Dwight Falkofske — Direct/Cross/Voir Dire
621 linesJUDGE NEWMAN: Next witness.
MR. CONRAD: The State calls Dwight Falkofske.
The witness, DWIGHT FALKOFSKE, was first duly sworn and testified as follows:
COURT CLERK: If you will, sir, please be seated. State your name, and then spell your last name.
DWIGHT FALKOFSKE: My name is Dwight Falkofske. Last name is spelled F-a-l-k-o-f-s-k-e.
VOIR DIRE EXAMINATION
BY MR. CONRAD:
MR. CONRAD: All right Mr. Falkofske, how are you doing this afternoon?
DWIGHT FALKOFSKE: Doing good.
MR. CONRAD: All right. Where were you employed, sir?
DWIGHT FALKOFSKE: I am employed with the FBI.
MR. CONRAD: Okay, and what is your job title there?
DWIGHT FALKOFSKE: I am an electronics engineer.
MR. CONRAD: What unit of the FBI are you employed in?
DWIGHT FALKOFSKE: In the Electronic Device Analysis Unit.
MR. CONRAD: Okay, and what does the Electronic Device Analysis Unit do at the FBI?
DWIGHT FALKOFSKE: We collect data off of cell phones and other mobile devices, and in my case vehicle systems. Mobile devices in general that can't be collected by commercial tools.
MR. CONRAD: All right, and so the FBI has a unit dedicated to extracting data off certain devices that is otherwise unavailable. Is that correct?
DWIGHT FALKOFSKE: That is correct.
MR. CONRAD: Okay, and you kind of mentioned it, but specifically what is your role in this unit?
DWIGHT FALKOFSKE: I serve a role as an automotive forensic specialist.
MR. CONRAD: Okay, and what does that entail? What does that mean?
DWIGHT FALKOFSKE: So, I take a look at automotive systems and extract data off of the memory components of those systems, and then from the images we get from those memory components, I will take a look at their -- find the data that we're interested in finding, and we will create parsing tools that will pull out that data and take it from a computer format to a human readable format.
MR. CONRAD: Let's explain that a little more. You said a parsing tool. What is that? Explain that to the jury what that is, please.
DWIGHT FALKOFSKE: Okay. So, a parsing tool is in this case a computer script that I'm writing that -- or I have written that will go in and look at the collected binary image, the flash memory image that I've created, and go in and either create a file system, or just go in raw with the binary and search for data that is of interest to us. This is data we've researched and found, and it will take that data out of the system and again, put it into a human readable format, text, graphics, or coordinate points so that we can understand it as humans.
MR. CONRAD: In its most basic format, data is stored how?
DWIGHT FALKOFSKE: In binary.
MR. CONRAD: And what does binary mean?
DWIGHT FALKOFSKE: Binary is just zeros and ones, what a computer reads.
MR. CONRAD: Okay, and the parsing tool, if I understood you correctly, it helps you take that binary information and translate it into information that you can read and understand. Is that correct?
DWIGHT FALKOFSKE: That is correct.
MR. CONRAD: Okay. All right, and have you -- first of all, tell us is little bit about your background. What education and training have you had in this area?
DWIGHT FALKOFSKE: I have a Bachelor's of Science degree in electrical engineering. And if you'll give me one moment, I have my CV here and I'll list out the training I've taken with the FBI. In August of 2016 I took the Digital Evidence Management Systems Training; that's to store data on our electronic evidence management system. In August 2016 I completed Digital Evidence Handling. October 2016 Legal Ethics Training. August 2017 CDARK Mentorship under FECR. CDARK Mentorship is an internal designation for -- at the time I was working as a contractor to the FBI, and this training allowed contractors to handle evidence and that was the extent of that training. I also in August of 2017 completed the CDR proficiency testing. And I've also testified as an expert witness in September of 2019.
MR. CONRAD: Okay, and what -- do you recall, if not specifically but generally, what were you qualified as an expert witness in 2019?
DWIGHT FALKOFSKE: I don't recall the exact name they gave me for the expert witness, but I served as what I've told them. I served as an electronics engineer automotive forensics specialist.
MR. CONRAD: Okay, and how would you best describe your expertise that you are going to talk about today? How would you personally describe it?
DWIGHT FALKOFSKE: I take a look at automotive systems, and I go in there and find the data of interest. If I go into the types of data, would be things like connected device cell phones, thumb drives. From cell phones I can also collect things like call records, contact lists. Also navigation data, location of vehicle or destinations that the user may have entered into the system, I go find that data in the systems and I write the parsing tools that I've mentioned to go ahead and pull those out. That's the general extent.
MR. CONRAD: So, would automotive forensic specialist be descriptive of what you do?
DWIGHT FALKOFSKE: Yes. Q. Okay.
MR. CONRAD: Your Honor, at this time the State would move to enter Mr. Falkofske as an expert in the area of automotive forensic specialist.
JUDGE NEWMAN: What says the defense?
MR. BARBER: No objection, Your Honor.
JUDGE NEWMAN: He's so qualified.
MR. CONRAD: All right. Thank you.
DIRECT EXAMINATION
BY MR. CONRAD:
MR. CONRAD: All right. So, let's talk a little more about the mechanics of how you obtained this data and what you do. And just talking not specifically in this case but just kind of generally in your unit --
DWIGHT FALKOFSKE: Okay.
MR. CONRAD: -- what do you do? When you receive a device from a vehicle -- first all, what kind of devices do you receive from vehicles?
DWIGHT FALKOFSKE: They tend to be infotainment centers, which can be, you know, basically the brains of the system that puts -- on some of these modern cars it puts up the screen, it shows your music. If it's got navigational, navigations. It's the computer brain of that system. Also take a look at components such as telematics box, which you'll hear about like the OnStar module in this case, and those tend to have connection to my services, and sometimes location data as well.
MR. CONRAD: Okay, and just generally speaking, how do you access the information stored on these devices?
DWIGHT FALKOFSKE: The first thing we do is what we call data extraction. And data extraction involves basically going in and finding the data -- the flash memory components with this computer, the infotainment system or the telematics box, and we will -- we have different methods to extract that data. We have software methods. We have methods where we will connect with the circuit board or the board, or sometimes we will just remove the chip and read it with a reader.
MR. CONRAD: Let me stop you real quick. This jury has heard testimony about cell phone extractions and how cell phones are extracted, and you mentioned sometimes you can use a software method. Is that how -- is that analogous to how cell phone data is normally obtained in an extraction?
DWIGHT FALKOFSKE: If I could compare it to a commercial tool like Cellebrite Software Solution would be something you plug into the system while it's operating in order to get into the system and extract the data you need.
MR. CONRAD: But some of these automotive devices are far more unique than an average cell phone, correct?
DWIGHT FALKOFSKE: Yes.
MR. CONRAD: And therefore in -- is it -- therefore, is there an off-the-shelf ready system that can access most vehicles, to your knowledge?
DWIGHT FALKOFSKE: No. There is one commercial company called Berla that does have a tool that can -- is used in the field. However, we only accept the devices at EDAU for systems that there is no support for.
MR. CONRAD: Okay. So, you mentioned this company Berla, which does produce a commercially available software that can extract data from some vehicles, correct?
DWIGHT FALKOFSKE: Some vehicles, yes.
MR. CONRAD: But it does not support the 2021 Chevrolet Suburban, correct?
DWIGHT FALKOFSKE: That's correct.
MR. CONRAD: All right, and that's how the device ended up with you, correct?
DWIGHT FALKOFSKE: That's correct.
MR. CONRAD: All right. So, I kind of stopped you there. And if a software solution isn't available like Berla, what are some of the other methods that you use to pull data off of some of these automotive systems?
DWIGHT FALKOFSKE: I mentioned such as attaching wires to a circuit board and extracting data from the memory component, or also removing the chip from the board and putting in a reader and reading the chip, the flash memory chip directly.
MR. CONRAD: Okay. All right, and let's talk more about what you did in this case. When you attempted to access the data for the 2021 Suburban, did you encounter any problems?
DWIGHT FALKOFSKE: Yes. We ran into our first instance of data being encrypted on a vehicle.
MR. CONRAD: Okay, and that's not something you had run into before.
DWIGHT FALKOFSKE: Not on vehicles.
MR. CONRAD: Okay, and briefly explain to the jury what you mean by encrypted, please.
DWIGHT FALKOFSKE: So when a system encrypts the data, it takes basically a code word such as a -- called a key and scrambles the data using that key so that it can't be written unless you have that key, and the key won't -- to read it back you require the key to unlock the data and see it back in its regular form.
MR. CONRAD: Okay, and you discovered this data on this Chevy Suburban was encrypted, correct?
DWIGHT FALKOFSKE: That's correct.
MR. CONRAD: All right. I'm going to show you -- they've been marked for ID only -- 448 and 447. And I'm going to -- take a look at them and see if you recognize these items, please.
(Break in proceedings.)
DWIGHT FALKOFSKE: This is the OnStar module that I processed.
MR. CONRAD: Okay.
DWIGHT FALKOFSKE: And this is the infotainment system that I processed for the Suburban.
MR. CONRAD: All right. How do you know those are the units you processed?
DWIGHT FALKOFSKE: We have an FBI identifier tag on here, and my personal identifier symbols are on here.
MR. CONRAD: And that's on both of those devices?
DWIGHT FALKOFSKE: On both units.
MR. CONRAD: All right.
MR. CONRAD: At this time, the State would move to enter Exhibits 447 and 448 into evidence.
MR. BARBER: No objection, Your Honor.
JUDGE NEWMAN: They are admitted.
(CAR MODULE MARKED AS STATE'S EXHIBIT NUMBER 447 WAS RECEIVED INTO EVIDENCE.)
(CAR MODULE MARKED AS STATE'S EXHIBIT NUMBER 448 WAS RECEIVED INTO EVIDENCE.)
MR. CONRAD: All right. So, let's talk about -- you say when you initially tried to access the data on these, they were encrypted. Can you tell us what the FBI did, or what you did to ultimately allow you to access the information?
DWIGHT FALKOFSKE: Involved our greater team to develop a tool that would be able to reach into a live system on one of these vehicles and extract the encryption keys and remove the -- get the encryption keys so then we could then decrypt the data that we had collected.
MR. CONRAD: Okay, and was that process ultimately successful?
DWIGHT FALKOFSKE: Yes, it was.
MR. CONRAD: And how long did that take approximately?
DWIGHT FALKOFSKE: Approximately one year.
MR. CONRAD: Okay. All right, and when you access this information and you finally had it decrypted, what types of information did you find? Let's start on the infotainment center. What types of information did you find on there?
DWIGHT FALKOFSKE: So, the infotainment center contained connected devices, phones that had been linked by Bluetooth on this vehicle, and associated with some of those devices were call logs and contact lists, and there was also a little bit of location data.
MR. CONRAD: Okay. So, you found some call logs, correct?
DWIGHT FALKOFSKE: That's correct.
MR. CONRAD: And how would that infotainment center get call logs? Explain that process. Why would they be on that center?
DWIGHT FALKOFSKE: So, a lot of cars that have Bluetooth connectivity will -- when you connect the Bluetooth with them, sometimes they will ask you if you want to let the car connect to it or access your data on your phone. Sometimes it doesn't ask, but in most cases it will ask you. And then at that point it will take things like call logs and pull them from the phone into the computer, the infotainment system.
MR. CONRAD: Okay. All right, and you found some call logs on this infotainment center, correct?
DWIGHT FALKOFSKE: Yes.
MR. CONRAD: You found some data, correct?
DWIGHT FALKOFSKE: That's correct.
MR. CONRAD: Do you recall if you found any from the date of January -- excuse me, June 7th of 2021?
DWIGHT FALKOFSKE: Yes. There was data from that date.
MR. CONRAD: Location data?
DWIGHT FALKOFSKE: Oh, location data, no. Just had call data.
MR. CONRAD: All right, you found some call data. You found some Bluetooth data, and what kind of Bluetooth data did you find for devices did you find?
DWIGHT FALKOFSKE: It -- primarily the Bluetooth address of the connecting device.
MR. CONRAD: Okay. Did it provide any information of when a device may have been connected to the infotainment center?
DWIGHT FALKOFSKE: No. There was no timestamps with that data.
MR. CONRAD: Okay. All right, but there's another thing, another type of data you found on this infotainment center, correct?
DWIGHT FALKOFSKE: Yes. We additionally looked for vehicle -- information regarding the state of the vehicle.
MR. CONRAD: Explain to the jury. What does that mean?
DWIGHT FALKOFSKE: So, what we were looking for on this car was something to show if the car was moving, if doors were opened or closed, windows up and down. We searched for this type of data on this vehicle.
MR. CONRAD: Okay, and did you find some of that data?
DWIGHT FALKOFSKE: We did. We found what we call states of the vehicle, and in this case it was more granular things such as -- one of the ones we're interested in looking at is the shift lever going in and out of park, kind of giving an indication.
MR. CONRAD: And we'll talk more about that in a minute.
DWIGHT FALKOFSKE: Okay.
MR. CONRAD: But would you say that that there was a lot of this vehicle stat -- vehicle status data that was stored?
DWIGHT FALKOFSKE: Yes. This vehicle stores a voluminous amount of data and some logs.
MR. CONRAD: And is the majority of that really useful when you try to --
MR. CONRAD: Okay, and did you attempt to pare down the data you were looking at to find potentially useful information?
DWIGHT FALKOFSKE: Yes. We combed through the data, and we looked for data that matched our testing of a similar vehicle -- or an identical type vehicle to be able to identify a record of -- messages in this log that were -- can be attributed to the vehicle status.
MR. CONRAD: Okay. Well, let's talk about that. You mentioned it. You said testing. What do you mean by testing? How -- what did you guys do to test this?
DWIGHT FALKOFSKE: We obtained an identical 2021 Suburban vehicle with the same build out, and we drove it multiple times and extracted data from it multiple times in a series of tests designed to try to understand what is going on inside the system.
MR. CONRAD: Okay. So, it's just simple testing. So, you go out and drive it and you would record -- you knew when you were driving it so you could record times, correct?
DWIGHT FALKOFSKE: We could record times and locations, yes.
MR. CONRAD: And then you could go back in and pull that data off the infotainment center of the test vehicle, correct?
DWIGHT FALKOFSKE: That's correct.
MR. CONRAD: And then you compare that to the logs that you guys wrote saying they did this at this time, correct?
DWIGHT FALKOFSKE: That's correct.
MR. CONRAD: And you could -- what could you do with that comparison? What did that help you with?
DWIGHT FALKOFSKE: So, that helped us identify in the logs -- the logs laid out states, very granular states of --
MR. CONRAD: What you say granular, and I'm going to -- and I apologize when I stop you, but I want to make sure, you know, we understand everything you're saying. When you say granular, what do you mean by that?
DWIGHT FALKOFSKE: I'll explain a few of the states to give you an example.
MR. CONRAD: Okay.
DWIGHT FALKOFSKE: When the vehicle first -- say you open the door and you see the screen turn on on the car, that would be maybe one or two of the states that the system tells me it's waking up, a message saying it's waking up, then a message saying I'm showing my animation video on the screen as it starts to boot up. And then eventually, like, if the car is being -- and then in other states of the car, such as in and out of park, the very -- a lot of the states only mean something very small in the whole scheme of how the car is operating, very specific little pieces of data.
MR. CONRAD: Okay, and there's a lot of them, correct?
DWIGHT FALKOFSKE: There's a lot of them.
MR. CONRAD: And so you had to kind of figure out a way to kind of pare that data down into something that's useful for you to interpret, correct?
DWIGHT FALKOFSKE: That's correct.
MR. CONRAD: All right, and how did you do that?
DWIGHT FALKOFSKE: Initially we wrote a utility into parser that would go through first of all and select all the messages we found of interest that indicated some sort of state of the vehicle, and then we attempted to take that data and put meaning to it. And it, it was a challenging process, let's put it that way.
MR. CONRAD: But ultimately do you feel like at least for certain types of events you were able to draw some conclusions about what was going on with the vehicle at certain times?
DWIGHT FALKOFSKE: Certain events were much more specific about certain of the things that were going on with the car and were clearer.
MR. CONRAD: All right, and when you were asked, you know, the question of, you know, is -- can you use any of this information to determine when a vehicle could potentially be moved, is that something that you looked for in this data?
DWIGHT FALKOFSKE: We were looking for that data, and we found something close to that data.
MR. CONRAD: Okay, and in your testing and analysis, what did you determine would be the best indicator to you looking at the data of when the vehicle was moved?
DWIGHT FALKOFSKE: A message indicating whether the car was in park or out of park.
MR. CONRAD: Okay, and so you found a reliable indicator from your, in your opinion, indicates the vehicle would likely or possibly be moving, correct?
DWIGHT FALKOFSKE: That's correct.
MR. CONRAD: All right. Now, all you said was you can -- this particular message says it's either in park or out of park, correct?
DWIGHT FALKOFSKE: That's all it says.
MR. CONRAD: And it doesn't necessarily say whether it's in drive, correct?
DWIGHT FALKOFSKE: That's right. I don't what gear it's in.
MR. CONRAD: Okay, but you can tell when it is out of park.
DWIGHT FALKOFSKE: Correct.
MR. CONRAD: All right, and can you tell from that whether the vehicle was actually physically moving?
DWIGHT FALKOFSKE: I cannot.
MR. CONRAD: Okay. I am -- and at the end of this analysis, did you prepare data and a parser report to send to SLED at the end of your analysis?
DWIGHT FALKOFSKE: Yes, I did.
MR. CONRAD: Okay. I'm going to show you what's been marked as Exhibit 443, and I'm going to see if you recognize that.
DWIGHT FALKOFSKE: Yes. This is a copy that I validated earlier today against the original --
MR. CONRAD: Okay.
DWIGHT FALKOFSKE: -- of events that were submitted.
MR. CONRAD: So, that contains the information you provided SLED, correct?
DWIGHT FALKOFSKE: That's correct.
MR. CONRAD: And generally speaking, what is contained on this CD?
DWIGHT FALKOFSKE: It is the -- our unit's derivative evidence results of what was extracted and recorded for both the OnStar module and the infotainment system.
MR. CONRAD: Okay. All right, and so this provides both -- we said there's voluminous raw data that came out of this vehicle, correct?
DWIGHT FALKOFSKE: Yes.
MR. CONRAD: And it includes a full copy of that, right?
DWIGHT FALKOFSKE: There is.
MR. CONRAD: But also includes a report that kind of pares that down into more useful information, too, correct?
DWIGHT FALKOFSKE: Yes.
MR. CONRAD: What did you call that report again? The -- was it the HTML report?
DWIGHT FALKOFSKE: The format was in HTML, so you could open it with a browser, yes.
MR. CONRAD: And what tool did you use to help you prepare that condensed report?
DWIGHT FALKOFSKE: That was the parsing tool that developed that.
MR. CONRAD: And that's what you told -- talked to about at the beginning of your testimony with the jury, and that's a way to software -- use software to help pare down the data to something useful, correct?
DWIGHT FALKOFSKE: Correct.
MR. CONRAD: Okay.
MR. CONRAD: At this time, the State would move to enter Exhibit 443 into evidence.
MR. BARBER: No objection.
JUDGE NEWMAN: It's admitted.
(DVD WITH REPORT MARKED AS STATE'S EXHIBIT NUMBER 443 WAS RECEIVED INTO EVIDENCE.)
MR. CONRAD: Okay, I'm going to show you what's been marked as Exhibit 449, and just describe what that is to the jury, please, real quick.
DWIGHT FALKOFSKE: Okay. This is a spreadsheet that basically shows many of the states of the vehicle that we were looking at and testing our -- the tests and -- running our tests on the test vehicle. This is an analysis of the states that were on there, and this is what we were using to develop the understanding of what these states meant.
MR. CONRAD: Okay, and so what would be a shorter way to describe that, or a more simple way to describe that?
DWIGHT FALKOFSKE: It's an analysis of the state of the machine -- or of the vehicle states.
MR. CONRAD: Okay, and this would be -- this would represent some of the research that you and your team performed?
DWIGHT FALKOFSKE: That is a research -- yeah, that's a research document.
MR. CONRAD: Okay.
MR. CONRAD: At this time, the State would move Exhibit 449 into evidence.
MR. BARBER: No objection, Your Honor.
JUDGE NEWMAN: It's admitted.
(REPORT MARKED AS STATE'S EXHIBIT NUMBER 449 WAS RECEIVED INTO EVIDENCE.)
MR. CONRAD: All right, and we talk about call logs, and you found some call logs, correct --
DWIGHT FALKOFSKE: Yes.
MR. CONRAD: -- on this vehicle?
DWIGHT FALKOFSKE: Yes.
MR. CONRAD: And where did those call logs come from again?
DWIGHT FALKOFSKE: They were stored within the infotainment system.
MR. CONRAD: All right. Where did the infotainment system get them?
DWIGHT FALKOFSKE: From an attached phone.
MR. CONRAD: Okay. All right, and I'm going to show you what's been marked as State's 446, and let me see if you recognize that document and where it's from.
DWIGHT FALKOFSKE: Yes. These were call logs that we recovered off the infotainment system.
MR. CONRAD: Okay, and those are two specific calls, correct?
DWIGHT FALKOFSKE: That's correct.
MR. CONRAD: And what are the date and time of those two calls?
DWIGHT FALKOFSKE: The first one, June 7, 2021, at 22:06:14.
MR. CONRAD: And what was the number dialed on that one?
DWIGHT FALKOFSKE: 9111.
MR. CONRAD: Okay. Three ones. Okay.
DWIGHT FALKOFSKE: And then another one shortly after at 22:06:18 a couple of seconds later for just 911.
MR. CONRAD: And in your research and testing, were you -- can you determine when these call logs would have been pulled off the phone that made these calls?
DWIGHT FALKOFSKE: No. At some point, the system would have downloaded that information from the phone. I don't know what time that occurred.
MR. CONRAD: Okay. All right.
MR. CONRAD: And at this time, I would move Exhibit 446 into evidence.
MR. BARBER: No objection.
JUDGE NEWMAN: They're admitted.
(CALL LOG MARKED AS STATE'S EXHIBIT NUMBER 446 WAS RECEIVED INTO EVIDENCE.)
MR. CONRAD: All right, and I'm going to show you what I believe is our last document, and this is Exhibit 442, and I'm going to ask if you recognize this document.
DWIGHT FALKOFSKE: Yes.
MR. CONRAD: And what is that document?
DWIGHT FALKOFSKE: I've titled this document the 2021 Chevy Suburban log file excerpts from June 7th of 2021.
MR. CONRAD: All right, and is this a condensed version of data from that original -- that CD that we with showed you a minute ago?
DWIGHT FALKOFSKE: Yes.
MR. CONRAD: Okay, and what is that condensed to? Why did you condense it to that particular data for this particular printout?
DWIGHT FALKOFSKE: This spreadsheet was the data that our parsing tool was looking for amongst all of the log files and extracting those out.
MR. CONRAD: Okay, and we talked about this a minute ago, but if you're trying to determine when this vehicle moved -- you identified a key indicator when the vehicle may have possibly moved. You identified a key indicator in that data that would indicate to you, in your opinion, that the vehicle could have possibly been moving, correct?
DWIGHT FALKOFSKE: That's correct, in or out of park.
MR. CONRAD: Okay, and when you produced that report, did you color code certain columns or rows?
DWIGHT FALKOFSKE: Yeah. I hand colored the columns on here that indicated those for clarity.
MR. CONRAD: And I think I meant to say rows because they're horizontal, correct?
DWIGHT FALKOFSKE: Correct.
MR. CONRAD: My apologies, and you color coded certain ones, right?
DWIGHT FALKOFSKE: That's correct.
MR. CONRAD: Okay.
MR. CONRAD: At this time, the State would move Exhibit 442 into evidence.
MR. BARBER: No objection.
JUDGE NEWMAN: It's admitted.
(LOG FILES MARKED AS STATE'S EXHIBIT NUMBER 442 WERE RECEIVED INTO EVIDENCE.)
MR. CONRAD: And we're going to publish this.
MR. CONRAD: And I'll need the computer, please. It's got to boot up. My apologies.
MR. CONRAD: So, we'll keep moving. I'm going to need that exhibit back, please, and we're going to switch the ELMO. Once we get the computer going, it will give a better view, but for the moment we'll look at the ELMO. Okay. Can you read that document on your screen, Mr. Falkofske?
DWIGHT FALKOFSKE: I think I can read that.
MR. CONRAD: Okay. So, let's just start at the top and I think you read the title. It's 2021 Chevy Suburban log calls, correct?
DWIGHT FALKOFSKE: That's correct.
MR. CONRAD: And then we see a row below that that looks like descriptors, correct?
DWIGHT FALKOFSKE: Correct.
MR. CONRAD: All right. Well, let's just start on the left and let's explain what these mean. We see on the far left it says line and then a number, or symbol or a hash tag. What does that mean?
DWIGHT FALKOFSKE: Okay. I will explain that using the next column over, if I may first.
MR. CONRAD: Sure.
DWIGHT FALKOFSKE: The file name indicates the particular log file that the data was recovered from. There was numbered log files in the system, and for this date there were two different log files that contained this data. And the line number indicates the physical, or the actual line number, starting from one at the top that data was located on.
MR. CONRAD: Okay, and then we see the date next to that. Is that -- what is that again, specifically the date and time?
DWIGHT FALKOFSKE: That is the timestamp of the actual log entry.
MR. CONRAD: All right. Let's switch to the computer, please, and this will make this a little bit easier to see hopefully. Okay, and can you see? Is that a little better for you to see, Mr. Falkofske?
DWIGHT FALKOFSKE: I can see it fine.
MR. CONRAD: Okay. All right. It looks like somehow I managed to mess up the spreadsheet. My apologies. All right. So, event type, what does event type mean?
DWIGHT FALKOFSKE: The event type is -- part of the log entry to it describes what sort of event is going on. It describes the event.
MR. CONRAD: Okay. Event description, what does that mean?
DWIGHT FALKOFSKE: It's just a longer, more verbose version of the time.
MR. CONRAD: And event value, what does that mean?
DWIGHT FALKOFSKE: That is the actual value of the event rather than this is the event and this is what its value is.
MR. CONRAD: Okay, and when we say value, what do we mean by that?
DWIGHT FALKOFSKE: It can be a one, a zero, a true, a false, or a textual indicator of the system's state.
MR. CONRAD: All right, and you say one or zero, true or false, you mentioned a while ago the data is always binary, right?
DWIGHT FALKOFSKE: Yes.
MR. CONRAD: And binary is always one or zero, correct?
DWIGHT FALKOFSKE: In case a lot of these are one and zero.
MR. CONRAD: Okay, and that's how data is typically stored in a computer system?
DWIGHT FALKOFSKE: Typically, yeah.
MR. CONRAD: Okay. All right. So, finally on the far right it says raw line from the service log file. What does that mean?
DWIGHT FALKOFSKE: That is actual line from the file copy verbatim.
MR. CONRAD: Okay, and so that's the actual data log that you pulled out of the system.
DWIGHT FALKOFSKE: That's correct.
MR. CONRAD: And it includes a timestamp as well, correct?
DWIGHT FALKOFSKE: That's correct.
MR. CONRAD: Okay. So, let's just look at the top here. And you said you did -- you added in some color coding, correct?
DWIGHT FALKOFSKE: That's correct.
MR. CONRAD: And the top line appears to be red. That's 8384, correct?
DWIGHT FALKOFSKE: Yes.
MR. CONRAD: And 8676 is also red, correct?
DWIGHT FALKOFSKE: That's correct.
MR. CONRAD: Why did you color code those red? What is that?
DWIGHT FALKOFSKE: Those were basically messages that were showing the system starting up. The computer for the infotainment center initiated a boot sequence.
MR. CONRAD: All right, and did your testing identify a number of ways the system on this vehicle could start up?
DWIGHT FALKOFSKE: We observed it starting up in several ways. I don't think we know all of the ways it may start up.
MR. CONRAD: Okay. Well, what are some of the ways you observed that it could start up?
DWIGHT FALKOFSKE: Just some things such as opening the door of the vehicle, or getting in the vehicle and turning it on.
MR. CONRAD: Okay, and when I say -- when we say system start up, we mean the infotainment center?
DWIGHT FALKOFSKE: This is referring to the infotainment center, not the whole vehicle.
MR. CONRAD: Okay. So, it's not necessarily we're turning the vehicle on every time we see a red color there.
DWIGHT FALKOFSKE: That's correct, just the infotainment system.
MR. CONRAD: It could be someone just opening the door, correct?
DWIGHT FALKOFSKE: Yep.
MR. CONRAD: And that represents in some cases where the screen in that car just kind of lights up if the door opens or -- for another reason, correct?
DWIGHT FALKOFSKE: That would be an indicator, yes.
MR. CONRAD: Okay, and are there certain occasions where the system can kind of start up on its own?
DWIGHT FALKOFSKE: There are some unexplained times when the system seems to initiate a boot for no apparent reason. It's theoretical on what the car is doing at that point.
MR. CONRAD: Okay. All right, and then below that at line 9142 and 9144, it looks like you color coded those two lines as blue, correct?
DWIGHT FALKOFSKE: That's correct.
MR. CONRAD: All right, and what why did you color code those lines as blue?
DWIGHT FALKOFSKE: Those indicated these vehicle parked message that we found to be very useful in determining potentially car movement.
MR. CONRAD: Okay, and this is something that you found in your testing and analysis, correct?
DWIGHT FALKOFSKE: That's correct.
MR. CONRAD: That was reliable?
DWIGHT FALKOFSKE: This is a reliable message.
MR. CONRAD: All right, and reliably means what?
DWIGHT FALKOFSKE: Reliably tells you whether the car was shifted into park or shifted out of park.
MR. CONRAD: Okay. All right, and it looks like line 9142 and 9144 both occurred at 12:21:43 on June 7th of 2021. Is that correct?
DWIGHT FALKOFSKE: That's correct.
MR. CONRAD: And is that local time?
DWIGHT FALKOFSKE: That is local time.
MR. CONRAD: All right, and what does that mean? What does vehicle parked true mean?
DWIGHT FALKOFSKE: Vehicle parked true means the shift lever of the vehicle was placed into the park position.
MR. CONRAD: Okay. So, the vehicle was shifted into park.
DWIGHT FALKOFSKE: That's correct.
MR. CONRAD: All right, but I see it looks like the exact same message on both lines, correct?
DWIGHT FALKOFSKE: That's correct.
MR. CONRAD: Why do we have the exact same message on both lines?
DWIGHT FALKOFSKE: If you take a look and scroll to the right, the -- when it's showing the raw values, you'll see that the messages are not identical. They're from two pieces of the subsystem reporting the same event.
MR. CONRAD: Okay. So, this particular log and maybe some other ones get recorded in different places on this infotainment system. Is that correct?
DWIGHT FALKOFSKE: There's a lot of duplication of messages.
MR. CONRAD: Okay, and they don't -- if they have the same timestamp, how would you interpret that if you see duplicative messages with the exact same timestamp?
DWIGHT FALKOFSKE: I would typically consider that just a single event.
MR. CONRAD: Okay. Okay, and so let's look down below that, and I see multiple things happening, and I'm highlighting it on lines 9185 to 9156 at 12:33 and 23 seconds, and I see a number of things happen there with the same timestamp, correct?
DWIGHT FALKOFSKE: That's correct.
MR. CONRAD: And in your analysis and in your opinion, when you see a group of messages happening at the same time, what's the best way to interpret that information?
DWIGHT FALKOFSKE: You have to kind of look at them as an aggregate.
MR. CONRAD: Okay, and so you kind of look at all of these messages as a whole to interpret what they mean, correct?
DWIGHT FALKOFSKE: That's correct.
MR. CONRAD: Rather than each one individually.
DWIGHT FALKOFSKE: That's correct.
MR. CONRAD: Okay. So, let's look at it. Looking at lines 9148 and all of those lines that are timestamped identically, which goes down to line 9159, what does that group of messages, in your opinion, mean was happening on this vehicle at that time on June 7th of 2021?
DWIGHT FALKOFSKE: It looks like the infotainment computer was beginning the power down sequence.
MR. CONRAD: Okay, and we go down to 12:42, and we see a few lines at 9167, 9459, and 9716, we see a few of those red colored code lines, correct?
DWIGHT FALKOFSKE: That's correct.
MR. CONRAD: All right, and, again, what does that mean? Why are those coded that way?
DWIGHT FALKOFSKE: The infotainment system initiated a boot-up sequence starting up.
MR. CONRAD: Okay, but any number of reasons of why that would have potentially booted up at that time, correct?
DWIGHT FALKOFSKE: It could have been a number of reasons.
MR. CONRAD: Okay, but then at 9954 and 9956, we see some blue color-coded messages, correct?
DWIGHT FALKOFSKE: That's correct.
MR. CONRAD: All right, and what do those mean? It says vehicle parked false. What does that mean?
DWIGHT FALKOFSKE: Vehicle parked false means the car was shifted out of park.
MR. CONRAD: Okay, and that's at what time?
DWIGHT FALKOFSKE: 18:23:57.
MR. CONRAD: Help us out. What's that in civilian time?
DWIGHT FALKOFSKE: 6:23:57.
MR. CONRAD: P.m.?
DWIGHT FALKOFSKE: P.m.
MR. CONRAD: On what day?
DWIGHT FALKOFSKE: On June 7th of 2021.
MR. CONRAD: And again we see two identical messages, correct?
DWIGHT FALKOFSKE: Yes.
MR. CONRAD: But you would interpret that as one event, correct?
DWIGHT FALKOFSKE: Yes.
MR. CONRAD: And what is that event again?
DWIGHT FALKOFSKE: It's a vehicle taken out of park.
MR. CONRAD: Okay, and we see a few things happening. It looks like at 1853 and 1911 some of those red color coded. What's your interpretation for lines -- it looks like 396 and 984 on June 7th? What is going on on those lines?
DWIGHT FALKOFSKE: It's another infotainment center boot up, startup sequence.
MR. CONRAD: Okay, and then we see another red event at 21:03:44, correct?
DWIGHT FALKOFSKE: Yes.
MR. CONRAD: And what is that?
DWIGHT FALKOFSKE: Another boot-up sequence.
MR. CONRAD: And from any number of reasons, correct?
DWIGHT FALKOFSKE: Correct.
MR. CONRAD: Could be if someone just opened a car door, correct?
DWIGHT FALKOFSKE: Yes.
MR. CONRAD: Okay, and then we see a group of messages. It looks like a few at 21:04:05, and then a few at 21:04:18, and quite a few more at 21:04:18. And that's 9:04 p.m., correct?
DWIGHT FALKOFSKE: That's correct.
MR. CONRAD: All right, and that group of messages at 9:04:18 p.m, what, in the aggregate, what is that telling you is going on with that vehicle at that time? I had the times highlighted there.
DWIGHT FALKOFSKE: Yeah. At 21:04:18, those ones look like the system was -- prior to that it seemed to be shutting down, and then it stopped and started coming back up.
MR. CONRAD: Okay, and so it seems to be starting up around 21:04:18, correct?
DWIGHT FALKOFSKE: Yes.
MR. CONRAD: And that would be consistent with that red coded message you see -- we saw a second ago, correct?
DWIGHT FALKOFSKE: Yes.
MR. CONRAD: And it's also consistent with the red coded message at line 1281 at 21:05:56, correct?
DWIGHT FALKOFSKE: What do you mean by consistent with that message?
MR. CONRAD: I'm sorry. Take a look at line 1281. Do you see that?
DWIGHT FALKOFSKE: Yes, I see 1281. That's the next system startup message.
MR. CONRAD: Okay, and what time is that again?
DWIGHT FALKOFSKE: 21:05:56.
MR. CONRAD: All right, and I'm going to do my best, and I'll try to stop you. Let's try to talk in local time or civilian time, excuse me.
DWIGHT FALKOFSKE: Okay. I'll try to. I'll start processing it that way.
MR. CONRAD: And I make that mistake, too. What time is that in civilian time?
DWIGHT FALKOFSKE: That would be 9:05:56.
MR. CONRAD: P.m.?
DWIGHT FALKOFSKE: P.m.
MR. CONRAD: On June 7th of 2021?
DWIGHT FALKOFSKE: On June 7th of 2021.
MR. CONRAD: Okay, and then below that we see a group of messages starting at line 1557, and they have an identical time state of what?
DWIGHT FALKOFSKE: 9:06 and 44 seconds.
MR. CONRAD: Okay. P.m.?
DWIGHT FALKOFSKE: P.m.
MR. CONRAD: All right, and what is that group of messages telling you at that time?
DWIGHT FALKOFSKE: That looks like the vehicle system is moving -- continuing it's power-up process.
MR. CONRAD: Okay. All right, and then we see a series of messages that all occur within 2 or 3 seconds starting at line 1591 at 9:06:48 p.m., and then continuing on through 9:06:49 p.m., and quite a few at 9:06:49 p.m., and then into 9:06:50 p.m., and that's lines roughly 1628 down to 1654. What did that group of messages tell you is occurring?
DWIGHT FALKOFSKE: So at that point, partway through those message sets it actually has an engine running event. So, the car has been turned on.
MR. CONRAD: Okay. So in your opinion, the vehicle is running at approximately 9:06:49 to 9:06:50 p.m.?
DWIGHT FALKOFSKE: Yes.
MR. CONRAD: Okay. On June 7th?
DWIGHT FALKOFSKE: Yes.
MR. CONRAD: All right, and then we see at line 1670 and 1672, it looks like another couple of blue colored messages, correct?
DWIGHT FALKOFSKE: Yes.
MR. CONRAD: And, again, what are those blue colored messages? What do they indicate to you?
DWIGHT FALKOFSKE: The vehicle parked message.
MR. CONRAD: All right, and it says vehicle parked false. What does that mean?
DWIGHT FALKOFSKE: The vehicle was taken out of park.
MR. CONRAD: Okay. The vehicle was taken out of park at 9:06 and 50 seconds, correct, p.m.?
DWIGHT FALKOFSKE: Correct.
MR. CONRAD: On June 7th, correct?
DWIGHT FALKOFSKE: Correct.
MR. CONRAD: All right, and if we look at it on line 1672, the timestamp -- it has a color, different colored stamp. I don't know. Is that date viewable on your screen? It looks like it is colored more green, correct?
DWIGHT FALKOFSKE: That is correct.
MR. CONRAD: Why did you color that particular block green at line 1672?
DWIGHT FALKOFSKE: I was highlighting events where you could see where the vehicle was taken out of park, and it loots like it was continually used and then put back into park.
MR. CONRAD: Okay, and so first of all those two lines at 1670 and 1672, they are -- they represent the same event?
DWIGHT FALKOFSKE: They are the same event.
MR. CONRAD: Okay, and that's the vehicle taken out of park, correct?
DWIGHT FALKOFSKE: That's correct.
MR. CONRAD: And you color coded that green because you wanted to find when the vehicle was put back into park, correct?
DWIGHT FALKOFSKE: Correct. I wanted to -- yes.
MR. CONRAD: Okay, because you, in your opinion and your analysis, you determined that that message is pretty reliable. It's something we can rely upon to make a determination of when that vehicle could have been moving, correct?
DWIGHT FALKOFSKE: Correct.
MR. CONRAD: All right, and so 9:06:50 p.m., the vehicle is put -- taken out of park. And then let's go down the line, 1904, 1904, and we see another green stamp embedded in a blue line. Do you see that, sir?
DWIGHT FALKOFSKE: Yes.
MR. CONRAD: What does that mean to you?
DWIGHT FALKOFSKE: Well, it was the next event where the vehicle went back into park.
MR. CONRAD: Okay. So -- and what time is that?
DWIGHT FALKOFSKE: At 9:22 and 45 seconds p.m.
MR. CONRAD: The vehicle was put back into park, correct?
DWIGHT FALKOFSKE: That's correct.
MR. CONRAD: All right, and in your opinion, could the vehicle have been moving between those two times?
DWIGHT FALKOFSKE: It could have. I have no evidence of that.
MR. CONRAD: Okay. All right, but the vehicle is out of park, correct?
DWIGHT FALKOFSKE: It is out of park.
MR. CONRAD: And that's something, in your opinion, we can rely upon, correct?
DWIGHT FALKOFSKE: Yes.
MR. CONRAD: And roughly -- I'm not to going ask you for exact seconds. Roughly how much time passes between the vehicle taken out of park on line 672 and back into park?
DWIGHT FALKOFSKE: Approximately 16 minutes.
MR. CONRAD: And I'm going to scroll down. I'm going to scroll down to line 3059 and 3061, and I see some more green colored blocks here, correct?
DWIGHT FALKOFSKE: Yes.
MR. CONRAD: All right, and what are those blocks? What information is contained in those blocks? What messages?
DWIGHT FALKOFSKE: Again, it's the vehicle in or out of park messages.
MR. CONRAD: Okay, and so -- and what time is that, those two messages at 3061?
DWIGHT FALKOFSKE: 3061 shows 9:43:05.
MR. CONRAD: P.m.?
DWIGHT FALKOFSKE: P.m.
MR. CONRAD: And that's June 7th, correct?
DWIGHT FALKOFSKE: June 7, 2021.
MR. CONRAD: And what -- and I'm sorry to interrupt you, but at that particular event, what happens with the vehicle?
DWIGHT FALKOFSKE: The vehicle goes out of park.
MR. CONRAD: Okay, and then at line -- the next line below that, what's the time on that, the date and time on that?
DWIGHT FALKOFSKE: 9:43 and 59 seconds, June 7, 2021. That's p.m.
MR. CONRAD: And what happens with the vehicle?
DWIGHT FALKOFSKE: It goes back into park.
MR. CONRAD: Okay, and so roughly how much time passed between those two events?
DWIGHT FALKOFSKE: It looks like just under a minute.
MR. CONRAD: Okay, and you can't tell us whether the vehicle actually moved during that time, correct?
MR. CONRAD: All right. All you could tell us is it was out of park for a little under a minute.
DWIGHT FALKOFSKE: Yes.
MR. CONRAD: Okay. All right, and not to put you on the spot, and we'll go back up and look real quick. So, that's at 9:43:05 p.m., correct?
DWIGHT FALKOFSKE: Correct.
MR. CONRAD: Let's go back and look at the previous vehicle parked at 9:22:45 p.m., and that's line 1904. That's when the vehicle had been placed into park, correct?
DWIGHT FALKOFSKE: That's correct.
MR. CONRAD: All right, and let's just do some rough math. If you have a pen you can write it down if you need to. At 9:22:45 the vehicle was in park.
DWIGHT FALKOFSKE: Okay.
MR. CONRAD: 920 -- or, excuse me, 9:43:05, the vehicle is now back out of park, correct?
DWIGHT FALKOFSKE: That's correct.
MR. CONRAD: Roughly how much time passes between those two events?
DWIGHT FALKOFSKE: Approximately 21 minutes.
MR. CONRAD: Okay. All right, and so the vehicle is out of park for about a minute at lines 3061 and 3079, then let's scroll down to line 3096 and 3310. And what happens with the vehicle there?
DWIGHT FALKOFSKE: The vehicle goes out of park.
MR. CONRAD: Okay. At what time?
DWIGHT FALKOFSKE: At 9:44, 54 seconds on June 7th of 2021. That's p.m.
MR. CONRAD: Okay, and then the next event below that, what occurs there?
DWIGHT FALKOFSKE: Next event, the vehicle goes back into park at -- that would be 10:00 and 30 seconds -- 36 seconds on June 7, 2021, p.m.
MR. CONRAD: And those are color coded green because they kind of represent a matching pair, correct?
DWIGHT FALKOFSKE: That's correct.
MR. CONRAD: When it went out and when it went back into park, correct?
DWIGHT FALKOFSKE: That's correct.
MR. CONRAD: And roughly how much time passes between those two events at 9:44 and 10:00 of the night of June 7th?
DWIGHT FALKOFSKE: Approximately 16 minutes.
MR. CONRAD: Okay. All right, and then let's go down to lines 3327, 3328. And those are two more green colored events that represent that matching pair, correct?
DWIGHT FALKOFSKE: That's correct.
MR. CONRAD: The vehicle out of park and the vehicle in park, correct?
DWIGHT FALKOFSKE: That's correct.
MR. CONRAD: All right, and what are the times associated with those two events?
DWIGHT FALKOFSKE: The vehicle goes out of park at 10:01 and 17 seconds on June 7, 2021 -- that's p.m. -- and it goes back into park at 10:01, 29 seconds on June 7th of 2021, p.m.
MR. CONRAD: And roughly speaking, how many seconds is that?
DWIGHT FALKOFSKE: About 12 seconds.
MR. CONRAD: Okay. Well, let's go to just a few seconds later, lines 3336 and 3340. And we see another matching pair of these green messages?
DWIGHT FALKOFSKE: That's correct.
MR. CONRAD: Out of park and then back into park, correct?
DWIGHT FALKOFSKE: That's correct.
MR. CONRAD: And what are the times on that particular event?
DWIGHT FALKOFSKE: The vehicle goes out of park at 10:01 and 30 seconds on June 7th of 2021 -- that's p.m. -- and it goes back into park at 10:01 and 43 seconds, June 7th.
MR. CONRAD: So, maybe I can do the time. That's roughly about 13 seconds that's out of park?
DWIGHT FALKOFSKE: That's correct.
MR. CONRAD: Okay, and we see a whole bunch of messages, again that group of messages starting at 22:04:44, and kind of going on until 20 -- excuse me, 10:04:44 p.m., and 10:04:47 p.m. we see another group of messages. What does that group of messages generally indicate to you in the aggregate? And that's this group I'll highlight.
DWIGHT FALKOFSKE: It looks like the system is powering down.
MR. CONRAD: Okay, and then we get down to lines 3464, and that shows another green color coded pair of messages, correct?
DWIGHT FALKOFSKE: That's correct.
MR. CONRAD: And, again, it goes out of park and then back into park, correct?
DWIGHT FALKOFSKE: That's correct.
MR. CONRAD: And what are the two times associated with those two messages at 3664 and 3682?
DWIGHT FALKOFSKE: Yes. What's your question?
MR. CONRAD: I'm sorry. What are those times?
DWIGHT FALKOFSKE: Oh, what are the times.
MR. CONRAD: Yes.
DWIGHT FALKOFSKE: 10:04:49 it goes out of park -- that's p.m. -- on June 7, 2021. It goes back into park at 10:05:55 p.m. June 7, 2021.
MR. CONRAD: And that's roughly more than a minute, correct?
DWIGHT FALKOFSKE: That's correct.
MR. CONRAD: And then let's go down to lines 3490 and 3504. We see another matching pair, in and out of park and then in park, correct?
DWIGHT FALKOFSKE: That's correct.
MR. CONRAD: And what are the times associated with those two?
DWIGHT FALKOFSKE: The vehicle goes out of park at 10:11 and 45 seconds, on June 7, 20:21 p.m., and then it goes back into park at 10:12 and 38 seconds p.m., June 7th of 2021.
MR. CONRAD: Okay. All right, and that is roughly just under a minute or so?
DWIGHT FALKOFSKE: That's correct.
MR. CONRAD: All right. Almost to the end here. Okay, and then we see another message. So, first of all, we see some messages that are blue colored at 3506 through 3515. And why are those blue coded instead of green coded?
DWIGHT FALKOFSKE: Those were vehicle park messages, but they appeared to be, you know, basically duplications of the existing ones.
MR. CONRAD: So, that's just duplicate information, correct?
DWIGHT FALKOFSKE: That's correct.
MR. CONRAD: Okay, and then finally at line 3521, we see a -- the vehicle, what happens with the vehicle at that line?
DWIGHT FALKOFSKE: Okay. It goes out of park at 10:13 and 39 seconds p.m. on June 7, 2021.
MR. CONRAD: Did you find a matching kind of pair as we talked about for when the vehicle goes back into park after that?
DWIGHT FALKOFSKE: No. No log message was present for that.
MR. CONRAD: Okay. Can you explain to me why that log message may not be present?
DWIGHT FALKOFSKE: We found during the testing of our test vehicle that there are times when the system decides to temporarily stop recording a message. The reason is not clear.
MR. CONRAD: But you do see it come out of park at 22 -- or, excuse me, 10:13:39, correct?
DWIGHT FALKOFSKE: That's correct.
MR. CONRAD: All right. Now, and just to reiterate this, you're just telling us when this vehicle is in and out of park, correct?
DWIGHT FALKOFSKE: That's correct.
MR. CONRAD: Because that's the most reliable piece of information you've been able to deem from this data, correct?
DWIGHT FALKOFSKE: That's correct.
MR. CONRAD: And you can't tell us necessarily when the vehicle is moving, correct?
DWIGHT FALKOFSKE: That's correct.
MR. CONRAD: And you can't tell us if it's moving, or if you see it go out of park who's shifting the actual gear knob, can you?
DWIGHT FALKOFSKE: No. We don't know who's in the car.
MR. CONRAD: All you can look at is this particular data, correct?
DWIGHT FALKOFSKE: That's correct.
MR. CONRAD: All right, and just so it's clear, you know, you've determined -- you're interpreting this data because you use the test vehicle to see when you see these messages, correct?
DWIGHT FALKOFSKE: That's correct.
MR. CONRAD: All right, and that's why you're giving us these opinions today, correct, from your testimony?
DWIGHT FALKOFSKE: That's correct.
MR. CONRAD: All right, and when you were using your test vehicle, if you took the vehicle -- if you took the vehicle out and drove it, took it out of park and drove it and then put it back into park, would you find that exact same matching pair of in and out of park messages that we just talked about, correct?
DWIGHT FALKOFSKE: Yes.
MR. CONRAD: And it wouldn't necessarily -- you weren't able to determine any other data that would likely tell you if it was moving or not, correct?
DWIGHT FALKOFSKE: That's correct.
MR. CONRAD: All right, but -- so, if the vehicle is driving and you see that, you would see that identical pair of messages like we just talked about?
DWIGHT FALKOFSKE: Yes.
MR. CONRAD: However, if the car is just stopped and someone shifts it out of park and just sits there with their foot on the brake, and then some time later puts it back into park, would you see that same matching pair of in park, out of park message, and back into park message?
DWIGHT FALKOFSKE: Yes.
MR. CONRAD: You would? Okay. All right.
MR. CONRAD: Nothing further from the State from this witness.
JUDGE NEWMAN: By the defense?
(Break in proceedings.)
JUDGE NEWMAN: Let's stand for a moment.
(Break in proceedings.)
CROSS-EXAMINATION
BY MR. BARBER:
MR. BARBER: Good afternoon, sir.
DWIGHT FALKOFSKE: Good afternoon.
MR. BARBER: I won't -- hopefully this won't take long, just a few clarifying questions. First you mentioned that this -- the data was encrypted?
DWIGHT FALKOFSKE: Yes. When we pulled the data off the chip, it was encrypted.
MR. BARBER: Is this something that the manufacture did?
DWIGHT FALKOFSKE: Yes.
MR. BARBER: Okay. It's not something that -- the end user doesn't do something to encrypt the data. It comes that way. Is that --
DWIGHT FALKOFSKE: Not for the infotainment system, no.
MR. BARBER: And so you -- it sounded like you kind of had to reverse engineer with a test vehicle to figure out the meaning of stuff. Were you not able to get General Motors to assist with that?
DWIGHT FALKOFSKE: We could have, but we generally tried to find the data on our own. Often we have the -- when -- it's difficult for us to get the manufacturers to work with us on data.
MR. BARBER: Did anyone attempt to reach out to the General Motors to de-encrypt the data?
DWIGHT FALKOFSKE: Not from EDU.
MR. BARBER: I won't go over this spreadsheet too much. Do you still have the exhibit with you?
DWIGHT FALKOFSKE: I have a copy.
MR. BARBER: Okay.
(Break in proceedings.)
MR. BARBER: I wanted to ask you just briefly about, if I can find it on this. There is some things that were happening at 9:03 --
(Break in proceedings.)
MR. BARBER: -- and 9:04. I didn't quite understand. What do these mean? This group of things that say info state sleep and state summary animate, all of these things happening in this 9:04/9:05 range, what does that mean?
DWIGHT FALKOFSKE: So, I was attempting to explain before that some of these messages, like, individually they don't mean a whole lot. Like, what does it actually mean? But in this case it's generally showing -- like if you just scroll down just a little bit more so I can just see a few more of the messages? So, it looks like initially like at line number 984 where the system initially boots up, and then at 9:04 --
MR. BARBER: Let me stop you there. When you say system startup, what does that mean? What does the system -- what is it doing when it starts up?
DWIGHT FALKOFSKE: So, this is just the computer for the infotainment center. This is not the entire vehicle, but something woke up that system. And just like your home computer, it needs to boot up before Windows is ready. It's a similar thing that has a boot up sequence. This is a log that says that was initiated.
MR. BARBER: Okay, and what would trigger this? What would make this startup happen?
DWIGHT FALKOFSKE: We know that -- some events that make it happen, such as opening the door or starting the car. We don't know all of the events that might make that happen.
MR. BARBER: Well, on my Chevy if you walk near it with the key fob, then the lights come on on the little door handles. You can stick your foot up under the rear and the rear will come up. Would walking near it with the key fob trigger anything?
DWIGHT FALKOFSKE: It's a possibility, but we did not investigate that.
MR. BARBER: But scrolling down here to 9:06 and 48 seconds, am I reading this correctly to say that the engine was turned on?
DWIGHT FALKOFSKE: Can you scroll down just a little bit further? Keep going just a little bit more in the 49 second. So, if you see there was -- at one point there was a message that says engine run false, which is only within the same second as I'm following up on engine running true. The -- it's messages like this that get a little bit confusing on there. But ultimately it's moving to -- it's basically saying here I'm at, but I'm moving to this state here. So, in that case it looked like the engine started running at this time.
MR. BARBER: Okay. Well, I don't think I'll belabor this spreadsheet anymore, but I did want to ask. Did you additionally retrieve data related to the phone connecting to the entertainment system? I think there was the 911 call that you --
DWIGHT FALKOFSKE: We had a call log that was extracted as well as the connection of a Bluetooth -- or several Bluetooth devices.
MR. BARBER: Okay, and I want to hand you a printout. Is this a printout of device connection history that you were able to obtain from the vehicle?
DWIGHT FALKOFSKE: We need to go back to the original material and take a look at this because it looks more like what originally collected. There's pages of this here.
MR. BARBER: Can you identify this?
DWIGHT FALKOFSKE: I mean, the format looks familiar, but it looks -- I might have to go back in the original material and pull up the HDML report. Is that acceptable?
MR. BARBER: Absolutely.
MR. CONRAD: And, Your Honor, I think the witness is asking to look at his original data to validate what Mr. Barber has, and the State has no objection to that but we would just need to few minutes for him to look at it.
MR. BARBER: No objection, Your Honor, absolutely.
JUDGE NEWMAN: Ladies and gentlemen, I will have you to go to the jury room for a short break.
(The jury left the courtroom.)
JUDGE NEWMAN: We are in recess.
(A break was taken.)
JUDGE NEWMAN: If you would bring the jury.
MR. CONRAD: Your Honor, we're just copying a little bit of data, so we'll need maybe just 2 or 3 more minutes.
JUDGE NEWMAN: We're going to bring the jury and let them watch you do that.
(The jury returned to the courtroom.)
COURT BAILIFF: The jury is present, sir.
MR. CONRAD: Thank you.
(Break in proceedings.)
JUDGE NEWMAN: Ladies and gentlemen, we're going to recess for the day and resume at 9:30 in the morning. Please do not discuss the case.
(The jury left the courtroom.)
JUDGE NEWMAN: We'll be in recess until 9:30.
(Whereupon, the case was at ease.)