At the trial of Dzhokhar Tsarnaev Tuesday, Tsarnaev’s defense team called several witnesses to the stand before officially resting its case, ending the evidence presentation portion of the trial. Tsarnaev is a 21-year-old former University of Massachusetts Dartmouth student who is accused of placing two bombs at the finish line of the 2013 Boston Marathon, killing three and injuring over 260.
The first witness called to the stand by the defense was Mark Spencer, president of Arsenal Consulting, a data forensics analysis company based in Chelsea.
Spencer testified about evidence found on the Samsung computer of the defendant’s deceased older brother, Tamerlan Tsarnaev. Spencer explained how his company used data forensics software to analyze the Internet search history on the three computers seized related to the case. Spencer said a company member, a native Russian speaker, was instrumental in translation while working on this case, as some files were saved in Cyrillic.
Among the evidence presented in Spencer’s testimony were the Internet search histories of both Dzhokhar and Tamerlan Tsarnaev, an external hard drive and a thumb drive. In the days preceding the Marathon bombing on April 15, 2013, there was a series of about seven swaps where the external hard drive found on Laurel Street in Watertown passed between Tamerlan’s computer, a Samsung laptop and the defendant’s, a Sony 1R6 desktop computer.
Among the things swapped was a PDF file from al-Qaeda’s Inspire Magazine entitled “How to Make A Bomb in the Kitchen of Your Mom,” which detailed the construction of the same type of pipe bomb found at all detonation sites in Watertown.
Spencer explained that the security identifier numbers from these computers were pivotal in determining the interaction between the two brothers in a potential plotting process.
“Each computer has a global unique identifier, used to distinctify each from the other. This is called the security identifier, or SID,” he said. “When we look at files, we ask with which computer is this file associated, which owner is associated with the SID on this list, and what does that SID relate to?”
Spencer explained that the processes of copying a file from the hard drive of one computer, to the hard drive of a mobile drive, and from a mobile drive to a unique computer, all create unique file paths which are traceable.
“There are particular files created on the drive that are associated with the formatting process of formatting a computer hard disk. When you format a hard drive, there will be a suite of objects that will be formed to have it operate properly,” he said.
The security identifiers for the files and folders analyzed from the hard drive found on Laurel Street in Watertown were related to the security identifier of the Samsung laptop. The files were also found on the Sony desktop belonging to Dzhokhar, but Spencer said it was evident that the search and transmission of these files was done by Tamerlan.
“This would appear to indicate that the Inspire [article] was copied from the Samsung laptop to the Sony laptop,” he said.
The PDF was created on Dzhokhar’s computer on Jan. 21, 2012 and transferred from Tamerlan’s via thumb drive on the day Tamerlan left the United States for Eastern Europe.
Spencer’s team also investigated the Internet search history of both Tsarnaev brothers. Both computers showed histories of searches, post-attack, for the Boston Marathon Bombings, but this was the only congruence.
Spencer said while Dzhokhar’s search history was clear of pertinent searches, Tamerlan’s history showed searches for “ruger 95 [a type of gun],” “gun stores in NH,” “gun stores in NH salem,” along with “various versions of the words ‘transmitter,’ ‘receiver,’ ‘silo-scope,’ ‘fireworks,’ ‘firing system,’ ‘detonator’ and ‘the Boston Marathon.’” These searches occurred between March 2013 and four days before the bombing.
The second witness called by the defense was Elaina Graff, a latent fingerprint examiner with the FBI.
Graff explained the technicalities of fingerprint collection.
“Latent prints are usually left in sweat, in oils, the impression left behind by touching with the hand,” she said.
Numerous items were presented, among them cardboard samples, a transmitter, batteries, scraps of exploded backpacks and duct tape from the Boylston bomb scenes, and the lid to the pressure cooker from the Watertown scene. On all of these items, only Tamerlan’s fingerprints were found. There was no evidence of Dzhokhar’s fingerprints on the items, Graff testified.
The defendant’s fingerprints were only found on a Tupperware containing explosive material and fuse left in the Mercedes-Benz SUV, which the defendant abandoned in Watertown, on which his two fingerprints were outnumbered by Tamerlan’s six, Graff said.
When it came to the prosecution’s turn, they focused largely on technical anomalies.
“The bombs didn’t build themselves, the backpacks didn’t carry themselves onto the scene. The absence of fingerprints on an item doesn’t indicate that the person never touched it. They may have worn gloves, or just not have sweaty hands,” said William Weinreb, lead attorney for the prosecution.
“That is correct,” Graff responded. “If there’s not enough matrix on the ridges of a person’s finger, it won’t leave a print. I can only tell if someone touched an item. I cannot tell how recently the impression was made.”
Before the court broke for lunch, there were repeated objections from both the prosecution and the defense over admitted evidence. The sidebars lasted up to 20 minutes.
When the court reconvened, the defense officially rested its case. Closing statements in the trial are set to begin on Monday.
U.S. District Judge George O’Toole dismissed the jury with a stern warning.
“[It is] crucial you do not speak anything of this case,” he said, “even to yourself in the mirror.”
