PX

Case 4:14-cv-00815-BCW Document 42-9 Filed 09/27/14 Page1of5

DECLARATION OF JOSEPH CARBON
PURSUANT TO 28 U.S.C. § 1746

I, Joseph A. Carbon, state that I have personal knowledge of the facts and matters set forth
below, and if called as a witness would testify competently thereto:

1. ITamaU-sS. citizen over the age of eighteen years old.

2. Iama Digital Forensic Analyst with CACTI, Inc., 6315 Bren Mar Drive, Suite 175,

24

25

Alexandria, VA 22312. Iam ACE Certified and have been practicing forensics for over
two years. As part of my job duties, I often do contract computer forensic work for the
Federal Trade Commission (FTC).

On September 19, 2014, in connection with a pending lawsuit, FTC v. Butterfly

Labratory, Hugh Huettner, Technical Forensic Examiner for the FTC, 400 D Street SW,

Washington D.C., 20024 instructed me to forensically image digital media that was
located at 10770 El Monte Street, Suite 101, Leawood, Kansas 66211.

. LT arrived at 10770 El Monte Street, Suite 101, Leawood, Kansas 66211 on September

19", 2014 in the early morning where the receiver, Eric L. Johnson, allowed me access to
the premises. I was instructed by Leah Fraizer, who was the matter lead attorney for the
FTC, to image select devices.

The names of the forensically sound images taken at 10770 El Monte Street, Suite 101,
Leawood, Kansas 66211 are listed below:

BFL-ELM-IT02-JoshZerlan: Physical image of Samsung MZ-7PC256 256gb hard drive
S/N: SOZ4NEAC834664 from custom generic desktop with no serial number. This
image was stored on FTC Media 02, Western Digital WDSO00BPVT-OOHXZT3 S/N:
WXHI1E93ZKJ49. This device was identified as belonging to Josh Zerlan.

BFL-ELM-IT03b-DaveMcClain: Physical image of Seagate ST2000DMO001 2tb hard
drive S/N: Z340S6F9. This image was stored on FTC Media 07, HGST
HTS721010A9E630 S/N: 6PHE3KTE. This device was identified as belonging to Justin
Rourden, though initially idenitified by the case team as belonging to Dave McClain.

BFL-ELM-IT04a-Fishbowl: Memory and pagefile capture from custom generic server
with no serial number. This image was stored on FTC Media 04, Western Digital
WDSO00LPVX-22VOTTO S/N: WX21A34J7907. This server was identified by its label
FISHBOWL.

1
Case 4:14-cv-00815-BCW Document 42-9 Filed 09/27/14 Page2of5

BFL-ELM-IT04b-Fishbowl: Physical image of Samsung MZ-7TD120 120gb hard drive
S/N: S14CNEACB08918 from custom generic server with no serial number. This image
was stored on FTC Media 04, Western Digital WD5000LPVX-22VOTTO S/N:
WX21A34J7907. This server was identified by its label FISHBOWL.

BFL-ELM-IT04c-Fishbowl: Logical image of “BFLCloud” partition of size 1890gb
found on Seagate ST4000DM000 4tb hard drive S/N: Z30101X1 from custom generic
server with no serial number. This image was stored on FTC Media 04, Western Digital
WDS5000LPVX-22VOTTO S/N: WX21A34J7907. This server was identified by its label
FISHBOWL.

BFL-ELM-IT04d-Fishbowl: Logical image of “FTP” partition of size 1835gb found on
Seagate ST4000DMO000 4tb hard drive S/N: Z30101X1 from custom generic server with
no serial number. This image was stored on FTC Media 04, Western Digital
WD5000LPVX-22VOTTO S/N: WX21A34J7907. This server was identified by its label
FISHBOWL.

BFL-ELM-IT05-JoshZerlan: Physical image of Seagate ST320LT012-9WS14C 320gb
hard drive S/N: SOV1030M from ASUS 1015E laptop S/N: D4NO0CX276730156. This
image was stored on FTC Media 05, Western Digital WDSOO00LPV X-22VOTTO S/N:
WX21A34L0252. This device was identified as belonging to Josh Zerlan.

BFL-ELM-IT06a-DaveMcClain: Memory and pagefile capture from Lenovo ThinkPad
X230 laptop S/N: R9-RXND7 12/08. This image was stored on FTC Media 06, Western
Digital WD5000BPVT-00HXZT3 S/N: WXHIE93ZKR33. This device was identified as
belonging to Justin Rourden, though initially idenitified by the case team as belonging to
Dave McClain.

BFL-ELM-IT06b-DaveMcClain: Physical image of Micron C400-MTFDDAK128MAM
128gb hard drive S/N: 1220033CD595 from Lenovo ThinkPad X230 laptop S/N: R9-
RXND7 12/08. This image was stored on FTC Media 02, Western Digital
WDS5000BPVT-0OHXZT3 S/N: WXHIE93ZKJ49. This device was identified as
belonging to Justin Rourden, though initially idenitified by the case team as belonging to
Dave McClain.

BFL-ELM-IT07a-DaveMcClain: Memory and pagefile capture from Lenovo ThinkPad
W530 laptop S/N: PK-11ZYZ 13/09. This image was stored on FTC Media 06, Western
Digital WDS5000BPVT-00HXZT3 S/N: WXHIE93ZKR33. This device was identified as
belonging to Dave McClain.

2
Case 4:14-cv-00815-BCW Document 42-9 Filed 09/27/14 Page3of5

24

25

BFL-ELM-IT07b-DaveMcClain: Physical image of Ricoh SD 8gb memory card S/N:
0001 which was found inserted in Lenovo ThinkPad W530 laptop S/N: PK-1L1ZYZ
13/09, This image was stored on FTC Media 06, Western Digital WDSO000BPVT-
OOHXZT3 S/N: WXHIE93ZKR33. This device was identified as belonging to Dave
McClain.

BFL-ELM-IT07c-DaveMcClain: Physical image of Chronos MKNSSDCR240GB-DX
240gb hard drive S/N: MK130801AS1068815 from Lenovo ThinkPad W530 laptop S/N:
PK-11ZYZ 13/09. This image was stored on FTC Media 06, Western Digital
WDS5000BPVT-00OHXZT3 S/N: WXH1E93ZKR33. This device was identified as
belonging to Dave McClain.

BFL-ELM-IT08-Ambralzanburg: Physical image of Seagate ST9500325AS 500gb hard
drive S/N: S2WJR6R4 from Lenovo G570 laptop S/N: CB16608818. This image was
stored on FTC Media 08, Western Digital WDS000LPVX-22VOTTO S/N:
WX11A34K2891. This device was identified as belonging to Ambra Izanburg.

BFL-ELM-IT1la-MarcGoodpasture: Memory and pagefile capture from Lenovo
ThinkPad T520 laptop S/N: R9-PVWZN 11/2012. This image was stored on FTC Media
11, Western Digital WD5000BPVT-00HXZT3 S/N: WXHIE93UMR95. This device
was identified as belonging to Marc Goodpasture.

BFL-ELM-IT11b-MarcGoodpasture: Physical image of generic 1gb thumb drive S/N:
B30DA964 which was found inserted in Lenovo ThinkPad T520 laptop S/N: R9-
PVWZN 11/2012. This image was stored on FTC Media 11, Western Digital
WDS5000BPVT-OOHXZT3 S/N: WXH1E93UMR95, This device was identified as
belonging to Marc Goodpasture.

BFL-ELM-IT1 1c-MarcGoodpasture: Physical image of HGST HTS725050A7E630
500gb hard drive S/N: YO9KZYW8M from Lenovo ThinkPad T520 laptop S/N: R9-
PVWZN 11/2012. This image was stored on FTC Media 11, Western Digital
WD5000BPVT-OOHXZT3 S/N: WXHIE93UMR95. This device was identified as
belonging to Mare Goodpasture.

BFL-ELM-IT12-MarcGoodpasture: Physical image of generic 512mb thumb drive S/N:
CCFE2008d6d945d which was found in the room designated as N on the desk designated
N2 next to the laptop indicated in BFL-ELM-IT11. This image was stored on FTC
Media 11, Western Digital WD5000BPVT-00HXZT3 S/N: WXHIE93UMR95. This
device was identified as belonging to Mare Goodpasture.

BFL-ELM-IT15-SonnyVleisides: Physical image of Intel SSDSCMMW240A3L 240gb
hard drive S/N: CVCS345300VU240C from Lenovo ThinkPad X1 Carbon laptop S/N:
R9-WEVA8. This image was stored on FTC Media 13, Hitatchi HTS721010A9E630
S/N: 6PHE182E. This device was identified as belonging to Sonny Vleisides.

3
Case 4:14-cv-00815-BCW Document 42-9 Filed 09/27/14 Page4of5

5.

I maintained the hard drives containing the above mentioned images in a secure location
until September 20", 2014, where I handed and signed them over to Jason T. Sweeney,
Digital Forensic Analyst for CACTI, Inc., 6315 Bren Mar Drive, Suite 175, Alexandria,
VA 22312. I signed the FTC chain of custody form when I handed the hard drives to
Jason T. Sweeney. The custody of the hard drives transferred at the collection site, 1077
El Monte Street, Suite 101, Leawood, Kansas 66211.

I declare under penalty of perjury that the foregoing is true and correct.
Executed on the 25th day of September 2014, in Alexandria, VA.

Qogh Lanbr—

Joseph A. Carbon

4
Case 4:14-cv-00815-BCW Document 42-9 Filed 09/27/14 Page5of5