A forensic investigator who examined Bradley Manning's army computers following his arrest discovered thousands of US embassy cables and Guantánamo detainee reports that matched exactly the documents published by WikiLeaks, the soldier's pretrial hearing was told on Sunday.
David Shaver, an agent with the Computer Crime Investigative Unit, provided testimony to the court that is likely to prove central to any court martial of the 24-year-old soldier that might ensue.
He testified that he found evidence that the soldier had been using specialist technology designed to speed up the downloading of files from databases when he explored Manning's user profile on his two army computers. Shaver also found thousands of complete embassy cables, and hundreds of unique files related to Guantánamo detainees.
When he compared the files with the documents on Guantánamo published by WikiLeaks, they matched.
Manning had two work computers, marked with identification numbers .22 and .40. The .22 computer was his secure machine with access to secret material; the .40 was unclassified, the court heard.
The secure computer had been configured to have intel-link – described as the "Google of classified information" – as its home page. Shaver said his examination of intel-link logs created on Manning's computer enabled him to reconstruct what searches the soldier had been doing.
He found that between October 2009, when Manning arrived in Iraq, until May 2010 when he was arrested, more than 100 searches for Julian Assange, the founder of WikiLeaks, had been made. There were also many searches for Iceland; a US embassy cable known as Reykjavik-13 was the first to be published by WikiLeaks in February 2010.
In a folder called "blue", Shaver said he found a zip file in which there was a spreadsheet containing record numbers for all state department cables in March, April and May 2010. The record numbers were displayed sequentially and the agent said he was struck by the number on the top of the spreadsheet: 251,287. WikiLeaks went on to publish 251,287 US embassy cables.
In other parts of Manning's user profile, Shaver said he found two files each containing 100 complete department of state cables. They had all been put into a form of file known as a CSV, which Saver said meant they were easier to transmit from one database to another.
Elsewhere, thousands of other complete embassy cables were recovered forensically, some of which were classified "secret".
Manning has been charged with 22 counts relating to the historic leaking of US state secrets to the whistleblowing website. The current pretrial hearing is designed to decide whether or not he should go to a full court martial, where he could face a maximum sentence of life in custody with no chance of parole.
Shaver told the investigating officer who is presiding over the hearing that he found on Manning's computer a specialist programme that is designed to allow the speedy downloading of files.
Manning was able to download a huge quantity of documents using the programme, called Wget. The programme, which, according to records, Manning started to use from early March 2010, was used hundreds of times to illegally download classified files, it was claimed.
"You can actually create a script around it to automate, in this case, to download a large number of files in a shrunk period of time," Shaver said, adding that "it is not a standard programme" and was not authorised to be used on military computers.
Shaver followed a trail of hidden data held by the computer that linked Wget back to Manning.
"It showed that Wget was run, it showed paths it was run from and it was used from several locations of Manning," he said.
Various commands were run at the same time to "download a lot of files at the same time," the court was told.
Shaver said more than 700 Wget commands were run for files relating to Guantánamo and he found documents with hundreds of names, including four complete detainee assessment reports.
Other crucial elements of the WikiLeaks publications were also found stored on the computers. The video of an Apache helicopter firing on civilians in Iraq, which WikiLeaks published as Collateral Murder in April 2010, was found to have been downloaded to Manning's profile in March that year, Shaver told the court.
In one area of the computer, Manning had allegedly stored what appeared to be the original army footage of the incident, in which 11 civilians died including two people who worked for Reuters. Next to it was the video put out by WikiLeaks.
Other searches by the agent revealed material on the Garani airstrike in Afghanistan in 2009 in which scores of Afghan civilians were killed.
Other documents retrieved included Jpegs of aircraft over combat zones and PDFs concerning hospital burns victims.
David Coombs, Manning's defence lawyer, will cross-examine Shaver at the Maryland military base on Monday.
