SAVED THERE AND IN ITS INDEX MARKS IT AS NO LONGER BEING NECESSARY. AND IT WILL BE OVERRIDDEN IN TIME.

Walgren asks Marks if once a screenshot is placed into an unallocated space, would it be overridden eventually? Marks states it is dependent upon the storage on the device, but yes, it would. It will be set up to eventually be overridden if in unallocated space. Marks states the larger the storage area for unallocated space on the phone, the less chance of being overridden.

Marks confirms he conducted an analysis of Murray's iPhone, including an analysis of the unallocated space on the phone. Marks confirms he was able to locate some screenshots.

Marks confirms that some screenshots contain a date. Makrs states some may actually contain a graphic depiction of the date on the screenshot itself. He states for others, if the screenshot coincides with data, sometimes a date can be attached to it that way as well.

Marks confirms there were a large number of screenshots available on Murray's iPhone, but there was a limited number for which he could assign dates.

Walgren shows several exhibits to the defense for which there is no objection.

The first exhibit (People's 46) is a screenshot that was recovered from the allocated space of the iPhone. The screenshot was most recently updated on June 25th, 2009 at 7:03 a.m. This particular screenshot contains the actual date.

Walgren: OKAY. AND BASED ON YOUR TESTIMONY THEN, DOES THIS REFLECT THAT AT 7:03 OR SOMETIME THEREAFTER THE PERSON IN POSSESSION OF THIS I-PHONE WAS VIEWING THIS SCREENSHOT THAT WE SEE HERE IN PEOPLE'S 46?

Marks confirms this to be accurate.

Walgren moves onto the next exhibit which is People's 47. Marks confirms it is a screenshot with a date of June 25th, 2009 at 9:45 a.m., signifying the phone was viewed at that time or later.

Marks states he was able to recover an email during that time. Marks states the email was located in the email database on the phone.

Walgren: OKAY. AND DID THAT E-MAIL ALSO REFLECT AN EXCHANGE OF E-MAILS ALL DATED OR THE RELEVANT ONES DATED JUNE 25, 2009?

Marks: YES. THAT E-MAIL WAS REFERRED TO AS A THREAD WHICH WOULD BE A SERIES OF LINKED COMMUNICATIONS.

Marks is asked to focus his attention upon an email (People's 48) with a date of June 25th, with the greeting "Hi, Conrad" and a an electronic signature from Bob Taylor of Robertson Taylor Insurance Brokers in London. Marks confirms the email was sent from London. Marks confirms the email was sent at 5:54 a.m. Los Angeles time. Marks confirms he was able to retrieve the contents of the email.

Walgren: OKAY. AND IT APPEARS TO BE FROM AN INSURANCE BROKER REGARDING THE UPCOMING TOUR?

Marks: I DON'T KNOW IF HE IS AN INSURANCE BROKER. I KNOW THAT THE SUBJECT MATTER IS THE INSURANCE FOR THE CANCELLATION POLICY, YES.

Marks confirms the email appears to have included "specific inquires" regarding the health of Michael Jackson.

Marks and Walgren discuss how the contents may have been displayed. Marks states the email being discussed would be visible to the reader, the actual verbiage, though a user may use differing applications to view the actual words.

Walgren: AND THAT INCLUDES THE SENTENCE, "YOU CONFIRM THAT AS FAR AS YOU ARE AWARE YOU ARE THE ONLY DOCTOR CONSULTED DURING THE THREE-YEAR PERIOD."

Marks confirms he sees the line reference above.

Walgren: AND PROCEEDING THAT SENTENCE WAS, "I HAVE ADVISED THE INSURERS THAT YOUR RECORDS GO BACK FROM THE PRESENT TIME TO 2006 WHEN YOU FIRST MET WITH M.J. IN NEVADA"; IS THAT RIGHT?

Marks confirms this to be true. Marks confirms there to be a series of questions pertaining to press reports regarding Michael's health. Marks confirms he was able to detect the email was read. The screenshot of the email being read is labeled as People's 50.

Marks states he does see in People's 50 the line, "From Bob Taylor and the to Conrad" as well as the time of 5:54 a.m. Marks confirms the date of June 25th and he can see the greeting "Hi, Conrad".

Marks again confirms the email was read and there was a response to the email.

Walgren: DIRECTING YOUR ATTENTION TO WHAT WAS MARKED PEOPLE'S 49 FOR IDENTIFICATION, WAS THIS THE RESPONSE OF E-MAIL THAT YOU HE OBTAINED FROM YOUR FORENSIC ANALYSIS OF THE I-PHONE?

Marks concurs and agrees the email contains the same subject line which was "Artist Insurance".

Marks confirms the email was from Conrad Murray ("FROM CONRAD MURRAY BEING DOCTOR DOT MURRAY AT G.C.A. AT SBC GLOBAL DOT NET") to Bob Taylor. Marks confirms the reply sent by Murray was sent at 11:17 a.m. Los Angeles time as of June 25th, 2009.

Marks confirms the email begins with "Dear Bob" and is signed with "Sincerely, Conrad Murrray".

Walgren: "THAT AUTHORIZATION FOR RELEASE OF HIS MEDICAL RECORDS IN ORDER TO ASSIST YOU TO PROCURE CANCELLATION INSURANCE POLICY FOR HIS SHOW. HOWEVER, AUTHORIZATION WAS DENIED." GOES ON TO SAY, "IN REGARDING TO THE PRESS INQUIRIES, AS FAR AS THE STATEMENTS OF HIS HEALTH PUBLISHED BY THE PRESS, LET ME SAY THEY'RE ALL FALICOUS TO THE BEST OF MY KNOWLEDGE. SINCERELY, CONRAD MURRAY."

Marks is able to confirm the email sent apparently by Murray was sent at 11:17 a.m. and was created by and sent from the iPhone per a screenshot.

Marks confirms that People's 50 (this is later found to be a mistake, it should be marked as People's 51) is a screenshot for the screen one would use to enter information for an email.

Walgren: AND THE TEXT, YOU CAN SEE WHAT APPEARS TO BE THE BOTTOM HALF OF THE GREETING, "DEAR BOB?"

Marks states "yes".

Walgren: STARTING WITH "I'M IN RECEIPT OF YOUR E-MAIL?"

Marks confirms this to be true. He also confirms the information in the screenshot matches up to the full-email that was recovered.

Walgren: AND THIS KEYBOARD VISIBLE HERE, IS THAT THE KEYBOARD THAT POPS UP ON AN I-PHONE WHEN YOU WANT TO USE YOUR FINGERS TO SEND AN E-MAIL?

Marks confirms this to be accurate. He continues...

Marks: I SHOULD ALSO ADD TO MY PREVIOUS STATEMENT THAT I FOUND A REPLY TO THIS. SO IT DOES APPEAR THAT IT WAS SENT.

Walgren again confirms they are discussing the email that was sent at 11:17 a.m. Walgren concludes his direct examination.

CROSS-EXAMINATION: MR. CHERNOFF

Chernoff asks Marks if there were forwarded emails attached to the email from the insurance broker. Marks confirms this to be true.

Chernoff: AND THE E-MAILS THAT WILL WERE ATTACHED THAT WERE FORWARDED, DID YOU OBSERVE THAT THEY WERE, THEY SEEMED TO BE SENT BACK AND FORTH TO ACCOMPANY INDIVIDUALS REGARDING MICHAEL JACKSON'S INSURANCE ISSUES?

Marks concurs.

Chernoff asks if these individuals were with AEG but Marks is not able to specifically recall. Marks is asked if he recalls someone by the name of Sean Trell in any of the emails but states he cannot recall the name and would need to review the emails to be able to answer. Chernoff asks Marks if the emails are available to him to which he states they are available to him. Chernoff concludes his cross-examination.

Upon re-direct examination Walgren clarifies misstating an evidence item.

He clarifies the following:

People's 46 was the timestamp of 7:03 a.m.

People's 47 was the timestamp of 9:45 a.m.

People's 48 was the email from Bob Taylor sent at 5:54 a.m.

People's 49 is the response by Conrad Murray at 11:17 a.m.

People's 50 is the screenshot reflecting the reading of the email mentioned above.

Walgren states he may have called People's 51 People's 50 by mistake earlier. People's 51 is a screenshot showing the keyboard and the responsive email being sent from Murray to Taylor.

Walgren has nothing further. Chernoff declines to re-cross Marks. Marks is excused.