STEIN CHAPMAN SUPPLEMENTAL REPORT.PDF

Supplemental Report on the Independent Investigation
Pertaining to Maricopa County Assessor Paui Petersen
Report of Findings and Statement of Charges
Pursuant to A.R.& § 11-664(B)
December 26 9 2019
OMNI STEIN
CAREY CHAPMAN
Al TO NEY Al LAV 1
Lee Stein
Anne M. Chapman
MITCHELL I STEIN I CAREY I CHAPMAN, PC
One Renaissance Square
2 North Central Avenue, Suite 1450
Phoenix, AZ 85004
lee@inscciaw.coni
602-358-0290
1

Introduction
This report supplements our Preliminary Report on the Independent Investigation
Pertaining to Maricopa County Assessor Paul Petersen dated December 5, 2019. Unless
otherwise indicated in this Supplemental Report, our findings and analysis remain
unchanged from our Preliminary Report.
Additional Investigation
Our additional investigation for this Supplemental Report focused on the forensic
analysis of the Maricopa County Surface Laptop issued to Mr. Petersen in the fall of
2013, 1 which was conducted by Cosmich Simmons & Brown, PLLC, under the direction
of Mitchell Stein Carey Chapman, PC. Following the Board of Supervisors' decision to
suspend Mr. Petersen on October 28, 2019, the County Information Technology
Department disabled Mr. Petersen's County Windows account on November 1, 2019. 2
On November 13, 2019, in a telephone conversation with Mr. Petersen's counsel, County
Attorney Adel requested that Mr. Petersen return his County-issued laptop. 3 As indicated
in our Preliminary Report, we also requested on November 25 that Mr. Petersen return
1 The County purchased this laptop for more than $2,000 in 2017 at Mr. Petersen's specific
request. See Email, Beird to Mackert re: Surface Laptop for Paul, Nov. 7, 2017, and Your receipt
from Microsoft, Nov. 9, 2017 (Exh. 57). Following our Preliminary Report, we received email
correspondence from Maricopa County Auditor Michael McGee confirming that the laptop
issued to Mr. Petersen in 2017 was the only laptop that Maricopa County issued to Mr. Petersen.
The October 28, 2019 report of the high-level assessment conducted by the Maricopa County
Internal Audit Department mistakenly indicated that the laptop was issued in 2007. See
Preliminary Report at 20 n.76; Letter and High-Level Assessment of Assessor's Office, McGee
to Maricopa County Board of Supervisors, Oct. 28, 2019 (Exh. 7), at 2.
2 Supplemental Findings and Report to Mitchell Stein Carey Chapman, PC, by Cosmich
Simmons & Brown, PLLC, Dec. 23, 2019 (Exh. 56), at 1.
3 County Attorney Adel provided us with information about this telephone call.
2

the laptop so that we could analyze its contents as part of our investigation.' Despite
assurances from Mr. Petersen's counsel about the laptop's impending return, it was not
returned or obtained with sufficient time for us to analyze it and include the results of our
analysis in our Preliminary Report. 5
The Arizona Attorney General's Office seized the laptop pursuant to a search
warrant on December 3, 2019, and the following day, we requested that the Attorney
General's Office provide us with a digital image of the laptop. 6 On December 10, 2019,
the Attorney General's Office provided us with a forensic image of the laptop. 7 As with
our investigation leading up to our Preliminary Report, Cosmich Simmons & Brown
assisted us with the forensic analysis and review of the data from the laptop image.
Also as part of our additional investigation, we viewed the review hearing
requested by Mr. Petersen, which the Maricopa County Board of Supervisors conducted
on December 11, 2019. 8 We did not reach any additional findings or conclusions, or
change any of our previous findings or conclusions, based on the information and
argument presented at the hearing.
4 Preliminary Report at 10; Letter, Stein to Langhofer re: Maricopa County Attorney's
Office Investigation, Nov. 25, 2019 (Exh. 28).
5 Preliminary Report at 11; Email, Langhofer to Stein re: Paul Petersen, Nov. 26, 2019
(Exh. 29).
6 Preliminary Report at 11.
7 Supplemental Findings and Report to Mitchell Stein Carey Chapman, PC, by Cosmich
Simmons & Brown, PLLC, Dec. 23, 2019 (Exh. 56), at 1.
8 Video of the December 11, 2019 special meeting to review Mr. Petersen's suspension is
available through the Board's website: httos://www.marico a.aov/3 24/Board-of-Supervisors-
Meeting4nformation.
3

Additional Factual Findings
1. Factory Resets or Operating System Upgrades Performed on October
30 and November 12, 2019
Forensic analysis of the laptop revealed that a factory reset or operating system
upgrade was performed on the laptop on October 30, 2019, the day after Mr. Petersen
was released from federal custody on October 29, and again on November 12, 2019. 9
Factory resets and system upgrades both have the effect of preventing identification of
data that existed on the laptop before those events.' The resets or upgrades on October
30 and November 12 were not automatic updates pushed out by Windows." In other
words, the October 30 and November 12 resets or upgrades were intentional acts initiated
by a user. 12 These actions also were not taken with the knowledge, direction, approval, or
assistance of the Maricopa County Information Technology Department. 13
There is substantial evidence supporting our conclusion that these resets or
upgrades occurred. First, a "Windows.old" folder was created on October 30, which
occurs automatically when a Windows operating system is restored or upgraded.'
Second, the Windows user accounts installed by the County (All Users, Default, Default
User, and Public) were removed and a Windows user account, which is created when an
operating system is installed, was created on November 12, 2019, and identified as
9 Supplemental Findings and Report to Mitchell Stein Carey Chapman, PC, by Cosmich
Simmons & Brown, PLLC, Dec. 23, 2019 (Exh. 56), at 1-2.
10 Id. at 2.
Id. at 1-2.
12 Id.
13 This was confirmed with information technology staff within the County Assessor's
Office.
14 Supplemental Findings and Report to Mitchell Stein Carey Chapman, PC, by Cosmich
Simmons & Brown, PLLC, Dec. 23, 2019 (Exh. 56), at 1.
4

"Paul."' Third, as a result of the reset or upgrade on October 30, 2019, data was deleted
from the laptop, including personal files, apps, and settings.' Fourth, there are no
Windows event logs before November 12, 2019, and the file counts and the volume of
data on the laptop are abnormally low." Fifth, the County domain user account
"petersenp" was removed from the laptop."
The consequence of these resets or upgrades is that available forensic data is
severely limited. 19 Specifically, they prevent the identification of the existence of relevant
data on the laptop before the resets or upgrades." There is no information available
concerning connected devices (such as USB drives) before the resets or upgrades.' User
web browser history before the resets or upgrades is also unavailable.' In addition, it
cannot be deteunined whether certain documents saved in cloud storage, which was
synced to the laptop, were accessed before the resets or upgrades. 23
In sum, because of the resets or upgrades intentionally performed on October 30
and November 12, 2019, only a small amount of data was available for analysis. As
discussed below, however, the available data supports our previous conclusion that Mr.
Petersen was using County resources for his private law practice and adoption business
and for other non-County matters. His County-issued laptop contained several thousand
15 Id. at 2.
16 Id. at 1-2.
17 Id.
18 Id. at 2.
19 Id.
20 Id.
21 Id.
22 Id.
23 Id. at 5.
5

files related to his private business and other private matters, and he accessed this
information even after the Board of Supervisors voted to suspend him on October 28.
2. Forensic Findings
A. Specific Evidence of Use
Despite the limited data available on the laptop, there is evidence that the laptop
was used for purposes related to Mr. Petersen's private law practice and adoption
business on November 6, 2019. 24 Specifically, on that date, user "Paul" retrieved from
OneDrive pleadings related to two pending legal matters that Mr. Petersen was handling
and saved at least one document to the laptop's local drive.' There is also evidence that
several USB devices were connected to the laptop after November 12, 2019. 26
B. Internet Browser Data
Internet browser data was not available for dates before October 30, 2019. 27 The
data that was available, however, indicates the Mr. Petersen was conducting searches on
the laptop related to ways to remove data from a computer. 28 For instance, the following
Bing searches were conducted on November 29, 2019, after our written request to Mr.
Petersen's counsel on November 25 that the laptop be returned:
• "uninstall microsoft word"
• "remove cookies"
• "uninstall Microsoft edge"
• "uninstall Microsoft Word" 29
24 Id. at 2.
25 Id.
26 Id. at 2 n.3.
27 Id. at 2.
28 Id. at 5.
29 Id.
6

Mr. Petersen also viewed articles related to his current circumstances, including a Fox 10
article on October 31 titled "Woman who is accused of helping Paul Petersen with
alleged adoption fraud in court today," and an AZ Central article on November 18 titled
"Paul Petersen doesn't deserve his county assessor job. Here's why he'll get it back
anyway."3°
C. Keyword Search Results
We were able to collect and search 55,863 documents within the laptop data. 31 We
ran sixty-eight search terms across the data and identified 2,588 key-word-positive
documents.32 These documents are OneDrive documents that were synced to the laptop
on November 9, 2019. 33 We could not determine if the sync occurred automatically or
was user initiated, but the sync would have required using a password to log in to
OneDrive. 34 Mr. Petersen did not have access to OneDrive as part of his County Assessor
duties.35
Based on a review of the documents, 2,334 of them relate to Mr. Petersen's private
law practice and adoption business. 36 The documents included:
O Medical records (867)
• Adoption services agreements (429)
• Affidavits (342)
30 Id.
31 Id. at 2, 3.
32 Id. at 3.
33 Id.
34 Id. at 2.
35 See Preliminary Report at 38; Supplemental Findings and Report to Mitchell Stein Carey
Chapman, PC, by Cosmich Simmons & Brown, PLLC, Dec. 23, 2019 (Exh. 56), at 2 n.4.
36 Supplemental Findings and Report to Mitchell Stein Carey Chapman, PC, by Cosmich
Simmons & Brown, PLLC, Dec. 23, 2019 (Exh. 56), at 3.
7

• Law office bank records (216)
• Adoption file documents (72)
• Petitions for adoption (71)
• Other documents related to adoption services (70)'
Notable among the documents were a letter to the Indiana Department of Health Services
regarding qualification for state Medicaid for a pregnant mother, multiple bank transfers
to Mr. Petersen's co-defendant in the Arizona state criminal case, and 1099 tax foiins
issued by the Law Office of Paul Peterson to individuals including some named in the
criminal indictments against Mr. Petersen. 38
The identified documents also include screen shots of text messages related to Mr.
Petersen's law practice and adoption business. 39 Among those are:
O Messages from Mr. Petersen to women who had changed their minds about
giving up their babies, including:
o Mr. Petersen advising that he will remove his name from the apartment
causing the woman to be evicted
o Mr. Petersen advising that he could sever the parental rights of a father who
will not sign adoption papers
O Message from Mr. Petersen stating: "All you girls work for me, not the other
way around"
e Messages between Mr. Petersen and others regarding their requests for and
payment of funds'
As with the internet browsing history, because of the resets or upgrades, we could
not determine whether any of these documents were accessed before October 30, 2019. 41
37 Id.
38 Id. at 4.
39 Id.
40 Id.
41 Id. at 5.

D. Emails
We did not find evidence that emails were accessed locally on the laptop. 42 It is
unclear whether this lack of data results from the resets or upgrades or because any email
was accessed through browsers.
Conclusion
Factory resets or Windows operating system upgrades were done on Mr.
Petersen's County-issued laptop on October 30 and November 12, 2019, limiting the
forensic data available on the laptop and preventing identification of relevant data before
October 30. OneDrive was synced with the laptop, and because Mr. Petersen did not have
access to OneDrive or any other cloud storage system for County business, there was no
County-related reason for Mr. Petersen to be using OneDrive. Also, because OneDrive
was synced with the laptop, many documents related to Mr. Petersen's private law
practice and adoption business were on the network of the County-issued laptop.
Our review of the laptop data supports the conclusion in our Preliminary Report
that Mr. Petersen used County resources for his private law firm and adoption business
and for other personal purposes. 43 Likewise, for reasons similar to those explained in the
Preliminary Report, our fmdings related to the laptop may also constitute crimes. 44 In
particular, the evidence that data was intentionally removed from Mr. Petersen's County-
issued laptop may form a separate basis for finding that Mr. Petersen committed
destruction of or tampering with public records in violation of A.R.S. § 38-363, 4' A.R.S.
42 Id. at 4.
43 See Preliminary Report at 38, 47-49.
44 See id. at 50-51 & nn.204-209.
45 A.R.S. § 38-363 ("A public officer whose office is abolished by law, or who, after
expiration of the time for which he has been appointed or elected, or after he has resigned or
9

§ 38-421,46 and A.R.S. § 13-2407.47 This conduct also may constitute criminal damage in
violation of A.R.S. § 13-1602." It is also possible that this conduct may form the basis of
other criminal charges, such as tampering with physical evidence in violation of A.R.S.
§ 13-2809.49
been legally removed from office,. . . knowingly mutilates, destroys or takes away any thereof,
or who knowingly and unlawfully withholds or detains from his successor, or other person
entitled thereto, any money or property in his custody as such officer, is guilty of a class 4
felony.").
46 A.R.S. § 38-421(A) ("An officer having custody of any record, map or book, or of any
paper or proceeding of any court, filed or deposited in any public office, or placed in his hands
for any purpose, who steals, or knowingly and without lawful authority destroys, mutilates,
defaces, alters, falsifies, removes or secretes the whole or any part thereof, or who permits any
other person so to do, is guilty of a class 4 felony.").
47 A.R.S. § 13-2407(A)(4) ("A person commits tampering with a public record if, with the
intent to defraud or deceive, such person knowingly: . . . Destroys, mutilates, conceals, removes
or otherwise impairs the availability of any public record[1").
48 A.R.S. § 13-1602(A)(2) ("A person commits criminal damage by: . . . Recklessly
tampering with property of another person so as substantially to impair its function or value.").
49 A.R.S. § 13-2809(A)(1) ("A person commits tampering with physical evidence if, with
intent that it be used, introduced, rejected or unavailable in an official proceeding which is then
pending or which such person knows is about to be instituted, such person: . . . Destroys,
mutilates, alters, conceals or removes physical evidence with the intent to impair its verity or
availability[1").
10

-ctk b7

Fa, fo G/7
CoSM[CI SimmoNS &T I3ROWN, PLLC
Strategic Business Solutions, PLLC
1950 Waldorf St. NW
Grand Rapids, MI 49544
Matthew' T. Clarke, Esq.
Office: 616.202.6004
Mobile : 602-293-7751
inatt.clarke@cs-lale.corn
December 23, 2019
Jackson, MS
Hattiesburg, KIS
Covington, KY
New Orleans, LA
St. Louis, MO
Scottsdale, AZ
Pittsburgh, PA
Anne M. Chapman, Esq.
MITCHELL STEIN CAREY CHAPMAN, PC
One Renaissance Square
2 North Central Avenue, Suite 1450
Phoenix, AZ 85004
anne(&,mscclaw.com
Re: Maricopa County Internal Investigation — Petersen
SBS First Supplemental Data Analysis Report
SUPPLEMENTAL FINDINGS AND REPORT
Dear Anne,
Below is our Supplemental Findings and Report to the December 4, 2019, Preliminary Findings and Report related to
the Paul Petersen investigation. The focus of this report is the collection of Petersen's County issued laptop computer.
As indicated in our December 4th Report, Petersen was issued a Surface Laptop in the Fall of 2017 and took possession
of it in October or November 2017. He occasionally took the laptop into County offices for technical support, the last
time being the Summer of 2019. Following Petersen's suspension his County Windows account was disabled by
County IT on November 1, 2019. The County-issued laptop was obtained by the Arizona Attorney General's Office
pursuant to a search warrant on December 3, 2019. A digital image of Petersen's laptop was provided to Tens on
December 10, 2019.
I. Forensic Inspection and Data Collection
On December 10, 2019, a logical forensic image of the three partitions' from Petersen's laptop computer, serial number
008755373957, were acquired using computer forensic software Access Data FTK Imager (v 4.2.0.1.3). The
information was subjected to forensic analysis by the forensics team at Tens.
Forensic inspection revealed an abnormally low volume of data on the laptop. Further inspection revealed that a
"Windows.old" folder was created on October 30, 2019. 2 A "Windows.old" folder is created automatically when a
Windows Operating System is restored or upgraded. In this instance, it was a user-initiated system restoration or
upgrade, not the result of a windows prompted restoration or upgrade. As a result of the restoration or upgrade of
1 The three Partitions include: (1) NTFS Partition, (2) System Partition, and (3) Windows RE tools Partition.
2 The "Windows.old" folder with a creation date of October 30, 2019 contains many of the artifacts found on the laptop.

October 30, 2019, data was deleted from the laptop, including personal files, apps, and settings. Forensic examination
further indicated that on November 12, 2019, a second factory restoration or Windows 10 Operating System upgrade
was performed on the laptop. This was also user-initiated.
The County installed Windows User accounts on the laptop including All Users, Default, Default User and Public
accounts were removed and replaced with the user account "Paul". The County domain user account "petersenp" was
removed from the laptop. As a result of the upgrade Windows event logs (Application, Security, Setup and System)
were deleted for dates prior to November 12, 2019. As a result of the upgrade the Windows file that tracks connected
devices such as USB drives - the Setupapi.dev.log file - was erased and there is no information concerning connected
devices prior to November 12, 2019. 3 Finally, as a result of the system upgrade or factory reset, forensics examination
is unable to determine the user web browser history for dates prior to October 31, 2019.
The Windows 10 Operating System upgrade or factory restore events of October 30, 2019 and November 12, 2019, had
the same effect as anti-forensics tools in terms of preventing us from identifying data that existed on the laptop prior to
those events.
Data Recovery
Despite the Windows 10 Operating System upgrade or factory restore events Tens identified and collected 55,863 files
consisting of a combination of user created files and system files. Examination of the data reveals that on November 9,
2019 a OneDrive folder with files was created on the laptop through a "sync" with a Microsoft OneDrive account. 4 It
is not clear whether the sync was intentional or the result of an automatic sync feature. Nevertheless, it could only have
occurred as a result of a successful Onethive login (username and password credentials entered to the OneDrive app).
As will be discussed below, approximately 4600 files can be attributed to user "Paul/OneDrive". Approximately half of
those related to his adoption agency or private law practice.
The forensic team found no native emails for either Petersen's county email account or any of the various Gmail or Ya-
hoo mail accounts we previously identified on Petersen's office Desktop. 5 A small amount of web-browser history was
recovered, limited to browser activity on or after October 31, 2019. Finally, approximately 200 screen shots of text
messages were found in a camera role mapped to OneDrive.
III. Specific Evidence of Computer Use
The information that was still available on the County issued laptop demonstrates Petersen used the laptop to view
and/or store documents related to his adoption agency and his private law practice, and for various other non-county
matters. For example, browser activity logs that were still available after the deletion efforts indicate user "Paul"
logged into OneDrive on November 6, 2019 and retrieved pleadings related to two pending legal matters Petersen was
handling, and at least one of the documents was saved to his local drive at
file:///C:/Users/Paul/Desktop/REDACTED.Answer.pdf.
The chart below lists the URL, User, Date/Time and Page Title for the browser history reference above:
3 Examination revealed several USB devices were connected to the laptop after November 12,20/19.
4 Microsoft OneDrive is a file hosting service and synchronization service operated by Microsoft as part of its web version of Office. OneDrive allows users to store
files and personal data and access it from their phone, tablet or computer — referred to as "cloud storage." It also allows them to work on the files offline and sync
when back online. As indicated in our December 4, 2019 report, Petersen was not mapped to OneDrive cloud storage for purposes of his County work and there was
no County work related reason for him to install OneDrive on the laptop.
5 The forensic team identified some Gmail fragments in the stored history, but those files are not in a readable format and were not part of our review.
2

https://onedrive.live.com/edit.aspx?cidfa37ce00e23c447&p age=view&residFA37CE00E23C447118427&parId=0FA37 Paul 11/6/2019 REDACTED.Order.Con.Final.Hearing.docx -
CE00E23C4471163&appWord — 18:56 Microsoft Word Online
hap I18684&app—Word&wdrtd=1&wereviousSession=df548f3b% s://onedrive.live.com/edit .aspx?resid=FA37CE00E23C447 Paul 11/6/2019 REDACTED.Ansr.lawsui.docx we - Microsoft
2D20c0%2D4a78%2Daea3%2D70d60159e83e 18:59 Word Online
https://onedrive.live.com/edit.aspx?cidfa37ce00e23c447&p age=view&resid=FA37CE00E23C447!18684&parId=FA37CE Paul 11/6/2019 REDACT ED.Answer.lawsui.docx - Microsoft
00E23C447118683&app—Word 19:01 Word Online
https://onedrive.live.com/edit.aspx?cidfa37ce00e23c447&p age=view&resid-FA37CE00E23C447!18684&parIc0FA37 Paul 11/6/2019 REDACTED.Answer.lawsui.docx - Microsoft
CE00E23C447!18683&app=Word 19:11 Word Online
Windows does not distinguish between Internet Explorer, Edge or File Explorer. As such, some entries identified as
"browser history" are potentially representative of access to a D drive, e.g., a USB device. Some limited "browser
history" supports the conclusion Petersen used the County laptop to access documents unrelated to his County job
duties; in this instance it was likely accessed from a USB device on the D-drive:
file:///D:/REDACTED/REDACTED.zip Paul 11/25/2019
IV. Review and Assessment of Data Recovered
a. Key Word Positive Documents
Consistent with the workflow utilized during the first phase of this project, we instructed Tens to process the collected
files into Relativity where we applied 68 search terms designed to isolate documents that might relate to Petersen's
adoption business or his private law practice. As a result of that filtering, we identified 2,588 documents as key word
positive. Those documents have "document creation" dates ranging from 2013 — 2019, and are the documents loaded
onto the laptop during the November 9, 2019 OneDrive sync. There were also 2 .pdf images on the system unrelated to
OneDrive — both adoption related documents. Our team reviewed the subset and identified 2,334 as being related to
Petersen's adoption practice / private law practice; the remaining key word positive documents were unrelated to
Petersen's adoption business or law practice.
Data concerning the 2,334 documents is attached as Exhibit A (Laptop Analysis FINAL_REDACTED). Exhibit A
represents a summary of our evaluation of the 2,334 documents. Below is a partial excerpt from Exhibit A, identifying
a sample of the documents on Petersen's County issued laptop, with the volume of each document type represented by
the "Document Count" column (the full list is in the exhibit itself). For example, 867 documents identified as medical
records; 429 documents identified as Adoption Agreements, etc.:
Document Type Document Count
Medical Records 867
Agreement - Adoption services 429
Pleadings - Affidavits 342
Law Office - Bank records 216
Adoption File - Multiple documents 72
Pleadings - Petition for Adoption 71
Law Office Other - Adoption services 70
Law Office Other — Text messages with clients 53
Court Orders / Reports - Adoption 47
Pleadings / Orders - Bankruptcy 40
3

Of interest in these documents are the following:
• April 26, 2019, Letter from Paul Petersen to Indiana Division of Family Services regarding determination of
pregnant mother's qualification for Indiana Pregnancy Medicaid.
• 2017 and 2018 1099 miscellaneous income reports from Law Office of Paul Petersen to multiple individuals,
including a co-defendant in one criminal case.
• Bank records showing wire transfers to multiple individuals including a co-defendant in one criminal case.
b. Text Message Screen Shots
From the OneDiive download on the laptop we located a camera roll of what appears to be data retrieved from
Petersen's cell phone, including various personal items such as family photos, etc. Among the data, however, were
approximately 200 screen shots of text messages between Petersen and various parties, including prospective adoptive
parents, birth mothers, birth fathers, etc.
Some of the texts are in English, some are in Marshallese, and some are a combination of the two. Full analysis of the
documents will require formal translation, which we did not perform. However, we are confident in our conclusion that
most of the texts relate to his adoption business, based upon our review of the portions that are in English, for example:
• A text solicitation where someone offers to provide Petersen with "many pragnant marshall lady [sic]"
• A text solicitation where someone asks Petersen "if you guys still taking prego moms from here [sic]"
• Messages from Petersen to women who changed their mind about giving up their baby, including:
o A text advising he would remove his name from the apartment, causing her to be evicted once rent pay-
ments stop, and then "force [her] to repay funds [she] defrauded [his] client..."
o Describing a mother's behavior as "awful," and not a "smart decision" to keep her baby
o Explaining he could sever parental rights of a father who won't sign adoption papers
• 2018 text explaining "All you girls work for me, not the other way around."
• 2015 text to Petersen requesting money to for an airline ticket and threatening to "go to the media if that's what
it takes" "and I'll even tell the Nitijela in Majuro" (Nitijela is Marshallese Parliament)
• Text messages between Petersen and others regarding their requests for and payments (e.g., "I can pay you 4
grand if the girls sign today as we discussed"
c. Non -Keyword Positive Files
During the file analysis of non-keyword positive files, we identified an additional 116 files related to Petersen's
adoption/private law practice, including text messages (discussed above). Those were added to the documents from the
key word positive set.
The balance of files consisted generally of thousands of stock image files, web page files, data and text-based format
files, programming files, data export files, and a series of what appear to be corrupt files that we could not open. There
were about 50 Word documents, some related to County business, some purely personal, and some that we were unable
to open due to the files being corrupt.
d. e-Mail
No email data was identified on the system, other than the fragments of Gmail indicated above, which were not in a
reviewable format and were not part of the analysis.
e. Web Brower Histoly
4

Again, the operating system upgrade or restoration performed on the laptop prior to its return has limited the volume of
substantive web browser information available for review.
The limited browser history on the laptop was consistent with the history associated with Petersen's desktop — Google
and Yahoo activity, social media, banking and financial planning, news, sports, shopping, login.live, dropbox, etc. Most
of the activity appears to relate to his pending legal issues and banking activities.
Of interest were searches regarding ways to remove data from a computer and searches related to Petersen's legal
issues. We include a sample of those below:
Searches related to removing data from a computer
• 11/29/2019 22:43: Bing search: "uninstall Microsoft edge"
• 11/29/2019 22:43: Bing search: "uninstall Microsoft Word"
• 11/29/2019 23:40: Bing search: "remove cookies"
• 11/6/2019 19:02: Bing search: "download Microsoft word"
• 11/16/19 14:13:14: User accesses: "ms-settings:windowsupdate"
Searches related to Petersen's legal issues
• 10/31/2019: Fox 10 "Woman who is accused of helping Paul Petersen with alleged adoption fraud in court to-
day"
• 11/18/2019: AZ Central "Paul Petersen doesn't deserve his county assessor job. Here's why he'll get it back
anyway."
• 11/1/2019: Google search for "utah criminal case name search"
V. Conclusion
The October 30, 2019 and November 12, 2019 Windows 10 Operating System upgrade and/or factory restoration had
the effect of preventing our team from identifying almost any of the data that existed on the laptop prior to the time of
those events. Our review was limited to examining data we were able to retrieve from the computer. We cannot
determine whether documents saved in cloud storage, and subsequently synced to the laptop on November 9, 2019,
were accessed on the laptop prior to the October 30, 2019, restoration or upgrade.
Based upon the information available to us, we reasonably conclude Petersen possessed several thousand files on his
County issued laptop that related to his adoption business and his private law practice. Because of the apparent effort to
remove data from the laptop, we are not able to determine how many, if any of those documents were created or
modified on the laptop. We reasonably conclude Petersen used a USB drive to access documents from his County
issued laptop that related to his private law practice. Again, because of the effort to remove data from the laptop, we are
not able to determine exactly how many documents were accessed.
Kind Regards,
Matthew T. Clarke, Esq.
5

EXHIBIT A
AVAILABLE UPON
REQUEST


6-7
From: Tyler Beird (ASR) <Tyler.Beird@Maricopa.Gov >
Sent: Tuesday, November 7, 2017 3:45 PM
To: Kimberly Mackert (ASR)
Cc: Dawn Humphrey (ASR)
Subject: Surface Laptop for Paul
Attachments: SurfaceLaptop.pdf
Kim,
Paul asked me to purchase through Dell a Surface Laptop. Dell does not carry Surface Laptops though, so we will need to
go through another vendor. It looks like the prices are the same across all retailers, so we may want to purchase directly
from the Microsoft Store.Here's what Paul needs ordered (also attached):
Surface Laptop — Core i7, 16 GB RAM, 512GB storage— Cobalt Blue
Surface Pen — Cobalt Blue
Surface Arc Mouse — Cobalt Blue
Also, we will probably want to get a warranty/accidental damage protection with the Surface Laptop. The Microsoft
Store offers a two-year warranty for $149, so that might be the way to go.
Let me know if you have any questions.
Thanks,
Tyler Beird
Systems Administrator
Maricopa County Assessor's Office
beirdt@mail.maricopa.gov
602-372-9240
1

Configure your device 52,199.03
Choose front the options below.
Surface Laptop - 51263 / Intel Core i7 /16GB RAM (Cobalt Blue)
Color:
1-]
Processor:
Intel Core IS Intel Core 17
Perfect for photographs, The Intel Core 17 option
videos, reports, and indudes Intel Iris graphics,
presentations.Crompatible with making your photo, video, and
Surface Dial (off-screen 3D applications run faster. It
interaction) Choose from Into also ghres you the ability to
memory and storage play more PC games.
configurations. Compatible with Surface Dial
(off-screen interaction).
Memory: o
, [ BOB 16GB
Storage: o
512GB
Surface Laptop (Cobalt Blue) — Intel Core 17, 16GB, 512GB
Surface Pen - Cobalt Blue
**** 45
$99.99
.559.99 Special pricing for eligible students, parents, teachers, and military. Check now
Choose your product
Platinum Burgundy
Black Cobalt Else
Aqua (Limited Edition)
Find in store
Cite 5,1tP1,4. Free r=t,".
Surface Arc Mouse - Cobalt Blue
** 13
479.99
571.99 Spacial pricing ter eligible students, parents, teachers, and military. Check no,
Find in store
Fat
Description

From: Microsoft Store <email@email.microsoftstore.com >
Sent: Thursday, November 09, 2017 10:38 AM
To: Kimberly Mackert - ASRX <MackertK@mail.maricopa.gov >
Subject: Your receipt from Microsoft
Details of your Microsoft purchase
Su it Office PCs & ehiets Apps
Receipt Details
Scottsdale Fashion Square
7014 E Camelback Rd
Scottsdale, AZ 85251
Store Phone: (480) 308-0800
Receipt ID: 000110021000016190
Date purchased: 11/9/2017 10:31 AM
1

Item Description Qty Price
Microsoft Surface Laptop i7 16GB 512GB - Cobalt 1 $2,067.06
Blue
Product sku: DAL-00055
S/N: 008755373957
Price: $2,199.00
Line Discount: ($131.94)
Microsoft Comm Complete for Bus 3YR Warranty 1 $249.00
US USD Surface
Product sku: F9W-00094
Price: $249.00
Microsoft Surface Pen - Cobalt Blue 1 $93.99
Product sku: EYU-00017
Price: $99.99
Line Discount: ($6.00)
Microsoft Surface Arc Mouse - Cobalt Blue 1 $75.19
Product sku: CZV-00051
Price: $79.99
Line Discount: ($4.80)
Summary of Charges
Order subtotal: $2,485.24
Tax: $177.78
Order total: $2,663.02
Payment method
Credit: $2,663.02
Your order barcode
Print this barcode or pull it up on your phone if you need to return an item.
See exchange/return info
II 1 ,11 1 1 11 z11 1011,11,11I 01 J9 1 111.,
Have a question about your order? Call us at (480) 308 -0800.
2

The best of Microsoft in one place
Visit Microsoft store for handpicked selections of the latest Microsoft
products, including Surface, Xbox, Windows PCs, and Windows Phones.
C
riq Lipp! t
View in brow Careers Privacy Staterrent
Free UPS Standard shipping. Expected delivery within 3-7 business days after shipping. See weboaoe for additional details.
*Go to htto://microsoftfeedback.com for complete official rules. No purchase necessary to enter or win. You must be 18 or older to enter.
Ends 12/31(17.
This email was automatically generated. Please do not reply.
This is a mandatory service communication. To set your contact preferences for other communications, visit the Promotional
Communications Manager,
Microsoft Corporation, One Microsoft Way, Redmond, WA, 98052, USA