The Yorgen Fenech trial on Saturday was dominated by digital evidence and the search of Keith Schembri's Castille office, with forensic expert Keith Cutajar explaining the complexities of recovering electronic evidence before jurors were shown police footage from the 2019 search that uncovered documents scrutinised by the defence.

Yorgen Fenech, a businessman, has pleaded not guilty to two principal charges: complicity in the wilful homicide of Daphne Caruana Galizia and criminal association to commit the murder. 

Caruana Galizia, a columnist with The Malta Independent, was killed in a car bomb on 16 October, 2017.

One of the most significant exchanges in the morning session came after a juror asked whether a lost or badly damaged mobile phone, such as Daphne Caruana Galizia's burnt handset, could be cloned.

Cutajar replied that the issue could not be answered with a simple yes or no, explaining that digital evidence exists in different forms and locations. While telecom operators can provide records such as call logs and location data linked to a mobile number, they cannot recover information physically stored on the handset itself.

He explained that under Maltese law service providers are obliged to retain records of communications but not their content, meaning text messages, photographs and other locally stored files cannot simply be obtained through a network provider. Engineering data, he added, is retained only at the provider's discretion.

The expert also elaborated on WhatsApp data recovery after another juror sought clarification about cloud backups.

He explained that WhatsApp conversations are generally backed up to third-party cloud services such as Google Drive. To access those backups, investigators require the correct email account together with its password.

"If I do not find WhatsApp backups, it is obvious that it is not the correct account," he testified.

A juror then asked whether the Gmail account examined by investigators therefore had no connection with the relevant WhatsApp account.

"You are correct," Cutajar replied.

Jurors also questioned the searches carried out on data extracted from electronic devices.

Asked why searches for certain names had not produced expected results, Cutajar explained that forensic software can perform either exact-match or broader searches, depending on the instructions given by investigators.

In this case, he had been instructed to carry out exact-match searches. Consequently, if investigators searched for the full phrase "Daphne Caruana Galizia", instances where only "Daphne" appeared would not be returned. Similarly, a search for a particular spelling or nickname would not automatically identify similar variations unless specifically programmed to do so.

Another juror asked about the digital devices seized from the Mellieħa residence of former OPM chief of staff Keith Schembri.

Cutajar explained that investigators routinely seize every digital device found during a search because it is often impossible to establish ownership immediately.

"The same devices are often shared and used by multiple people in a household," he testified, adding that any device in a residence could potentially have been used by a suspect.

Earlier, under cross-examination, Cutajar confirmed that investigators had been unable to extract data from two devices recovered from Schembri's home - an iPad and an Asus tablet.

The remaining extracted data largely appeared to belong to members of Schembri's family rather than Schembri himself.

Questioned about audio recordings involving state witness Melvin Theuma, Cutajar stressed that his role had been limited to analysing the recordings and verifying the integrity of the forensic process rather than examining how the original calls had been recorded.

He also revealed that while reviewing documentation prepared by Europol he had identified administrative shortcomings that fell short of European standards. However, he stressed that he had not challenged the actual extraction of the data, only requested that the agency amend its documentation to include missing procedural details.

Cutajar also described the extensive work carried out immediately after Caruana Galizia's assassination. Arriving at the Bidnija blast scene about two hours after the explosion, he immediately began securing CCTV footage from the surrounding area, explaining that many surveillance systems retain recordings for only seven to 10 days before overwriting them. Investigators subsequently widened their search to include footage from road junctions and other strategic locations across Malta.

Among the footage examined was video extracted from a dome camera positioned around 16 storeys above Valletta's Grand Harbour, giving investigators a bird's-eye view of the port. The camera enabled them to monitor the movements of the Degiorgio brothers' boat, the Maya, as part of the murder investigation. Cutajar also told the court that when investigators inspected the Pembroke compound where Caruana Galizia's rental car had been taken after the assassination, they discovered that several security cameras were already out of order. He added that the surveillance system could also have been disabled simply by cutting its power supply.

The witness also referred to work he carried out in connection with Melvin Theuma's money laundering case. Referring to a report dated April 27, 2020, Cutajar said he had overseen the formal presentation and inventory of cash seized during the investigation.

"We spent an entire day overseeing all the cash bags," he testified.

The exercise involved documenting the various currencies, banknote denominations and sealed evidence bags. In total, the 11 bags contained €797,440, £5,000, around $2,000, 520 Swedish krona and €2,750 in electricity credit tokens.

Cutajar also outlined other assignments carried out during the wider investigation, including the forensic enhancement of audio recordings and the unlocking of encrypted mobile phones in Germany using specialised technology that was unavailable in Malta at the time.

Following Cutajar's testimony, court translator Katya Vassallo briefly confirmed Maltese translations of English-language testimony presented during the public inquiry into Caruana Galizia's murder.

Lawyer Sonia Consiglio then testified about civil proceedings instituted by the Caruana Galizia family in 2020 seeking to freeze €2 million in assets belonging to state witness Melvin Theuma.

She also confirmed that searches had revealed Theuma drafted a will three days after the alleged hitmen were arraigned and that, despite his arrest in November 2019, he continued carrying out property transactions, including the sale of an apartment and a garage valued at €150,000.

The jury in the trial of Yorgen Fenech on Saturday afternoon was shown video footage of the police search conducted inside Keith Schembri's office at Castille, with the defence focusing its cross-examination on how key documents discovered during the operation were handled by investigators.

The afternoon sitting was dominated by the testimony of Inspector Charlot Casha, head of the Police Forensic Unit.

Prosecutor Godwin Cini led Casha through a report he had compiled as part of the 'Daphne Leaks' inquiry into Keith Schembri's office at Castille Palace.

Casha told the court that he had accompanied Inspectors Keith Vella and Kurt Zahra and Assistant Commissioner Keith Arnaud during the search on December 5, 2019, taking 16 photographs and recording 10 video clips to document the state of the premises.

The photographs and videos were subsequently played in court.

One of the key exhibits shown to jurors was a handwritten document discovered on Schembri's desk, containing references including "DCG" and "arrests", which prosecutors described as appearing to outline a plan. The footage also showed officers searching through files and cabinets inside the office while Schembri remained present throughout the operation.

Another document projected onto the courtroom screens referred to Tilgate Inc, Schembri's Panama-registered company revealed in the Panama Papers. According to the document read out in court, investigators had not identified any active assets, funds or bank accounts linked to the company at the time it was compiled.

The videos also captured Schembri watching investigators closely as they searched his desk and office.

At one stage, he was seen leaning over the desk to observe a document being examined by officers, while his body language appeared tense as he repeatedly shifted position, uncrossed his arms and glanced between the investigators and the camera. In another clip, he was seen holding a mobile phone while speaking to officers as they continued searching the office.

Under cross-examination by defence lawyer Gianella de Marco, Casha reiterated that he was the only officer from the Forensic Unit present during the search and that his sole responsibility was to document what investigators were doing.

The defence concentrated much of its questioning on the handling of the document referring to "DCG" and "PD", suggesting proper evidential procedures may not have been followed.

Casha explained that the document had been found among other papers on a table by Inspector Keith Xerri, after which Assistant Commissioner Arnaud immediately picked it up for examination.

He said he noticed Inspector Zahra photographing the document, realised it was significant and began filming the scene before later taking photographs of both sides of the paper himself.

De Marco suggested the document should have been immediately placed inside an evidence bag rather than being handled in the manner shown in the footage.

However, Casha confined his replies to describing what he had personally observed and recorded during the search.

The defence also questioned Casha about the wider investigation, referring to searches conducted in connection with the separate 'Daphne Leaks' inquiry rather than the homicide investigation.

Asked whether he knew what investigators were specifically searching for inside Schembri's office, Casha repeatedly replied that he did not.

He stressed that he had simply been filming the search and that any questions about the objectives of the investigation or items seized should be directed to the investigators conducting the operation.

When asked whether Schembri had been holding a mobile phone during the search, Casha replied: "It could be."

His cross-examination concluded shortly afterwards, with the court adjourning until Monday, when the jury is expected to hear evidence from a new slate of witnesses.