Jessica Hyde

“One of the biggest complexities is the assumption that because data exists in the write-ahead log, a user took an action to delete it. When I teach at the university, when I peer-review my colleagues' reports, this is one of the most common mistakes I see.”

Frames the defense expert's deletion conclusion as a common professional error, not a reasonable interpretation.

“That artifact is not the time of search — it's the time of movement of the tab. As well as the statement that it was deleted, due to the demarcation of Cellebrite as 'recovered.'”

Hyde identifies two specific errors in defense expert Richard Green's affidavit — wrong timestamp interpretation and wrong deletion conclusion.

“My conclusion is that there was a search at 02:47 a.m. for Hockomock Sports — that that browser was in use and there were continual searches throughout the night.”

Establishes what the 2:27 a.m. timestamp actually corresponds to — sports browsing, not the incriminating search.

“I had no evidence of deletion.”

Hyde's bottom-line conclusion directly rebutting the defense claim that the search was deleted to conceal it.

“There is a very unlikely possibility, based on the fact that there is no evidence that the search occurred before that time. That's just like saying that the user searched for pandas at 2:27 a.m. — could you rule that out? I can't rule out something that doesn't exist.”

Hyde's most forceful defense of her conclusion, but the concession that she cannot rule it out is the defense's key takeaway.

“That scope was relayed to me by Detective Tully.”

Establishes that police controlled what the expert examined, supporting the defense narrative of a directed investigation.

“There is absolutely a danger in just relying on parsed results. When an algorithm is used to determine what data is stored as, it doesn't tell you what that data means. And that's where you need a forensics examiner.”

Frames the prosecution argument that prior defense expert analysis relied too heavily on tool output without deeper examination.

“In May of last year, Cellebrite made an update to their software, actually to remove this artifact because of its ambiguity and the risk that an examiner may overstate or misstate what it is.”

Bolsters Hyde's position by showing even Cellebrite recognized the BrowserState.db timestamp was misleading enough to warrant removal.

“What I can state to a scientific degree of certainty is that that search occurred at 6:24 a.m. and was the last search in the tab that had been opened at 2:27.”

Hyde's central opinion on the search timing — the 2:27 timestamp reflects tab activity, not the search itself.

“My opinion is there was no deletion that occurred by the user because it is not something a user can delete.”

Directly rebuts the defense theory that McCabe deleted the search — Hyde says tab history cannot be deleted through the user interface.

“The opinion is that I can see that it's done by the device itself utilizing unified logs — that the system is deleting the 201st call every time a new call is received or outgoing.”

Explains missing call logs as iOS system behavior (200-record limit), not user deletion.

“I concur.”

Hyde agrees that pressing the lock button is an interaction with the phone, undermining her report's claim that no interaction occurred after 12:20 a.m. on O'Keefe's device.

“While a definitive reason as to why the timestamp is listing the time of 2:27:40 is unknown.”

Hyde's own May 2023 report admitted the reason for the 2:27 timestamp was unknown — contrasting with her later, more definitive opinions offered on direct examination.

“Cellebrite did remove that timestamp from the tool. That is correct.”

Establishes that a major forensic tool vendor removed the very timestamp the prosecution relies upon from its automated parsing.

“Correct. It is not in accordance with best practices. I agree.”

Hyde concedes O'Keefe's phone was never properly secured — no airplane mode, no Faraday bag — undermining the integrity of phone evidence collection.

“No, I was asked to provide my report, not to reach a particular result.”

Directly rebuts any implication from cross that Hyde was directed to reach a prosecution-favorable conclusion.

“Yes, it was removed. That timestamp in the version starting in May of 2024 — Cellebrite actually removed that and they put a release note stating that it was due to the ambiguity and potential for misconstruing the meaning of that data.”

Cellebrite's own decision to remove the 2:27 timestamp supports Hyde's position that it was unreliable.

“AXIOM in their artifact reference guide for this artifact does speak to the possibility of misinterpretation and states that the timestamp can be earlier”

Even AXIOM — which still displays the timestamp — warns about misinterpretation, undermining the defense's reliance on it.

“Steps doesn't necessarily mean that you took a number of steps. It's based on the motion of the device. So it could be steps, it could be you're carrying it, it could be that you're in some other kind of motion.”

Contextualizes the health data raised on cross, preventing the jury from over-interpreting '80 steps' as literal walking.

“12:32:16.”

Establishes the last recorded movement of O'Keefe's phone before a nearly six-hour gap until 6:04 a.m.

“Yes.”

Concedes that data can be overwritten when a phone is not in a Faraday bag, meaning evidence could be lost

“They don't.”

Concedes Cellebrite's basis for removing the timestamp is unexplained

“Correct. That is the timestamp that they show for that artifact. Exactly.”

Confirms Magnet AXIOM still recovers and displays 2:27:40 a.m. as a timestamp