🚨🚨ARIZONA UPDATE: Maricopa County Audit Team Testify That Deleted Files Have Been Recovered and That Serial Numbers Are Missing Between Original, Duplicate Ballots…

A contractor for Cyber Ninjas, Ben Cotton, founder of the digital forensics company CyFIR, and a few others, testified in a special hearing stating the auditors have recovered the election databases that were deleted before the audit took place. But that’s not all…

The audit team, as well as Former Secretary of State Ken Bennett, brought up the issue of serial numbers that were missing between original and duplicate ballots, violating state law.

We posted the full video below but timed it at the part where they go into explaining the missing serial numbers between the ballots. (see transcript below).

Transcript

Ken Bennett ➝ 16:29

Madam President, this comes right out of ars.16.621 which says, “if any ballot including any ballot received from early voting is damaged or defective so that it cannot properly be counted by the automatic tabulating equipment, a true duplicate copy shall be made of the damaged or defective ballot in the presence of witnesses and substituted for the damaged or defective ballot.” It also says “all duplicated duplicate ballots created pursuant to this subsection shall be clearly labeled duplicate and shall bear a serial number that shall be recorded on the damaged or defective ballot.” We’ve started into our first boxes of ballots that were damaged and had to be sent to duplication, there are some other situations, for example, braille ballots – I looked at a box of braille ballots the other day and a braille ballot is about the size of a cookbook and it’s got a big plastic ring thing on the side and it’s about an inch thick and that has to be determined what were the votes in that and those votes have to be reflected on a duplicate ballot. As we were going through some of the early boxes of boxes marked as original or damaged ballots sent to duplication, we then went to boxes marked duplicate ballots and we are finding a six-digit unique identifier serial number, it says in “16621” on the duplicate ballots, but we’re not finding a corresponding serial number on the original ballot that was damaged or otherwise had to be duplicated. In fact I was so surprised that I brought the two observers from the Secretary of State’s office over along with some other volunteer observers from various parties just to – kind of – document that we’re running into batch after batch after batch of ballots sent to duplication, but there’s no unique serial number or identification number on the ballot that had to be duplicated – that should correspond with a ballot over in the “has been duplicated box” because those should match up one-for-one – and obviously they should add up the total number of ballots as a whole, but you literally should be able to say ‘here’s the damaged ballot” and it’s “123456” and “here’s the duplicated ballot” “123456” and anyone could be, should be, able to audit and say “yes we can see that the votes off of the damaged ballot – that the machine couldn’t read – have been correctly… made”. And so we are struggling as to how we’re going to be able to match up ballots sent to be duplicated with the ballots that were duplicated, if one of those – the originals – are missing that six-digit number… we’re struggling as to how we’re going to be able to match the originals to the duplicates if the originals don’t have the same serial number as required by 16.621 as the duplicate palette does.

Ben Cotton ➝ 31:32

So we follow a very strict forensics acquisition process, in which, we don’t turn on a system if it’s delivered to us in a powered-off state. We remove the hard drives, we perform forensics imaging with write-blocks to prevent any changes to those hard drives, and we produce a bit for bit forensics copy of that particular drive.

In the case of the ems server, there were actually six drives. Two of those drives were for the operating system and they were in – what we call – a mirror configuration. So if something was changed anywhere on the operating system drive, that would automatically be reflected on both drives. The other four drives were data drives and it turns out that they were in a raid configuration known as one-plus-zero. So in other words, you have a volume that is not only mirrored, but it’s also data redundancy and stripped across both drives as well. Obviously if I don’t turn on a system, I don’t have access to the raid parameters, and the county did not provide those to us. So I had to do a discovery process to determine what that rate configuration was. Part of that process is a scan across those drives to detect partitions of data and to also detect what we call a master-file-table. So a master file table – very simply put – is a record of all of the directories and the files that are contained in that partition and a pointer to where that data resides on the hard drive. In the course of performing that MFT discovery, I discovered an MFT that clearly indicated that the database directory was deleted from that server. So all of this however may be a moot point because subsequently I’ve been able to recover all of those deleted files and I have access to that data.

---

All evidence shows that some Maricopa Co election databases were deleted but auditors report that they have access to what is needed due to the digital recovery efforts they’ve made! #Experts!

— Dr. Kelli Ward 🇺🇸 (@kelliwardaz) May 18, 2021

Auditors expect to finish counting before the end of June. #AzAudit #AmericasAudit

— Dr. Kelli Ward 🇺🇸 (@kelliwardaz) May 18, 2021

Senator @votewarren is correct – Arizona is doing the first full forensic audit on an American election. Other states are watching & learning. And that’s exactly what the Left fears. Katie Hobbs let that slip when she Wasko with Rachel Maddow (OMG other states might follow!).

— Dr. Kelli Ward 🇺🇸 (@kelliwardaz) May 18, 2021