Comrade investigator, your file has peeled off

Data on the “Network” accused in the case* were changed after the arrest

The main evidence of the existence of the “network” is two documents: the so-called “vault”, with the presentation of the goals and structure of the community, and the protocol of its “congress”, supposedly held in St. Petersburg in February-2017. The first document (a file called “Regulation”), according to the prosecution, was found on the portable Toshiba hard drive, which was seized during a search in St. Petersburg, Arman Sagynbaeva. The second (Congress (2017) file) - on the Toshiba laptop, seized from Penzenz Ilya Shakursky.

Sagynbaev’s apartment was searched for by employees of the St. Petersburg FSB on behalf of senior investigator Valery Tokarev, leading the Penza case of the “network”. The seized was packed, supplying the Petersburg department of the FSB, and handed over to the Penza colleagues. The protocol of the first inspection of 13 electronic media of information seized from the defendants of the case (including the hard disk of Sagynbaev and the Shakursky laptop) dated February 20, 2018. It was conducted by investigator A. I. Matyukhin with the participation of technical specialist I. A. Ganin and two witnesses. The protocol does not indicate how the objects examined were packed, whether the integrity of the packaging was violated, what seal is worth it. And it is not reflected whether the studied files under study have undergone. Ganin’s signature is only on two of the 78 pages of the protocol - the first and last, although it is necessary to certify each sheet with it.

The second inspection of electronic media was conducted by investigator Tokarev on March 16, 2018 on behalf of the St. Petersburg FSB. Without witnesses, with the participation of a specialist Anatoly Aymin. And again, the protocol does not indicate how the objects examined were packed. And Aymin's signatures are not at all, not on any sheet.

For the third time, carriers are inspected by the investigator of the Penza UFSB D. S. Boltyshov on September 8, 2018 with the participation of a specialist Ganin, again without witnesses. This time the packaging is described in the protocol - it only does not look like the initially. Sagynbaev seized in the St. Petersburg apartment was placed in a polymer package closed with an adhesive tape, "excluding the possibility of unauthorized penetration." And in September, a package was presented for the inspection, in which "the neck is tied with a black thread." But at the same time, the packaging is still the seal of the St. Petersburg FSB, although the contents since then were examined twice in Penza, after which (as it listed in protocols) was re-packed and provided with seals of the Penza administration. And inside the package with Sagynbaev seized there is no longer a portable Toshiba hard drive.

Victor Filinkov defender Vitaly Cherkasov drew the attention of the court to these metamorphoses, seeing the signs of possible frauds of evidence in them.

Investigator Tokarev, questioned in the St. Petersburg process as a witness, could not give convincing explanations. Rather, his performance on video conferences added new questions. So, Tokarev stated that he personally examined the hard drive of Sagynbaev and the Shakursky laptop until March 2018.

However, in the materials of the Penza case there is a protocol of only one, preceding the March inspection of these carriers - from February 20, but it was carried out not by Tokarev, but Matyukhin.

You can make bets that the version looks more to the court: that Tokarev lied at the hearing or carried out an unauthorized, without a protocol, inspection of material evidence.

Last week, Sagynbaev’s hard disk, which disappeared by September 2018, appeared in the Penza process. He, along with the Shakursky laptop, was delivered to study evidence at the hearing, inviting the specialist of the Federal Security Service - the very Ganin.

The hard drive was in a sealed envelope with the only signature - the investigator Tokarev (although there should be signatures of all participants in the last inspection) and the post -ceremony - opened to familiarize the accused and their defenders with material evidence, after which it was again packed and sealed.

But they could not open the disk. His damage, as the specialist Ganin suggested, could be caused by the fact that he was "stored inadequate." The possibility of restoring data remained in question - for the answer to it you need diagnostics, Ganin explained.

The defense had reasonable fears: would the result of the “restoration” of the next surprises from the FSB will bring the result of “restoration”. The proposal of the prosecutor Sergei Semerenko to return the disc to the specialist of the UFSB for diagnosis and recovery caused a general protest of protection. The presiding judge Yuri Kubkov promised that re -packed material evidence would remain in court. Which, however, did not remove the alarms of the defendants and their lawyers about what could happen to these material evidence in five days of a break between meetings. As with the other carriers seized from the defendants, who have not yet been delivered to court and remain at the disposal of the investigative group of the Penza UFSB.

When studying at a meeting of the laptop Ilya Shakursky (it was also delivered in the package without indicating the date of the last inspection), it turned out that many files contained in it were subjected to manipulations after its detention on October 19, 2017. And the information that could serve as evidence of his innocence turned out to be deleted - as Ilya himself said. At the same time, on the computer, it was not possible to detect some of the documents reinforcing the accusations listed in the February inspection protocol. So, it says that on the Toshiba laptop, the “Sunrise 1” file containing a three -page text document with a statement of the stages of revolutionary activity was found. But when Shakursky at the meeting asked Ganin to find this file in a laptop and show, the specialist could not do this and was forced to admit:

- He is not here.

“And there is in the protocol, and they described it there for half a page,” Ilya reminded.

The study of the laptop at the hearing issued a stunning result. It turned out that a number of files, including Congress (2017), opened on October 30, 2017-that is, after the arrest of Shakursky, before the laptop was officially examined for the first time. The date of the latest conservation, for example, the file “Supplement on the Safety Document”-November 3, 2017, and changes to folders with the promising names “Intelligence”, “Saperers”, “Network” and the “Poems” folder were made in the summer-2018. Quite amazing things were also revealed: for example, in several files the last changes were made before their creation-ten years before the fact (2008 and 2016, respectively).

Protection is sure that the files in the laptop not only opened on October 30, 2017 or in the summer of 2018, but also underwent some manipulations.

If the files are only visible, the date of the latest changes remains, which was before, the specialist Ganin confirmed in court. And the owner of the laptop, being in a pre -trial detention center, did not have access to his laptop seized from him.

The February inspection protocol states that "a number of files are restored by a remote specialist." Ganin could not explain how much and which ones (from the described 595).

- When restoring remote data, you write, with what program this was done? - asked the defendant Sagynbaev.

“Yes, we point out,” the specialist assured.

- Why is the program not indicated here in this protocol?

“Well ... I didn’t draw up the protocol, investigator.”

Ganin refused to call the program at the hearing, citing a secret “specialized product”.

- Can I restore the metadata of deleted files? - continued Sagynbaev.

- Partly yes.

- Is it possible to restore the name of deleted files?

- No.

- What name did you assign to restored files?

“Those that were,” answered a short memory specialist, who had just declared the impossibility of restoring the name.

He did not remember a lot of things - in particular, why his signatures are not on the 76 pages of the protocol and how exactly the packaging of material evidence looked. But he firmly remembered that it was packed as it should be and fastened with signatures of all participants - witnesses, investigator, specialist.

Although in fact there was one signature of the investigator.

- Do you understand well what it means to give false testimonies? - Sagynbaev could not stand it.

But, having coped with emotions, he continued to ask questions on the merits:

- The devices in the inspection of which you participated were seized in 2017. Is it possible that the files that were created or changed in 2018 were found there?

- This is impossible.

- What date of creation should be the restored files in which it is impossible to restore metadata, as you say?

- I can't say.

- I will tell you - the date of creation should be the same as the recovery date, that is, no later than February 20, 2017.

Tired of this duel, the judge tried to interrupt the dialogue that was obscure to him:

- Ask specific questions, which file you are interested in?

“I am interested in all 595 files specified in the protocol,” Sagynbaev did not let up.

He recalled that, according to the protocol, 13 devices seized from the defendants were examined in total, 75 of the files investigated - this video and audio with a total duration of 2 hours 17 minutes plus 520 images and still volumetric text files (one, for example, 48 pages). Then the investigator had to manually dial a description of the examined - it occupies over 70 pages. For some time it took to connect system units and devices, search for files, restoration of remote documents. And all this titanic work, according to the time indicated in the time protocol, was done from 9.35 to 20.20. Of these 11 hours, it is still necessary to subtract the dining time - Ganin admitted that the examination participants were leaving.

He heard all these details about the manipulations with electronic media of Sagynbaev and Shakursky, the defendant Vasily Kuksov asked to quickly deliver to the court and all the devices seized from him:

-I am afraid, suddenly something will change on my computer and tablet while they are in the FSB.

Dmitry Pchelintsev addressed a similar request.

The presiding judge promised that Sagynbaev’s hard disk and the Shakursky laptop would remain in the building of the Penza Regional Court, where the on -site meetings of the Volga Military Court are held. And by the next meeting (scheduled for July 29), he will ask the FSB to deliver other electronic devices seized from the defendants.

• The organization was recognized as terrorist and prohibited in the territory of the Russian Federation.