ation and registered owner, which are user input data. He is expected to explain that Government Exhibits 405 and 419 were generated by Access Data AD Lab. The Government further anticipates that will testify that he examined certain exhibits contained on the devices marked for identification as Gove

eviewed the properties for GX 417, 418, 420,421,422 (GX 417B, 418B, 420B, 421B, 422B) and confirmed accuracy by running software (Access Data's Lab, AD Lab); confirmed GX 417 on GX 55 (NYCO24349); GX 418, 420, 421, 422 on GX 54 (NYCO24350); all word documents • El confirmed GX 412 and GX 415 on GX 54;

er 5, 2021 Call with • Checked registry file called SAM file which documents users on machine, has ideatit-Km for the users; checked Access Data's AD Lab • Re-checked 3 user accounts on GX 54: for guest account, zero logins; for administrator account, approximately 30 logins; ghislaine logins: 390 l

rganizes data off of computers, digital media, for review; same tool as Forensic Tool Kit (FTK), but that is limited to one user at a time, whereas AD Lab allows for multiple users at a time • Group in headquarters test and validate tools before CART uses the tools • GX 418, 420, 421,422 were create