Jessica Hyde

“One of the biggest complexities is the assumption that because data exists in the write-ahead log, a user took an action to delete it. When I teach at the university, when I peer-review my colleagues' reports, this is one of the most common mistakes I see.”

Frames the defense expert's deletion conclusion as a common professional error, not a reasonable interpretation.

“That artifact is not the time of search — it's the time of movement of the tab. As well as the statement that it was deleted, due to the demarcation of Cellebrite as 'recovered.'”

Hyde identifies two specific errors in defense expert Richard Green's affidavit — wrong timestamp interpretation and wrong deletion conclusion.

“My conclusion is that there was a search at 02:47 a.m. for Hockomock Sports — that that browser was in use and there were continual searches throughout the night.”

Hyde's conclusion places the Hockomock Sports search at 02:47 a.m. while separately referring to phone use at 02:27 a.m.; the supplied transcript does not resolve the discrepancy.

“I had no evidence of deletion.”

Hyde's bottom-line conclusion directly rebutting the defense claim that the search was deleted to conceal it.

“There is a very unlikely possibility, based on the fact that there is no evidence that the search occurred before that time. That's just like saying that the user searched for pandas at 2:27 a.m. — could you rule that out? I can't rule out something that doesn't exist.”

Hyde's answer characterizes the earlier-search possibility as very unlikely and unsupported by evidence, while explaining that she cannot rule out an unrecorded event.

“That scope was relayed to me by Detective Tully.”

Establishes that Detective Tully relayed Hyde's assignment; Hyde also testified that she reviewed related phone-use artifacts within that scope.

“There is absolutely a danger in just relying on parsed results. When an algorithm is used to determine what data is stored as, it doesn't tell you what that data means. And that's where you need a forensics examiner.”

Hyde explained why she believed parsed results require deeper forensic examination and expert interpretation.

“In May of last year, Cellebrite made an update to their software, actually to remove this artifact because of its ambiguity and the risk that an examiner may overstate or misstate what it is.”

Bolsters Hyde's position by showing even Cellebrite recognized the BrowserState.db timestamp was misleading enough to warrant removal.

“What I can state to a scientific degree of certainty is that that search occurred at 6:24 a.m. and was the last search in the tab that had been opened at 2:27.”

Hyde's central opinion on the search timing — the 2:27 timestamp reflects tab activity, not the search itself.

“My opinion is there was no deletion that occurred by the user because it is not something a user can delete.”

Directly rebuts the defense theory that McCabe deleted the search — Hyde says tab history cannot be deleted through the user interface.

“The opinion is that I can see that it's done by the device itself utilizing unified logs — that the system is deleting the 201st call every time a new call is received or outgoing.”

Explains missing call logs as iOS system behavior (200-record limit), not user deletion.

“I concur.”

Hyde agreed that a lock-button press can be an interaction, while saying she had not reviewed or validated Whiffin's specific artifact and distinguishing direct user interaction from device motion.

“While a definitive reason as to why the timestamp is listing a time of 2:27:40 is unknown.”

Hyde's May 2023 report used this wording to describe the unknown reason the 2:27 BrowserState timestamp appeared; it does not by itself state that her broader search-time opinion was unknown.

“Cellebrite did remove that timestamp from the tool. That is correct.”

Establishes that Cellebrite removed automated parsing of the 2:27 timestamp; the removal does not itself establish when a search occurred or resolve Hyde's broader multi-artifact opinion.

“Correct. It is not in accordance with best practices. I agree.”

Hyde agreed that the phone was not preserved in accordance with best practices. She also testified that it was not wiped and that continued incoming data was observed, so the concession does not itself establish lost data or a global reliability failure.

“No, I was asked to provide my report, not to reach a particular result.”

Directly rebuts any implication from cross that Hyde was directed to reach a prosecution-favorable conclusion.

“Yes, it was removed. That timestamp in the version starting in May of 2024 — Cellebrite actually removed that and they put a release note stating that it was due to the ambiguity and potential for misconstruing the meaning of that data.”

Cellebrite's own decision to remove the 2:27 timestamp supports Hyde's position that it was unreliable.

“My understanding is that it is not a reliable timestamp and that is why Cellebrite removed it.”

Hyde stated her understanding that Cellebrite removed the value because it was not a reliable timestamp; this was her interpretation of the vendor change, not an independent determination of search time.

“Steps doesn't necessarily mean that you took a number of steps. It's based on the motion of the device. So it could be steps, it could be you're carrying it, it could be that you're in some other kind of motion.”

Contextualizes the health data raised on cross, preventing the jury from over-interpreting '80 steps' as literal walking.

“12:32:16.”

States a time from Hyde's phone-health testimony without establishing that O'Keefe personally moved.

“They don't.”

Hyde confirmed that the release notes did not describe the further research.

“Correct. That is the timestamp that they show for that artifact. Exactly.”

Confirms that AXIOM currently displays 2:27:40 a.m. for the artifact; the recross exchange established display state, not search time.

“Yes.”

Hyde agreed that data can be overwritten when a phone is not Faraday-isolated; she characterized loss as theoretical and maintained that non-isolation did not affect her conclusions, with no identified actual loss.