Yorgen Fenech trial: Expert defends digital evidence as jury shown Schembri office search
Digital forensics expert Keith Cutajar spent hours defending the integrity of the electronic evidence gathered in the investigation into Daphne Caruana Galizia’s murder, while the afternoon sitting saw jurors shown video footage of the police search inside Keith Schembri’s office at Castille, where investigators discovered documents that became the focus of a lengthy cross-examination by the defence.
Yorgen Fenech, a businessman, has pleaded not guilty to two principal charges: complicity in the wilful homicide of Daphne Caruana Galizia and criminal association to commit the murder.
Caruana Galizia, a columnist with The Malta Independent, was killed in a car bomb on 16 October, 2017.
Five men have already been convicted in connection with Caruana Galizia’s assassination. Vince Muscat admitted his role in the murder in 2021 and was sentenced to 15 years’ imprisonment. Alfred and George Degiorgio each received 40-year prison sentences after pleading guilty in 2022, while Robert Agius and Jamie Vella were sentenced to life imprisonment in 2025 for supplying the bomb used in the attack.
The prosecution is being led by Attorney General lawyers Godwin Cini, Anthony Vella and Danika Vella, assisted by Assistant Commissioner Keith Arnaud and Inspector Kurt Zahra. Fenech is represented by lawyers Charles Mercieca, Gianella Demarco and Gianluca Caruana Curran, while lawyers Therese Comodini Cachia and Jason Azzopardi are appearing parte civile on behalf of the Caruana Galizia family.
Judge Edwina Grima is presiding.
Please refresh for updates
17:25
That wraps up Charlot Casha cross-examination.
The trial will continue on Monday, when the jury is expected to hear from a new slate of witnesses.
Thanks for following our live blog. We’ll be back on Monday with all the latest from Hall 22.
17:19
The defence also mentions Inspector Charlot Casha and his team going to Keith Schembri’s office in the inquiry of ‘Daphne Leaks’ and not the homicide inquiry.
Lawyer Giannella De Marco further states the peculiarity of not seeing a laptop in 2019, asking the witness what the investigators were primarily looking for.
Inspector Casha responds that he was only filming and that questions should be directed to the other investigators conducting the search
GDM: Do you know what was elevated? Neither right?
CC: As I already said, no, I do not know.
GDM: Keith Schembri had a mobile phone in hand did I see correctly?
CC: It could be.
17:06
Court shown blue file containing Daphne Caruana Galizia ‘Running Commentary’ posts on Schembri
The courtroom is shown a previous video clip of the search inside Keith Schembri’s office. The footage zoomed in on a blue folder containing printed articles from Daphne Caruana Galizia’s blog.
Under cross-examination by defence lawyer Giannella De Marco, Inspector Casha confirms he was the sole representative from the police forensics department present during the search inside Keith Schembri’s Castille office.
GDM (Giannella De Marco): So it was just you from the department of forensics to take a film? There were no scene of crime officers with you?
CC (Inspector Charlot Casha): No.
Turning to the document containing references to “DCG” and “PD” alongside dates, the defence presses Casha on how the sheet of paper was handled and filmed.
Casha clarifies that the paper was found amongst other papers in the middle of the table. Inspector Keith Xerri found it, and Assistant Commissioner Keith Arnaud immediately took it and looked at it.
Casha says that when he noticed Inspector Zahra taking a photo of it, he moved towards him since he realised it was of interest, and recorded a video. Once he stopped the recording, he took photographs of both the front and back of the paper.
The defence raises questions over the handling protocol of the document, maintaining that such material ought to have been placed into an official evidence bag on site.
16:46 Inspector Charlot Casha testifies that his role in the investigation was strictly limited to documenting the search inside Keith Schembri’s Castille office, confirming he had no other involvement with the former OPM Chief of Staff.
When asked whether he remembered Schembri’s arrest, Casha states he had no direct knowledge of it, emphasising that as head of forensics, his department operates independently from police investigators.
The video footage presented in court, Casha adds, captures the search inside Castille prior to Schembri’s arrest.
16:35 As the video playback continues, the audio quality is muffled, with only sporadic words audible. In the clip, investigators can be seen pulling multiple files and documents from a cabinet inside the office.
Keith Schembri then appears in frame, gesturing with open hands as he speaks to the officers, holding a mobile phone in his hand.
A tense exchange breaks out in the courtroom when AG lawyer Godwin Cini addresses defence lawyer Charles Mercieca over snide remarks regarding the mobile phone Keith Schembri is seen holding during the search.
Judge Edwina Grima immediately steps in, warning both parties against escalating into petty arguments. The video clips have ended.
16:15 In the clip, Inspector Casha can be seen recording the footage while holding the document containing the words “DCG” and “arrests” close to the camera lens for a clear view.
Another segment of the video shows Inspectors Kurt Zahra and Assistant Commissioner Keith Arnaud extending their search to two additional desks located inside Schembri’s office, with the former OPM chief of staff heard saying ‘yes of course’ to the investigators opening a cabinet.
16:05 The next video clip shows officers shifting their focus directly to Keith Schembri’s desk. A tense silence hangs over Hall 22 as the court watches the search unfold.
Schembri, still visibly stressed, closely monitors the officers as they handle his belongings. At one point, he leans forward over the desk to get a clearer view of a specific document an investigator was examining.
15:52 A portion of the video clip zooms in on a specific document, the text of which remains illegible from the press gallery.
Reading the contents aloud for the court, AG lawyer Godwin Cini reveals that the document mentions Tilgate Inc, Keith Schembri’s offshore company in Panama exposed during the 2016 Panama Papers leak.
The report noted that, at the time of its compilation, no active assets, funds, or bank accounts associated with the company had been identified.
In the footage played for the court, former OPM Chief of Staff Keith Schembri, dressed in a striped top under a dark blazer and blue jeans, can be seen looking on as an investigator looks through the contents of his desk.
Schembri’s body language appeared visibly tense as he shifted nervously, uncrossing his arms to place his hands in his trousers pockets while darting glances back and forth between the camera and the investigating officer.
15:22 As the photos taken inside Keith Schembri’s former office in Castille are projected onto the courtroom screens, prosecutor Godwin Cini describes one particularly notable document captured in the images: a sheet of paper found inside the office that appeared to show a plan, featuring words such as ‘DCG’ and ‘arrests.’
Following the photographic evidence, a video recording detailing the physical search inside Schembri’s office is played.
15:17 The prosecution directs court expert and Inspector Charlot Casha to a report he compiled as part of the ‘Daphne Leaks’ inquiry concerning former OPM Chief of Staff Keith Schembri’s office at Castille Palace.
Casha testifies that an investigation was launched on 5 December 2019. Together with Inspectors Keith Vella and Kurt Zahra, and Assistant Commissioner Keith Arnaud, Casha documented an investigative search inside the office.
“I took 16 photos and 10 video clips, all of which were documented and preserved on a DVD,” he explains, confirming that his role was to record the physical state of the premises during the search.
15:03 Scene of Crime Officers are scheduled to testify soon.
12:57 That’s it for the morning session.
The court has adjourned for a lunch break. We’ll be back this afternoon as more witnesses are set to testify.
12:56 Taking the stand, Sonia Consiglio formally confirms the 2020 civil proceedings filed by the Caruana Galizia family against state witness Melvin Theuma, which sought a prohibitory injunction freezing €2 million in assets.
Searches also showed that Theuma drafted a will three days after the hitmen were charged in court.
Under cross-examination by defence lawyer Giannella De Marco, Consiglio is asked whether Theuma had continued conducting real estate transactions following his arrest on 14 November 2019.
Consiglio confirms that he had, revealing that Theuma engaged in the sale of an apartment valued on 21 December 2020, more than a year after his arrest. He also sold a garage priced at €150,000.
12:36 Prosecutor Godwin Cini calls court translator and transcriber Katya Vassallo to the stand, asking her to formally confirm the Maltese translations of testimonies delivered in English during the public inquiry into the murder of Daphne Caruana Galizia, including that of the late journalist’s son, Matthew Caruana Galizia.
Following Vassallo’s brief testimony, Sonia Consiglio takes the stand.
Consiglio testifies regarding her role as the legal representative for Identita during the ‘Daphne Leaks’ inquiry back in 2021.
12:24 Elaborating on data recovery possibilities, Cutajar explains that while a physical device theoretically retains all stored activity, recovering cloud-based messaging data involves complex layers.
He notes that WhatsApp typically backs up chat histories onto third-party services like Google Drive. In such cases, investigators require the specific email address and password to retrieve the backup files.
“If I do not find WhatsApp backups, it is obvious that it is not the correct [account],” he explains.
Juror: “So, the Gmail account you used had no link to WhatsApp? Therefore, to my knowledge, this was not the most updated Gmail address?”
Cutajar: You are correct.
Keith Cutajar’s testimony comes to an end.
12:18 Following a brief recess due to fireworks disrupting the sitting, digital forensics expert Keith Cutajar takes the stand to complete his response to the juror’s question, saying that the answer to their question is far from a simple “yes or no.”
Cutajar explains that digital evidence exists across multiple formats and levels of accessibility. While service providers can supply call and location logs for a specific mobile number, the physical content stored locally on a handset cannot be retrieved through a network provider.
“An SMS belongs to the service provider, but not every provider logs the actual message content,” Cutajar testifies.
He notes that under Maltese law, telecom operators are only obligated to retain data records of activity, not the content of the communications themselves.
Regarding engineering data, he adds that providers retain these files solely at their own discretion.
11:42 The juror states that a question that worries her and fellow jurors is whether a lost mobile phone can be cloned, specifically, whether Daphne Caruana Galizia’s burnt phone could be cloned.
The expert, however, could not give an answer due to extremely loud noises from fireworks seemingly going off right above the court.
The sitting will resume at noon.
11:36 A juror seated on the far right of the panel asks Cutajar for clarification regarding the digital devices seized from Keith Schembri’s residence, pressing on whether they belonged exclusively to family members.
Cutajar explains the technical challenge of attributing device ownership in a house, noting that it is difficult to confirm whether a specific phone or computer was used only by one individual.
“The same devices are often shared and used by multiple people in a household,” Cutajar testifies. “It is standard practice for investigators to seize all digital devices found on-site for the simple reason that a suspect could potentially use any device available to them.”
The same juror follows up with a second question regarding the keyword searches conducted across the extracted data, asking whether a query for “Daphne” would return results and raising eyebrows over the fact that the name “Degiorgio” never appeared in the findings.
The juror questions whether a search for a nickname, such as “Fredu,” would automatically pick up variations like “Fred.”
Cutajar explains that forensic searches rely on strict technical parameters. Investigators can opt for either an “exact match” or a broader, flexible search. In this instance, he was specifically instructed to execute an exact match protocol.
He clarifies the mechanics of how the system processes these commands: if a search is set strictly for the full string “Daphne Caruana Galizia,” the system will only flag that exact phrase-meaning instances where only “Daphne” appears on its own will be bypassed entirely.
11:12 Lawyer Giannella de Marco asks Cutajar about the content on Keith Schembri’s data extractions.
Cutajar confirms to the court that he was unable to extract any data from two key devices seized during the police search of Keith Schembri’s Mellieħa residence: an iPad and an Asus tablet.
Under cross-examination, the expert testifies that data recovered from the remaining devices seized at the property appeared to belong to members of Schembri’s family rather than Schembri himself.
Addressing the audio recordings related to Melvin Theuma, Cutajar clarifies that while he was unfamiliar with how the underlying calls were originally captured, his focus was strictly on analysing the audio files, transcripts, and so on.
He notes that during his review of files handled by Europol, he had identified documentation gaps that fell short of European standards.
Presiding Judge Edwina Grima intervenes to ask for clarification: “Was the extraction the same as the one done by Europol?”
“Yes, it was. To clarify, I did not challenge the extraction,” Cutajar replied.
“They passed on the data file and I only drafted the report. My role was to perform verification checks to ensure the process and data integrity remained untouched.”
11:01 Prosecutor Godwin Cini directs Cutajar to a report concerning the ‘Daphne Leaks’ inquiry.
Cutajar explains that in 2021, he was tasked alongside other court-appointed experts with unlocking an iPhone belonging to Johann Cremona, as well as two mobile devices belonging to Kenneth Camilleri.
He testifies that standard forensic software was incapable of bypassing the devices’ security, forcing experts to resort to a brute forcing mechanism, a specialised method that exploits system vulnerabilities to crack locked devices. Since the required technology was unavailable in Malta at the time, Cutajar had to transport the phones abroad to utilise specialised foreign forensic laboratories.
Cutajar personally flew to Germany, where international experts connected the devices to high-powered hardware to execute repeated cracking attempts.
He told the court that he was informed in September 2021 that both of Kenneth Camilleri’s devices had been successfully breached, followed by news on 4 March 2022, that Johann Cremona’s iPhone had also been unlocked.
10:46 Turning to a separate digital hard drive passed to him for analysis, Cutajar explains how he audited forensic work previously conducted by Europol and flagged several omissions in their documentation.
“The work done by an expert today needs to be documented so thoroughly that 10 years down the line, if someone were to replicate the process, they would arrive at the exact same conclusions,” he explains.
However, Cutajar testifies that the Europol report lacked administrative details, such as an official case number and the identity of the specific investigator who carried out the extraction.
“I had to clarify this in the inquiry. In fact, I challenged Europol and told them to amend the report,” Cutajar states, adding that while the technical data extraction itself was done well, he insisted the agency rectify the procedural gaps.
10:29 Cutajar went on to detail how investigators extracted footage from a dome camera positioned roughly 16 storeys high, offering a bird’s-eye view over Valletta Port to monitor movements of the Degiorgio brothers’ boat, ‘Maya’.
Prosecutor Godwin Cini directs the witness to a separate report drafted on 27 April 2020, relating to Melvin Theuma’s money laundering case.
Cutajar testifies that he was present inside the courtroom to oversee the formal presentation and inventory of massive amounts of seized cash.
“We spent an entire day overseeing all the cash bags,” he told the court, describing the meticulous process of documenting the various currencies, banknote denominations, and sealed evidence bags collected during the investigation.
Across the 11 seized bags, the total cash inventory amounted to €797,440, £5,000, roughly $2,000, 520 Swedish krona, and €2,750 in electricity credit tokens.
10:12 Continuing his testimony, Keith Cutajar details the process of analysing vast amounts of video footage in the days following the blast.
“I continued extractions on 17th October with footage that was extremely long. Geographically, you pinpoint the exact area of the explosion and start fanning out, opening up the search zone bit by bit,” he explains.
Cutajar was subsequently instructed to pull CCTV footage from primary road junctions across Malta, as well as specific locations, including the offices of the rental company from which Daphne Caruana Galizia leased her vehicle.
He testifies that on 4 November 2017, experts accessed the Pembroke compound where Caruana Galizia’s rental car was placed after the assassination. However, investigations made at the site revealed that several cameras were already out of order.
Cutajar further notes a security vulnerability, explaining that if someone were to deliberately cut the power supply to the compound, the cameras would immediately shut down and all potential video evidence would be lost.
09:59 Prosecutor Godwin Cini directs the court expert to his initial report on the homicide, the first he drafted following the fatal explosion in Bidnija.
Cutajar recalls receiving his original order from then-Magistrate Consuelo Scerri Herrera, who dispatched him to the scene of the explosion roughly two hours after the assassination. His objective was to secure and extract local CCTV footage.
“I immediately started two extractions, but I needed help. I had to retrace the entire surrounding area to secure CCTV footage,” Cutajar testifies.
He states that most systems only retain data for a maximum of seven to 10 days, and therefore had to act fast.
The IT expert tells the court that alongside securing the physical video footage on 16 October, he immediately issued a series of official requests to telecom service providers regarding several mobile lines active in the area.
09:50 Turning to digital audio evidence, Cutajar testifies that on 3 January 2024, he was tasked with making a copy of a DVD containing an audio recording belonging to Edgar Brincat and performing a forensic enhancement to improve its clarity.
The witness explains the technical process, highlighting how he applied background noise reduction, audio normalisation, and frequency wave adjustments to make the dialogue decipherable for the proceedings.
However, Cutajar cautions that forensic enhancement has its limits.
“We do not do miracles,” he noted, adding that acoustic conditions vary from one courtroom to another, making it inherently difficult for degraded audio recordings to be heard clearly in the courtroom.
09:42 Prosecutor Godwin Cini turns to a cloud extraction performed on Keith Schembri’s email account.
The witness explains the process, detailing how cloud extractions pull data directly from remote servers storing backups of chats, WhatsApp conversations, emails, and related digital files.
Cutajar describes the keyword search methodology he employed, presenting the court with a specified list of names and key search terms he was tasked with executing across the extracted data sets.
Although the report is displayed on the courtroom screens, it remains unclear for the press in the gallery.
9:36 Taking the stand, court-appointed forensic expert Keith Cutajar outlines his extensive background, explaining that he has been involved in numerous criminal investigations involving digital extractions, mobile phone unlocking, and cyber forensics.
Prosecuting lawyer Godwin Cini directs the expert to a report he drafted on 26 November 2019.
The report detailed the forensic analysis and data extraction performed on a batch of mobile phones and computers handed over to him by police officers following a raid on Keith Schembri’s residence in Mellieħa.
09:29 Lawyer Charles Mercieca pushes back against the prosecution’s accusations, reminding the court that cross-examination is designed by law to permit leading and suggestive questions.
Addressing the prosecution’s objections regarding Kenneth Camilleri’s testimony, the defence argues that it was the prosecution’s own witness who had demonstrated genuine fear of Keith Schembri.
The defence asserts that while testifying behind closed doors in the public inquiry, Camilleri was allegedly approached by an individual who warned him that he had exposed Schembri, explicitly telling him that Schembri was a man to be feared.
The court decides that both parties rest on the evidence and testimonies produced in the jury’s bills of indictment. The jurors have now entered.
09:24 Before the jurors pile in, the prosecution accuses the defence of repeatedly referencing testimony and documents that fall outside the official bill of indictment to unfairly influence the jury.
AG lawyer Anthony Vella formally objects to yesterday’s cross-examination of former OPM security detail Kenneth Camilleri, where the defence counsel confronted him with testimony behind closed doors during the public inquiry into the assassination.
The prosecution informs the court that these claimed statements do not exist within the official acts of the jury.
Labelling the defence’s strategy as “disloyal behaviour,” AG lawyer Anthony Vella argues that with the consequence that neither the prosecution nor the court could control the situation, this is tantamount to grave prejudice on the prosecution.
9:06 We’re back in Hall 22 as the trial of Yorgen Fenech enters its fourth consecutive week.
Today’s sitting, set to begin soon, will face another slate of new witnesses.
RSS Feed Source: Independent Malta Yorgen Fenech trial: Expert defends digital evidence as jury shown Schembri office search