← All EvidenceDirectIan Whiffin Direct Examination: Safari Search-Timestamp Analysis Ian Whiffin Adam Lally CrossIan Whiffin - Cross-Examination Ian Whiffin David Yannetti
Digital Evidence
McCabe Phone BrowserState.db and WAL File
McCabe's BrowserState database and WAL, including deleted record 4028 with the cold-search URL and a 2:27:40 a.m. timestamp, plus visualizations of live tabs and deleted-record gaps.
About
The WAL record's 2:27:40 a.m. timestamp was the crux of the timestamp dispute. The prosecution argued the timestamp reflected tab focus state carried across browser sessions rather than the actual search time, while the defense examined whether the deletion could have been performed by someone with data access rather than by an iOS mechanism.
The BrowserState.db database and its Write-Ahead Log (WAL) from McCabe's iPhone, including record 4028 — a deleted record containing the 'how long to die in cold' Google search URL with a 2:27:40 a.m. timestamp — along with visualizations of live tab records clustered around 2:27 a.m. and deleted record gaps.