Ian Whiffin

“So these particular two searches were conducted at 6:23:51 and 6:24:18, respectively. They were searched using the search bar that's built into Safari. The fact that they didn't exist within history DB, and that there were no deleted records from history.DB leads me to believe that they never successfully loaded.”

Whiffin gave the technical basis for placing the searches later than the browser-state timestamp.

“So in conclusion, I determined that the tab that was used was focused at 22740. So the tab was opened at that time, at which point it was being used to show Ozone Basketball and Hockomock Sports websites.”

This was his central distinction between a tab-focus timestamp and the time of a search.

“We recognize that this time stamp could be misleading. Regardless of how we label that time stamp, the very fact that a time stamp is there, we feel would be, well, potentially misrepresented.”

Whiffin testified that Cellebrite removed the timestamp from this information because it could be inaccurate.

“Correct. I used the closest version I could find.”

Whiffin acknowledged that his demonstration did not use the iOS version installed on McCabe's phone.

“It's potentially possible, but would require a large amount of knowledge and skill to do in a way that can't be detected.”

Whiffin qualified his answer about whether extracted data could be altered and renumbered without detection.

“The fact that there's no missing records indicates it was never written into that database, and therefore, could not have been selectively deleted.”

Whiffin used the absence of missing records to explain his opinion on selective deletion.

“I'm of no doubt that the only time those two searches were conducted was at 6:23 and 6:24 on the morning of the 29th.”

Whiffin stated his conclusion about the timing of the two searches.

Whiffin testified that, across the iOS versions he tested, the timestamp consistently referred to when a browser tab took focus.

Whiffin said the absence of missing history-database records meant the records were never written there and could not have been selectively deleted.

“It's not a term I'm familiar with.”

Whiffin gave a limited answer when asked about spontaneous deletion.

“discovered that it was actually the timestamp that the tab within the browser was brought into focus and had no relevance to when the actual web query had been made.”

States Whiffin's explanation for the disputed 2:27:40 timestamp.

“Based on the totality of all of the information that we've described, my opinion is that the device never moved far away from the flag pole.”

States Whiffin's ultimate opinion about the phone's location overnight.

Whiffin described data he said placed the two searches, including "how long to die in cold," at 6:23:51 and 6:24:18 rather than 2:27 a.m.

Whiffin testified that the location and speed data showed John O'Keefe's phone still traveling near the driveway and stopping later near the flagpole area.

“Correct. The location latitude/longitude was moving westerly, but at the same time the accuracy was increasing, so it didn't intrinsically prove that the device was moving.”

Whiffin qualified the inference that location records established actual movement.

“No, I left it out of the timeline.”

Whiffin acknowledged that his timeline omitted the report's movement description.

“Based on the low accuracy information, yes, the answer is yes.”

Whiffin agreed that the low-accuracy data could place John O'Keefe's phone in the house.

“I can't take a temperature reading and make a determination about a GPS location based on the temperature reading.”

He limited what battery-temperature information alone could establish about location.

“The hash value matches. But because I didn't do the extraction, I'm unable to actually validate that that was an original hash and hadn't been modified.”

He described a limitation in validating the extraction from Jen McCabe's phone.

“I have an idea of how it occurred, but I've not been able to replicate it. So my idea is unsubstantiated.”

He acknowledged that his explanation for the deletion mechanism had not been replicated.

“No, it's difficult to give an answer to a high degree of scientific certainty based on the sporadic nature of the records that night.”

Qualifies the limits of his location-data opinion.

“The tools are very good at surfacing data, but I believe it's up to the examiner to understand what that data means and to provide context to the information which the tool itself can't give.”

Explains his approach to interpreting forensic software output.

“Aside from being unethical to change the data in that way, this is an artifact that is easily validated by any examiner and if I was to tamper with it for the purposes of changing the outcome of a case, it would be detected by all of our customers immediately and would destroy the reputation of Cellebrite, which I've got no intention of doing.”

Responds to questions about whether software data could be altered to favor law enforcement.

“So it demonstrates the fact that the phone is constantly refining the location data or the accuracy of the location data even though it's using the same central point — the latitude and longitude — as the reference point. It doesn't necessarily mean the device had to move.”

Explains the expert's interpretation of changing location-accuracy circles without inferred movement.

“And the time here still says 1410 because that's the time that I first loaded the tab. The fact that I navigated — the fact that I minimized and reopened Safari — bears no relevance to this timestamp. It is purely the timestamp that that tab was created or brought back into focus.”

States the conclusion illustrated by the live Safari demonstration.

“Purely because we determined it was unreliable to use as a time that the page was last viewed.”

Gives Whiffin's explanation for why Cellebrite removed that timestamp treatment.

Whiffin conducted a live Safari demonstration and testified that the displayed timestamp reflected when a tab was created or brought into focus, not when a later search occurred.

“Other than to use different search terms, it's the same demonstration.”

Whiffin characterized the live demonstration as unchanged except for search terms while defense counsel examined when it had been altered.