Commonwealth v. Read — Trial Archive
Trial 1 Transcript Ian Whiffin
Trial 1 / Day 26 / June 17, 2024
6 pages · 3 witnesses · 3,030 lines
Trooper Paul completed crash-reconstruction testimony, followed by expert testimony on Jennifer McCabe's phone records and Guarino's digital-forensics work.
← Day 25
Day 27 →
CrossRedirectRecross

Ian Whiffin — Cross/Redirect/Recross

Adam Lally David Yannetti Ian Whiffin
103 lines
Cross Ian Whiffin David Yannetti
1

CROSS-EXAMINATION BY MR. YANETTI:

2 5:56:58

MR. YANNETTI: Good afternoon, Mr. Whiffin.

3 5:57:00

MR. WHIFFIN: Good afternoon.

4 5:57:01

MR. YANNETTI: Sir, you had spoken a little bit about what was your assignment here in terms of the data that was sent to you, and I believe that you testified regarding that 2:27 a.m. or 227 and 40 a.m. time stamp that it didn't make sense to the investigators, correct?

5 5:57:30

MR. WHIFFIN: Correct.

6 5:57:31

MR. YANNETTI: Were you told that one of the investigators was Trooper Michael Proctor?

7 5:57:36

MR. WHIFFIN: I don't recall any names being mentioned. The ticket came to me or the request came to me via another Cellebrite employee who had been asked about this case and asked whether we could offer any help.

8 5:57:49

MR. YANNETTI: Okay. Thank you. You would agree with me that when you're making or doing a simulation, you want it to be as close to an apples to apples comparison as you can get?

9 5:58:03

MR. WHIFFIN: As best possible, yes.

10 5:58:06

MR. YANNETTI: And to get truly accurate research results, you want to eliminate as many variables as you can, correct?

11 5:58:15

MR. WHIFFIN: Correct.

12 5:58:16

MR. YANNETTI: You wouldn't, for instance, want to use an android operating system to try to replicate the activity from Jennifer McCabe's Apple iPhone, correct?

13 5:58:27

MR. WHIFFIN: Correct.

14 5:58:28

MR. YANNETTI: What version of iOS did you use for your testing of Jennifer McCabe's data?

15 5:58:33

MR. WHIFFIN: So this test has been undertaken on various different versions of iOS from iOS 12, 13, 14, 15, 16, 17, and most recently, on the beta version of 18 last week. This particular demonstration was on 15.8.2.

16 5:58:55

MR. YANNETTI: Okay. And you're aware that -- you said 15.8.2, correct?

17 5:58:58

MR. WHIFFIN: Correct. I've also tested on 15.7.

18 5:59:03

MR. YANNETTI: Oh, fair enough. You're aware, however, that Ms. McCabe was using iOS version 15.2.1, correct?

19 5:59:10

MR. WHIFFIN: Correct.

20 5:59:11

MR. YANNETTI: And you would agree that the way that an artifact is stored would depend on the iOS version that you use, correct?

21 5:59:21

MR. WHIFFIN: Correct.

22 5:59:22

MR. YANNETTI: And your simulation did not use the iOS version that Ms. McCabe was running on her iPhone, correct?

23 5:59:27

MR. WHIFFIN: Correct. I used the closest version I could find.

24 5:59:32

MR. YANNETTI: So I'd like to ask you some questions about the characteristics of browser state.db dash WAL in record number 4028.

25 5:59:42

MR. WHIFFIN: Okay.

26 5:59:43

MR. YANNETTI: That record number I believe you testified was found to be deleted, correct?

27 5:59:49

MR. WHIFFIN: Correct.

28 5:59:49

MR. YANNETTI: But you were able to recover the date and time associated with it, correct?

29 5:59:56

MR. WHIFFIN: The date and time of the last viewed?

30 5:59:58

MR. YANNETTI: Of that?

31 5:59:59

MR. WHIFFIN: Yes.

32 6:00:00

MR. YANNETTI: And what was that date and time?

33 6:00:03

MR. WHIFFIN: 2:27 and 40 seconds a.m.

34 6:00:06

MR. YANNETTI: You were also able to recover the content of that particular Google search itself?

35 6:00:10

MR. WHIFFIN: I was able to recover the URL for it, yes.

36 6:00:13

MR. YANNETTI: Okay. And what was that Google search?

37 6:00:15

MR. WHIFFIN: "Hos long to die in the cold."

38 6:00:17

MR. YANNETTI: And it's true, however, that the session history could not be recovered, correct?

39 6:00:23

MR. WHIFFIN: That's correct.

40 6:00:24

MR. YANNETTI: Now, given those characteristics that you've just discussed, did your testing result in a WAL file record, W- A-L, file record that matched the characteristics of 4028? In other words, deleted with session history not recoverable.

41 6:00:45

MR. WHIFFIN: The issue with the session history, I was able to recover only the first page of session history. What happens is, when there's a large amount of data that's split over multiple pages, if it's a live record, all those pages point to each other so that you can chain it together and get one large amount of information. Once they've been deleted, some of those pages can be overwritten, and therefore the pointers don't make sense anymore. So the amount of information in this session was way larger than one page, and I wasn't able to recover anything further.

42 6:01:20

MR. YANNETTI: Okay. And you'd agree that the simulation was done using a different operating system, correct?

43 6:01:25

MR. WHIFFIN: Correct.

44 6:01:26

MR. YANNETTI: Were you able to recreate the other deletions that appeared before and after that record 4028?

45 6:01:35

MR. WHIFFIN: Which deletions, sorry.

46 6:01:35

MR. YANNETTI: Well, you had testified I believe there was an exhibit that was introduced that showed that there were multiple deletions both before and after, correct?

47 6:01:43

MR. WHIFFIN: Correct.

48 6:01:43

MR. YANNETTI: Were you able to recreate those deletions?

49 6:01:47

MR. WHIFFIN: When I manually deleted records from the history, then the records also were deleted from the browser state.

50 6:01:56

MR. YANNETTI: Now, I believe that you testified, and if you didn't, I believe it's in your report, that there are essentially five mechanisms for record deletions in the browser state database, correct?

51 6:02:10

MR. WHIFFIN: Correct.

52 6:02:11

MR. YANNETTI: You ruled out four of them pretty quickly, correct?

53 6:02:15

MR. WHIFFIN: Correct.

54 6:02:15

MR. YANNETTI: And I believe you've testified to that today, correct?

55 6:02:18

MR. WHIFFIN: Correct.

56 6:02:19

MR. YANNETTI: The only remaining option was selective deletion by the user, or there's some internal mechanism for record deletion that is not fully understood, correct? A Correct.

57 6:02:32

MR. YANNETTI: And you know of, as you've testified today, you know of no internal mechanism for record deletion that's not fully understood, correct?

58 6:02:40

MR. WHIFFIN: I've not been able to replicate that function, no.

59 6:02:43

MR. YANNETTI: All right. If there is no internal mechanism for record deletion that's not fully understood, that would leave selective deletion by the user, correct?

60 6:02:54

MR. WHIFFIN: Not in this case, no.

61 6:02:55

MR. YANNETTI: All right. Well, selective deletion, you would agree, means that a user selects what to delete, correct?

62 6:03:03

MR. WHIFFIN: Correct.

63 6:03:03

MR. YANNETTI: And regarding the user, the term user, what is this? Who is it?

64 6:03:13

MR. WHIFFIN: Whoever's using the phone at the time.

65 6:03:14

MR. YANNETTI: Okay. So it's actually somebody who is using the actual iPhone itself, correct?

66 6:03:20

MR. WHIFFIN: Correct.

67 6:03:20

MR. YANNETTI: Not necessarily a computer expert, correct?

68 6:03:23

MR. WHIFFIN: Correct.

69 6:03:24

MR. YANNETTI: Would you agree with me that somebody who had access to the data before it was extracted and sent to you could have made selective deletions of the data?

70 6:03:41

MR. LALLY: Objection.

71 6:03:41

JUDGE CANNONE: I'll allow that.

72 6:03:41

MR. YANNETTI: No, I don't.

73 6:03:45

MR. YANNETTI: Are you aware of an app called MySQL?

74 6:03:48

MR. WHIFFIN: Yes.

75 6:03:49

MR. YANNETTI: What is MySQL?

76 6:03:53

MR. WHIFFIN: MySQL is just a method for viewing SQLite databases.

77 6:03:56

MR. YANNETTI: All right. If someone had access to the raw data, again before it was sent to you, and used that app, it could make selective deletions of the data, couldn't they?

78 6:04:10

MR. WHIFFIN: I assume you're talking about opening the extraction, taking out the particular file and editing it?

79 6:04:16

MR. YANNETTI: Sorry. I interrupted you. You're right. Your Honor, I apologize. And I apologize to you. If you could restate your question -- or answer or give me your full answer.

80 6:04:24

MR. WHIFFIN: Okay. So it would be possible with the extraction to take out particular databases, alter them, and put them back into the extraction. But there's something called a hash mechanism that we have in place that would -- it essentially hashes the original data, and then it can be hashed again at a later date. It results in a long string of characters, and if there's any changes to the original data, then we'd see that it's been modified.

81 6:04:57

MR. YANNETTI: Would you agree with me that someone with access to that data and appropriate application or program could also delete and renumber history.db and knowledge.cso so that it would appear as though there was no break in the numbering, so that it would also appear that nothing was deleted?

82 6:05:22

MR. WHIFFIN: It's potentially possible, but would require a large amount of knowledge and skill to do in a way that can't be detected.

83 6:05:31

MR. YANNETTI: Thank you very much, sir.

84 6:05:35

JUDGE CANNONE: Mr. Lally.

Redirect Ian Whiffin Adam Lally
85

REDIRECT EXAMINATION BY MR. LALLY:

86 6:05:47

MR. LALLY: Any discrepancy between the iOS version in Ms. McCabe's phone and the iOS version in the demonstration that you did, what, if any, impact does that have on what you showed this jury?

87 6:05:59

MR. WHIFFIN: So in this particular case, every iOS version I tested, as I mentioned, from 12, 13, 14, 15, 16, 17, 18, the time stamp is always referring to the time that the tab took focus. So even though there are some differences with when the record's created, the meaning behind that time stamp has been consistent.

88 6:06:24

MR. LALLY: Now, what you were asking about selective -- what you were asked about in regard to selective deletion, you indicated that there's no evidence of that in this case; is that correct?

89 6:06:32

MR. WHIFFIN: Correct. Selective deletion would require that the record existed in the history database in order to be selected to be deleted. The fact that there's no missing records indicates it was never written into that database, and therefore, could not have been selectively deleted.

90 6:06:49

MR. LALLY: Now, the hash mechanism that you testified as far as detecting whether or not someone had surreptitiously gone in and deleted things, do you see any evidence of that in your view of the extraction of Ms. McCabe's phone?

91 6:07:01

MR. WHIFFIN: I didn't have access to the hash information to see whether any changes had been made. That's something that the original examiner would have had access to. From my point of view, there was nothing in there that would indicate that tampering had occurred. The time stamps all made sense for the files. The historical pages all made sense. It's probably possible, but it would take a large amount of skill to do.

92 6:07:30

MR. LALLY: Now, with regard to your analysis and your testing in this case, again, what is your opinion or conclusion as for when these two Google searches were conducted?

93 6:07:41

MR. WHIFFIN: I'm of no doubt that the only time those two searches were conducted was at 6:23 and 6:24 on the morning of the 29th.

94 6:07:50

MR. LALLY: Thank you, sir. Nothing further, Your Honor.

Recross Ian Whiffin David Yannetti
95

RECROSS-EXAMINATION BY MR. YANNETTI:

96 6:07:53

MR. YANNETTI: Prior to today, have you ever heard of spontaneous deletion?

97 6:08:00

MR. WHIFFIN: It's not a term I'm familiar with.

98 6:08:02

MR. YANNETTI: Thank you.

99 6:08:04

JUDGE CANNONE: All right, sir. You are all set. You may step down.

100 6:08:07

MR. WHIFFIN: Thank you.

101 6:08:08

JUDGE CANNONE: Do you need a couple of minutes to get yourself down?

102 6:08:11

MR. WHIFFIN: I'll be quite fast. Thank you. Fast. Thank you.

103

(End of requested testimony.)

Continue to next page Nicholas Guarino — Direct (Part 1)
← Day 25
Day 27 →
← Ian Whiffin — Direct 5 of 6 Nicholas Guarino — Direct (Part 1) →