The process of unlocking Yorgen Fenech’s phone lasted months with Europol finally gaining access to the device in January 2020, an expert for the agency told a court this morning.
The expert, Yulia Toma, had performed what is referred to as a partial extraction of Fenech’s phone, which she had also unlocked.
She explained to the court that the process involves trying out different password combinations in order to find the right one.
“In the worst-case scenario, it can take up to 30 years,” Toma said. “In this case, we were successful after a few months.”
Toma, a digital forensic expert, was being cross-examined by Charles Mercieca – one of the lawyers appearing for Fenech – and was asked to explain why it was necessary to perform a partial extraction, as well as a series of questions on who had access to the phone.
She explained that the partial extraction created a copy of the phone’s contents and it was industry best practice to do so, mainly to allow analysts to examine the contents of the phone without risking damage to the original data.
“It is done to preserve the integrity of the device,” she told the court.
Toma refused to divulge details about the process used to unlock the phone, adding only that one could not remain in the room for more than 24 hours and that she checked the exhibits every day because the unlocking process occasionally stopped for unknown reasons.
Replying to questions about whether anyone had access to the device, Toma said that she had no way of telling whether anyone had accessed the phone before her, explaining that the unlocking of the phone had been carried out in a Faraday cage – a room used to block out electromagnetic fields and prevent signals within it from interference.
She said that she had been handed two phones by her colleague at 11:30pm and had immediately set about extracting the data from them before proceeding to unlock the devices.
Toma confirmed that the phone was still at Europol’s headquarters and that other employees had access to it. She did say that access to the room in which it was held was limited to some 10 individuals who possessed a specific type of clearance.
At one point, Mercieca zoomed in on a written statement reading ‘same case as my previous case’, in a set of notes that Toma exhibited in court. He asked what the previous case was and whether it was linked to the Caruana Galizia case, much to the displeasure of the prosecution.
The court warned Mercieca not to put words in the witness’s mouth but allowed the question as to whether Toma had worked on anything linked to the Caruana Galizia case. She confirmed that she had not worked on related cases.
During cross-examination, Mercieca also suggested that Toma had kept the devices in her possession for 10 months, despite not being authorised to do so by a Maltese court.
Toma refuted the lawyer’s assertion, insisting that she had been added to the list of experts a few weeks after it was originally issued.
She did acknowledge that she was at a point asked to stop working on the devices since she had not been listed in a court decree authorising the phones to be analysed.
What do you make of today’s proceedings?