Commonwealth v. Read — Trial ArchiveNicholas Guarino
Testimony Impact
Trooper Nicholas Guarino is a Massachusetts State Police digital forensics examiner who testified in both trials about phone extractions, GPS data, call logs, text messages, and health data from devices belonging to John O'Keefe, Karen Read, Kerry Roberts, and Jennifer McCabe. His testimony covered the timeline of Read's movements on the night of January 28–29, 2022, and directly rebutted defense expert Richard Green's analysis of McCabe's phone data. In Trial 1 he also addressed the failed extraction of Read's Lexus infotainment system and presented velocity calculations arguing O'Keefe could not have entered 34 Fairview during a brief GPS anomaly window.
Trial 1 vs Trial 2
In Trial 2, Guarino's direct examination was spread across three days and structured more methodically — beginning with his forensic background and extraction methodology before moving to the phone data itself, suggesting the prosecution refined its presentation after Trial 1's cross revealed vulnerabilities in how his findings were introduced. Trial 2 placed greater emphasis on the chronological PowerPoint of Read's calls, texts, and voicemails through the early morning hours, while the extended rebuttal of Green's defense report that dominated Guarino's Trial 1 Day 26 testimony was not replicated in Trial 2 in the same form.
Notable Quotes From The Record
“As I was told by AGP, there was no data that was recovered off the infotainment system or the telematics module from the chip off.”
Establishes that no vehicle data was recoverable from Read's Lexus despite exhaustive efforts, leaving a gap in the evidence about the vehicle's movements.
“I didn't see that many — maybe a handful, showing different spots in Canton, but nothing that stood out to me... Normally if the GPS points aren't there, then location services are probably turned off.”
Notes the absence of GPS data on Read's phone while O'Keefe's phone had significant GPS data, suggesting location services were off on Read's device.
“So he states that there's a Google search that's done at 2:27 in the morning. That immediately stuck out to me because when I went back and looked, that file that was parsed was not from the database that should have showed searches — this came from the Session State tabs for Safari, which is a big red flag.”
Directly challenges defense expert Richard Green's claim about the timing and source of the McCabe Google search — a central defense theory.
“those calls — while they do show marked as deleted — again, they come from the WAL file, and they're also located in two other parts of the database. Again, as a user of an iPhone, you can't go in and just delete these files — they're handled by the operating system. It's impossible.”
Rebuts the defense claim that McCabe deliberately deleted 18 phone calls from the morning after O'Keefe's body was found.
“The contact for Brian Albert was still in her phone — not deleted. So I don't know — maybe she just deleted the screenshot.”
Contradicts Green's claim that McCabe deleted Brian Albert's contact information.
“There were over 50 — I think it was 53 or 55.”
Establishes the volume of unanswered calls Read made to O'Keefe in the early morning hours.
“So Miss Read's phone auto-connected to John O'Keefe's Wi-Fi at his house at 12:36 a.m. They know this because it's a password-protected access to the Wi-Fi network.”
Places Read's phone at O'Keefe's Mansfield residence at 12:36 a.m., corroborating her text that she went home.
“In a direct straight line to the front door, 72 feet, not accounting for the stairs.”
Establishes the distance from where O'Keefe's body was found to the front door of 34 Fairview — central to the question of whether he entered the house.
“He'd have to go about 48 feet per second when I did a velocity calculation, which is about 32 mph — a second to the house, a second back. There were no GPS points ever showing inside the home, the backyard of the home.”
Prosecution's key forensic argument that the GPS data makes it physically impossible O'Keefe entered 34 Fairview during the brief accuracy fluctuation window.
“On Saturday, January 29th, 2022, Trooper Michael Proctor and Sergeant Yuri Bukhenik of the Norfolk County District Attorney's Office responded to the unattended death of John O'Keefe at 34 Fairview Road in Canton. Through his investigation, it was found O'Keefe was a victim of a motor vehicle homicide. While on scene, Trooper Proctor secured his phone and brought it to the Norfolk DA's Office for forensic analysis.”
Guarino's own report states the phone was recovered 'while on scene' at 34 Fairview, establishing chain of custody issues
“monotonic date time, baseband date time, and then a display date time”
Witness acknowledges three different iPhone clocks that were not in sync, with a three-minute discrepancy on O'Keefe's phone
“They all just sort of dump them on my desk and say 'do this phone for me.'”
Establishes Guarino as the primary forensic examiner in his unit, countering defense attacks on his qualifications.
“It's literally showing that Waze has been opened and that it's pulling power from the phone. And that is it — that is nothing else.”
Dismisses the defense's three-clock exhibit as irrelevant to GPS location timestamps, confining it to power log data only.
“Well, it's physically impossible to search two things at once. Her phone — she's searching the daughter's basketball at 2:27, and then she's searching 'It's Raining Men' and a few other things on her phone, listening to music”
Core rebuttal to defense theory that McCabe's 'hos long to die in cold' search occurred at 2:27 a.m. — her phone was actively doing other things at that time.
“Again, the user has no input on how a WAL file is deleted. It's an automated thing that the database does to clean up.”
Directly counters defense suggestion that deleted WAL entries indicate user-initiated deletion of evidence.
“That was deleted — there were some search items that were not there in the phone but found cookies related to said searches and websites visited.”
Introduces evidence of deleted search history on Karen Read's phone from the afternoon of January 29, flipping the deletion narrative back toward the defendant.
“Even if it's just a period, yes, any alteration to that initial extraction, with that number it immediately would change.”
Explains hash value integrity verification — the core mechanism prosecutors use to prove phone data was not tampered with.
“These reports are finding the low-hanging fruit in the proverbial tree. So, that's showing you the stuff that the program has set that most people are looking for.”
Acknowledges that standard forensic tools surface obvious data first, with deeper analysis requiring additional software and corroboration.
“No, it wasn't supported by GrayKey, the phone model and number.”
Explains why Read's phone could not be immediately accessed, requiring a wait until July 2022 for software to advance enough to brute-force the passcode.
“I would wait for a request. Again, my knowledge of most of the cases is very limited.”
Establishes Guarino's role as a technician executing requests rather than directing the investigation — relevant to questions about what was and wasn't examined.
“If the call is not answered, that means the call rang out and goes to voicemail. If the call is rejected, that is someone actively hitting the send-to-voicemail button to disable the call — to stop it from ringing.”
Establishes technical distinction that O'Keefe was actively rejecting Read's calls, not simply missing them
“From John O'Keefe to the defendant. Sick of always arguing and fighting. It's been weekly for several months now. So, yeah, I'm not as quick to jump back into being lovey-dovey as you, apparently.”
O'Keefe's characterization of the relationship as one with chronic conflict
“From the defendant to John O'Keefe, I think the four of us together is toxic to this relationship. Would like to limit it.”
Read's stated view that the dynamic with O'Keefe's children was damaging their relationship
“At 12:36:09 a.m., the defendant's phone auto-connects to the Wi-Fi PatsFan123.”
Places Read's phone within range of O'Keefe's home Wi-Fi network at 12:36 a.m., establishing her proximity to the residence.
“Depending on which one it's connecting to, which band, it's either 150-foot indoor range or up to 300 feet outdoor. So, again, when you pull into your home, sometimes you can still be connected to your home Wi-Fi in the driveway.”
Establishes the proximity required for the Wi-Fi connection, suggesting Read was very close to O'Keefe's home.
“Defendant texts John O'Keefe: 'I'm back in Mansfield. The kids are home alone.' 1:04:14 a.m. on the 29th.”
Text message places Read claiming to be back in Mansfield at 1:04 a.m., part of the prosecution's timeline reconstruction.
Key Moments
- Guarino presented Apple Health data showing O'Keefe's phone recorded stair climbs between 12:22 and 12:24 a.m. at a location the prosecution placed near Maple Croft and Pine Cone — a half mile from 34 Fairview — which became a focal point for both sides in arguing where O'Keefe was in the minutes after leaving Read's car.
- Guarino testified that Read's phone auto-connected to O'Keefe's password-protected Wi-Fi at his Mansfield residence at 12:36 a.m., corroborating her account that she drove to his house after dropping him off.
- Guarino performed a velocity calculation showing that for O'Keefe to have entered 34 Fairview and returned during a brief GPS accuracy fluctuation, he would have needed to travel at approximately 32 miles per hour — which Guarino stated was not supported by any health or motion data.
- In Trial 1, Guarino systematically went through defense expert Richard Green's report point by point, testifying that it was 'mostly incorrect,' specifically rebutting Green's claims about the timing of McCabe's 'how long to die in cold' Google search and the significance of 18 call log entries Green characterized as deleted.
- Guarino confirmed that despite employing Berla vehicle infotainment extraction technology and a chip-off attempt, no data was recovered from Read's Lexus, leaving no electronic record of the vehicle's movements on the night in question.