Commonwealth v. Read — Trial ArchiveNicholas Guarino
Testimony Impact
Trooper Nicholas Guarino is a Massachusetts State Police digital forensics examiner who testified in both trials about phone extractions, GPS data, call logs, text messages, and health data from devices belonging to John O'Keefe, Karen Read, Kerry Roberts, and Jennifer McCabe. His testimony covered the timeline of Read's movements on the night of January 28–29, 2022, and directly rebutted defense expert Richard Green's analysis of McCabe's phone data. In Trial 1 he also addressed the failed extraction of Read's Lexus infotainment system and presented velocity calculations arguing O'Keefe could not have entered 34 Fairview during a brief GPS anomaly window.
Challenges & Responses
What attorneys challenged during examination and how the witness responded.
On cross-examination in Trial 1, defense attorney Yannetti challenged Guarino's qualifications — noting his training consisted primarily of introductory online courses and that he holds no computer science degree — and highlighted that Guarino did not examine O'Keefe's location and Apple Health data until April 2023, more than a year into the investigation and only after the defense retained its own expert. Yannetti also drew out a discrepancy between Guarino's written report, which stated O'Keefe's phone was recovered 'while on scene' at 34 Fairview, and his trial testimony, and challenged the precision of the stair data timestamp Guarino cited in his report.
Trial 1 vs Trial 2
In Trial 2, Guarino's direct examination was spread across three days and structured more methodically — beginning with his forensic background and extraction methodology before moving to the phone data itself, suggesting the prosecution refined its presentation after Trial 1's cross revealed vulnerabilities in how his findings were introduced. Trial 2 placed greater emphasis on the chronological PowerPoint of Read's calls, texts, and voicemails through the early morning hours, while the extended rebuttal of Green's defense report that dominated Guarino's Trial 1 Day 26 testimony was not replicated in Trial 2 in the same form.
Notable Quotes From The Record
“As I was told by AGP, there was no data that was recovered off the infotainment system or the telematics module from the chip off.”
Establishes that no vehicle data was recoverable from Read's Lexus despite exhaustive efforts, leaving a gap in the evidence about the vehicle's movements.
“I — I can't say. I didn't see anything, like I said, that stuck out to me. Normally if the GPS points aren't there, then location services are probably turned off.”
Guarino could not determine from his review whether the user's location settings were on or off; he said that missing GPS points normally probably indicate location services are off.
“So he states that there's a Google search that's done at 2:27 in the morning. That immediately stuck out to me because when I went back and looked, that file that was parsed was not from the database that should have showed searches — this came from the Session State tabs for Safari, which is a big red flag.”
Directly challenges defense expert Richard Green's claim about the timing and source of the McCabe Google search — a central defense theory.
“those calls — while they do show marked as deleted — again, they come from the WAL file, and they're also located in two other parts of the database. Again, as a user of an iPhone, you can't go in and just delete these files — they're handled by the operating system. It's impossible.”
Rebuts the defense claim that McCabe deliberately deleted 18 phone calls from the morning after O'Keefe's body was found.
“The contact for Brian Albert was still in her phone — not deleted. So I don't know — maybe she just deleted the screenshot.”
States that Green's report described a deleted screenshot of Brian Albert's contact, while Guarino found the underlying contact still present; Guarino did not rule out that the screenshot itself may have been deleted.
“There were over 50 — I think it was 53 or 55.”
Establishes the volume of unanswered calls Read made to O'Keefe in the early morning hours.
“So Miss Read's phone auto-connected to John O'Keefe's Wi-Fi at his house at 12:36 a.m. They know this because it's a password-protected access to the Wi-Fi network.”
Establishes that Read's phone auto-connected to O'Keefe's Wi-Fi at his 1 Meadows Avenue residence at 12:36 a.m.; separately, Guarino reported Read's text stating that she was back in Mansfield.
“In a direct straight line to the front door, 72 feet, not accounting for the stairs.”
Establishes the distance from where O'Keefe's body was found to the front door of 34 Fairview — central to the question of whether he entered the house.
“He'd have to go about 48 feet per second when I did a velocity calculation, which is about 32 mph — a second to the house, a second back. There were no GPS points ever showing inside the home, the backyard of the home.”
Prosecution's key forensic argument that the GPS data makes it physically impossible O'Keefe entered 34 Fairview during the brief accuracy fluctuation window.
“On Saturday, January 29th, 2022, Trooper Michael Proctor and Sergeant Yuri Bukhenik of the Norfolk County District Attorney's Office responded to the unattended death of John O'Keefe at 34 Fairview Road in Canton. Through his investigation, it was found O'Keefe was a victim of a motor vehicle homicide. While on scene, Trooper Proctor secured his phone and brought it to the Norfolk DA's Office for forensic analysis.”
The report said Proctor secured the phone 'while on scene'; Guarino testified that he did not know which scene or recovery location the wording referred to.
“monotonic date time, baseband date time, and then a display date time”
Witness acknowledges three different iPhone clocks that were not in sync, with a three-minute discrepancy on O'Keefe's phone
“They all just sort of dump them on my desk and say 'do this phone for me.'”
Establishes Guarino as the primary forensic examiner in his unit, countering defense attacks on his qualifications.
“It's literally showing that Waze has been opened and that it's pulling power from the phone. And that is it — that is nothing else.”
Dismisses the defense's three-clock exhibit as irrelevant to GPS location timestamps, confining it to power log data only.
“Well, it's physically impossible to search two things at once. Her phone — she's searching the daughter's basketball at 2:27, and then she's searching 'It's Raining Men' and a few other things on her phone, listening to music”
Core rebuttal to defense theory that McCabe's 'hos long to die in cold' search occurred at 2:27 a.m. — her phone was actively doing other things at that time.
“Again, the user has no input on how a WAL file is deleted. It's an automated thing that the database does to clean up.”
Directly counters defense suggestion that deleted WAL entries indicate user-initiated deletion of evidence.
“That was deleted — there were some search items that were not there in the phone but found cookies related to said searches and websites visited.”
Introduces evidence of deleted search history on Karen Read's phone from the afternoon of January 29, flipping the deletion narrative back toward the defendant.
“Even if it's just a period, yes, any alteration to that initial extraction, with that number it immediately would change.”
Explains hash value integrity verification — the core mechanism prosecutors use to prove phone data was not tampered with.
“These reports are finding the low-hanging fruit in the proverbial tree. So, that's showing you the stuff that the program has set that most people are looking for.”
Acknowledges that standard forensic tools surface obvious data first, with deeper analysis requiring additional software and corroboration.
“No, it wasn't supported by GrayKey, the phone model and number.”
Explains why Read's phone could not be immediately accessed, requiring a wait until July 2022 for software to advance enough to brute-force the passcode.
“I would wait for a request. Again, my knowledge of most of the cases is very limited.”
Establishes Guarino's role as a technician executing requests rather than directing the investigation — relevant to questions about what was and wasn't examined.
“If the call is not answered, that means the call rang out and goes to voicemail. If the call is rejected, that is someone actively hitting the send-to-voicemail button to disable the call — to stop it from ringing.”
Establishes technical distinction that O'Keefe was actively rejecting Read's calls, not simply missing them
“Sick of always arguing and fighting. It's been weekly for several months now. So, yeah, I'm not as quick to jump back into being lovey-dovey as you, apparently.”
O'Keefe's characterization of the relationship as one with chronic conflict
“From the defendant to John O'Keefe, I think the four of us together is toxic to this relationship. Would like to limit it.”
Read's stated view that the dynamic with O'Keefe's children was damaging their relationship
“At 12:36:09 a.m., the defendant's phone auto-connects to the Wi-Fi PatsFan123.”
Records the 12:36:09 a.m. auto-connection and the named PatsFan123 network; the connection does not by itself establish an exact phone-to-home distance.
“Depending on which one it's connecting to, which band, it's either 150-foot indoor range or up to 300 feet outdoor. So, again, when you pull into your home, sometimes you can still be connected to your home Wi-Fi in the driveway.”
Describes generic indoor and outdoor ranges that depend on the router band. Guarino had not inspected the router in person and did not identify its actual band.
“Defendant texts John O'Keefe: "I'm back in Mansfield. The kids are home alone." 1:04:14 a.m. on the 29th.”
Text message places Read claiming to be back in Mansfield at 1:04 a.m., part of the prosecution's timeline reconstruction.
Key Moments
- Guarino presented Apple Health data showing O'Keefe's phone recorded stair climbs between 12:22 and 12:24 a.m. at a location the prosecution placed near Maple Croft and Pine Cone — a half mile from 34 Fairview — which became a focal point for both sides in arguing where O'Keefe was in the minutes after leaving Read's car.
- Guarino testified that Read's phone auto-connected to O'Keefe's password-protected Wi-Fi at 1 Meadows Avenue at 12:36 a.m. Separately, he read messages in which Read said she was going home and then was back in Mansfield; the Wi-Fi location and the reported Mansfield location were distinct.
- Guarino performed a velocity calculation showing that for O'Keefe to have entered 34 Fairview and returned during a brief GPS accuracy fluctuation, he would have needed to travel at approximately 32 miles per hour — which Guarino stated was not supported by any health or motion data.
- In Trial 1, Guarino systematically went through defense expert Richard Green's report point by point, testifying that it was 'mostly incorrect,' specifically rebutting Green's claims about the timing of McCabe's 'how long to die in cold' Google search and the significance of 18 call log entries Green characterized as deleted.
- Guarino confirmed that despite employing Berla vehicle infotainment extraction technology and a chip-off attempt, no data was recovered from Read's Lexus, leaving no electronic record of the vehicle's movements on the night in question.