Defence Computer Expert Report (English)

From The Murder of Meredith Kercher
Jump to: navigation, search
This is an English language translation of the report. See Defence Computer Expert Report for the Italian original.

Thank you to Catnip from PMF community for this translation.

Letter to Carlo Dalla Vedova:

Rome, 31 March 2008

Subject: Technical report re Amanda Knox laptop

The undersigned Marco Angelucci, in fulfilment of the request received, on 11 February 2008 at 15:00 proceeded with a technical evaluation of the Toshiba-brand laptop property of Miss Amanda Knox currently in the custody of Professor Massimo Bernaschi for the purpose of analysis of its contents and functionality as tasked by the GIP of Perugia inasmuch as the equipment is subject to seizure provisions in relation to investigations in progress.

The joint technical evaluation was carried out, over various sessions, at the IAC/CNR head office at 137, Viale del Policlinico, Rome, on the first floor in the office of the analyst. At no time was the expert on behalf of Mr R Sollecito present at any session.

The technical report and observations are presented in the following Appendix A.

With best regards Marco Angelucci


[page]

Contents

Title Page

Appendix A

Technical report re Amanda Knox laptop

[page]

Contents

  • Computer details
  • Findings
  • Technical evaluation
    • 11 February 2008
    • 20 February 2008
    • 14 March 2008
    • Further evaluations
  • Technical opinions
    • CTU
    • Forcing open
    • Unrecoverable data
  • Hypotheses
    • General
    • Voluntariness
  • Photographic evidence

[page]

Technical details

  • Manufacturer: Toshiba
  • Model: Satellite M55
  • Serial number: 75418110K
  • Year of manufacture: 2004 - 2006
  • Colour: black and silver
  • Physical condition:
    • Chassis: Complete, without internal Hard Disk;
    • Video display: Complete, working;
    • Keyboard: Complete, working with its touchpad (see annexed photo 1 and 1A)
  • Internal disk:
    • Physical state: removed from its lodging, visibly complete, but non-functioning, the fixtures and seals entire, no electronic component visibly damaged;
    • Characteristics: Toshiba Model MK1032GAX, capacity 100 GB, 5400 r.p.m. , 16Mb cache, voltage +5V, current 1A. (see annexed photo no. 2 )


Findings

The undersigned writer on 11/02/2008, at 15:00, in the CNR head office at number 137, Viale del Policlinico, Rome, following an arranged meeting with Professor Bernaschi, initially visually inspected the equipment the subject of examination which revealed that said equipment, a Toshiba-brand laptop property of Miss Amanda Knox was in an optimum state of general use. It was observed that the external shell of the Toshiba laptop was without any scrapes and bumps and in good condition and the internal hard disk drive (HDD) unit – usually installed, internally connected, covered with a guard cover forming part of the shell by means of a screw-fixed mechanical covering and an integral part of any laptop – had been dismounted. The computer appeared almost totally covered by a layer of chemical material designed to reveal fingerprints, a white-coloured powder for revealing latent fingerprints. From a declaration made by Professor Bernaschi it appears that the latter had received the computer without any internal disk, inasmuch as it had been dismounted and removed from the apparatus during prior phases of police investigative taskforce and expert activities (see annexed photo no 3).

I was advised by Professor Bernaschi that the latter had been also tasked with examining the disks and associated laptops belonging to the victim, Meredith Kercher, and to Mr Raffaele Sollecito, those also under seizure following investigations by the police taskforce. [page]

The laptops belonging to Ms Kercher and to Mr R Sollecito likewise resulted in being physically separated from their internal drives inasmuch as they were already dismounted prior. Ms Kercher’s laptop is an Apple brand and at the time had not been subject to joint verification activity. As a consequence of the physical states of the disks and of the activity relating to the recovery of their contents, successive evaluative activity was effected. Professor Bernaschi has declared to having already attempted to recover the contents of the three disks the subject of examination, prior to the session on 11 February 2008, with negative results for the two disks belonging to the laptops of the victim and of Mr R Sollecito and partially positive for the Toshiba disk of Miss Knox.

Technical evaluations

1. Session of 11 February 2008

The Toshiba laptop under examination appeared in an optimum state of preservation, covered with white-coloured powder (composed of titanium oxide, talcum power, etc) for revealing latent fingerprints, the keyboard and video display showing signs of normal use and, from a test effected jointly with the expert, appeared functional. In fact even without its hard disk drive (HDD) the Toshiba laptop was carrying out its BIOS contents reading and loading operations normally, showing the correct contents in its video display. Following this, by reading the CD-ROM unit, it was correctly loading the resident part of the Operating System supporting CD-ROMs with the result of showing the correct activation commands and functions on the video display. The fixed internal drive (HDD), also produced by and branded as Toshiba, from an analysis of its physical state appeared complete and entire, both in its mechanical components and in its electronic components, with a self-adhesive sticker, guaranteeing the integrity of the internal magnetic platters and protecting access to them, intact and unbroken.

Analysis of the fixed internal drive (HDD) was commenced, linking it by a USB port (Universal Standard Bus) through the appropriate cable and adapter to an IBM PC, property of the CNR Institute. The disk appeared non-functional, the motor completely off, no command logic signal was activating its selection, as revealed by the USB adapter and therefore the disk was not usable and no data content was accessible. This indicates that at least one component, the logic board of the disk, was damaged and therefore the unit was not capable of functioning. Obviously no evaluation of its mechanical functionality was possible. [page]

At the same time a functionality test of the other two disks the object of expert examination was carried out, linking them through a USB port via appropriate cable and adapter to the same CNR Institute PC, with the result they were non-functional.

With the intent of diagnosing the cause of these malfunctions and to isolate the damage to either one of the two components, the electronic logic board or the mechanical chassis, which assembled together form the hard disk, a counter-test was effected, wherein the tasked expert had procured three tested and functioning hard drive units, of the same brand and type, with the intent of diagnosing whether the disk contents could be read and recovered.

Therefore the electronic board was first disconnected from the Toshiba-brand hard drive belonging to Miss Amanda Knox’s laptop and substituted with a functioning logic board of the same type linking to a USB port via appropriate cable and adapter to the CNR Institute PC with the result being certain that the just-powered disk was starting the rotation of the internal magnetic platters with the correct instructions, a matter verifiable by the vibrations of the unit but it was not effecting any positioning or data-reading actions such as to produce results and legible responses on the command line of the computer screen.

At this point it was possible to determine with certainty that the original electronic board of the Toshiba-brand and make fixed internal drive belonging to Miss Amanda Knox’s laptop was damaged and not restorable unless by hardware intervention, the motor and the mechanical components could be considered as functional and capable of allowing an attempt at the recovery of the data content. The same counter-test was carried out on the other two disks the subject of expert examination, the Fujitsu and the Hitachi belonging to the computers the property of R Sollecito and M Kercher, with similar results, by substituting the electronic board the disks could be recovered and the contents read.

In a prior activity, Professor Bernaschi had already attempted the recovery of the disk contents, with the following results:

(A)
Two of the disks, the Fujitsu and the Hitachi, besides the inactive electronic logic board also presented problems on the mechanical side or in the internal parts that support the positioning of the heads and reading/writing
(B)
The Toshiba disk belonging to Miss Amanda Knox presents problems in the electronic board, also inactive, but substituting it, it was possible to copy part of the contents receiving numerous error messages.

The preceding activity had been notified to the GIP of Perugia.

[page]

At this point, to try and read the hard drive contents, it is only possible to carry out a recovery operation at a specialist company. The procedure is usually the following: On arrival, all the storage media received are carefully analysed in a laboratory to establish:

  • If the problem is physical (hardware), logical (software) or both
  • If it is necessary to open the media in a clean room to be able to access the data
  • If the magnetic surface is readable
  • The amount of data recoverable
  • What damages the file structure might have suffered and how much could be reconstructed
  • If recovery is opportune and how much it is going to cost
  • Proceeding with the recovery of the data

All of which is done by means of dedicated equipment and specialist technicians who operate in suitable technical environments.

Following authorisation from the GIP, the three disks have been sent to the Italian head office of the Krollontrak company http://www.krollontrack.com, to proceed with the recovery.

2. Session of 20 February 2008

Following notification from Prof Bernaschi, concerning the arrival of the three disks, after activity at the Krollontrak company, a new meeting had been advised to verify the recovery of the data on the three disks the subject of expert examination.

The two disks belonging to R Sollecito’s computer and Meredith Kercher’s Apple computer, the Fujitsu and the Hitachi, have been recovered, in terms of their contents, following activity at the Krollontrak company then furnished to Prof Bernaschi, while the attempt at recovering data from the Toshiba disk belonging to Miss Amanda Knox’s computer had not been possible, due to a high error rate possibly attributable to platter-surface damage from a head crash.

On 20 February all tests to verify the results of the recovery attempt were carried out and the impossibility of proceeding with the recovery is confirmed.

At this point Professor Bernaschi has formally requested the GIP to proceed with a second recovery attempt of the contents of Miss Knox’s disk by sending it to the specialist company “Field Associates Limited” http://www.fieldsassociates.co.uk.

[page]

3. Session of 14 March 2008

The second company tasked by Prof Bernaschi with the recovery attempt has communicated, on 5 March 2008, that due to the high error rate of “severe Bad Sectors which prevents access from the Data”, the operation was not able to be concluded positively. In fact, after the normal attempt at recovery, the following had been done: (1) substitution with other read-write heads (2) work focussed on the microchip Notwithstanding the later activity, no data was recovered.

On 14 March, having the three disks available, the opening of the chassis containing the read-write heads and disk platters was proceeded with. The Toshiba disk was opened and inspected.

Visual inspection has confirmed that the upper visible surface of the disk is integral and that to inspect the others dismounting of the whole set of platters and mechanical assemblage was required, but it being a matter of an operation which precludes any attempt at later recovery, Professor Bernaschi has asked the GIP for authorisation to proceed. (see annexed photo no 4)

I can confirm that due to the technology used by Toshiba, the maker of the disk, it is not possible to proceed otherwise, if not by physical inspection of the disk, but at the same time this rendered successive recovery attempts almost impossible.

4. Further evaluations

The third company tasked, “CBL Data Recovery Tech.” http://www.cbltech.com/data-recovery/, has carried out a further recovery attempt of data from the disk belonging to Miss Amanda Knox’s computer, with a negative result, arriving at the same technical diagnosis as the preceding companies:

“As we told you in the E-Mail before, the BIOS from the disk has been damaged through the PCB, logic board or controller”.

[page]

Technical opinions

1. Technical opinion on the CTU operation

As for the CTU operation, professor Bernaschi has been transparent, technically correct and aimed at the recovery of the contents The conjoint activity has been technically transparent, logically coherent and objectively aimed at resolving the problem of recovering data from the fixed disks of the three laptop units. Even the choice of three of the most well-known and quoted data recovery and salvage companies in Europe has been correct.


2. Technical opinion on forcings or tamperings

Considering the physical state of the Toshiba laptop, as revealed on 11 February and then successively, in my opinion it has not suffered any forcing or tampering, except for the dismounting of the internal drive and the [finger]print-revealing activity.

No signs of forcing appear on the screws that hold the laptop together and the same uniformity in the layer of material, chemical material designed to reveal finger prints, evidences the integrity of the apparatus. It not being possible to proceed with the reading of the files that contain the activity history, we are able to refer only to the visible physical state and what was revealed during the expert examination activity and no evaluation can be effected on possible forcing open, or software intrusions on the contents.

8 [sic; read: 3]. Technical opinion on the unrecoverability of the data

Following the tests carried out, by various interveners, it therefore appears that the Toshiba disk belonging to Miss A Knox’s Toshiba-brand laptop was damaged with problems evident in the electronic board, which resulted as being inactive, just like the other two. While the contents of two of the three disks have been recovered, following the Krollontrak company’s diagnosis, the third disk seems to have been also damaged in its component mechanics, while CBL Data’s and Recovery Tech’s diagnoses confirm that the third disk has been damaged in its electronic component. In reality, the damaged component is the electronic board, where an integrated circuit sits, sometimes referred to as “BIOS”, containing the binary code that allows access to the data, calibration, writing and reading. This technical specification belongs to the Toshiba manufacturing house, a proprietary [page] technology. The electronic board and the binary data contents of the disk being inextricably linked and intertwined, and the Toshiba logic board being damaged, it has therefore been impossible to recover it. Only a possible intervention by the parent company or its licentiate, by means of supplying the binary/BIOS code, would be able to justify a further intervention. It is however truly incomprehensible that three hard drive units, differing among themselves as to capacity, produced by among the most quoted manufacturers, belonging to and operating on three different laptops, could all three end up damaged in a similar manner and all three react in the same manner to an attempt at reading the data by an external disk controller run by the Operating System residing on an IBM PC furnished by the IAC/CNR Institute and of relative utility for data recovery.

On the CTU side, recovery utilities compatible with the Microsoft Windows Operating System and belonging to the “Open Source” category were used, to guarantee an efficacious recovery of data.

Hypotheses

8. General Hypotheses

As previously described, all the electronic boards of the three disks are damaged and inactive and have surely suffered an electric shock, even though not appearing physically damaged. How could an anomalous event like that unleashed at Technical Evaluations and with the corresponding Observations have occurred?

I have shown in the TECHNICAL CHARACTERISTICS that the disk of a laptop is usually supplied with a positive tension of 5 volts (+5V) and one of 0V which is also the reference for the mass logic line and takes advantage of the “IDE” standard to interface to the disk controller that resides on the computer’s motherboard where the Processor is.

The disks under examination are generally installed in laptops in appropriate compartments with obligatory connections that prevent connection errors by means of keyed connectors or restricted access, whilst when they are freely connected to a USB connector it is possible that the connector could be misaligned such that the disks in question present the particularity of having 4 pins free for selection in the case of multiple connections, and then the lining up between the electrical connections and the logical ones is altered and a short circuit is produced.

Another hypothesis is the possibility of trying to connect to another type of connector, taking advantage of the current directly feeding the internal disks of a fixed computer (PC).


9. Hypothesis on voluntariness

On the basis of what has been revealed, no indication concerning the voluntariness [i.e., deliberateness, in the lay sense] of the multiple damage is available.