Nicholas Guarino

“The trim level that the defendant had is not still supported. There is Toyota and Lexus support now, but it's not, unfortunately, for her model.”

Explains the stated limitation on obtaining readable data from the Lexus infotainment system.

“Yeah, so he stated that Ms. McCabe had deleted 18 phone calls from the morning after John O'Keefe's body was found. Looking at the data from her call log, those calls, while they do show marked as deleted, again, they come from the WAL file, and they're also located in two other parts of the database. Again, as a user of an iPhone, you can't go in and just delete these files. They're handled by the operating system. It's impossible.”

States Guarino's technical basis for disputing the claimed user deletion of the cited call records.

“So by looking at the timeline in the phone, we were able to see that Ms. Read's phone auto-connected to John O'Keefe's WiFi at his house at 12:36 a.m.”

Guarino identified a time-stamped phone connection to O'Keefe's home Wi-Fi.

Guarino described O'Keefe's phone location data, including a Waze search for 34 Fairview, the route to that area, and phone points that he said remained between 32 and 34 Fairview overnight.

“No. Again, like I said, the phone is a high tech pedometer. It doesn't mean that steps were taken. It means the phone was manipulated in a way that it believed it was moving and taking steps.”

Guarino explained his qualification on the meaning of Apple Health step data.

“I didn't look at any specific calls that morning. I created a Cellebrite report. That's about it.”

Guarino described the limited scope of his own review of the call records at issue.

“Well, it's physically impossible to search two things at once.”

Guarino stated the basis of his opinion that the disputed searches did not occur at 2:27 a.m.

“Again, the user has no input on how a WAL file is deleted. It's an automated thing that the database does to clean up.”

Guarino gave his explanation for why WAL-file entries could be marked deleted without user action.

“Even if it's just a period, yes, any alteration to that initial extraction, with that number it immediately would change.”

Explains hash value integrity verification — the core mechanism prosecutors use to prove phone data was not tampered with.

“These reports are finding the low-hanging fruit in the proverbial tree. So, that's showing you the stuff that the program has set that most people are looking for.”

Acknowledges that standard forensic tools surface obvious data first, with deeper analysis requiring additional software and corroboration.

“No, it wasn't supported by GrayKey, the phone model and number.”

Explains why Read's phone could not be immediately accessed, requiring a wait until July 2022 for software to advance enough to brute-force the passcode.

“I would wait for a request. Again, my knowledge of most of the cases is very limited.”

Establishes Guarino's role as a technician executing requests rather than directing the investigation — relevant to questions about what was and wasn't examined.

“If the call is not answered, that means the call rang out and goes to voicemail. If the call is rejected, that is someone actively hitting the send-to-voicemail button to disable the call — to stop it from ringing.”

Establishes technical distinction that O'Keefe was actively rejecting Read's calls, not simply missing them

“Sick of always arguing and fighting. It's been weekly for several months now. So, yeah, I'm not as quick to jump back into being lovey-dovey as you, apparently.”

O'Keefe's characterization of the relationship as one with chronic conflict

“From the defendant to John O'Keefe, I think the four of us together is toxic to this relationship. Would like to limit it.”

Read's stated view that the dynamic with O'Keefe's children was damaging their relationship

“At 12:36:09 a.m., the defendant's phone auto-connects to the Wi-Fi PatsFan123.”

Records the 12:36:09 a.m. auto-connection and the named PatsFan123 network; the connection does not by itself establish an exact phone-to-home distance.

“Depending on which one it's connecting to, which band, it's either 150-foot indoor range or up to 300 feet outdoor. So, again, when you pull into your home, sometimes you can still be connected to your home Wi-Fi in the driveway.”

Describes generic indoor and outdoor ranges that depend on the router band. Guarino had not inspected the router in person and did not identify its actual band.

“Defendant texts John O'Keefe: "I'm back in Mansfield. The kids are home alone." 1:04:14 a.m. on the 29th.”

Text message places Read claiming to be back in Mansfield at 1:04 a.m., part of the prosecution's timeline reconstruction.