Nicholas Guarino - Cross

MR. YANNETTI: Trooper Guarino, you've testified that you disagree in many respects with the findings of the defense expert Rick Green, uh, which he outlined in his affidavit submitted in connection with this case. Correct?

MR. YANNETTI: I'd like to ask you some questions about your training and education and your qualifications in the area of computer forensics. Um, you graduated from Westfield State University in 2003, yes?

MR. YANNETTI: You majored in criminal justice and mass communications, correct?

MR. YANNETTI: Right. You chose not to major in computer science, correct?

MR. YANNETTI: Two years after graduating, you became a— —patrolman in Norwood, correct?

MR. YANNETTI: The town of Norwood is right next to Canton, is it not?

MR. YANNETTI: You stayed as a patrolman in Norwood for 10 years with the Norwood Police Department, correct?

MR. YANNETTI: You then became a Massachusetts State Trooper in 2015?

MR. YANNETTI: And you spent four years in the Patrol Division of the Massachusetts State Police, correct?

MR. YANNETTI: And that was until 2019, correct?

MR. YANNETTI: And 2019 was the first time that you took a forensic computer course — would you agree with that?

MR. YANNETTI: Would you agree with me that since then, your training has mainly consisted of online courses and webinars?

MR. YANNETTI: Okay. Well, you list, with regard to your training, some in-person trainings, sir, but you list — 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19 — actually over 20 online courses, do you not?

MR. YANNETTI: Well, 2019 was not during COVID, was it?

MR. YANNETTI: I got you, but you say 2019 to 2020 in terms of your online courses and webinars, correct?

MR. YANNETTI: All right. And with regard to some of the courses that you were taking during that time period, would you agree with me that one of them was "Introduction to Computer Networks"?

MR. YANNETTI: I asked you whether one of the courses that you took was called "Introduction to Computer Networks."

MR. YANNETTI: And another course that you took was "Introduction to Cell Phone Investigations," correct?

MR. YANNETTI: "Introduction to Previewing," correct?

MR. YANNETTI: You hold no degrees in the field of computer forensics, do you?

MR. YANNETTI: You hold no degrees in the field of computer forensics or computer science, correct? Like a college degree?

MR. YANNETTI: You have no publications in the field of computer forensics, do you?

MR. YANNETTI: And you've never taught a course in computer forensics, have you?

MR. YANNETTI: All right. Well, as a Norwood Police Officer for 10 years and a Massachusetts State Trooper for nine years, you would agree that you've written a lot of police reports over the years, have you not?

MR. YANNETTI: Prior to becoming a Norwood Police Officer back in 2005, you attended a police academy, right?

MR. YANNETTI: And at the academy, one area of focus was the proper way to write a police report, was it not?

MR. YANNETTI: You were taught that it's important to write police reports close in time to the events in question while they're still freshest in your memory, correct?

MR. YANNETTI: So is it your testimony before this jury that it's preferable to wait months before you submit a police report on something that happened months ago?

MR. YANNETTI: Okay. But once the information is received that you need to write a police report, would you agree with me that it's important to record it in a report as soon as you can?

MR. YANNETTI: So I think you just answered my question. You said— "—as soon as the data is available, and you've completed your investigation—"

MR. YANNETTI: Let's say you've completed your investigation. So you're going to argue with me that it's preferable not to wait to record that data in a report?

MR. YANNETTI: You were also taught that it's important to include all the important details in your police report, correct?

MR. YANNETTI: Okay, so in other words, there are times when you're writing a police report when you intentionally leave out important details, Trooper? Is that your testimony before this jury?

MR. YANNETTI: So you would agree with me, going back to my question, that it is important to include all the important details in your report, is it not?

MR. YANNETTI: One purpose of writing a police report is to share information with your fellow investigators, is it not?

MR. YANNETTI: Another purpose of writing a police report is to be fair to the people that you're investigating, by explaining as best you can what happened, correct?

MR. YANNETTI: The fact is, you did write some early police reports in this case, dated February 4th, 2022 — just six days after John O'Keefe was found mortally wounded on Brian Albert's front lawn — correct?

MR. YANNETTI: When you wrote those police reports, you knew this was a homicide investigation, correct?

MR. YANNETTI: So that underscored the importance of being accurate and truthful, correct? Especially in a homicide investigation?

MR. YANNETTI: And the purpose of one of your February 4th, 2022 reports was to explain how you came into possession of John O'Keefe's cell phone and to note the extraction that you did on the phone. Do you recall that report?

MR. YANNETTI: And before writing that particular report, you spoke with Trooper Michael Proctor, did you not?

MR. YANNETTI: And when you received the phone, the two of you did not remain mute, right? The two of you chatted?

MR. YANNETTI: Correct. I'm sure there was. And you recorded what Michael Proctor told you about that cell phone in your February 4th, 2022 report, did you not?

MR. YANNETTI: Michael Proctor told you that on Saturday, January 29th, 2022, he and Sergeant Bukhenik had responded to 34 Fairview Road in Canton, did he not?

MR. YANNETTI: Well, you wrote in your very first sentence in that report the following— —quote: "On Saturday, January 29th, 2022, Trooper Michael Proctor and Sergeant Yuri Bukhenik of the Norfolk County District Attorney's Office responded to the unattended death of John O'Keefe at 34 Fairview Road in Canton." Those were your words, were they not?

MR. YANNETTI: Did Michael Proctor tell you that he had received or retrieved John O'Keefe's cell phone from 34 Fairview Road in Canton?

MR. YANNETTI: You didn't know where it was retrieved from, correct? All right. But you did include in your report that while Proctor and Bukhenik were on— —scene, they retrieved the cell phone of John O'Keefe, correct?

MR. YANNETTI: I'm asking about your report, Trooper.

MR. YANNETTI: Go ahead. Can you read the first two lines to the jury, please?

MR. YANNETTI: Okay, so you'd agree with me that you included that clause — "while on scene, they secured his phone" — did you not?

MR. YANNETTI: Okay. And that was back on February 4th of 2022, correct?

MR. YANNETTI: Within six days of John O'Keefe being found mortally wounded on Albert's lawn, correct?

MR. YANNETTI: And at that time, you— —knew that the crime scene was 34 Fairview Road, correct?

MR. YANNETTI: Yet you put in your report "while on scene," did you not?

MR. YANNETTI: Well, you'd agree with me that the Canton Police Department wasn't the crime scene, correct?

MR. YANNETTI: Okay. Well, Canton Police Department was not the scene of any crime, was it?

MR. YANNETTI: You don't know if the Canton Police Department was the scene of a crime?

MR. YANNETTI: You don't think it was. Okay. Now, in that report you were trying to establish the chain of custody of that phone, right? Because you described where it was found, where it was taken, and who had possession of it, correct?

MR. YANNETTI: Well, hold on a second. Again, we're focusing on your report — as opposed to details you want to fill in now. You just testified that you never said where it was taken, yet previously you said it was taken to you. Was it not?

MR. YANNETTI: Did Trooper Proctor take the phone to you and hand it to you?

MR. YANNETTI: Okay, so it was taken to you. Correct?

MR. YANNETTI: All right, so you described in your report where it was found, because you said "while on scene." Correct?

MR. YANNETTI: And where it was taken — it was taken to you. Correct?

MR. YANNETTI: And who had possession of it, which was initially Trooper Proctor in terms of your observations, and then you. Correct?

MR. YANNETTI: And you would agree with me that chain of custody of a piece of evidence is an important detail in any criminal investigation, isn't it?

MR. YANNETTI: Would you agree with me that someone reading your report, or listening to it as the jury listened today, would understand you to be saying that Michael Proctor sees John O'Keefe's cell phone at 34 Fairview Road in Canton—

MR. YANNETTI: All right. I'd like to ask you some questions about the extraction that you discussed in that same February 4th 2022 report — the very same report. In that report, after you name the tools that you used to extract data from the phone, you indicated that a copy of that cell phone extraction was placed on a State Police server, or was it a DA's office server?

MR. YANNETTI: Okay, on a server so that it could be accessed there. Correct?

MR. YANNETTI: But that extraction you placed on the server did not include all the potential data on John O'Keefe's phone, did it?

MR. YANNETTI: Well, didn't you indicate in your report that the extraction was not inclusive of all potential data contained within the device?

MR. YANNETTI: Well, the extraction that you did — it contained communications: iOS messages, phone calls, social media communications between John O'Keefe and Karen Read. Correct?

MR. YANNETTI: And it contained communications between John O'Keefe and Jennifer McCabe?

MR. YANNETTI: All right. But it did not include any communications between John O'Keefe and Julie Albert, did it?

MR. YANNETTI: And again, I'm talking about that initial extraction. That initial one didn't include any communications between John O'Keefe and Chris Albert, did it?

MR. YANNETTI: That extraction report also did not include any location data, did it?

MR. YANNETTI: You didn't note any location data in that initial report, did you — in the February 4th report?

MR. YANNETTI: What was the first time that you reported on location data in this case?

MR. YANNETTI: Wasn't it until April of 2023?

MR. YANNETTI: Well, I didn't ask you if there was a reason for it, sir. You understood my question, didn't you?

MR. YANNETTI: You did not report on the location data on John O'Keefe's phone until April of 2023. Correct?

MR. YANNETTI: And you also did not report on any Apple Health data until the spring of 2023. Correct?

MR. YANNETTI: Okay, so Trooper Proctor had access to the phone first, and then you took care of it. Correct?

MR. YANNETTI: That is correct. Okay. And you would agree with me that you didn't address John O'Keefe's health or location data in any formal report until that April 2023 report. Correct?

MR. YANNETTI: Right. And you submitted your report in April of 2023 after you became aware of an affidavit filed by the defense expert Rick Green, in which Mr. Green extracted and analyzed John O'Keefe's location data and his movements according to Apple Health data. Isn't that correct?

MR. YANNETTI: Before Rick Green submitted that affidavit, no member of the State Police homicide investigation team — including you — had ever looked at, or at least reported on, the location data for anyone present at 34 Fairview. Correct?

MR. YANNETTI: All right. But you didn't—

MR. YANNETTI: Right. So you hadn't looked at John O'Keefe's location data in particular, prior to Richard Green pointing out the location data in his affidavit. Correct?

MR. YANNETTI: Yes. There's no report on it till then, right?

MR. YANNETTI: Same with Jennifer McCabe's location data — you didn't report on that either. Correct?

MR. YANNETTI: You didn't report on Brian Albert's or Colin Albert's or Brian Higgins's location data — would you agree with that?

MR. YANNETTI: But when you finally did check the location data, I want to ask you about your testimony on direct examination — that you believe that at a certain point with regard to John O'Keefe's phone, the accuracy of the GPS points was within three feet. Do you remember that testimony?

MR. YANNETTI: All right. Can you show me where in any of your reports you specify that the GPS points are accurate within three feet?

MR. YANNETTI: In my reports — or the report — yeah — any reports that you have in front of you, or any that you reviewed. Where is that? What do you — that you wrote. Is it in writing anywhere, sir?

MR. YANNETTI: All right. Now let me just have a moment.

MR. YANNETTI: It's — page — that would be page four or five. Should be in the top there. Paragraph nine. Can read it if you'd like.

MR. YANNETTI: Would you agree with me, in paragraph 9, there is nothing that mentions that the accuracy is within three feet?

MR. YANNETTI: I'm asking you about a report that you offered — that you just mentioned to this jury.

MR. YANNETTI: I'm not asking you to read it. You're mentioning paragraph 12, and you're talking about one particular spot in that. Correct?

MR. YANNETTI: Now, with regard to John O'Keefe's phone, would you agree with me that it's important to properly handle and secure a cell phone that is seized in connection with a homicide investigation?

MR. YANNETTI: Was it important in this investigation to properly handle and secure John O'Keefe's cell phone, since he was the homicide victim?

MR. YANNETTI: All right. Well, you testified that the first time you reported on — in your investigation or your evaluation of — the location data was in your April 24th 2023 report. Correct?

MR. YANNETTI: And in that report, you revealed that you looked at his location data using Magnet AXIOM software. Correct?

MR. YANNETTI: And AXIOM is a competitor of Cellebrite, you say that?

MR. YANNETTI: And AXIOM is relied on by law enforcement across the country?

MR. YANNETTI: And you relied on it here, in terms of this issue of the location data, did you not?

MR. YANNETTI: And regarding the location data that you examined with regard to John O'Keefe's phone, you noticed — or you noted, I should say — that after a period of no speed having been registered for a period of time, John O'Keefe's cell phone started registering movement at 6:04 or 6:15 a.m.?

MR. YANNETTI: 6:15 a.m. And that's actually 6:15 and 36 seconds. Correct?

MR. YANNETTI: Sound right?

MR. YANNETTI: And at that point his phone registered a speed of 0.484 meters per second. Just want to confirm.

MR. YANNETTI: I'm sorry. There it is. Yep. 0.484.

MR. YANNETTI: And that's at 6:15 and 36 seconds?

MR. YANNETTI: All right. So now, as you were examining that data, sir, you certainly knew from this investigation — by that point — that when the phone was moving according to that data at 6:15 and 36 seconds on January 29th of 2022, John O'Keefe had already been found mortally wounded and incapacitated. Correct?

MR. YANNETTI: I think we're talking over each other, because what I'm asking is: you knew that by 6:15 and 36 seconds in the morning on January 29th, John O'Keefe had already been incapacitated and mortally wounded — that was my question.

MR. YANNETTI: So you knew from your investigation that that meant it could not have been John O'Keefe moving with his phone at 6:15 and 36 seconds. Correct?

MR. YANNETTI: It had to be somebody else. Correct?

MR. YANNETTI: Would you agree with me that once investigators took possession of John O'Keefe's phone, any movement of his phone after that would not help in your homicide investigation, would it?

MR. YANNETTI: So— so in other words, uh, John O'Keefe's been incapacitated, yes, somebody from law enforcement seizes his phone, um, would it help your investigation or the investigation of the North Detectives Unit to track and record location data on that phone after 6:15 a.m.?

MR. YANNETTI: I— I didn't ask if it's there. I know it's there. I— I'm asking you, does that help you in your investigation of a potential— of a— of a homicide, um, to track the phone and have that location data recorded on the phone after John O'Keefe could not have been the one moving with it?

MR. YANNETTI: Um, in fact, if the phone is manipulated in some way after investigators take possession of it, that could potentially harm an investigation, couldn't it?

MR. YANNETTI: Well, to preserve the integrity of the data on the phone as it existed before the police took custody of the phone, there is a way to stop the phone from recording location data again after the police take custody of the phone, isn't there?

MR. YANNETTI: Yeah. You mentioned on direct examination that it could be accomplished by putting the phone into airplane mode, correct?

MR. YANNETTI: Um, but when that phone was seized, no investigator put the phone into airplane mode that early morning, because you know that location data was found on that phone, correct?

MR. YANNETTI: But you know it wasn't by 6:15 a.m., correct?

MR. YANNETTI: And there's also another way to prevent any signal from entering or exiting the phone, you'd agree with that?

MR. YANNETTI: During your direct examination you mentioned the concept of a faraday bag.

MR. YANNETTI: A faraday bag has special fabric that blocks electromagnetic signals entirely, does it not?

MR. YANNETTI: So putting the phone into a faraday bag would be another way to stop the phone from recording location data while the phone's in police custody, correct?

MR. YANNETTI: And you'd agree with me that during that early morning, as of 6:15 a.m. and thereafter, uh, no investigator in this case put that phone into a faraday bag on January 29th, correct?

MR. YANNETTI: Um, in fact, after John O'Keefe's cell phone started registering movement at 6:15 and 36 seconds in the morning on January 29th, it continued to record location data the rest of the morning until 11:56 and 1 second, uh, a.m. on January 29th, correct?

MR. YANNETTI: Um, so you would agree with me that for several hours after the police had the phone, it was not put in a faraday bag and it was not put into airplane mode, correct?

MR. YANNETTI: All right. Now, uh, with regard to the, uh, voicemails, uh, that you've previously testified to and that the jury has heard and they've been introduced into evidence, um, you had, uh, testified on direct examination that, uh, Karen Read's phone connected to the WiFi at 1 Meadows Ave at approximately 12:36 in the morning.

MR. YANNETTI: Um, so you can testify based on that that by 12:36 in the morning, uh, Karen Read was not at 34 Fairview, correct?

MR. YANNETTI: And, uh, that was, uh, the first of those voicemails that you testified to, correct?

MR. YANNETTI: Yes. That's 12:37, correct?

MR. YANNETTI: Uh, and that voicemail and every other voicemail that the jury heard was left after Karen had left 34 Fairview, correct?

MR. YANNETTI: Uh, and, uh, except for the one at, uh, you know, after 6:00 in the morning— the 4-minute one, when she went back— we heard that one, but all the other ones were, uh, apparently left when she was at 1 Meadows, correct?

MR. YANNETTI: Yes, that's correct. She was— not at 34, and you would agree with me, based on, uh, on those voicemails and what you know about them and what we've just discussed, that, uh, no one at 34 Fairview, including Jennifer McCabe, could have witnessed Karen Read outside that residence at 12:45 a.m., correct?

MR. YANNETTI: Um, so you agree with me no one could have— including Jennifer McCabe— could have seen her at 12:45 at 34 Fairview?

MR. YANNETTI: All right. Now, uh, we've talked about the, uh, findings of— or the fact that you reviewed the findings of Rick Green by reading the affidavit that he submitted, correct?

MR. YANNETTI: Um, and you learned in that affidavit that Rick Green was able to track not only when John O'Keefe arrived at 34 Fairview, but also the route that he and Ms. Read took to get there on January 29th, correct?

MR. YANNETTI: Um, you learned that he was able to accomplish that by examining the data from the app Waze that you spoke of, correct?

MR. YANNETTI: All right. And Waze is spelled W-A-Z-E, correct?

MR. YANNETTI: All right. Um, and you've previously testified it's a commonly used app for driving directions and navigation?

MR. YANNETTI: Um, and regarding your analysis of the phone, you learned that there was Apple Health data from John O'Keefe's phone on January 29th of 2022, correct?

MR. YANNETTI: And Apple Health data can reveal a number of steps that a person has taken during a given time period, as well as whether that person is going up or downstairs, correct?

MR. YANNETTI: And on John O'Keefe's phone, uh, you learned that there was Apple Health data that tracked his steps from the time he's seen on surveillance video leaving the Waterfall Bar & Grille and moving forward after that, correct?

MR. YANNETTI: Okay. At the Waterfall. And it actually was, uh, between 12:11 and 9 seconds, and then the, uh, ending period of that first time period was 12:21 and 5 seconds, uh, and— oh, yes, from the health— thank you, yes. Yeah. Okay. From the Apple Health, and the data showed that he took a total of 170 steps between that time period, correct?

MR. YANNETTI: All right. And, uh, regarding those 170 steps, um, isn't it true that, um, this data from Apple Health signifies that, uh, 170 steps took place at some point during that 10-minute approximate time period?

MR. YANNETTI: Um, so is it your understanding that those 170 steps all took place at 12:11?

MR. YANNETTI: Oh— I— I see your—

MR. YANNETTI: So— yeah. Let's— let's assume there were steps for the purpose of this discussion, okay? Because— and they could have been steps, correct?

MR. YANNETTI: All right. Um, assuming there were 170 steps taken, um, that could have meant that John O'Keefe took 170 steps beginning at 12:11, within that time period, correct?

MR. YANNETTI: Right. Yeah. So— so— he could have started walking at 12:11, correct?

MR. YANNETTI: All right. But he also could have taken those 170 steps closer in time to 12:21, correct?

MR. YANNETTI: I'm not asking, uh, about where he was. I'm just— I'm just asking about what the data shows. And I say— no, if it shows 170 steps between 12:11 and 12:21, then strictly based on the data, you don't know where those 170 steps took place within that 10 minutes, correct?

MR. YANNETTI: Okay. Um, and it's— it's possible it could have been toward the beginning, toward the end, or maybe fairly evenly spaced. You just know that there were 170 steps that were taken in that 10-minute time frame, correct?

MR. YANNETTI: Right. And again, I'm asking you from the data itself. Again, the phone says it stepped— doesn't mean they are. All right. Well, the Apple Health data also showed a total of 80 steps between 12:21 and 12:24, correct? Um, as part of your investigation of this case, were you aware that there was a 12:23 text message from Ryan Nagel to Julie Nagel in which Ryan texted his sister Julie he had arrived at 34 Fairview?

MR. YANNETTI: In any case, you would agree with me that 12:23 is between 12:21 and 12:24, correct?

MR. YANNETTI: And that is the 12:21 to 12:24 time frame where the Apple Health data showed that the user of John O'Keefe's phone took 80 steps, correct?

MR. YANNETTI: All right. Uh, now John O'Keefe's Apple Health data also showed that he climbed up or down three flights of stairs between 12:21 and 12:24, correct?

MR. YANNETTI: And that's the same period in which the data reflects 80 steps, correct?

MR. YANNETTI: Okay. But approximately?

MR. YANNETTI: All right. And, uh, regarding going up and down those three floors, Apple does not provide data precise enough to determine when within that range the three floors were traversed, correct?

MR. YANNETTI: Okay. Um, and you would agree with me that, uh— and again, assuming that there were stairs as Apple Health data reflects— they— those stairs could have been ascended or descended toward the beginning, toward the end, or throughout that 3-minute time period, correct?

MR. YANNETTI: All right. Finally, uh, his Apple Health data also showed a total of 36 steps between 12:31:56 and 12:32:06, correct?

MR. YANNETTI: So I would like to direct your attention to your May 9th, 2023 report, which was the second report that you wrote that O'Keefe's Health Data in Cellebrite shows him ascending/descending three flights of stairs at 12:22 and 14 seconds — did I read that accurately?

MR. YANNETTI: And the native locations in Cellebrite and the cache locations in Magnet AXIOM both show O'Keefe's phone location by the intersection of Oakdale Road and Pine Cone Road, which is in front of 36 Oakdale, and which is approximately a little over a half mile from 34 Fairview — did I read that essentially correct?

MR. YANNETTI: All right. Um, do you stand by the statement that he ascended and descended three flights of stairs precisely at 12:22 and 14 seconds?

MR. YANNETTI: Um, isn't it true that what the Apple Health Data actually states is that John O'Keefe's phone went up and down three flights of stairs sometime within the time period that began at 12:22:14 and ended at 12:24:37?

MR. YANNETTI: Right. I'm just asking about the data itself. It gives you that time period and tells you three flights of stairs, correct?

MR. YANNETTI: All right. Um, so, uh, assuming that those three flights of stairs were ascended or descended closer in time to 12:22:14, which was within that time period, um, that would still give him time to arrive at 34 Fairview within a couple minutes later, would it not?

MR. YANNETTI: Yeah, so we have a time period that you've agreed with, which is 12:22:14 ending at 12:24:37, right — a little over a couple of minutes, like 2 minutes and 23 seconds.

MR. YANNETTI: All right, so um, the three flights of stairs — again, just according to the data — could have been ascended or descended at the start of that time period, correct?

MR. YANNETTI: Sir, are you aware that apps on an iPhone may pull data from three different clocks when they're timestamping location data?

MR. YANNETTI: Asking about the house — I'm asking about the data.

MR. YANNETTI: No, what I'm — I'm strictly asking you just to look at the data.

MR. YANNETTI: And you agree with me — whenever there's a time period, Apple Health records either steps or stairs, you can't pinpoint just from the data when they occurred within that time, correct?

MR. YANNETTI: We're going to get to that, but I'm not asking you about that. I'm asking you about the fact that there's a time period, and you can't place where within that time period just based on that data itself.

MR. YANNETTI: Your conclusion was that John O'Keefe could not have been at 34 Fairview Road at 12:22 and 14 seconds because Waze put him on Oakdale Road about a half mile away, correct?

MR. YANNETTI: All right, and that caused you to disregard the Apple Health Data, or to attribute it not to steps — uh, or to stairs — uh, because he was a half mile away between that 12:22 and 12:24 time period, correct?

MR. YANNETTI: All right. So I want you to assume for a moment, Trooper, that John O'Keefe's phone location actually showed him on Oakdale Road 3 minutes earlier, at 12:19 a.m. Okay — if you have that in mind, you okay?

MR. YANNETTI: Um, with that assumption, would you agree with me that the Apple Health Data about him taking 80 steps and climbing up or down three floors at 34 Fairview Road would make more sense?

MR. YANNETTI: Sure.

MR. YANNETTI: That's not my question. My question was: are you aware that an app on an iPhone may pull data by choosing from three different clocks when it timestamps location data?

MR. YANNETTI: What are those three separate clocks?

MR. YANNETTI: With regard to John O'Keefe's actual iPhone, did you research what clocks were available for apps to pull data from?

MR. YANNETTI: Um, are you aware that those three clocks can vary in time?

MR. YANNETTI: Sometimes for a matter of seconds?

MR. YANNETTI: In other words, the three clocks could be seconds apart, correct?

MR. YANNETTI: And you would agree with me that sometimes the clocks could be off by three minutes, correct?

MR. YANNETTI: May I approach?

MR. YANNETTI: Okay. Um, I'm going to place this before you and ask you to review it, directing your attention specifically to what is marked Process 3434.

MR. YANNETTI: Um, do you see Process 3434 highlighted in blue on what I've placed before you?

MR. YANNETTI: And with regard to the right side of that exhibit, do you also see Process 3434 with more information on the right side?

MR. YANNETTI: And do you see the three different clocks that are listed on that printout?

MR. YANNETTI: What are those three different clocks?

MR. YANNETTI: Um, and looking at that, uh, you recognize that as being information that was available from John O'Keefe's phone from the extraction?

MR. YANNETTI: Um, I would offer that as an exhibit, Your Honor. Any objection, Mr. Lally?

MR. YANNETTI: Um, it could be called, uh, you know, a printout regarding 3434.

MR. YANNETTI: Thank you.

MR. YANNETTI: Um, now you have Exhibit 640 in front of you, sir. Um, looking at Exhibit 640, is it clear to you that those three clocks were not in sync regarding that one process number?

MR. YANNETTI: In fact, the monotonic clock regarding this particular Waze artifact from John O'Keefe's phone says 2:22 a.m., while the baseband and display clocks have timestamps 3 minutes earlier, correct?

MR. YANNETTI: So if there's a three-minute difference between the clocks — well, strike that. Do you know, with regard to that 2:22 a.m. location data on Waze, um, do you know which clock Waze was using for that, or the iPhone was using with Waze?

MR. YANNETTI: Okay. Um, but certainly that would have been available to you had you looked at it, correct?

MR. YANNETTI: You could have looked at that exhibit — right, the information in that exhibit — to see the three different clocks, sir?

MR. YANNETTI: All right, maybe Mr. Lally will ask you.

MR. YANNETTI: Um, but you would agree with me — if there's a three-minute difference between the clocks and you don't know which clock was used to put John O'Keefe's phone on Oakdale Road at 2:22 a.m., that could explain—

MR. JACKSON: Thank you — I'm sure everybody else did.

MR. YANNETTI: Um, with regard to the three-minute discrepancy between the clocks — and you said you don't know which clock Waze was using to put John O'Keefe's phone on Oakdale Road at 12:22 a.m. — that could explain the discrepancy between the Apple Health Data and the Waze data, could it not?

MR. YANNETTI: But, um, as you sit here today, you don't know whether Waze was running on the baseband, display, or monotonic clock, correct?

MR. YANNETTI: Now, you're aware that Jennifer McCabe signed a consent form on February 2nd of 2022 for her cell phone to be imaged?

MR. YANNETTI: And a full forensic extraction was performed on that phone sometime shortly after February 2nd of 2022?

MR. YANNETTI: Uh, but in any case, you generated a Cellebrite full file system extraction report on May 31st of 2022, correct?

MR. YANNETTI: And you were aware that that Cellebrite report was the one that was turned over to the defense in this case, correct?

MR. YANNETTI: Um, but you'd agree with me that that extraction report didn't contain anything close to the full file system, despite the name on it, correct?

MR. YANNETTI: Well, that report was filtered to return only Jennifer McCabe's communications with Karen Read, Kerry Roberts, John O'Keefe, and Kaylee Furbush, correct?

MR. YANNETTI: Did Michael Proctor instruct you to pull only those communications?

MR. YANNETTI: Um, you didn't seek to obtain any of Jennifer McCabe's communications with her sister Nicole Albert, did you?

MR. YANNETTI: And you didn't seek to obtain any of her communications with her daughter Allie McCabe, did you?

MR. JACKSON: May we approach?

MR. YANNETTI: Uh, you would agree with me that the full forensic image of Jennifer McCabe's phone was not shared with the defense until it was requested by us in October of 2022, sir?

MR. YANNETTI: Uh, when you wrote your report on April 24th of 2023, in response to an affidavit provided by uh Rick Green, the defense forensic computer expert, um, it was in that report that you finally disclosed for the first time the existence of three Google searches by Jennifer McCabe, correct?

MR. YANNETTI: Right. So let me ask that differently. Um, prior to April 24th of 2023, uh, you had not reported in any formal manner — uh, with anything that was shared with the defense — about the existence of uh, three Google searches by Jennifer McCabe, correct?

MR. YANNETTI: And so — was there anybody else from your unit, or anybody else that you worked with, that provided that material to us?

MR. YANNETTI: Page two — I — we don't have a print, I have — may I approach the witness with that?

MR. YANNETTI: Um, so I'm going to place this before you without destroying the — I got it — computer. Yep. Sorry, sir. You take a moment to familiarize yourself with that. Do you — can you tell the jury what that is?

MR. YANNETTI: But your name is on there, is it not?

MR. YANNETTI: What's the date?

MR. YANNETTI: Thank you. Yeah. Okay. Um, you'd agree with me with — — regard to that April 24th of 2023 report, um, on page two, you state — quote: "In my initial Cellebrite UFED Reader report" — and then you put version 7.3.0.2.9 — "that was created on May 4th of 2022, the search history for Jennifer McCabe's phone had two Google searches in Safari." Correct?

MR. YANNETTI: And you list out "how long to die in cold" at 6:23:51, and "hosong to die in cold" at 6:43:7. Correct?

MR. YANNETTI: Um, and by the way, with regard to the timing of those two particular searches, you are aware, are you not, that Jennifer McCabe placed a call to Brian Albert at 6:23 and 0 seconds?

MR. YANNETTI: Thanks. All right, sir. I'm placing before you a document. Could you uh, familiarize yourself with that, and then tell the jury if you recognize what it depicts?

MR. YANNETTI: Okay. Uh, but that record itself reflects a call uh, from Jennifer McCabe's phone at 6:23 and 0 seconds?

MR. YANNETTI: Okay. It also was incomplete because there should be two — — other records with this?

MR. YANNETTI: Does it give a duration?

MR. YANNETTI: Okay. And does it reflect that it was unanswered?

MR. YANNETTI: Okay. Can I have that marked for identification, please?

MR. YANNETTI: Um, did you investigate whether a call was placed from Jennifer McCabe to Brian Albert at 6:23 in the morning and 0 seconds?

MR. YANNETTI: Did you ask either Ian Whiffin or Jessica Hyde to look into that issue?

MR. YANNETTI: You would agree with me that that call, and the record of that deletion of that call, is nowhere in your April 24th report, correct?

MR. YANNETTI: All right. Did I ask you about your April 24th report, sir?

MR. YANNETTI: All right. Now going — — back to when you uh, began your examination around May 4th of 2022. Uh, you were looking for information on — did you look on Jennifer McCabe's phone back in May 4th of 2022?

MR. YANNETTI: Did you review the data at all? From — I'm confused — on the cell phone itself, or from the report?

MR. YANNETTI: Um, you never included the two searches that we discussed — the, you know, "how long to die in cold" and "hosong to die in cold" — um, in the full file system extraction that was turned over to the defense, did you?

MR. YANNETTI: Page six of your April 24th, 2023 report goes on to state that when you switched to a new version of Cellebrite — and dropped — yeah, it was the phone call — the Power log. Page six of your April 24th, 2023 report, um, says that when you switched to a new version of Cellebrite Physical Analyzer — which was version 7.61.0.12 — you found an artifact from the browser State DB WAL file for a Google search of "hosong dying cold" at 2:27 and 40 seconds. Correct?

MR. YANNETTI: May I approach?

MR. YANNETTI: I'm placing before you what has been marked as Exhibit 99. Do you recognize that?

MR. YANNETTI: Uh, and what is that?

MR. YANNETTI: Okay. And it's actually "hosong to ding," right? "Hos"?

MR. YANNETTI: That was marked by Cellebrite as deleted, was it not?

MR. YANNETTI: All right. And your April 24th, 2023 report goes on to mention two deleted calls to Jen McCabe's sister Nicole, who was saved as Coco in her phone, correct?

MR. YANNETTI: May I approach?

MR. YANNETTI: Thank you. Showing you what's been marked Y for identification. If you'd familiarize yourself with that and look up at me when you're done.

MR. YANNETTI: Um, does that show the two deleted calls to Jen McCabe's sister Nicole, who was saved as Coco in her phone?

MR. YANNETTI: All right. Uh, and what was the duration of those two calls according to that log?

MR. YANNETTI: All right. And those calls — both of them — which — — actually had durations — were marked answered by Cellebrite, correct?

MR. YANNETTI: May I offer that?

MR. YANNETTI: I understand. So what I'll do is I'll let you display it. And then — Mell? — at some point, you find where this is, and we will mark this, like, A to whatever the — whatever the number is. Thank you. Right. Um, Mr. B, if you could display what was — and uh, Trooper, with regard to what is displayed on the screen now, uh, is that consistent with what I had just handed to you?

MR. YANNETTI: All right. And with regard to the first entry there, uh, you stated — uh, you said it doesn't say who was making the call. Was that your testimony?

MR. YANNETTI: Okay. And you know that that "0204" — last four digits — that is to somebody who was um, listed as Coco in the phone, correct, right?

MR. YANNETTI: — testified these two calls were from somebody to somebody who was named Coco in the phone.

MR. YANNETTI: Uh, and the time of the first call was 6742, is that right?

MR. YANNETTI: And you testified that that's the one that had the duration of 9 seconds?

MR. YANNETTI: Listed as answered, correct?

MR. YANNETTI: And — correct? Yes. And no?

MR. YANNETTI: Listed as deleted, is it not?

MR. YANNETTI: Is it listed as deleted?

MR. YANNETTI: With regard to the second call — that appears to be to the same number, or at least the same last four digits?

MR. YANNETTI: And in the sheet in front of you, that's also to Coco, correct?

MR. YANNETTI: And that has a timestamp of 68 and 17 seconds, correct?

MR. YANNETTI: That also has a duration, and that's of 7 seconds?

MR. YANNETTI: Also listed as answered?

MR. YANNETTI: And also marked deleted, correct?

MR. YANNETTI: Um, are you aware that uh, Miss McCabe um, made other calls that morning which were in fact marked unanswered by Cellebrite?

MR. YANNETTI: Um, so as you testify here today, you have no memory as to whether or not she made a number of other calls that were marked deleted?

MR. YANNETTI: — approach to show something that's on a computer? — screen. Thank you. Got it. Okay. I've placed before you what appears to be a PDF document on a computer screen. If you familiarize yourself with it and look up at me when you're done.

MR. YANNETTI: What does that appear to be, sir?

MR. YANNETTI: Okay. And do you see in that PDF that there were a number of calls that were marked unanswered by Cellebrite?

MR. YANNETTI: Is your name on it at the very top?

MR. YANNETTI: So the answer to my question is: your name is on that document — correct?

MR. YANNETTI: Right. And with regard to the calls that were marked unanswered, would you agree with me that Cellebrite had them with durations of zero seconds?

MR. YANNETTI: Can you agree with that? Can you answer that question? Please answer it.

MR. YANNETTI: So are you testifying that nobody in law enforcement created that document? Or that no forensic expert for the defense created that document?

MR. YANNETTI: Was it Michael Proctor?

MR. YANNETTI: Well, I'd like to ask you some questions about my client's cell phone, sir. Okay. On Tuesday, when Mr. Lally was questioning you, he had you point out and read some text messages that were on her phone — between John O'Keefe and her — correct?

MR. YANNETTI: Okay. Would you agree with me that when he was pointing out those text messages to you, he skipped about 40 pages of messages at one point?

MR. YANNETTI: Michael Proctor seized my client's phone on January 29th of 2022, did he not?

MR. YANNETTI: And you would agree with me that, certainly as of six days later — your February 4th report — you had not yet been able to access the content of the phone, correct?

MR. YANNETTI: At some point you were able to access the content of the phone, correct?

MR. YANNETTI: All right. You later became aware that Michael Proctor was searching through my client's phone in August of 2022 — correct? The actual device itself or the extraction report?

MR. YANNETTI: I apologize. I'm not trying to confuse you. With regard to my client's phone — which is where we started — were you aware that Michael Proctor was searching through her phone in August of 2022, of the extraction report?

MR. YANNETTI: Were you made aware that on January 1st of 2023, the defense requested a full forensic image of Karen Read's phone, which was in your possession?

MR. YANNETTI: And have you seen a forensic image or Cellebrite report of the forensic image from Karen Read's phone?

MR. YANNETTI: Okay. And would you please tell the jurors how many phone calls were deleted from Karen Read's phone from January 29th of 2022?

MR. YANNETTI: And would you please tell the jurors, other than to John O'Keefe, to whom did Ms. Read place phone calls between 12:00 a.m. and 4:30 a.m. on January 29th?

MR. YANNETTI: And how many Google searches did she do from 12:00 a.m. until 5:00 a.m.?

MR. YANNETTI: And how many Google searches were deleted by Ms. Read at any point on January 29th of 2022?

MR. YANNETTI: Leaving that aside, sir — with regard to all of the data that was provided to you — how many Google searches did you see or find that Karen Read deleted from January 29th of 2022?

MR. YANNETTI: During what time period?

MR. YANNETTI: But you saw no deleted calls, correct?

MR. YANNETTI: All right. No further questions.