Affidavits of Gary Hunt

The **affidavits of Gary Hunt** are affidavits used in Kathleen Zellner's appeals and signed by forensic IT expert Gareth (Gary) Hunt. The affidavits deal with Hunt's analysis of the Dassey family computer.

## Affidavit of Gary Hunt

### Part of motion

*Defendant Steven Avery’s Motion for Reconsideration*

### Pages

6 (excluding exhibits)
25 (including exhibits)

### Date signed

20 October 2017

**Now comes your affiant, Gary Hunt, and under oath hereby states as follows:**

1. I am of legal majority and can truthfully and competently testify to the matters contained herein based upon my personal knowledge and to a reasonable degree of certainty in the field of computer science. The factual statements herein are true and correct to the best of my knowledge, information, and belief.
2. I am a Senior Forensic Examiner with QDiscovery, LLC. My curriculum vitae is attached as Exhibit A.
3. I have been ACE (AccessData Certified Examiner) certified since 2012 and CCE (Certified Computer Examiner) certified since June 2013. The authority overseeing the ACE is Access Data, a forensic tool developer and vendor while the CCE authority is the International Society of Forensic Computer Examiners (ISFCE).
4. Over the course of my career in digital forensics I have conducted numerous digital forensic investigations.
5. In the past 4 years, I have testified as an expert before courts in a number of cases. A listing of these cases is included within Exhibit A.
6. QDiscovery was retained by Zellner & Associates July 31, 2017. I received a forensic image from Zellner & Associates later the same day, along with one report from the previous investigation conducted in 2006:

- *2006.04.21 - DCI (Fassbender) report re examination of Dassey computer.pdf*
7. It is my understanding from reviewing the report that the forensic image was generated from a computer seized in the Dassey household on April 21, 2006.
8. The forensic image I was provided was processed using the latest releases of several forensic tools including AccessData's Forensic Toolkit v6.2.1 (released May 2017) and Magnet Forensics' Internet Evidence Finder v6.9.3 (released August 2017). Magnet Forensics describes its tool as follows:

"*Magnet IEF is a digital forensics software solution that you can use to discover, analyze and report on digital evidence from various types of drives and devices. With Magnet IEF you can recover data from social networking and chat applications, cloud-based artifacts, web browser history, and much more.*"
9. At the time of the 2006 investigation, there were three leading forensic examination utilities; Encase, Forensic Toolkit (FTK), and X-Ways. It is important to note that the platforms have significantly evolved since th 2006 investigation. FTK specifically added new features and parsing capabilities allowing for more efficient investigations and greater insight into the data at stake. Additionally, Internet Evidence Finder ("IEF") was not first released until March 22, 2009. The technology did not exist during the original investigation. The bulk of my analysis revolved around web activity which was streamlined by the use of IEF.
10. While the corpus of data contained within the forensic image I was provided has not changed, the tools available have dramatically improved since 2006 which allow examiners such as myself to more thoroughly search, review, and analyze the data contained with the forensic image.
11. During my investigation, I determined the following:

**a.** There was a single user account on the computer named "HP\_Owner".
**b.** The HP\_Owner user conducted the following internet searches on various dates:
1. teen pussy
2. 11 year old sex
3. 12 year old sex
4. 15 year old girl
5. 15 year old girl naked
6. aaa teens
7. cute kid naked
8. fuck preteen girl
9. girl younger 12
10. hot teen girl
11. hot teen pussy
12. kid slut
13. kid sluts
14. naked teens
15. naked young girl
16. naked young pussy
17. nude teenage girl
18. nude teenage girls
19. pre teen sluts
20. pree teens naked
21. preteen boobs
22. preteen busty
23. pre-teen busty
24. preteen girl model naked
25. preteen girl naked
26. preteen girl nude
27. pre-teen girls naked
28. preteen naked
29. preteen pussy
30. preteen sex
31. preteen sluts
32. pre-teen girls naked
33. preteens naked
34. pre-teens naked
35. pre-teens nakedirl
36. teen black pussy
37. teen girls naked
38. teen porn
39. teen pussy
40. teen redhead pussy
41. teen sex
42. teen tits
43. teen twat
44. teenage pussy
45. teens naked
46. teens spread wide open
47. wet teen pussy
48. young 13 girl nude
49. young 13 year old girl nude
50. young 13 year old naked
51. young 13 yr old naked
52. horsecum
53. car accident
54. car accsidents
55. deseised girls
56. dessesed girls
57. diseased girls
58. drawned girls
59. drawned pussy
60. drowned girl
61. drowned girl nude
62. drowned pussy
63. fast car accident
64. gun to haead
65. gun to head
66. knife goes though skin
67. knife goes through skin
68. rotten girl
69. seeing bones hot girls
70. tempo car accident
**c.** On September 18, 2006, between 5:57 AM and 10:04 AM, the HP Owner user conducted 75 unique Google searches. These searches have been attached as Exhibit B.
**d.** In addition to the recovered internet searches, cached internet search results were identified. These cached results grant the ability to see what the user saw, as well as the images that the user clicked on. A sampling of these images along with available metadata information has been attached as Exhibit C.
**e.** Two pictures were found in the unallocated space2; the first showing Teresa Halbach and Steven Avery, the second showing only Teresa Halbach. These have been attached as Exhibit D for reference. Both images were carved from the unallocated space of the computer hard drive. The first image was carved from sector 67,975,480 within the unallocated space. The second image was carved from sector 75,476,224 within the unallocated space. Since the files were recovered via data carving, there is no file system metadata available. The files' original path, file name, and created, accessed, or modified timestamps are not available, nor is there any information regarding how they arrived on the computer.
12. In conclusion, the computer was used to run internet searches including (but not limited to) those identified in paragraph 11b and Exhibit B. Some images displayed as a result of the searches were clicked on by the user. Additionally, two pictures of Teresa Halbach were recovered from the unallocated space. These images do not have any date attributes or information suggesting how they arrived on the computer.

## Supplemental affidavit of Gary Hunt

### Part of motion

*Defendant Steven Avery’s Amended Supplement to Previously Filed Motion For Reconsideration*

### Date signed

30 October 2017

**Now comes your affiant, Gary Hunt, and under oath hereby states as follows:**

1. I am of legal majority and can truthfully and competently testify to the matters contained herein based upon my personal knowledge and to a reasonable degree of certainty in the field of computer science. The factual statements herein are true and correct to the best of my knowledge, information, and belief.
2. In my original affidavit (Exhibit Q to Motion for Reconsideration), I made a typographical error at ¶ 11(c). My affidavit should read: "On September 18, 2005, between 5:57 AM and 10:04 AM, the HP\_Owner user conducted 75 unique Google searches."
3. Using 2017 technology, I have detected eight periods in 2005 when computer records are missing and presumably deleted from the Dassey computer: August 23-26; August 28-September 11; September 14-15; September 24-October 22; October 23-24; October 26-November 2; November 4-13; and November 15- December 3.
4. On October 31, 2005, the Dassey computer was used to access the internet at 6:05 a.m., 6:28 a.m., 6:31 a.m., 7:00 a.m., 9:33 a.m., 10:09 a.m., 1:08 p.m., and 1:51 p.m.