Future Focus, Inc

Future Focus, Inc.

PO Box 2547
Woodinville, WA 98072
phone(425)489-0446
toll free (888) eSieuth
fox (206) 374-2321
www.eSieuth.com
Analysis of computer hard drives from the
technical enquiries
Whatcom County Sheriff's Office
Re: Murphy vs. Whatcom County ... Al20012-001
Receipt of Item 2, 20 GB hard drive on July I, 2013
if:J February 17, 20/.J
Caution Jnformation contained in this
report is highly sensitive in nature.
Distribution should be limited.
This report contains law enforcement
sensitive material and photos of victims.
Page 1 of73
1 Opinions
Tbis report is a statement of my opinions that I will express and the basis and reasons for them.
All the forensic work described in rhis report was personally supervised or performed by me.
Under penalty of perjury I certifY that the mmerial in this report true and correct to the best of my
knowledge.
Signed and dated by me this
Jay of ..... : ...... =: ........................................
G Mitchell
Digitally signed by G Mitchell
DN: c n ~ Mitchell,
email=gmitca:eSieuth.com
Date: 2014.02.17 11:20:57 -08'00
Gordon L Mitchell. PhD. CPI'. CISSP
I
c Fchruan 1 _ :!0 I-!
t(t
Note: the r ~ f e r e n e s are shown in bold they refer to the items shown in the Resources section of this report on page 25
Questions to be answered by examining the 20GB hard drive included:
Q 1: Does the hard drive operate normally?
Q2: Do files on the hard drive match the load in 9/9/09 programs
Q3: What personal nics are on the hard drive?
Q4: What was the extent of personal web surfing?
QS: Were personal photos, documents and spreadsheets stored on the computer?
Q6: Were work-related resources used to generate personal files?
Q7: Could 20GB hard drive function in a Tough book with the programs and data that were standard for the Whatcom
County Sheriffs Office?
Q8: Would it make sense to replace 80 GB hard drive with 20 GB hard drive?
Questions to be answered by examining the 80 GB hard drive included:
Q9: Does the hard drive operate normally?
Q 10: Do files on the hard drive match the load in 9/9/09 programs?
Q 11: What personal files are on the hard drive?
Ql2: Was the extent of personal web surfing?
Ql3: Were personal photos, documents and spreadsheets stored on the computer?
Ql4: Were work-related resources used to generate the personal files?
Consolidating dates from evidence items 80GB image 1, Interview with IT and Tough book configuration the following time line
was generated to assist in exolainin
Future Focus, Inc February 17, 2014 Page 4 of73
Considering the questions above and available evidence I reached the following opinions. The
following are considered more probable than not based on a reasonable degree of engineering
certainty.
Q I: Does the hard drive operate normally?
Q2: Do files on the hard drive match the load in 9/9/09 programs
Q3: What personal files are on the hard drive?
Q4: What was the extent of personal web surfing?
Q5: Were personal photos, documents and spreadsheets stored on the computer?
Q6: Were work-related resources used to generate personal files?
20 GB hard drive was defective; the contents of the hard drive were not visible making Q2-Q6
unanswered. For more information on the basis for this opinion see page 7.
Q7: Could 20GB hard drive function well in a Toughbook with the programs and data
that were standard for the Whatcom County Sheriffs Office?
No (even if it was not defective). Operating a computer system that required 17.8GB on a 20
GB drive would not be practical. With only 2GB of empty space on the hard drive, added data,
restore points or other system files would slow the computer to the point of making it unusable.
A file generated by hibernation of the computer could by itself take 512 MB of the available
space. This calculation is not as significant as noting that according to Tough book
configuration the hard drive provided with this computer was apparently changed down from 80
GB to 20GB.
Q8: Would it make sense to replace 80GB hard drive with 20GB hard drive?
The hard drive size for this Panasonic Tough book as procured on 4/13/06 was 80GB according
to 9/9/09 programs. It is more probable than not that a change from 80 to 20 GB would NOT be
done by or approved by IT technicians.
In 2009 replacement 80GB 2.5" hard drives cost about $45 (source: archived quotes from
Amazon and Newegg). There is no good economic, mechanical or performance reason for
putting a smaller capacity hard drive into the Toughbook. It is clear from Tough book
configuration that there were no limitations requiring a smaller capacity hard drive since the
Tough book of concern came with an 80 GB drive.
Answers from examining the 80 GB hard drive included follow.
Q9: Does the hard drive operate normally?
Yes. 80 GB hard drive worked well and it was possible to produce 2 forensic images from it.
More information on the basis for this opinion is on page 9.
Future Focus, Inc !:)February 17, 201-1 Page 5 of73
Q I 0: Do files on the hard drive match the load in 9/9/09 programs?
Almost. 80 GB hard drive included the programs in 9/9/09 programs and in addition had
programs for playing audio and video files. I asked John Dahlquist about these additions. He
stated in Interview with IT that they included Apple programs (Quick Time. Bonjour, iTunes),
Real Player, WinAmp, VLC player. The additional files were added by county technicians to
allow deputies to review audio and video files as part of their work.
Qll: What personal files are on the hard drive?
See the answer to Q 13.
Q12: Was the extent of personal web surfing?
In the period of time which has browser activity records, August 2011- February 2012, personal
web surfing was estimated to be about 74% of the total of work+ personal surfing. Personal
surfing was done on approximately 6 days per month with about 1 minute of surfing on each of
those days- with the exception of 2/9/12 which had about 93 minutes and 2/10/12 which had
about 154 minutes.
Browser records are not available before 5/3/11 when 80 GB hard drive was cloned to eliminate
a virus and in May-July 2011 for unknown reasons.
For more information on the basis for this opinion see pages 17 and 22.
Q 13: Were personal photos, documents and spreadsheets stored on the computer?
Personal photos represented about 2% of the total number of images; work represented 31% of
total images on 80GB image 1. I am not familiar with county policy or department practice so
could not judge if this is significant or not.
Personal documents, e.g., from Microsoft Word, represented about 1% of the total number of
document and about I% of the work documents on 80GB image 1. I am not familiar with
county policy or department practice so could not judge if this is significant or not.
No personal spreadsheets were discovered.
For more information on the basis for this opinion see pages 12, 15 and 16. Thumbnails of the
documents categorized as personal are in Appendix E- thumbnails of personal documents, on
page 72. Thumbnails of the pictures characterized as personal are on page 13.
Q14: Were work-related resources used to generate the personal files?
No. More information on the basis for this opinion is on page 13.
Future Focus, Inc FebruaJJ! 17, 20J.I Page 6 o/73
2 Facts and data
Photos of evidence items and imaging equipment, on the cover of the report and in this section
were processed by adjusting exposure and contrast, not editing individual items within the photo.
Copies of all images are available in a raw format.
On July I, 2013 I traveled to Bellingham to the Whatcom County Sheriffs Office and met with
Inspector Steve Cooley who provided evidence items 20GB hard drive and SO GB hard drive.
Note: when resources are shown in bold they refer to the items shown in the Resources section
of this report. See page 25.
The 20 GB hard drive was identified as being the hard drive which was in the Whatcom County
Sheriffs Office Panasonic Toughbook computer used by Paul Murphy and turned in to the IT
department in the fall of2010. See more details in the Resources section ofthis report on page
25.
20 GB hard drive with its Panasonic Tough book shock absorbing container.
This hard drive was found to be defective. Its motor runs but the hard drive could not be
mounted (electrically connected and logically able to communicate) to produce a forensic image.
This indicates that it would not have been operable in the Tough book.
Future Focus, Inc < Februm:v 17, 20/.J Page 7 of73
20 GB hard drive attached to a WiebeTech Ditto
Somre: . "''"""''"'' C
Ues!la;J!lun:
I
c
Uel
VI
No source hard drive (20GB hard drive) is seen, zoom in to show details
Fttlllre Focus, Inc@ February 17, 20 l.J Page 8 of73
A second hard drive identified as being in the Whatcom County Sheriffs Office computer used
by Paul Murphy until his departure from the Sheriffs Office was delivered to me by Inspector
Steve Cooley.
Shock mount container holding 80GB hard drive
80 GB hard drive connected to WiebeTech Ditto for imaging
Forensic images were produced from 80GB hard drive onto freshly wiped hard drives. 80GB
image 1 was retained by Future Focus for analysis and 80GB image 2 transferred to Inspector
Steve Cooley.
Because these images were produced by connecting 80GB hard drive to the source side of the
WiebeTech Ditto the 80GB hard drive was protected from alteration. A detailed record of this
operation was produced by the WiebeTech Ditto for each imaging operation and is identified as
Image 1 log and Image 2 log.
Future Focus, Inc if) February li, 20/.f. Page 9 of73
80 GB image 1 and 80 GB image 2 were separately imaged
80GB image 1 was analyzed using X-Ways Forensics version 17.1 SR-I x64. Initially the hard
drive was found to contain 69,354 files but refinement with a particularly thorough file system
data structure search, a file header signature search, extraction of the contents of ZIP and RAR
archives, etc. produced an additional 62,571 files for a total of 131,925 files.
Browser history files were from collected Internet Explorer history files and from fragments
extracted with HstEx 3.8 and analyzed using Net Analysis 1.54.
Important questions to be answered by analysis of 80 GB image 1 included:
Q9: Does the hard drive operate normally?
QJO: Do files on the hard drive match the load in 9/9/09 programs?
Q ll : What personal files are on the hard drive?
Q 12: Was the extent of personal web surfing?
Ql3: Were personal photos, documents and spreadsheets stored on the computer?
Ql4: Were work-related resources used to generate the personal files?
The first step for analysis was to recover files from 80 GB image 1.
Future Focus, Inc@ February 17, 201../ Puge 10 of73
Total files 69,354 initially, 131,925 after recovery of files not recognized by the file system.
File system: NTFS
Total capacity: 80,023,716,864 bytes= 74.5GB
Sector count: 156,296,322
Bytes per sector: 512
Bytes per cluster: 512
Free clusters: 120,021,730 = 77% free
Total clusters: 156,296,321
The file structure on the only partition of 80GB image l is shown below
B Partition 1
Path unknown
SExtend
!I! SWIN_NTS.-BT
CAD
Administrator
All Users
--.J cwilsonl
cb :...J Default Ustr
!H ....J dscott
cp .....J jdalquesl
8J -..J LocaiService
[f' r-JetvvorkSer;ice
[8
cE Whatcom
e2742baffa4990fc010444
tiJ .....J MSOCache
ED Novell
ffJ PocketJet V1.5
m PocketJet V6
f!J ._j Program Files
ffJ .....J RECYCLER
GJ System Volume Information

ch ....J WINDOWS
XP SP3
Yahoo Widgets
Numbers in parentheses indicate the number of intact files under each folder.
Future Focus, Inc @ Februmy 17, 201./ Page II of73
Files were filtered to select pictures including the file types shown in Appendix A- picture file
types.
Pictures using above filter result 40,657 files. To avoid obvious errors in carving files from the
hard drive pictures over 3MB were not considered. Small files, typically tiny details ofwebsites
such as arrows, clip art, and fillers were also excluded by not considering files that were less than
70 kB.
The results of analysis of the recovered photos categorized them as follows.
Damaged or partial or unknown web site, 717 images
Work, 333 images
Personal, I 7 images
Summary of images including recovered deleted images
Neal Rothenbuler photos were categorized as work because of their location on the hard drive.
They were in "Follow-up's & Wanted folder" "\Documents and
Settings\pmurphy\Desktop\Follow-up's & Wanted's\NR"
3 naked woman pictures (not included in pictures exported for this report) were files categorized
as work; they were from "\Documents and Settings\pmurphy\Desktop\To Sort Later\WCSO
reports\20 II\ II A 19573 Cyberstalking"
Among the I 067 pictures the naked woman pictures are the only ones that have an original
image size of 1280xl024. This check was done as a quick check to determine ifthey were
pictures related to others on the hard drive. They appear to not be despite being from a Pentax
camera model which is common to many of the work pictures.
The 3 pictures were
IIAI9573 Cyberstalking- 3.jpg
II A 19573 Cyberstalking - 4.jpg
IIA 19573 Cyberstalking- 5.jpg
I am not familiar with Whatcom County policy with regard to computer use policy nor the actual
practice of county employees. Consequently, l used an inclusive standard for classifying photos
as personal. If a photo in the size range examined (70 kB to 3 MB) was classified as personal if
it was NOT
Clearly of a law enforcement nature because of content or location on the hard drive
Obviously a small feature of a web site like a small feature, clip art or photo
A picture of a public figure such as might be seen on a web site
An image provided by a software manufacturer
A defective image, typically pa11ially overwritten or blank.
Future Focus, Inc (f) FebrumJ' 17, 20/./ Page 12 of73
The following photos were classified as personal
29307_100474936
670017 _10000122
5320620_1456_23
95331_n.jpg
Dc17JPG
Dc19JPG
Dc21JPG
Dc23JPG
Dc16JPG
DclBJPG
DclOJPG
DcllJPG
Dc24.JPG
I examined the question "Were the photos with names beginning in "De" which appear to be
personal taken with a camera used for work photos?"
The naming of these 9 photos is different from others on the computer. According to the
embedded EX IF data (see Wikipedia.org for more information on EXIF) provided by the camera
they were taken with the same model (Pentax Optio WPi) camera as 333 other images.
Unfortunately the EXIF data for this camera doesn't record a serial number which would resolve
this question.
Future Focus, inc February 17, 20/./ Page 13 of73
A comparison of the EX!F data from image Del 7.JPG and image IMGPOOOJ.JPG is show
below. White background lines are the same in both; red background lines are from
IMGPOOOJ .JPG; green background lines are from De 1 6.JPG. The lines that are different
between the two photos are variables like light level which would be expected to change
between different scenes.
Focal Length In 35n:m Format
Scene Capture Type
Contrast
Saturation
Image Height
Encoding Process
Bits Per Sample
Color Components
Y Cb Cr Sub Sampling
38 IT .. "n
Standard
llormal
Normal
(old-style)
2112
Baseline DCT
1
Huffman coding
: 8
3
YCbCr4:2:2 (2 1)
3.3
Comparison of EXIF data from De 1 7.JPG and image !MGPOOO 1
In order to discover other possible links between the images, IMGP0028.JPG was examined for a
signature of dirt on the camera sensor, black or white pixels. None was noted.
Considering these factors, there is not enough data to determine if the photos starting with
filenames starting with "De" were taken with the same camera used for work-related pictures on
the hard drive. They could have been but the comparison above doesn't rule out the use of a
personal camera that is the same model as the one used for work photos.
Work photos are shown in Appendix B -work photo thumbnails, page 51. Miscellaneous
photos are shown in Appendix C- miscellaneous photos, page 59. Photo files are attached as
folders shown in Appendix D --attached material, page 71
Future Focus, Inc (Q February 17, 201-1 Page 14 of73
Spreadsheet files were recovered by the file extension, e.g., ".xlsx" in the master file table and
were found elsewhere by the signature bytes that define the file. This carving operation can
yield files that were deleted long ago. Files that were carved from unallocated clusters include
the following file types.
xla- MS Excei/Addin
xlk- MS Excel backup
xlr- MS Works spreadsheet
xis- MS Excel spreadsheet
xlsx- MS Excel 2007
xlsm- MS Excel 2007
xlt- MS Excel template
xltx- MS Excel 2007 template
xlw- MS Excel 4.0 workbook
Spreadsheets were sorted by examining each of the 568 files satisfying the filter criteria shown
above. They were separated into categories
568 spreadsheet files were sorted into categories
Mise 91, damaged files, spreadsheet samples from Microsoft
Work 47, files showing Whatcom County forms, procedures, spreadsheet templates
Personal 0, do not fit in the categories above
Categorized spreadsheet files
Spreadsheet files are attached as folders shown in Appendix D -attached material, page 71.
Future Focus, Inc Februm:v 17, 2014 Page 15 of73
Files were filtered to show common file types which are generated by word or text processing
programs.
rtf- Rich text
wp5 - WordPerfect
wp5 - WordPerfect
wpd - WordPerfect
wpp - - WordPerfect
wps- MSWorks
doc-MS Word
docm- WS Word document- macro enabled
docx- MS Word 2007
dot- MS Word template
dotx- MS Word 2007 template
1643 document files were examined and moved into the following folders
Mise 384- files not clearly work or personal, e.g., tiles provided with commercial software.
Work 1248- files that appear to be work related
Personal 12- files that appear to be personal
Categorized document files
Document files are attached as folders shown in Appendix D- attached material, page 71
Files categorized as personal are illustrated in thumbnails shown in Appendix E- thumbnails of
personal documents, page 72.
Future Focus, Inc February Ji, 201-1 Page 16 af73
vs.
In order to understand the web site history a summary was generated. The following is the first
of 135 pages. This page has the most popular web sites. Note that this analysis is for all users of
the computer.
NE'tANAl.YSiS
C8se Releence: Cmm;y ,AI 2tt2-1Xl1
e., G"rct'm M,t,r.en future
Future FOcus, Inc 'February 17, 201-1
l'm>teU:
l<mf Jcne Setl":\1: f3M,c $tan<lartllime (llTC -OCMJ
Page 17 af73
The breakdown of each user's browser activity by different web locations, Universal Resource
Locators (URLs) is:
25,702 URLs, user unspecified, e.g., browser checking site configuration or blocking ads
7232 URLs, whatcom
1459 URLs, pmurphy
28 URLs jdalques 1
7 URLs, cwilson
3 URLs, SYSTEM
1 URL, administrator
Overall browser activity
The total number of URLs shown here is not a direct indication of how many web sites were
visited, however, since multiple URLs are needed to get all of the information needed to display
a web page on the browser. For example, in less than 3 seconds on 2/10112, 13 different URLs at
were accessed by user pmurphy. All of these appear to provide different parts of the same page.
Focusing only on the web activity (not cookies, local computer Jiles, and cached objects) of user
pmurphy, Internet Explorer history includes the following sites.
abigailadamsproject.com
link.brightcove.com
nation.foxnews.com
rope.zmle.iimc.net
twitter.com
update.microsoft.com
weblink.co.whatcom.wa.us
www.art2superpac.com
www.facebook.com
www.google.com
www.marklevinshow.com
www.rushlimbaugh.com
www.scribd.com
www.update.microsoft.com
www.whatcomcounty.us
Full/re Focus, Inc FebrumJ 17, 201../ Page 18 of73
A number of web sites had varying addresses, for example, the scribd website includes:
scribdassets.com
imgv2-4.scribdassets.com
imgv2-1.scribdassets.com
imgv2-3.scribdassets.com
imgv2-2.scribdassets.com
Scribd.com
Simplifying the web site ranking by combining the variants of top web sites
Rank Site Personal Work
1 scribd 732
2 microsoft 360
3 face book 319
4 rushimg 110
9 whatcomcounty 81
11 marklevinshow 62
13 abiga iladamsproject 44
Totals 1267 441
User pmurphy site ranking from browser history
Items that appear to be personal or work related are indicated in the table above.
The conclusion from this site ranking is that personal use is about 3 times the work use of the
browser on this computer. An overall view of the most popular browser sites including cookies
is shown on the following page.
Fwure Focus, Inc@ February 17, 201../ Page 19 of73
G.;r Scrfbd Mobl!o;
Popular web sites
Scribd
Microsoft
Connect with frhmds and tho
Facebook ' - -
.. .... ... ... ..
woddl #
3
r Facebook.
Rushimg

Whatcomcounty
-!-
Marklevinshow
abigailadamsproject
1'- ll'l!dNtmh.ow(om
Notes: User pmurphy web site visits for most popular sites were over a range
of dates. Screen shots to illustrate the top personal interest site images taken
from the Internet on August 2013. Ranking of each from the consolidated site
ranking table is shown.
Future Focus, Inc@
1
S) FCbruary 17, 20/.J Page 20 of73
Sign Up
r:; free
B
Web sites identified in Web activity interrogatories are compared with sites which are
mentioned in browser history (as above) as well as cookies and cached files.
Web sites in interrogatories compared with Browser history
Paul Murphy posted to, per
Seen on 80 GB hard drive
Web activity interrogatories
facebook facebook.com, facebook.net,
fbcdn. net, vMvl, facebook. com
twitter twitter.com
TeaPartyCommunity
linkedin linkedin.com,
FreedomNetworks
FreedomTorch
scribd scribd.com, www.scribd.coo
iatn
WhatcomUncovered
SweeneyPolitics
SlideShare slideshare.net
BellinghamHerald
ebay
RateMyCop
WcsoGuild
Craigslist craigslist.ca
EasternDoor
BoardHost
wafop24
kl03radio
ancestry
PoliceOne policeone.com, www.policeooe.com
KeepAndShare keepandshare.com
Blogspot blogspot.com
JohnKBennett
OperationScreamingEagle
ning
Atlas5hrugs2BBB
TypePad typepad.com
MohawkNationNews
PatriotActionNetwork
Future Focus, Inc FebruaiJ' li, 201-1 Page 21 of73
Internet Explorer was the only browser on the computer. Looking at
a screen shot of Net Analysis browser history we see:
'0"11 >/3/'<)llB-:lllX""T""
Jr.-. '-'
J M U
C !':Jt.:l';M<T-" !::Jt:)Ot'"':'Joc ! Pk=<
[magnify page to see details]
A total of27,780 events were recovered from Internet Explorer activity. User pmurphy browser
activity started on 5/411 I but wasn't more than a few hits per month till 8/411 I. After that usage
is summarized in the following table.
This includes a total of 4272 items from the browser history records. This large number is
somewhat misleading since items here can represent portions of a web page such as a tiny icon
or button. A session on I/26/I2 illustrates this where JavaScript, images, portions of a website,
arrows and icons are downloaded at the rate of 65 per second. This is likely all making up just
one composite image shown by the browser.
A balanced way of looking at personal use of the browser for personal Internet surfing is to
observe the time spent per day. The following table shows personal Internet usage for user
pmurphy for the time that this hard drive was active after it was repaired on 5/311 I.
Month Days with any Typical activity per Comments
activity day
8/1 I 10 I minute
911 I 7 2 minutes 7 minutes on 9/8
I 0/11 0
II III 2 I minute
12111 2 I minute
III 2 7 I minute
2/12 2 33 minutes, On 2/9/12
154 minutes and 2110112
User pmurphy web surfing averages 6 days/month, I mm/day except on 2/9/12 and 2/10/12
Future Focus, Inc February 17, 20l.f Page 22 of73
According to Interview with IT standard 80 GB Panasonic Toughbook hard drives that were
issued to deputies such as Paul Murphy were loaded with the standard 80GB software and basic
data by cloning a hard drive. The programs on that load were enumerated in 9/9/09 programs.
Panasonic Toughbook CF29 Mk4 WC AT# 17451
Restored Symantec Ghost image dated Sept, 9, 2009 from AT#l7292 I DBurks
*Single NTFS partition usin 11 available disk space (80 GB)
The description of data in 9/9/09 programs indicates clearly that the standard Tough book hard
drive was 80 GB.
V401 Associated Text Window
Order- 56427 Type- OP Line- 1.000 Print Before N
40 CF29 PM738 S. 3 775.00 151 000.00
256MB 8OGB SHilCK MTD HDD ......._
56K MODEM
802.11A+B+G 13.3"XGA TOUCHSCRN
DISPLAY FILM BACKLIT
ION BAT,WTN XP SP2,
AC ADAPTER FDD DR 3YR WARRAN1'Y
40 512MB R.A!\l UPGRADE INSTALLED 88.00 3,520.00
40 TOUGHBOOK CF29 LOCKING ADJ TRAY 158.00 6.320.00
40 DC POWER ADAPTER (BARD. WIRED) 112.00 4 480.00
Further confirmation of the 80GB hard drive size is provided in Tough book Configuration
A calculation of the amount of room needed to accommodate the standard programs, system files
and user-specific data can be started with the load from 9/9/09 programs shown in the summary
for the C:\ drive.
Future Focus, Inc February 17, 20/.J Page 23 of73
~ I
Type: Local Disk
File sys-tem NTFS
_ll Used space: 10.108.959232byte; 9.41 GB
R Free space: 69,914.757,120byte; 651GB
Capacity B0,023.716,352bytes 745GB
DriveC
I Qi;k Cleanup I
0 .G;ompress d1ive to save disk space
~ l l o w Indexing Se1vice lo jndex this disk for fast tae sea1ching
CJiQI Cancei:J
The basic hard drive clone uses 9.41 GB
The expected drive size needed is:
Total
80 GB hard drive data
Documents and settings, user information
Pagefile.sys, cached memory
System volume information, principally restore points
Basic clone described in 9/9/09 programs
Provision for system hibernation assuming 512 MB RAM
2.9GB
1.5GB
3.5 GB
9.4 GB
0.5 GB
17.8GB
Operating a computer system that required 17.8 GB on a 20 GB drive would not be practical.
Adding only 2GB of data, restore points or other system files could slow the computer to the
point of making it unusable. A file generated by hibernation of the computer would by itself take
512 MB of the available space.
Future Focus, Inc@ i} Febmary li, 20/-1 Page 24 of73
When referenced in other portions of this report the items below will be shown in bold, for
example, a sentence mentioning Item I will refer to it as 9/9/09 programs in the sentence.
Item I. (9/9/09 programs) "Hard drive content request 07-13.docx" provided by attorney Dale
Kamerrer who received it from Whatcom County Sheriffs office. This file lists programs that
were installed on a Sheriffs Office computer that was used to clone hard drives for deputies. It is
annotated "Panasonic Toughbook CF29 Mk4 WC AT# 17451, Restored Symantec Ghost image
dated Sept, 9, 2009 from AT# 17292 I DBurks"
Item 2. (20GB hard drive) Seagate Monentus 20GB hard drive serial 3KVOBQEE FF tag
589533, labeled "OLD DRIVE", contained in Panasonic Toughbook hard drive enclosure
N2CABTD00006 0 6M HOD CF-29LTQGZBM labeled "Murphy 20GB hard drive ... " I
received this hard drive from Inspector Inspector Steve Cooley of the Whatcom County Sheriffs
Office. This was identified as a hard drive which was in the Toughbook used by Paul Murphy
before an upgrade from 20 to 80 GB, I examined this hard drive in the Whatcom County
Sheriffs Office on 7/1/13.
Item 3. (80GB hard drive) Hitachi 80GB hard drive serial X6HK074G FF tag 590771,
contained in Panasonic Toughbook hard drive enclosure N3CABTD00006 0 5K HOD CF-
29L TQGZBM, I received this hard drive from Inspector Steve Cooley of the Whatcom County
Sheriffs Office. This was identified as a hard drive which was in the Toughbook used by Paul
Murphy from the time that the Sheriffs Office migrated to a new user authenticate method using
Microsoft Active Directory on 9/14/10 until his departure. I examined in the Whatcom County
Sheriffs Office on 711113.
Item 4. (80GB image 1) Seagate 500GB serial Z2A7VH6J, FF tag 590751. This hard drive
contains an image of Item 3, 80GB hard drive. It was moved to Future Focus for analysis,
imaging details are in Image 1 log
Item 5. (80GB image 2) Seagate 500GB serial Z2A 7W7W J, FF tag 590773. This hard drive
contains an image of Item 3, 80GB hard drive. It was left in the custody oflnspector Steve
Cooley of the Whatcom County Sheriffs Office on 7/1/13. Imaging details Image 2 log
Item 6. (Web activity interrogatories) "Defendant's first interrogatories, plaintiff Paul
Murphy", time stamped: 2013 SEPT 18,2013 PM 2:07, provided by attorney Dale Kamerrer
Item 7. (Interview with IT) On 2/6/14 Dale Kamerrer and Gordon Mitchell talked with John
Dahlquist a hands-on IT technician in the information technology department that serves the
Whatcom County Sheriffs office. Material from that telephone interview is summarized below.
Starting in August 20 I 0 the Whatcom County Sheriffs Office transitioned, over about 6 weeks,
to a Microsoft Active Directory system for managing login and user privileges. This required
bringing computers in for an update. User privileges were set to minimize the installation of
software by users. In addition to the nonnal Windows software on Panasonic Toughbooks, a
Future Focus, Inc@ rf:) February 17, 201-1 Page 25 of73
number of applications were added as needed to computers to support needs of the deputies
using them. They included Apple programs (Quick Time. Bonjour. iTunes), Real Player,
WinAmp, VLC player. A single image was used to update computer and that was provided as
9/9/09 programs above.
Mr. Dahlquist described the process that the 80GB hard drive would have gone through. It was
to replace the existing hard drive in the county computer used by Paul Murphy. Deputies were
asked to put all data that they wanted to retain in a separate location for the upgrade process.
When Mr. Murphy turned the computer in for an upgrade, a 20GB hard drive was found in the
computer. This was unexpected since all hard drives had previously been 80 GB size. The 20
GB hard drive was replaced with a spare 80GB hard drive. After installation of the operating
system in September 20 I 0 the 80 GB hard drive was used until 5/3111 when the operating system
was reinstalled and a replacement profile for user pmurphy was established.
Item 8. (Image llog) file S_20130701143626.xml records the details of80 GB image 1 from
80GB hard drive. File S_20130701143626.xml is attached to this report. It indicates that 80
GB hard drive had a MD5 hash of 01 E82145B76212FCA43968DE12F76220 which matches
the hash reported by X-Ways Forensics for the MD5 hash of80 GB image 1.
Item 9. (Image 21og) file S_20130701152309.xml records the details of80 GB image 2 from
80GB hard drive. File S_20130701152309.xml is attached to this report.
Item I 0. (Tough book configuration) File info@lldkb.com_20 14021 0_082412.pdfThis
document received from Dale Kamerrer was identified as a copy of county procurement and
assignment forms for the Toughbook was which was initially assigned to Steve Roff but later
transferred to Paul Murphy. The asset data form indicates that it was acquired on 4113/06. A
copy of the purchasing ledger indicates that it had an 80 GB hard drive when first procured.
Future Focus, inc@ 17, 20/.f Page 26 of73
3 Exhibits
Receipt of Item 2, 20GB hard drive on July 1, 2013
Future Focus, Inc FebruWJ' 17, 201./ Page 27 of73
20 GB hard drive with its Panasonic Toughbook shock absorbing container.
20 GB hard drive attached to a Wiebe Tech Ditto
Future Focus, Inc FebrumJ' 17, 20J..I Page 28 of73
'
"
Orl
v.
No source hard drive (20GB hard drive) is seen, zoom in to show details
Shock mount container holding 80 GB bard drive
Future Focus, Inc February 17, 201../ Page 29 o/73
80 GB hard drive connected to Wiebe Tech Ditto for imaging
80 GB image 1 and 80 GB image 2 were separately imaged
Future Focus, Inc@ February 17, 201-1 Page 30 of73
file structure on the only partition of 80 GB image 1 is shown below
, Partition 1
''8 Path unknown
SExtcnd
SWIN_NTS.-BT
CAD
Documents and Settings
Administrator
i:tJ All Users
ii' cwilsonl
L Default User
dscott
,__J jdalqut:sl
locaiService
[tl c2742baffa4990fc010444
il __J MSOCache
c1 __j Novell
CEI P ocketJet V1.5
8J PocketJet V6
CiJ Program File;
GJ ~ RECYCLER
System Volume Information
uti I
WINDOWS
XP SP3
__J Yahoo Widgets
results of analysis of the recovered photos categorized them as follows.
Damaged or partial or unknown web site, 717 images
Work. 3 3 3 images
. 17 ;;;." Pe<
Summary of images including recovered deleted images
Future Focus, Inc Februm:v 17, 2014 Page 31 of73
The following photos were classified as personal
29307_100474936
670017_10000122
5320620_1456_23
95331_n.jpg
Dc17JPG
Dc19.JPG
Dc21JPG
Dc23JPG
Future Focus, Inc
Dcl6JPG
Dc18JPG
Dc20JPG
Dc22JPG
Dc24JPG
February 17, 2(}f.f Page 32 of73
cal Length In 35mm Format
Scene Capture Type
llidth
Image Height
Encoding Process
Bits Per Sample
Color Components
Y Cb Cr Sub Sampling
38 mm
Standard
Normal
Normal
Baseline OCT, Huffman coding
8
3
YCbCr4:2:2 (2 1)
3.3
Comparison ofEXIF data from Dcl7.JPG and image IMGPOOOl.JPG
spreadsheet files were sorted into categories
Mise 91, damaged files, spreadsheet samples from Microsoft
Work 47, files showing Whatcom County forms, procedures, spreadsheet templates
Personal do not fit in the above
Future Focus, Inc February /7, 20J.I Page 33 of73

643 document files were examined and moved into the following folders
Mise 3 84 -files not clearly work or personal, e.g., files provided with commercial software.
Work 1248- files that appear to be work related
Personal!2 files that appear to be
Categorized files
NE1:ANAI.YSiS
c.-0., ;;,-n""""'C""'dr. M 7illl.Wl
1ly:" '"'''""" lkow;; f'""'
P'"''"<l:
I""" lM<c "J: P-<vk 1 (Vlt -?""Mlj
-5,702 URLs, user unspecified, e.g., browser checking site configuration or blocking ads
7232 URLs, whatcom
1459 URLs, pmurphy
28 URLs jdalques 1
7 URLs, cwilson
3 URLs, SYSTEM
1 URL, administrator
Overall browser activity
I
Future Focus, Inc ifd February 17, 20 I-I Page34of73
Rank Site Personal Work
1 scribd 732
2 microsoft 360
3 facebook 319
4 rushimg 110
9 whatcomcounty 81
11 rna rklevinshow 62
13 abigailadamsproject 44
Totals 1267 441
User pmurphy site ranking from browser history
Future Focus, Inc February 17, 201-1 Page 35 of73
Popular web s i t e ~
Scribd
I #l I
Microsoft
Facebook
Whatcomcounty
Marklevinshow
abigailadamsproject
Notes: User pmurphy web site visits for most popular sites were over a range
of t e s ~ Screen shots to illustrate the top personal interest site images taken
from the Internet on August 2013. Ranking of each from the consolidated site
I ranking table is shm.vn.
Future Focus, Inc (E) February 17, 20/.J Page 36 of73
sites in i ies compared 1-1ith Brm1ser history
Paul MHrphy to, per
Seen on 80 GB hard drive
"\Veb aunllJ w .. uries
facebook fa, . com, facebook. net,
fbcdn.net, wc,,.J.facebook.com
tt1itter tHitter.com
TeaPartyCommunity
linked in linkedin.com,
Free1
,I,.
FreedomTorch
scribd scribd. com, ,.,,,,,. scribd. com
iatn
WhatcomUncovered
S"JeeneyPo); + i
<;I i riPS hare slideshare.net
Bellingha1
lri
ebay
WcsoGuild
Craigslist
EasternDoor
Boa1
wafop24
k103radio
ancestry
PnlirPOne poI i rPnn". com, CJVM. ooliceone. com
Share keep !.com
Rl no<nn+ h
:.com
!nnett
inn<;r"""minoFool<>
ning


1a1:i
Patri
Future Focus, Inc@ 1;) FebruWJ' 17, 1014 Page37 of73
1
Order-
40 CF29
I
Type local Disk
Fie system NTFS
1111 Used sp<>ee:
1111 Free space
10.10!t959232b)'les 9.41 GB
69.914.757.120 bytes 65.1GB
80.023.716,352 byres 74.5GB
I Qisk Cleanup j
0 .korr:f)fess dfive 'o save di:>k :;pace
[!i]A!ow Indexing Savice lo .indel< this disk [Of fast fie seatching
The basic hard drive clone uses 9.41 GB
Fulllre Focus, Inc@ february 17, 201-1
Print Before !'!
77.oo 151 ooo.oo
Page38473
tD
The expected drive size needed is:
80 GB hard drive data
Documents aud settings, user information 2.9GB
Pagefile.sys, cached memory 1.5GB
System volume information, principally restore points 3.5 GB
Basic clone described in 9/9/09 pmgrams 9.4 GB
Provision for system hibernation assuming 512MB RAM 0.5 GB
Total 17.8GB
Operating a computer system that required 17.8 GB on a 20GB drive would not be practical.
Future Focus, Inc@ r&J FebrumJ' /7, 20J.I Page 39 of73
ndix A,_ niwln,-,o
recovery was limited to the followiog file types_ For each one signatures were used to
files which had been deleted as well as files which were easily recovered usiog the file
system master file table_
3fr- Hasselblad RAW
acr- Dicom
ani - animated cursor
apx - Ability Phctops!nt Image
art- AOL
arw- Sony RAW
awd- FaxView Document
bga- OS/2 8itrru3p
bm- X11 Bitmap
bmp- Bitmap
bpx- Truevision Targa
bw- Si!iccn Graphi-cs RGB
cam - Ca.sio QV 100
cdr - Corel Draw
cdrtl- Corel Draw
Qdffi - Computer Graphics Me-tafile
cin - Kodak cmean
cit- lntergraph Format
crnt - Chinen ES 1000
a2 - Canon EOS
c:w- Canon Pcwer.shot
csh - Photoshop custom shape
cur - cursor
cut- Dr. HakL BPM Studio OJe
points
dae - COLLADA 30 Digital Asset
dc2 - Kodak RAW
dc3- Dlcom
dcd- Design CAD Drawing
dcr- Kodak Pro Digital RAW
dcx - Zsoft Publisher
dib- Windows devlce-indep.
bitmap
dng- digi!al negative
drw- MacDraw
d1t19 - AutoCAD
dxf- AuloCAD
ecw - Enhanced compression
wavelet
ei - Electric Image
emf- Windows enhanced
eps - Encspsu!a!ed postscript
fig - OeskMate drawing
fie - Aulodesk Animator
fpx - FlashPix Bitmap
fxd V\finF AX

fxo- WinFAX
fxs \1\'inFAX
gbr- Glmp Brush
gdf- GrephWorX32
gif- Graphic Interchange Format
gp4 - CALS Raster
grey- Raw
gry
Future Focus, Inc
hdr- ApoUo HDRU
hpd- HD Photo
icc2 - Icon co!!edion
icl I con Ubrary
icns - Mac icon
teo -leon
icon- Sun icon
iff- Amiga FF
ipi-IP Lab
iris - Silicon Graphic RGB
itc2- iTune.s artwork cache
ithmb- iPod Photo Thumbnails
ivb- Truevi.sion Targa
j2k- JPEG 2000
jfli - Ricoh digital camera
jbf- Paint Shop Pro crow.ser
cache
jbg- Fax image
jbfg - Fax image
jlif- JPEG
jnt- MS V'ilndows Journal
jp2- JPEG 2000
jpe- JPEG
jpeg- JPEG
jpg- JPEG
jpx - JPEG 2000
k25 - Kodak OC25
kdc - Kodak DC 120
t.qp - Konica camera fiie
ibm - De:lu:xe Paint
mdd- MacOraft drawing
mdi - MS Office Document
Imaging
mif- Image Magick File
mix- Microsoft Piciure !tl
mng- Mutiple Network Graphics
mos Nikon raw
mrw - Minette DiMAGA raw
nef- Nikon raw
oil - Open Image library
art- Olympus raw
peg - DrawPage1.0 Drawing
pbd - Palm Piio!
pbm- Portable Ima-ge
pcd - Kodak Photo CD
pet- Macintosh Quickd raw
pcx - ZSoft Paintbrush
pef- Pentax
pfi- Photo Fi!tre Studio
pgm - Portable GrayMap graphic
pic - Or_ Halo, Advanced Art
Studio
picio - Pixar Picture File
pict- Macintosh Quickdraw
picl2- Macintosh
if) Februw:v 17, 20/.J
pix- Alias Image File
pixar - Pixsr Picture Fife
pm- X11 Pixmap
pmp- Sony DSC-Ft
tga- Truevision Targa
tga- Truevision Targa
thumbs. db- Thumb-nail database
tif- Tsgged Image Fo-rmat
tiff- Tagged Image Format
tim - T sgged Image Format
tm2 -Sony PS2
ufo - Photolmpect Graphic
vdx- XML for Vrsio Drawing File
vst
v-sx- Vs.io
wbmp -Wireless Bitmap
wdp - Windows Media HD Photo
w-e.bp- Chrome Weppy
v.ix- 1/VinFAX
wmf- Windows Metafile
wmz.- Media Player Skin
wpg - Corel OLE
x3f- Sigma RAW
xara - Xam X drawing
x.bm - X 11 bitmap
xcf- Gimp bitmap
xpm - X 11 Pixrnap
VlFF bitmap
yw- YUV 16-bit interleav-ed
zbr
Page40of73
)fJewr!ixB v"''orkphoto t!nnni:m_::Iils
containing these pictures are in sub folders under the "work" folder on the attached USB device .
...
Future Focus, Inc :0 February 17, 201-1


Page 41 of73
C f4isn:-Haneous photos
These photos are on the attached USB device in subfolders of the "mise" folder
x]


M



1-:;.,-.-,::<1,,,.,""
t0:0rt""'' H:hp; i)JG:TI f"J P'XlKpJ \J[l;{,jip.y
n!


.. /""
n
.. ..
w

0Yh77h"''P r,m:-ttt-""'; fiXi.'M

WK4"t COOi'.U 11-i-Uip')


.

ro'l.lfJJ_t"'f fX.f.NMtw.;- (%C:)l?.IY>1t 1X'1.21tmp !XtlS! ll--;<;:- oc:.M.t-..,-T 1X1J0l>"'li
X\O'>llbq> IJ01HJt.-p mn:tJtmp tcB:tlr."''f 0Cll4l l>''<''


'\)
..

Wltll 001!-t!pq \I)C.t::J.l;,-.p
Future Focus, Inc February 17, 2014 Page 42 of73
Image I log
Image 21og
Tough book configuration
919109 programs
Recovered files in tbe following folder structure are attached
J e:.porl:

ncpth
Ptr!Cn-tl
with pJ1h
Dc<ume.nts Md 5-eum;;;
Nc,.tl!
Pdh ud:'.C>N1"1
frcg:::m F1!e;
vH
V;>tlDC'h$
'i'<Cfk
Ft"HOIHI
.; with p!1h
S-dlmg>
!Jc-,-t'll
f:ECYCUR
1..1<!
\'11JDO';;S
#

n<::pth
Future Focus, Inc @

anl;no,'dl
V<ith
work
FebrumJ' 17, 20/.J Page 43 of73
Hugo Black and the KKK
,,,,,_,.
,,.,._,,
llJ !2, ]'))":, 1 nz:ilm D cJ:kcll\ ',i;c' Bl:.;k tde<
1n-if (c,, e-f ntk n:n 1'nl
h:u hlu' Khut " m.uL _\nll Thr hi\: h.
Hugo Black's Opinion in Adamson v. California
(1947)
Adamson v. California (1947)
Pl Humor Comer: Officer Murphy's Laws
Future Focus, Inc February Ji, 201-1 Page 44 of73
4 Qualifications
I have had no publications in the last I 0 years
I have been active in the international security and engineering community for the last 30 years.
In 1996 I was recognized as one of 6 who received professional achievement awards from the
300,000 member Institute of Electrical and Electronics Engineers. The International Society for
Optical Engineering elected me a fellow in 1997. I am currently the president of Future Focus,
Inc., a company that is licensed to do investigative work by the state of Washington.
Recognition in the professional community
A number of professional organizations have certified my qualifications by appointments,
certification or membership. Check the links to learn more about these certifications and
recognition.
Certified Information Systems Security Professional (CISSP) #5137 awarded by the
(1SC)
2
consortium of leading international computer security organizations.
Certified in incident handling, security and penetration testing by the Security
Administration, Networking and Security (SANS) Global Incident Analysis Center
Certified protection professional (CPP) the highest qualification of the American Society
for Industrial Security. Chairman, Puget Sound Chapter, 1998, chapter life membership
2009, verify by emailing .
General info is at:
Board of directors, Computer Technology Investigators Northwest, the leading regional
computer forensic organization training judges, prosecutors, investigators and first
responders. 2001-2003. Honorary life membership 2009 see Notes on
Chapter volunteer and officer, Information Systems Security Association
Fellow, International Society for Optical Engineering
As a volunteer I have worked actively in community service through professional organizations:
Institute of Electrical and Electronics Engineers, Computer Technology Investigators Network,
Agora, Information Systems Security Association, AS IS International, International Society for
Future Focus, Inc @ {:J Februmy 17, 20/-1 Page 45 of73
Optical Engineering, Pacific Northwest Association of Investigators, Association of Threat
Assessment Professionals
Future Focus, Inc
1
' Februm:v 17, 201-1 Page 46 of73
Expert witness engagement examples
Case Description My role Outcome
Criminal Robert Durall, Killer Show jury only connection Convicted, 46 year
between killer and body, sentence, became
demonstrate his preparation Forensic Files
for murder. program
Criminal Kim Mason, Killer Validate evidence against Convicted, Life
killer in trial sentence
Criminal Rosemary Heinen, Initial investigation for Guilty plea, 4 year
$3.7M Embezzler victim, produce affidavit for sentence
prosecutor
Criminal Peter Rilling, hacker Investigate computer 1.5 year sentence
intrusion to damage ex (longest to date in
employer's computer system. county for this crime)
Criminal Michael Landon, Documented transactions, Guilty plea, 30 days
Software thief discovered email interception + I vear
Criminal Walter Harris, assault Testimony in trial related to Convicted, 16 year
with firearm electronic eavesdropping sentence, appealed,
overturned
Criminal Andrew Garcia, Investigation with 2 Guilty plea, I year
computer attack consultants, Prepare report for prison sentence
Asst US Attorney, LA
Criminal Execs of TAP Authenticate memo in Boston Acquitted
Pharmaceutical, federal court testimony for
bribery US Attorney
Criminal Eric Barnes, firearms Analyze computer evidence Guilty plea, 4 month
violations for Asst US Attorney, Seattle prison sentence
Civil Employees vs. HAPO Analysis of computers, mail Resolved before trial
credit union server and backup tapes
Civil Lakeside Technologies Analysis of web sites for Resolved before
federal court and testimony in decision
arbitration
Criminal Kevin Love, Analysis of credit union Guilty plea
embezzler computers, report
Civil Robert Lindrud will Catch attempted theft Childrens Hospital
won
Civil Employee vs. City of Discover facts related to Facts prevailed after
Marysville employee misconduct appeal
Criminal State vs. Turski Testimony for defense related Convicted
to digital images
Tribal Ex employee suit Testify about computer Claims dismissed
misuse
Future Focus, inc@) r[:_; February 17, 201-1 Page 47 of73
Technical qualifications
Formal education and technical activity form the basis for my work; this background includes:
Ph.D., electrical engineering, University of Washington 1974
Licensed professional engineer (mechanical and electrical) in several states
Author of 60 technical papers, portions of 5 books, I 0 US patents
Reviewer for 3 technical journals, an editor for one
Professor, affiliate faculty, University of Washington Dept of Electrical Engineering 1984-
2009
Updated 2/16/14
Future Focus, Inc @ February 17, 201./ Page 48 o/73
5 Testimony and depositions
Other cases in which, during the previous 4 years, the I have testified as an expe1t at trial or by
deposition include
Washington State vs. Garrett Turski, vehicular homicide trial testimony
Anne Marchand vs. Colville tribes, testimony in hearing before administrative law judge
Estate of Robert Lindrud vs. John Wade and others, deposition
6 Compensation to be paid for the study and testimony
For this investigation I was retained by Law, Lyman, Daniel, Kamerrer
& Bogdanovich, P.S. via Thomson-Reuters Expert Witness Services.
I am compensated at $250/hour with a 4 hour minimum/day for depositions and testimony.
Typically I do not bill for minor expenses such as local travel or hard drives used. Billing
through 1/31/14 on this project has totaled $5675. My compensation is not dependent on the
outcome of this case.
Future Focus. Inc CE Februm:v li, 201-1 Page 49 of73
Appendices
Picture recovery was limited to the following file types. For each one signatures were used to
extract files which had been deleted as well as files which were easily recovered using the file
system master file table.
3fr- Hasselblad RAW
acr- Dicom
ani - animated cursor
apx- Ability Photopaint Image
art- AOL
arw- Sony RAW
awd- FaxView Document
bga- OS/2 Bitmap
bm- X11 Bitmap
bmp Bitmap
bpx- Truevision Targa
bw- Silicon Graphics RGB
cam- Casio QV 100
cdr- Corel Draw
cdr6 - Corel Draw
cgm - Computer Graphics Metafile
cin - Kodak Cineon
cit -lntergraph Format
cmt- Chi non ES 1000
cr2 Canon EOS
crw - Canon Powershot
csh - Photoshop custom shape
cur- Windows cursor
cut- Dr. Halo, BPM Studio cue
points
dae - COLLADA 30 Digital Asset
dc2 - Kodak RAW
dc3- Dicom
dcd - DesignCAD Drawing
dcr- Kodak Pro Digital RAW
dcx- Zsoft Publisher
dib- Windows device-indep"
bitmap
dng -digital negative
drw- MacDraw
dwg - AutoCAD
dxf- Auto CAD
ecw- Enhanced compression
wavelet
ei - Electric Image
emf- Windows enhanced metafile
eps - Encapsulated postscript
fig - DeskMate drawing
flc- Autodesk Animator
fpx- FlashPix Bitmap
fxd- WinFAX
fxm -WinFAX
fxo- WinFAX
fxs- WinFAX
gbr- Gimp Brush
gdf- GraphWorX32
gif- Graphic Interchange Format
gp4 -GALS Raster
grey- Raw
gry- Raw
Fltlure Focus, Inc
hdr- Apollo HDRU
hpd - HD Photo
icc2 - Icon collection
ic! - Icon Library
icns - Mac icon
ico- leon
icon - Sun icon
iff- Amiga FF
ipi-IP Lab
iris - Silicon Graphic RGB
itc2- iTunes artwork cache
ithmb - iPod Photo Thumbnails
ivb- Truevision Targa
j2k- JPEG 2000
j6i - Ricoh digital camera
jbf- Paint Shop Pro crowser
cache
jbg - Fax image
jbig - Fax image
jfif- JPEG
jnt- MS Windows Journal
jp2 - JPEG 2000
jpe- JPEG
jpeg- JPEG
jpg -JPEG
jpx- JPEG 2000
k25 - Kodak DC25
kdc - Kodak DC 120
kqp - Konica camera file
Ibm - Deluxe Paint
mdd- MacDraft drawing
mdi - MS Office Document
Imaging
mif- Image Magick File
mix- Microsoft Picture It!
mng - Mutiple Network Graphics
mas - Nikon raw
mrw -Min alta DiMAGA raw
nef- Nikon raw
oil - Open Image library
orf - Olympus raw
pag - DrawPage1.0 Drawing
pbd - Palm Pilot
pbm - Portable Image
pcd - Kodak Photo CD
pet- Macintosh Quickdraw
pcx- ZSoft Paintbrush
pet- Pen tax
pfi -Photo Filtre Studio
pgm - Portable GrayMap graphic
pic- Dr. Halo, Advanced Art
Studio
picio- Pixar Picture File
pict- Macintosh Quickdraw
pict2 - Macintosh
<D FcbrumJ' 17, 201-1
pix- Alias Image File
pixar- Pixar Picture File
pm- X11 Pixmap
pmp- Sony DSC-F1
tga- Truevision Targa
tga - Truevision Targa
thumbs,db -Thumbnail database
tif- Tagged Image Format
tiff- Tagged Image Format
tim -Tagged Image Format
1m2 -Sony PS2
ufo - Photolmpact Graphic
vdx - XML for Visio Drawing File
vst- Vista
vsx- Visio
wbmp- Wireless Bitmap
wdp -Windows Media HD Photo
webp- Chrome Weppy
wfx-WinFAX
wmf- Windows Metafile
wmz- Media Player Skin
wpg - Corel OLE
x3f- Sigma RAW
xara - Xara X drawing
xbm- X11 bitmap
xcf- Gimp bitmap
xpm- X11 Pixmap
xv- VIFF bitmap
yuv- YUV 16-bit interleaved
zbr- Zener
Page 50 of73
B
Files containing these pictures are in subfolders under the "work" folder on the attached USB device.
11A17417

03y1in-Jpg
Canyon R1dtrs
T cny Dcugherty
l.jpg
IMGP0007JPG
!MGP0015JPG
IMGPOOl5JPG
IMGPOO:U.JPG
-
11A17427
Dan!eh,
lkhard.bmp
H:A Seth LJmm

!MGPOOO'il.JPG
IMGPOIJ17.JPG
JMGPOOl&JPG
!MGPOJJSJPG
Future Focus, Inc
Jl deg ma1cn
(ilp.jpg
HA mtmbErJpg
1MGP0009JPG
!tAGPOOli!JPG
IMGP002.7JPG
!MGP0036.JPG
Alcohol

Angel- (A
- thculdertat.jpg
IMGPOOiOJPG
lMGfl0019JPG
!MGP0328JflG
IMGPD037JPG
lti!GPOOG1JPG
!MGPOOllJPG
IMGPOOZCUPG
J1.1GPD029JPG
JMGP003SJPG
FebruarJ' 17, 201 .f
Am1go:; f,lih:
JHk- Z.jpg
IMGPIDJ2JPG
lMGP0012JPG
I!.!GP0011.JPG
!MGroJ30JPG
JMGroJ31JPG
ble-.in._n::i_-_pl.l
ker_run.liJlO_-_t

!MGPOI.Xl3JPG
lMGP{)()13JPG
IMGP0021JPG
!MGP0031JPG
!MGPOOJOJPG
Canyon
TcnyDcugherP;
- Z.Jpg
IMGPOJO.tJPG
JMGPOOHJPG
fMGPCOE.JPG
IMGPOO)lJPG
!MGPQMlJPG
Canyon Riders
T any Dougherty
3.jpg
IMGPO:\%JPG
IMGP0015.J?G
IMGP0024JPG
!MGP0033.J?G
IMGPOO.UJPG
Page 51 o(73
IMGP0052JPG I11GP0053JPG I!vlGPOOS4JPG JMGPOOSS.JPG 1MGP0056JPG IMGP0057.JPG IMGP\105BJPG JMGP0059.JPG IMGP0060JPG
IMGP0061JPG IMG?0062J?G !MGP0063JPG lMGPOO&tJPG II\.1GP006SJPG IMGP0066JPG IMGP0067 JPG IMGP006SJPG IMGP0069JPG
IMGP0070JPG JMGP0071.J?G IMGP0072JPG lMGP0073JPG IMGP0074JPG IMGP0075JPG JMGP0076.JPG IMGP0077 .JPG IMGP0073JPG
!MGP0079JPG lf-..-1GPOOSO.JPG IMGPOOSlJPG IMGPD002JPG IMGPOOE3JPG lMGPOre4JPG IMGP0085JPG IMGP0086JPG !MGP0037.JPG
JMGP0038JPG 1MGP000:9J?G JMGPfllSlJPG lMGPD835JPG IMGP0836JPG IMGPOE37.JPG ltv1GPOS33JPG IMGP0039JPG IMGPQ340JPG
1MGPOS41JPG IMGP0842JPG lr-.1GP0043JPG IMGP0044.JPG lMGM345JPG JMGP0046JPG IMGP0847.JPG lMGPOS<lBJPG IMGPOS49JPG
Fulllre Focus, Inc @l <LJ February 17, 2()/.J Page 52 of73

.
.
IMGP0350JPG IMGPOS51JPG IMGP0352JPG lMGP0053JPG IMGP0354JPG
Jlv1GP0364JPG IMGPOS65JPG JMGPOE67JPG IMGPOB63JPG
lMGPM73.JPG lMGPDSR/PG Jf1;1GP0875JPG IMGPOB76.JPG Jt,..lGP0377JPG
TMGPOB32JPG lMGP0883JPG ll'v1GPOSS9.JPG IMGP009Q.JPG IMGP0091JPG
1MGPOS%JPG IMGP0897 JPG IMGPOS99JPG IMGP0900JPG IMGPDOOlJPG
1MGP0905.JPG IMGP0907JPG IMGP090SJPG JtAGP0909.JPG IMGP0910.JPG
!Ur.Dffil1 c; mr. !Ut::!l001 h !Dr. !Of. tldr.ono1 o: mr. IUi.0/1.010 tor.
Future Focus, Inc@ iD Febmm:r 17, 2DJ4
ltv1GP0055.JPG JMGPOESCJPG lMGPOS57 JPG
!MGPOS69JPG 1MGPOB70.JPG !MGPOS71JPG
IMGPD87B.JPG lMGPOE79.JPG IMGPOSS-O.JPG
lMGP0092JPG !MGP0393JPG lMGPOE94JPG
!MGP0902JPG JMGP09Q3JPG !MGP0904JPG
J1,1GP0912.JPG H.1GP0913.JPG
lldt::Df\0"/fl mr. IUt';DfiO'}t mr. !Dr.
Page 53 o/73
!MGP0063JPG
IMGPOE72JPG
IMGPO&SlJPG
1MGPOS95JPG

1. .L;
,/"
..... '
Irv1GPDOOSJPG
[;I .
... . \ ...
1MGP0914.JPG


..
..
IMGPOSSOJPG 1MGPOB5UPG IMGPQ852JPG JMGP0053JPG IMGPOOS.t.JPG IMGP0855JPG IMGPOSSGJPG JMGPOOS7JPG 1MGP0363JPG
IMGP0364JPG IMGP0065JPG 1MGP0366JPG IMGPOE57 JPG IMGP036EJPG IMGP0369JPG IMGP0370JPG IMGP0371JPG IMGP0372JPG
1MGPOS74.JPG IMGPOB75JPG ll'v1GP0876JPG !MGM877JPG JMGPDS78:JPG IMGPil379JPG IMGPOS2D.JPG IMGPOS81JPG
IMGP0832JPG IMGPOSS3JPG JMGPDS89JPG IM'GPOB90JPG lt1GPOS91JPG IMGPfl892JPG IMGPOS93JPG IMGP0094JPG IMGP0395JPG
:1
1MGPC896JPG IMGPOS97 JPG If,TGP0899JPG IMGP0900JPG IMGPOOO!JPG IMGP090ZJPG IMGP0903JPG 1MGP{}-JD4JPG JMGPQ905JPG
r!l
'
.
Uv1GP0006JPG IMGP09Q7 JPG rr ..1GP0903JPG 1MGP0909JPG IMGP0910JPG IMGP0911JPG IMGP0912JPG IMGP0913.JPG JMGP0914.JPG
11v1GP0915JPG lMGP0916.JPG JMGP0917 JPG IMGP0918JPG IMGP0919JPG JMGPQ9ZOJPG IMGP0921.JPG JMGP0922JPG IMGP0923JPG
Fulure Focus, Inc@ (i) February !7, 2014 Page54of73
IMGP0924.JPG IMGP0925.JPG !MGPC1926.JPG IMGPCI927JPG IMGP0928JPG !l'vlGPD929JPG IMGPfJ93CUPG JMGP09Jl.JPG UviGP0932JPG
IMGP0933JPG IMGP!J934JPG IMGP0938JPG 1MGP0939JPG IMGP09..10JPG ItvlGP094UPG
IMGP0953.JPG IMGP0954JPG !MGP0955JPG IMGPfJ956JPG IMGPD957.JPG JMGPD953JPG IMGP0959JPG 1MGP60JPG IMGPiJ961JPG
IMGP0%2JPG IMGP0%3JPG IMGPD964.JPG IMGP0965.JPG 1MGPQ%6JPG IMGP0:%9JPG IMGP0970JPG IMGPQ97LJPG IffGPfJ978JPG
JMGP0979JPG rt-..1GPQ981JPG 1MGP0982.JPG !MGP0983JPG 1MGP0984.JPG IMGP0985JPG IMGP0986JPG IMGP0987JPG
l
IMGP09B8JPG IMGP0989.JPG Ilv1GP099{)JP G IMGP0991JPG lMGP0992JPG IMGP\l993JPG Uv1GPW94.JPG IMGP0995JPG IMGP0996JPG

IMGPQ997 JPG IMGP!J99BJPG IMGP0999.JPG IMGPlOOOJPG IMGP1001JPG 1MGP1002JPG IMGP1003JPG Ir.-1GP1004JPG IMGP1005JPG
Future Focus, Inc (l{J ifJ February 17, 201-1 Page55of73
;:;

n
1MGP1006JPG IMGP1007 JPG IMGP1003JPG JMGP1009JPG lMGP1010JPG 1MGP1011JPG li..!GP1012JPG JMGP1013JPG IMGP1014.JPG
bi..
iii
IMGP10I5JPG IMGP1016JPG IMGP1017JPG JMGP101BJPG !lv!GP1019JPG IMGP1020JPG !MGP1021JPG Ir.1GP1022JPG IMGP1013JPG

"

L,
JMGP1024JPG JMGP1025JPG Jf,lGP1027 JPG 1MGP102SJPG JMGP1032JPG !MGP1035JPG lMGP1036.JPG
IMGP1037JPG IMGP103SJPG IMGP1039JPG JMGP1040JPG !MGP1041JPG IMGP1043JPG !MGP104-UPG IMGPIQ..ISJPG
llAGP1046JPG IMGPIOUJPG IMGP1049JPG IMGP105lJJPG 1MGP1051JPG JMGP1052JPG IMGP105JJPG IMGP1054JPG
IMGP1055JPG !MGP1056JPG !MGP1057JPG 1MGP105SJPG IMGP1059JPG IMGPlOOOJPG IMGP1061JPG IMGP1062JPG IMGPlOCJJPG
IMGPlo&IJPG IMGP1065JPG lMGP1066.JPG 1MGP1067JPG Nea! RcthEnbu!er Neal P.othenbuler Neal Rothenbu!er Neal Rothenbu!er Neal Rcthenbuler

-.1 ;.,..,
- ""'
-F. !nt'l 7 ;.,,..
Fwure Focus, K:;1 FelmtaiJ' 17, 20/.J PageS6 of73
!MGP106-IJPG
Rcthenbuler
- 9.jpg
Neal Rcthenbuler
"18.jpg
Rothenbuler
-Family Tree.Jpg
PENTAX Optio
W?i 2010-10-14
21_55_19.JP9
PENTAX Optio
WPi2010-10-27
00_19_21,jpg
lMGP1065JPG
Ne3! Rothenbuler
-lO.jpg
Rolhenbuler
-19-;pg
Ne3! RothenbuiH

PENTAX Optio
WPi2010-10-14
21_55_39.jpg
PENTAX Oplio
WPi ZDl0-10-27
00_19_37.jpg
Future Focus, Inc
IMGP1066.JPG
Neal Rothenbuler
-11.jpg
Neal Rothenbuler
"ln.jpg
PENTAX Optic
WPi 20HH0-14

PENTAX Optic
WPi 2010-10-14
2l_56_05.jpg
PNTAX Op!io
WPi2010-10-29
01_01_3.f.jpg
IMGP1067.JPG
IJea!
-l1jpg
Neal Rc!henbulfr
-ll.jpg

PENTAX Optio
WPl2010-HH.J
21_54_14.JP9

.
.
PENTAXOplio
WPiZOl0-10-14
21_57_54.jpg
PENTAX Optio
WPi 2010-10-29
01_02_00jpg



Rcthenbuler
- 3.jpg
Neal Rothenbuler
-l3.jpg
tlEa! Rothenbu!er
ll.Jpg
PEr n AX Optin
wri;uno-10-14
21_54j4.jpg
PENTAX Optlo
WPi 2010-10-14
21_53_20jpg
PENTAX Optm
WPi 2010-10-29
Ol_G2_2l.Jpg
rf:J FelmtaiJ' 17. 20J.I
Rothenbu!er
. 4jpg
f.Jeal Rothenhuler
14,jpg
Ne!! Ro\henbu!er
. 26.jpg
PENTAX Optio
WPi 201010-14
21_54_33.JP9
PENTAX Optio
WPi20101016

PENTAX Optio
WPi201010-l9
01_03_3S.jpg
Neat Rothenbuler
- S.jpg
Rothenbu!er
-15Jpg
Neal Rothenbu!et
-.?8.jpg
PENTAX Optio
WPi 2010-10-14
21_54_47.jpg
PENTAXOptio
WPi 2010-Hl-16

PENTAX Optio
\NPi2010-11-D6
00_39_5{l.jpg
Near Rothenbuler
-6.jpg
NeJI Ro!henbu!er
-16.jpg
Neal Rcthenbuler
"31.jpg
PENTAX Optic
WPi 2010-1014
21_55_06 2.jpg
PEHTAJ( Optic
WPi 2010-10-16
01_3Z_2l.Jpg
PENTAX Optlo
WPi 2010-11-0fi

Page57of73
Neal Rothenbuiu
. 7jpg
I
.
Neal Rolhenhuler
-17.jpg
Neal Rothenbuler
- Cabin.jpg
PENTAXOptm
wri .zmo-10-u
21_55*06.jpg
PENTAY, Optio
WPi 2'.110-1027
OO_l8_SS.Jpg
PH../TAX Optio
WPi 1010-11-06
00_40_20.jpg
PENTAX Optm
V/Pi2010-ll..JJ6
00_43_14jpg
PENTAX Optio
WPilOl0-12-31
02_11_46-jpg
PWTAX Optw
WPil0!0-11-06
00_43_23.jpg
02_04_23 2.Jpg

......., ...
PENTAX Optio
WPilflll-Oli-14
18_25_52jpg
Raven sid todge
Oec171fl11
onwg
Future Focus, Inc (jj)
PfNTAX Optio
WPi 2fl1011<W
02_21_30 l.jpg
02_(}.1_23.jpg
Robin;onRll
Z.Jpg
PENTAX Optio
WPiZOl0-11-20
02_21_30.jpg
D2_04_32)pg
Robinson-R22

HNTAXOptio
'Nl'i2!J1012DS
Z1_45_5D.jpg
PENTAX Optio

02_3-t_ll.Jpg
Tom&Jo
Armstmng-S.jpg
((l FehmmJ' 17, 20f.l
PtroJTAX Optio
WPilOl0-12-H

P[NT AX Optio
WPi2\lll-0224
02_42_36.jpg
I
Zec Hende1:a::n
81 ':';.jpeg
PENTAX Optio
WPi 2.010-1214
18_43_1l,jpg
PENTAX Optio
WPiZOll-02-Z.t

PENTAX Optio
WPi2Dl0-1H4

PENTA)( Optio
WPiZOll-04-21
02_37_43-;pg
.,.
L \ \\"'
PENTAX Optic
\'/Pi201D1224
00_31_22.JP9
PENTAXOrtio
WPi 2011-06-14
18_25_Z3:jpg
Page 58 of73
These photos are on the attached USB device in subfolders of the "mise" folder

mc
.dl
000650 (1JG
library Q:::70).JP9
00076S.bmp
000%3.gif
OOH5i3.bmp
001Ul7.pnq
iJ '.
000033.wml
000551 (lJG
libary Q:o70)Jpg

fi!WW!&WlliiiJIJt: <"I
0009SS.bmp
001469
(Phcto;hop Web
Q;;::liJQ)jpg
00l60.:Lpnq
Future FOcus, Inc (fr!
112b.jpg
000652 (liG
libwy Q=70).jpg
00079S.ico
!Xl09E9.brnp
001478.brnp
OOHi09.pnq
-


II

4 '
f.;
1100653 (UG 000654 WG
library Q::70)jpg LibrtryQ.::70).jpg
000Ef.l2.i'co COOS03.ico
OOlOUbmp 001l35.bmp
001518-bmp 00152\).bmp
-- t;y
0016lO.prq 00161Lpnq
1) February 17, 20 I./
.,. .. ,.
i.su
iJO!Y..AJ9.wmf
000651.hmp
OOJ1J-(.).t,ICO
00125l.bmp
00152Lbmp
00!5l2.pnq

IX!V647.pn!J
'IJ!W!Ji!li!!@!IMti!Wf/$JfJ!;!f{
000677.bmp
000363
(Phctcnhcp
Qdl).jpg
00129Lbmp
001545.bmp
0015]6.bmp

! ' .:...
"""
(.'f)0643(11G
Library Qo:: 70)jpg
n
000714.bmp
0009l9.ico
001300.bmp
001579.p1g

OU1637.brnp
000649 (UG
Library Q.::70).jpg
L ... "d
000765.bmp
C0094tip11g
OOlW.'!.bmp
001602.p:ng
Oil163S.bmp
Page 59 of73
r-1
001639.bmp 001640.bmp 001677.bmp 00163Hmp 001707.bmp 00171Lbmp 001&64.png 0019\XLKo
...._ -
m
m<= -
oo2245.wmf 002300.bmp 002730,wmf 002835 \IJG 00283711JG 00283'3 {lJG 002839 (liG (UG 002841 {IJG
Library Q= 70).JP9 library Q= 70).Jpg Library Q::: 70).jpg library Q= 70).jpg Library Q:: 70).jpg libr;:uy Q= 70)jpg

l!l
001342 (IJG 002844 (UG 002845 (UG 002846 (IJG 0028-47 (lJG 002348 ([JG 002349 (IJG 002850 ilJG 002851 {IJG
library Q:: 70).jpg Q= 70).jpg library Q= 70).jpg Libra I)' Q= 70).jpg library q, 70).jpg Library Q=70)Jpg Library Q= 70).jpg library Q= 70).jpg Library Q= 70).jpg

..!!, -
002252 (UG 002853 (UG (IJG 002855 {liG 002856 (IJG 001857.jpg 002858 (l!G 002859Jpg J)J2860 [liG
library Q= 70)jpg library Q:::70).jpg library Q:: 70)jpg Libmy Q= 70).jpg libraiY Q:: 70)JP9 Library Q;:; 70).jpg Library Q::: ?O}.Jpg
M M
- .-- rp[..o'
002861.jpg 002862 (UG 002863 [UG 002864 (UG 002855 (llG 00266 [JJG 002S67 (UG 002923.wmf 002929.wmf
Ubra'Y Q= 70)Jpg library Q= 70}.jpg Libmy Q:::70).Jpg library Q=70).jpg Library Q= 70).jpg librBI)' Q= 70).jpg
. .. .[ .,. IR!I ..
LU \\\ . . fiil - . ISiJ
002989.wmf 003060 003111.bmp I)J3114.bmp 003115.bmp 003117,bmp 003119.bmp 003121.bmp 003122.bmp
Future Focus, Inc \iJ Februm:v 17, 2014 Page 60af73
.J?'l
LU
omn7.wmf
004032.png
004307.bmp
004411.bmp
-
004533.bmp
004772.bmp
{i;l
:LU
0032nwmf
004125.bmp
I
00432l.bmp
M l l ~
004415.bmp
004655
(Photoshop
Q:::12)JP9
004832.bmp
Future fOcus, Inc@
ii_'.;.l.
LU
003286.wmf
004126.bmp
004372.1CO
-
004416.bmp
004677.bmp
0048S2
(Photo>chop Web
Mac Q:85),jpg
003572.png 003832.bmp
004140.bmp OOU98.bmp
OOU97.ico 004393.ico
r---1
D04433.bmp 00450LICO
004673 004680
(Photoshop \Neb (Photo;hop Web
Q=69).jpg Q::70)JP9
-
I
004883 OO..!S86.bmp
(Photoshop \"lfb
Q::SD}.jpg
Februm)' 17, 20J.I
003914.bmp 003918.\co 003926.bmp
004213.bmp 004223 1)1).[l:63.bmp
{Photos hop Web
Q:::100)JP9
004399.!CO 004400.ico 0044Dl.ico
004507.bmp 004519 D04523.bmp
(Photo1hop W.:b
Q:70).jpg
0046S2.bmp 004685.bmp 004633.
(Photoshop Web
Q:::lOO).Jpg
00..!897 004S9S.bmp frJ4904
(Photoshop Web (Photoshop Web
Q:7D).jpg Mac Q::85)JP9
Page 61 of73
004008 (IJG
libr!lry Q,JQ).jpg
004276.png
0044Q2,1CO
())4556.bmp
004702
(Photo;hcp Web
Q=BO).jpg
0049fJS.bmp
..
006891.bmp
::-=
007678.png
Future Focus, inc (jj)
006950.png
007713.png
006982
{Photo;;hop \'.'eb
Q:::60).jpg
r.:wma:li'MIIIII!l!lll
007714.png
...
006991.png 007178.png
007986.png 007996.png
([;)February /7, 20/.J
'Pa'Oer.li
007356.png
OOS021.png
007485.png 00752fi.png 007610.png
111111
OOS:113.png
Page 62 of73

I
"
008119.png 008129.bmp ODS137.bmp 0032{/:Lbmp 003213.bmp 0032l4.bmp 003246JCO 008317.png
I
------- ---- -
,_
'
;a;.
'"'''""-"'-"
""'""'
'& -
""
-
OOS405.png OOS493.png 008572.png 003592.png 00800.png 002.624-png 008625.png 003665.png OOS893.bmp
- """'
I

mf"
008894.bmp 003897.Ko 008907.bmp 003926.bmp OOS929.bmp OOS956.bmp 00895S.bmp 003961.ico 008985.1CO
-
OOS9SS.bmp OOS990.bmp OOS995.bmp 009001.bmp 009002.bmp 009003.bmp
009009.bmp 009010.bmp 009011.bmp 009012.bmp 009013.bmp CrOl4.bmp 009015.bmp 009016.bmp 009017.bmp
009032.png
009051.bmp 009053.bmp 009054.bmp 009055.bmp 009056.bmp 000057.bmp OOOOS8.bmp
.
flf!Qfl'\Qhnm {lf\Q(II;(lhrnn f"'IVl()(;.J hmn MQf\Fii: h>nn /1(\Q('rf,Qh<nn J'li'IQI170 h ........ J'li'IQI17l hmn N\QI1X1 h>nn
Future Focus, Inc (fi) -0 Februm:v 17, 201./ Page63of73
L

,.;;--:!;!,
-
I"'
- -
... ..
009{}S.l_bmp 009097.bmp 00909S.bmp DQ9101.!CO 009127.png 009142.mr.'>' 009232.png 009270.png 009282.png
lll
I


00930-l.bmp (l!G 0094<10.png 0444.png 009473.bmp 00947,Lbmp 009628.png 00%50.png 009767.png
library Q:::85).jpg
-
tl i! HIIWJ!i!%
-
011273.png 011287.png 011398.png 0115-SB.png 011614.png 011635.png 011637.png 011720.png 011816.png
-
.Sc
II ...
011817.png 012032.png 0121BO.png 012255 (UG 012529.png 01260-8.png 012860.png 012953.png 013138.png
library Q::95}.jpg
g
:t; j
'

-
11111111111
013152.png 013217.png 013594.png 013614.png 01373-Lpng 0139D2.png 014053.png 014053.png
. '5;.;!

'
i:t
f!l

-


014066.png 0140S6.png 0141DS.png 014149.png 014453.png 014495.bmp 014584.png D14545.png 014662.png
ll:l
OH730.png Ol5123.png 01514S.png 01931B.gif 019319.gif 019890.pcx 01994S.bmp 019979.png
Future F'ocus, Inc@ FebntmJ' 17, 201-1 Page 64of73
t
Oll:l65a.png 020747.png
ll
023990.gif 02.!005.gif 02653S.png
Jll!!lll!'!lt.
030058.bmp 030087.png 030103.png

L
-
03035Lpng 03039!ipng 030-tll.png
030TIO.ico 030039.png 030S63.pa:
,;;;;;:.
'=
031323.png 031329.png 031337.png

1.'\
031349.png 031350.png 031353.png
Future Focus, inc@
021030 (l!G
Library Q::9S)jpg
;j)j,,
026552.bmp
030170.ico
II
030419.pcx
030939.png
@
03HW.png


031356.png

(l
029247.gif
03023-G.png
,
.
030963.pcx

03BU.png
031358.png
fJ FebrumT 17,201-1
;j)j,
021177.bmp 02119\:Lpo: OZ12GS.bmp
---
029252.gif 029S74 (UG 030016.png 03004B.ico
Library Q:: 75).jpg
ti.\J
1
\'jl
- 030149.png 030333.png 030337.png 030345.png
II


.
.
030432.png 030547.pcx 030757.png
03D992.png 03100I.png 031105.po 03119-t.pn:

031342.png 03B43.png 0313Kpng 031345.png
i}.

031359.png 031361J.png 03136S.png 031357.png
Page 65 of73



031413.png 031417.png 03141S.png
031434.png 031435.png 031435.png

03195S.png 032020.png 032:022.png
I
.
03240Lpng 032419.png 032656.bmp
;;
032903.pa 032965.ico 032:983.pot
033579.bmp 033653.bmp
Future Focus, Inc @I
c-,.
-
031419.png

031437.png
032057.pcx
032670.bmp
033052.png
033928 {llG
libr3ry Q::::95).jpg
03142\Lpng
031500.ico
031112
(Phcto1hop Web
Q=75)JP9
032671.bmp
033.D72.ico
OJ3997.po:
:>February 17, 2014
lllill

OJ1428.png
031503
Web
Q:75).JP9
032113,bmp
032694.po:
033101.po;

034045.bmp
;::;::::
0314?1.png
031504.bmp
032187.pcx
03ll45.pcx

033176.png
OJ.l065.bmp
031432.png
031875.png
032243.bmp
032E29.pc(
-'II
033572
{Photo;hop Vleb
Q:::66)jpg
034220
(Phcto;;hop Web
Q:::70}.JP9
Page 66 of73
031433.png
031944.pa
03226S.po
03ZS8l.ico
033574.bmp
034225.bmp
034226
Wfb
Q::EO),jpg
0.34303
(Photoshop Web
Q=70).jpg
03U69.bmp
03-1471
(Pholoshop Web
Q=75).JP9
03456-l.bmp
034227.bmp
034304.bmp
034370
(Photoshop Wfb
Q=75).jpg
034472.bmp
034573
(Photoshop Web
Q=EO)Jpg
Future FOcus, Inc @I
034233.bmp
034305
(Pholoshcp Web
Q=70).jpg
034371.bmp
034484.bmp
034574.bmp
034242.png
034306.bmp
034388.png
034485
(Pholoihop Web
Q=SOHpg
0342Hpng
034316
(Photoshop Web
Q:o70)jpg
034399.bmp
03.\49Lbmp
034652
(Photcshop WEb
Q:oSD).jpg
CO February 17, 2014
034269
(Photo:;hop Web
Q::70).jpg
034317,bmp
03440S.png
034499.ico
03465-t.bmp
034270.bmp
034331.bmp
-
034415.png
034561
(Photoshop Web
Q=75).;pg
03-l655
(Photo; hop Web
Q:o:50)jpg
0342Bl.bmp
034:.WO.png
034442.bmp
034562.bmp
03-1656.bmp
Page 67 af73
03-1290.png
034364
(Photoshop Web
Q=70)Jpg
034447.ico
034563
(Pholo5hop Web
Q=70).jpg
03.t657
(Pholmhcp Web
Q=50).jpg

7t,.,,
8 liji@l''
IQ!i@Jifl
034663 act_r:;,png Adobe AdobePOF417.p Agenda 21- AP!F1!e_8 2.ico AP!Fi!e_8.tw auton.m_enabled. Bi!Jboard.jpg
Web CS mp OeWeese.png JP9
Q::;:50}.jpg Macinlo>h
2006-01-24 21_L
!::::::::o:
:1-
..,
Bfi;;.bmp Bonhceffer_Dietri bubmo2.jpg butzano.jpg ector compact2.w1Tl1' ccmpact.wm: dialup 2.gif
ch_2.jpg samp!e.bmp
IIIII',.


w_
Jc
""
-

dialup.gif Oiel!ich direttory.jpg drunken DSC_!Ja07.Jpg e!fo harri>.JP9 l:'nglish.png e;pano!.png favicon 2.!Co
Bcnhoeffer.jpg sai!or.jpeg
mA.iM.l

: ..
-
favitcn.ico FDFFite_B Z.ico FDFFile_S.ico Finger in the Firep!ace-Wii.JPg fish_small2.jpg fi;h_small.jpg fnmcais.png
Windjpg




glmdiggp.png grp!vbg.bmp header_ma!n,jpg imagcl:lOl.png image003.png 1mageDSl.png imageD63.png img0.:16Jpg img089.jpg
<'!k,. '
\j
0 m
img136.jpg img149.jpg IMGPQOOSJPG inrta!l.jpg lmtaller 2.ico Installer.lco iPro!nst 2.bmp iProinstbrnp 10099149.Wf,lF
Future Focus, Inc FelmtmJ' 17,2014 Page 68 l?(73
M
-

-

10101856.BMP J028-0463.ViMF J0332925.JPG J0382926JPG .10382927 JPG XBB293QJPG JiJ332931JPG Kl38293BJPG J0332939JPG
llllild
11!1
J0332942JPG J03B2944JPG .1<:1332947JPG J03S2948JPG JC!?32950JPG
I
J03S2952JPG J0382954JPG J0332955JPG 10382.957 JPG
F'l?Ti'(ljifllfW"':
mrr
10382953JPG J0332959.JPG J033296\.1JPG J0332:951JPG Y.J382:%2.JPG J03S2963JPG J0332965JPG ID332%6JPG 10382967 JPG
JQ332963JPG J0382969JPG J0332970JPG ID334S6lJPG J03E4835JPG J03B48SBJPG 13vendu_sma!Ljp mode!lcg.ldf
g
M M
k
illii$.lilH
'
Y' ;, iii:(- """''
Moen flower.Jpg NA01363_.WMF NA014Zl_.WMF news2.png cbama_birth_cert OpenOffice_bann PDFFi!e_8 2.ico
ificate,Jpg er:JP9
---
k
mm,;;:.'l-
M

Ado:
I I
I

PDFFi!e_S.ico PDXFile_Sjco PE00489_.\\IMF PH01046JJPG PI-+J275DU.BMP PH02753U.BMP PH02754U.BMP PH02755U.8MP
Future Focus, Inc (r) Februm:v 17, 20 l.J Page 69 of73
!I
PHQ2756U.BMP PHD2757U.BMP PH02753U.BMP planets_ small planeH_smatiJpg Pov.rerjpg prinhessionse!up QRCode.pmp QuickSi!ver.wmz
2.jpg .bmp
-
Mf!!lJi i!IJi
XJ XJ m
Red moon ruin.jpg SecStoreFi!e 2.ico SecStoreFi!ejco setup 2.bmp >etup.bmp 5000726_.WMF S002413_.VVMF S002S62_.WMF
desert.jpg
}s,
.. fiiifH:WI

ilF/'''fitWI
steve-harris_2Jpg sv_architectimag SV-252f4.png sv2512.png tanklabeLjpg templog,ldf THOCRl.PSP THOCR3.PSP THOCR.PSP
e_256.bmp
_,"l'ii\V'>"'-7Wt

IIIII
Thumbs 2.db Thumbs-3.db Thumbs.db Tulips.jpg U3_removal.jpg \Vater lilies.jpg watermark_300x. \Yinter.jpg wmc_bw32.bmp
bmp
--->----
---+--
-+-----
lf!Wltll it'! ill

wmc_bAAS.bmp wmc_color32.bm wmc_colcr48.bm XDPFile_8 2.ico XDPFile_S.!Co XRLE2.PSP XFilE3.PSP XFILE.PSP XOCR3 2.PSP
p p
--->----
D
--->----
---+-- ---+-
.....-- -+-----
!lllllm.Wli


XOCR3.PSP xptht27djpg XSCAN32 2.PSP XSCAN32.PSP
Future Focus, Inc@ (C) Febntary 17, 2014 Page 70 af73
Image 1 log
Image 2 log
Tough book configuration
9/9/09 programs
Recovered files in the following folder structure are attached

exports
'
documents
miSC
no path
personal
unknown

with path
Documents and Setting$
Novell
Path unknown
Program Files
uti!
\VIIJDOVlS
work
'
pin
ex if
mi;c
no path
pe:rsonal
'
with path
Oocument5 and Settings
Novell
Path unknov,-n
Program Files
RECYCLER
uti I
WINDOVlS
work
'
spreadsheets
mise
no path
per5onal
unknown
with path
work
Future Focus, Inc {) FebruaJ)' 17, 201-1 Page 71 of73
Hugo Black and the KKK
.lu C< !937. fm:kli11 D Hu9-o BlKk into
m:A afr.:-r 11 few ,( "-1tn1l1alk, rvmm.:d ;1 S;r ;n:rn:t
Hugo Black's Opinion in Adamson v. Cailfomia
(1947)
Adam$011 v. California (1947)
Pl Humor Comer: Officer Murphy's Laws
Future Focus, Inc FebrumJ' 17, 2014 Page 72 of73
Psalm 55:22 ---You really need to read this.
This was \vtitten by a Metro Oenve:r Hospke Physician:
I driwtg frtWl a rr.::-!r,; t't.s abcut S, in
tr11:'fic en Cdor;;do ShU , <Jnd the c-.. 1r ::c thckt> <Jnd splutter .1nd
d.:< 1 b.3Jei'{ to c.uriihf.l, i:1':C a !.:.atio;;, gfad wly
that ! 1v::dd net be b\:xk;-:.g "::<lfi,c wold h;we 11 $071M'h,(jt >'<ilrm
wot to h'l!;: fCI the t:::w truck
lt wouldn't even tum r:Net, Ed ore I c:::uid m.!<.e the 1 :1
woman .-alf._ing cut cf the quidJe rnart build ng, ad -'t !oohd ;,o:e $he
C-"1. sene ice and fe!i ga:. t:ump, so I g:7. cut to ::e<: if !>he
was. ckay
When ! got there, it kxlked mere :Je b..1d bee:-1 C'>t::rccne
:han that she h-3d f;;1ir.n; she yuung wcman who really
hagg&rd ith di:rk (II c:es her t:'r'e.$, She dropped rorneth11>:; a!. 1
h>!'lpf'!-d f--tr I picked it up to give it to tt was a t1de{
The Secret Info
Your free Dr leonard Coldwell secret
Newsletter
Welcome to my free secret information
newsletter
Jeremiah Project
The Separation of Church and State
Fllture FOcus, Inc if:; Februw:v 17, 20 I-I /'age 73 o/73