Skip to content
Elizabeth Holmes- Case Archive
personpersonJustin OffenJustin OffenPwC forensic technology specialist who reconstructed electronic messages from Holmes's devices.← All People
WitnessPwC

Justin Offen

PwC forensic technology specialist who reconstructed electronic messages from Holmes's devices.

AppearedFederal Criminal Trial
277 lines·5 proceedings·1 mention

About

Justin Offen testified for the government about PwC's preservation and processing of electronic data from devices assigned to Elizabeth Holmes. He explained that PwC imaged six devices and used data from three of them to recreate a spreadsheet of subpoena-responsive messages believed to be between Holmes and Ramesh Balwani.

On direct examination, Offen described the extraction, filtering, matching, manual-review, and reconstruction process, including the treatment of unmatched Skype messages. He identified the resulting exhibits and considered the reconstruction sufficiently accurate for authentication, but he had not previously reviewed the individual messages and offered no personal knowledge about their substance or context.

Offen later identified additional reconstructed messages and completed the authentication foundation.

On cross-examination, Offen confirmed that the reconstruction did not reproduce the display ordinarily seen on a phone and that its sent-date metadata used UTC. He also acknowledged that messages sharing identical timestamps appeared in different orders across exhibits, leaving the materials unable to establish which message Holmes or Balwani viewed first.

Trial Record (5)

FederalFederal Criminal TrialAug 31, 2021 – Jan 3, 2022Called by prosecution

Justin Offen testified for the government about PwC's preservation and reconstruction of electronic messages from devices assigned to Elizabeth Holmes. His testimony established an authentication foundation while acknowledging limits concerning message context, display format, and the ordering of identically timed entries.

Day 9

ProceduralEvidentiary HearingMentioned

Summary

The court set an initial protocol for displaying selected Holmes-Balwani messages, confirmed limits on customer-impact testimony, and addressed corrected test reports without deciding all message-specific objections.

Mentioned in this proceeding.

Day 10

DirectJustin Offen — DirectJustin OffenRobert S. Leach7highlights183lines spoken

Summary

Justin Offen explained how PwC preserved Holmes's devices, reconstructed Holmes-Balwani messages, and validated the resulting spreadsheet. The court admitted selected message pages, sometimes only for Holmes's knowledge and notice, before scheduling caused the unfinished examination to be interrupted.

Highlights (7)

testimony highlightOffen testified that PwC made forensic copies of six devices assigned to Holmes—two desktops, three laptops, and one mobile phone—and explained how forensic and logical imaging preserved the underlying data and metadata.Open in transcript →
Quote“WE IMAGED, AGAIN, TOOK FORENSIC COPIES OF SIX OF HER ASSETS.”— Justin OffenOffen stated the scope of PwC's forensic preservation of devices assigned to Holmes.Open in transcript →
evidence eventUsing Exhibit 5386, Offen explained PwC's subpoena-response workflow: three devices yielded 80,948 extracted messages, which PwC filtered to 12,132 messages it believed were between Holmes and Balwani.Open in transcript →
testimony highlightOffen described the comparison between the recreated and original spreadsheets, including 12,081 programmatic matches, 21 manual matches, and 18 unmatched Skype messages; he said the recreation was sufficiently accurate despite using only three of the six imaged devices.Open in transcript →
Show all 7 highlights
Quote“BUT WHEN WE ONLY IDENTIFIED 18 THAT HAD NOT MATCHED, I WAS CONFIDENT THAT OUR RECREATION OF THE SPREADSHEET WAS SUFFICIENTLY ACCURATE AND DID NOT ASK MY TEAM TO DO ANY ADDITIONAL WORK.”— Justin OffenOffen explained both the remaining discrepancy and his judgment that the recreated message spreadsheet was sufficiently accurate.Open in transcript →
Quote“CORRECT. I NEVER REVIEWED THE INDIVIDUAL CONTENTS BEFORE.”— Justin OffenOffen expressly limited his testimony to collection and authentication rather than personal knowledge of the messages' substance.Open in transcript →
procedural actionThe court interrupted Offen's unfinished testimony, with counsel's consent, so the government could call James Mattis out of order because of scheduling conflicts.Open in transcript →
DirectJustin Offen — DirectJustin OffenRobert S. Leach2highlights54lines spoken

Summary

Justin Offen identified and presented Holmes-Balwani messages concerning laboratory operations, responsibility, and validation concerns. The court admitted redacted Exhibit 5387B and admitted Exhibit 5387A for authentication purposes while preserving message-specific objections.

Highlights (2)

evidence eventPages 20 and 21 of Exhibit 5387B were admitted and published. Offen identified July 15, 2015 messages from Ramesh Balwani to Elizabeth Holmes, including a message stating responsibility for everything at Theranos and that the decisions had also been his.Open in transcript →
Quote“ANY OTHER INDIVIDUAL OBJECTIONS CAN BE RAISED AT A LATER TIME. BUT THIS WITNESS WILL NOT BE NEEDED TO TESTIFY AS TO AUTHENTICITY.”— Edward J. DavilaThe court preserved later message-specific objections while resolving the need for further authentication testimony from Offen.Open in transcript →
CrossJustin Offen — CrossJustin OffenKatherine Trefz6highlights36lines spoken

Summary

Justin Offen explained the reconstructed spreadsheet's identifiers, UTC timestamps, and sorting conventions. He acknowledged that identical timestamps did not establish which message Holmes or Balwani viewed first.

Highlights (6)

testimony highlightOffen explained that the record identifiers were assigned during software ingestion and that parallel processing could cause records to be read into the database in different sequences.Open in transcript →
testimony highlightOffen testified that the spreadsheet consistently displayed sent-date metadata in UTC, requiring a seven- or eight-hour adjustment to determine Pacific time depending on the time of year.Open in transcript →
Quote“WE CHOSE, FOR CONSISTENCY PURPOSES, TO HAVE SENT DATE ON ALL OF THEM.”— Justin OffenOffen identified the convention used to present timestamps in the reconstructed spreadsheet.Open in transcript →
admissionOffen acknowledged that he did not know the spreadsheet's secondary sorting rule when two messages shared the same timestamp.Open in transcript →
Show all 6 highlights
Quote“I DO NOT KNOW WHAT THE SECONDARY SORT IS. SO IT'S THE QUESTION OF, WHAT IS THE SORT ORDER IF THERE'S A TIE? I DO NOT KNOW OFF THE TOP OF MY HEAD WHAT THE SECONDARY SORT IS.”— Justin OffenOffen acknowledged a limitation in determining how the spreadsheet ordered messages with identical timestamps.Open in transcript →
evidence eventThe defense compared Exhibits 5387B and 3481, showing the same two identically timed messages in different orders; Offen agreed that the materials did not establish which message Holmes or Balwani viewed first.Open in transcript →