Jessica Hyde

“My conclusion is that there was a search at 0247 a.m. for Hockomock Sports, that that browser was in use, and there were continual searches due through the night.”

Hyde stated her timeline conclusion before distinguishing the later search entries.

“In regards to those artifacts pertaining to those search terms, I had no evidence of deletion.”

Hyde gave her direct conclusion on whether the search-term artifacts showed deletion.

Hyde explained that the browser-state timestamp reflects tab activity rather than necessarily the time a search was made, while describing the two searches she identified at 6:23 and 6:24 a.m.

Hyde testified that repeated entries in the write-ahead log had the same unique identifier and represented one search entry rather than multiple searches.

“That timestamp is not indicative of a time of search. So the question is difficult to answer, because I can't say that that timestamp tells me anything about the time of search.”

Hyde distinguished the tab timestamp from evidence of when a search occurred.

“Correct. I had a very limited scope in this analysis.”

Hyde acknowledged that her review was limited in scope.

Hyde maintained that the 2:27 a.m. timestamp was associated with a tab, not a Google-search time, and said the extraction gave no indication of a search at or before that time.

Hyde said Detective Tully relayed a limited scope focused on Safari search history for January 29, 2022; she had not been instructed to examine call logs.

“What I can state to a scientific degree of certainty is that that search occurred at 6:24 a.m., and was the last search in the tab that had been opened at 2:27.”

Hyde gave her central opinion on the disputed search timing.

“My opinion is there was no deletion that occurred by the user because it is not something a user can delete.”

Hyde stated her opinion that the Safari item was not user-deleted.

“The opinion is that I can see that it's done by the device itself utilizing the unified logs, that the system is deleting the 201st every time a new call is received or outgoing.”

Hyde attributed removal of older call-log entries to the device's system behavior rather than user action.

Hyde testified that the "hos long to die in cold" search occurred at 6:24 a.m. and was the last search in a tab opened at 2:27.

“I cannot contest it because I do not recall looking at that specific artifact.”

Ms. Hyde said she had not reviewed the artifact defense used to question the timing in her report.

“Cellebrite did remove that time stamp from the tool, that is correct.”

Ms. Hyde acknowledged a change in Cellebrite's automated reporting of the disputed timestamp.

“Correct. It is not in accordance with the best practices. I agree. I would have Faradayed it.”

Ms. Hyde agreed that the phone handling reflected in the data did not follow the preservation practice she described.

“No, I was asked to provide my report, not to reach a particular result.”

Hyde denied being asked to reach a predetermined result.

“Steps doesn't necessarily mean that you took a number of steps.”

Hyde qualified the meaning of the phone's health-step entries.

“They don't, but --”

Hyde said the Cellebrite release note did not state what its referenced further research was.

“I analyzed her phone to see if there had been deletions of call logs and what I found was that there were records that were removed by the system and not recoverable from that database but were recoverable from biomes.”

Hyde distinguished system-removed call-log records from recoverable data found in another source.

Hyde said Cellebrite's release note attributed its change to further research, but did not identify what that research was.

Hyde testified that the phone identified as Mr. O'Keefe's appeared to have received signal from 6:00 a.m. to noon and not to have been placed in a Faraday bag, subject to her stated qualification about a potentially failing bag.