Trial 1 Transcript Nicholas Guarino
Trial 1 / Day 28 / June 20, 2024
6 pages · 3 witnesses · 2,246 lines
Rulings limited expert testimony and excluded proposed phone-search evidence from the Commonwealth's case-in-chief. The jury then heard phone-data testimony and medical-examiner evidence concerning John O'Keefe's injuries and death.
Defense Challenges Trooper Guarino's Phone-Data Analysis
1

CROSS-EXAMINATION BY MR. YANNETTI:

2 2:33:37

MR. YANNETTI: Trooper Guarino, you've testified that you disagree in many respects with the findings of the defense expert Rick Green, which he outlined in his affidavit submitted in connection with this case, correct?

3 2:33:51

MR. GUARINO: Yes, that's correct. I'd like to ask you some questions about your training and education and your qualifications in the area of computer forensics. You graduated from Westfield State University in 2003? A Yes, that's correct.

4 2:34:06

MR. YANNETTI: You majored in criminal justice and mass communications, correct?

5 2:34:11

MR. GUARINO: Yes, I double majored.

6 2:34:12

MR. YANNETTI: You chose not to major in computer science, correct?

7 2:34:16

MR. GUARINO: Yes, that's correct.

8 2:34:18

MR. YANNETTI: Two years after graduating, you became a patrolman in Norwood, correct?

9 2:34:23

MR. GUARINO: Yes, that's right.

10 2:34:24

MR. YANNETTI: The town of Norwood is right next to Canton; is it not?

11 2:34:27

MR. GUARINO: Yes, it is.

12 2:34:28

MR. YANNETTI: You stayed as a patrolman in Norwood for ten years with the Norwood Police Department, correct?

13 2:34:35

MR. GUARINO: Well, minus a stint in the National Guard, but, yes.

14 2:34:38

MR. YANNETTI: You then became a Massachusetts state trooper in 2015?

15 2:34:42

MR. GUARINO: Yes, I did.

16 2:34:43

MR. YANNETTI: And you spent four years in the patrol division of the Mass. State Police, correct?

17 2:34:50

MR. GUARINO: Yes, I did.

18 2:34:51

MR. YANNETTI: And that was until 2019?

19 2:34:53

MR. GUARINO: Correct.

20 2:34:54

MR. YANNETTI: And 2019 was the first time that you took a forensic computer course; would you agree with that?

21 2:35:00

MR. GUARINO: No, that's not true.

22 2:35:01

MR. YANNETTI: Would you agree with me that since then, your training has mainly consisted of online courses and webinars.

23 2:35:10

MR. GUARINO: That is also not true.

24 2:35:11

MR. YANNETTI: All right. Okay. Well, you list, with regard to your training, some in person trainings, sir, but you had list one, two, three, four, five, six, seven, eight, nine, ten, eleven, twelve, thirteen, fourteen, fifteen, sixteen, seventeen, eighteen, nineteen -- actually, over twenty online courses; do you not?

25 2:35:33

MR. GUARINO: Yes, that was during COVID.

26 2:35:37

MR. YANNETTI: Well, 2019 was not during COVID, was it?

27 2:35:39

MR. GUARINO: 2020 was.

28 2:35:40

MR. YANNETTI: All right.

29 2:35:40

MR. GUARINO: When I took most of them.

30 2:35:42

MR. YANNETTI: I got you. But you say 2019 to 2020, in terms of your online courses and webinars, correct?

31 2:35:49

MR. GUARINO: There's quite a few, yes.

32 2:35:51

MR. YANNETTI: All right. And with regard to some of the courses that you were taking during that time period, would you agree with me that one of them was "Introduction to Computer Networks."

33 2:36:01

MR. GUARINO: So this -- that course was through the NW3C. They just had a --

34 2:36:06

MR. YANNETTI: I didn't ask you where it was from. I asked you whether one of the courses that you took was called "Introduction to Computer Networks"?

35 2:36:14

MR. GUARINO: That's correct.

36 2:36:15

MR. YANNETTI: And another course that you took was introduction to cell phone investigations, correct?

37 2:36:20
38 2:36:22

MR. YANNETTI: "Introduction to Previewing," correct?

39 2:36:24
40 2:36:25

MR. YANNETTI: You hold no degrees in the field of computer forensics, do you?

41 2:36:29

MR. GUARINO: I hold certifications.

42 2:36:31

MR. YANNETTI: You hold no degrees in the field of computer forensics or computer science, correct?

43 2:36:37

MR. GUARINO: Like college degree?

44 2:36:38

MR. YANNETTI: Correct.

45 2:36:39

MR. GUARINO: Yeah, correct.

46 2:36:40

MR. YANNETTI: You have no publications in the field of computer forensics, do you?

47 2:36:44

MR. GUARINO: No, not yet.

48 2:36:47

MR. YANNETTI: And you've never taught a course in computer forensics, have you?

49 2:36:50
50 2:36:51

MR. YANNETTI: All right. Well, as a Norwood police officer for ten years and a Massachusetts State Trooper for nine years, you would agree that you've written a lot of police reports over the years; have you not?

51 2:37:05

MR. GUARINO: Yeah, you can say that.

52 2:37:06

MR. YANNETTI: Prior to becoming a Norwood police officer back in 2005, you attended a police academy, right?

53 2:37:12

MR. GUARINO: Yes, I did.

54 2:37:13

MR. YANNETTI: And at the academy, one area of focus was the proper way to write a police report, was it not?

55 2:37:20

MR. GUARINO: Amongst others.

56 2:37:22

MR. YANNETTI: You were taught that it's important to write police reports close in time to the events in question while they're still freshest in your memory, correct?

57 2:37:30

MR. GUARINO: It's not necessarily the case.

58 2:37:31

MR. YANNETTI: Okay. So is it your testimony before this jury that it's preferable to wait months before you submit a police report on something that happened months ago, sir?

59 2:37:40

MR. GUARINO: Well, it depends on the data that I'm using. If I can't get into a phone then, yeah, I have to wait months.

60 2:37:47

MR. YANNETTI: Okay. But once the information is received that you need to write a police report, would you agree with me that it's important to record it in a report as soon as you can?

61 2:37:57

MR. GUARINO: No, I stand by my previous statement that as soon as the data is available that I can do it, I will, and if, you know, things come up, then, you know, I do it when it's able.

62 2:38:06

MR. YANNETTI: So I think you just answered my question. You said as soon as the data is available and you've completed your investigation --

63 2:38:11

MR. GUARINO: I never said I completed. I said, if the data is available then --

64 2:38:14

MR. YANNETTI: Well let's say you've completed your investigation, sir. You're going to argue with me that it's preferable not to wait to record that data in a report?

65 2:38:22

MR. LALLY: Objection.

66 2:38:22

JUDGE CANNONE: Ask it -- ask it differently, Mr. Yannetti.

67 2:38:26

MR. YANNETTI: You were also taught that it's important to include all the important details in your police report, correct?

68 2:38:32

MR. GUARINO: Again, it depends on the report I'm writing.

69 2:38:34

MR. YANNETTI: Okay. So in other words, there are times when you're writing a police report when you intentionally leave out important details, Trooper, is that your testimony before this jury?

70 2:38:43

MR. LALLY: Objection.

71 2:38:43

JUDGE CANNONE: I'll allow that question. Is that what you do, Trooper?

72 2:38:45

MR. GUARINO: No, ma'am.

73 2:38:46
74 2:38:46

MR. GUARINO: Your Honor.

75 2:38:47

MR. YANNETTI: So you would agree with me, going back to my question, that it is important to include all the important details in your report; is it not?

76 2:38:55

MR. GUARINO: Again, it depends on the report that I'm writing. There's some data that goes in, there's some that doesn't. I can't have everything in again for a phone -- I'm speaking to technically phone reports or cell phones -- excuse me -- computers. I can't include everything. That's why we have the program that if I need to add something via Cellebrite or Axiom, I can create a report through that. If I did a handwritten report for everything, maybe thousands of pages for the amount of data in these devices.

77 2:39:22

MR. YANNETTI: One purpose of writing a police report is to share information with your fellow investigators; is it not?

78 2:39:31

MR. GUARINO: I suppose so.

79 2:39:33

MR. YANNETTI: Another purpose of writing a police report is to be fair to the people that you're investigating by explaining as best you can what happened, correct?

80 2:39:43

MR. GUARINO: I don't understand that question that I'm ...

81 2:39:47

MR. YANNETTI: Okay. The fact is you did write some early police reports in this case dated February 4, 2022, just six days after John O'Keefe was found mortally wounded on Brian Albert's front lawn, correct?

82 2:40:00

MR. GUARINO: That is correct.

83 2:40:01

MR. YANNETTI: When you wrote those police reports, you knew this was a homicide investigation, correct?

84 2:40:06

MR. GUARINO: I was told that it was believed to be, yes.

85 2:40:08

MR. YANNETTI: So that underscored the importance of being accurate and truthful, correct, especially in a homicide investigation?

86 2:40:16

MR. GUARINO: I write my reports no matter what the investigation is the same exact way.

87 2:40:19

MR. YANNETTI: And the purpose of one of your February 4, 2022, reports was to explain how you came into possession of John O'Keefe's cell phone, and to note the extraction that you did on the phone. Do you recall that report?

88 2:40:32

MR. GUARINO: Yes, I do.

89 2:40:33

MR. YANNETTI: And before writing that particular report, you spoke with Trooper Michael Proctor, did you not?

90 2:40:40

MR. GUARINO: I received the phone from him, but I --

91 2:40:42

MR. YANNETTI: I'm sorry?

92 2:40:43

MR. GUARINO: I received the phone from him, originally, yes.

93 2:40:45

MR. YANNETTI: Okay. And when you received the phone, the two of you did not remain mute, right? The two of you chatted?

94 2:40:51

MR. GUARINO: I don't remember the exact conversation.

95 2:40:53

MR. YANNETTI: But there was a conversation, correct?

96 2:40:56

MR. GUARINO: I'm sure there was.

97 2:40:57

MR. YANNETTI: And you recorded what Michael Proctor told you about that cell phone in your February 4, 2022, report, did you not?

98 2:41:06

MR. GUARINO: No, I didn't.

99 2:41:07

MR. YANNETTI: Michael Proctor told you that on Saturday, January 29th of 2022, he and Sergeant Bukhenik had responded to 34 Fairview Road in Canton; did he not?

100 2:41:17

MR. LALLY: Objection.

101 2:41:18

JUDGE CANNONE: I'll allow that.

102 2:41:19

MR. GUARINO: No, he didn't.

103 2:41:21

MR. YANNETTI: Well, you wrote in your very first sentence in that report the following, quote, on Saturday, January 29 --

104 2:41:31

MR. LALLY: Objection.

105 2:41:33

MR. YANNETTI: -- 2022, Trooper Michael Proctor and Sergeant Yuri Bukhenik of the Norfolk County District Attorney's Office responded to the unattended death of John O'Keefe at 34 Fairview Road in Canton. Those were your words, were they not?

106 2:41:46

JUDGE CANNONE: All right. So the objection is sustained. You can ask it differently.

107 2:41:49

MR. YANNETTI: Did Michael Proctor tell you that he had received or retrieved John O'Keefe's cell phone from 34 Fairview Road in Canton?

108 2:41:57

MR. LALLY: Objection.

109 2:41:58

JUDGE CANNONE: I'm going to allow that.

110 2:42:00

MR. GUARINO: No, I didn't know where it was retrieved from.

111 2:42:03

MR. YANNETTI: You didn't know where it was retrieved from?

112 2:42:05

MR. GUARINO: Correct.

113 2:42:11

MR. YANNETTI: All right. But you did include in your report that while Proctor and Bukhenik were on scene, they retrieved the cell phone of John O'Keefe, correct?

114 2:42:27

MR. GUARINO: At some point during the day, they did. I don't know where from, so there's multiple --

115 2:42:31

MR. YANNETTI: I'm asking about your report. You know, I'm questioning you about your report.

116 2:42:35

MR. GUARINO: No, I understand, and I'm explaining. I don't know what seems --

117 2:42:37

MR. YANNETTI: You don't get to explain, sir, most respectfully, until Mr. Lally questions you.

118 2:42:40

MR. LALLY: Objection, Your Honor.

119 2:42:41

JUDGE CANNONE: Okay. So no comments. I think to speed things along, do you have that -- your report with you?

120 2:42:48

MR. GUARINO: I do, Your Honor.

121 2:42:48

JUDGE CANNONE: I think it'll make it easier, Mr. Yannetti.

122 2:42:49

MR. YANNETTI: Of course.

123 2:42:50

MR. YANNETTI: Can you read the first two lines --

124 2:42:51

JUDGE CANNONE: Let him grab it.

125 2:43:01
126 2:43:01

MR. YANNETTI: Can you read the first two lines to the jury, please.

127 2:43:04

MR. GUARINO: Yep. "On Saturday, January 29, 2022, Trooper Michael Proctor and Sergeant Yuri Bukhenik of the Norfolk District Attorney's Office responded to the unattended death of John O'Keefe at 34 Fairview Road in Canton. Through his investigation, it was found O'Keefe was the victim of a motor vehicle homicide. While on scene, Trooper Proctor secured O'Keefe's phone and brought it to the Norfolk DA's office for forensic analysis.

128 2:43:24

MR. YANNETTI: Okay. So you'd agree with me that you included that clause, "While on scene, they secured his phone," did you not?

129 2:43:32

MR. GUARINO: I did write that.

130 2:43:34

MR. YANNETTI: Okay. And that was back on February 4th of 2022, correct?

131 2:43:39

MR. GUARINO: Yes, it was.

132 2:43:39

MR. YANNETTI: Within six days of John O'Keefe being found mortally wounded on Albert's lawn, correct?

133 2:43:45

MR. GUARINO: Yes, sir.

134 2:43:46

MR. YANNETTI: And at that time you knew that the crime scene was 34 Fairview Road, correct?

135 2:43:52
136 2:43:55

MR. YANNETTI: Yet you put in your report, "while on scene," did you not?

137 2:44:00

MR. GUARINO: Yes, I don't know what scene they recovered from. I know they went multiple places on the 29th. They didn't get back to me until 7:30 that night almost when I first got the phone.

138 2:44:10

MR. YANNETTI: But you'd agree with me that the Canton Police Department wasn't the crime scene, correct?

139 2:44:15

MR. GUARINO: I never said crime scene in my report. I wrote, "scene."

140 2:44:17

MR. YANNETTI: Okay, well, Canton Police Department was not the scene of any crime, was it?

141 2:44:23

MR. GUARINO: I don't know. I don't believe so.

142 2:44:26

MR. YANNETTI: You don't know if the Canton Police Department was the scene of a crime, is that --

143 2:44:30

MR. GUARINO: I don't think it was.

144 2:44:32

MR. YANNETTI: You don't think it was. Okay. Now, in that report, you were trying to establish the chain of custody of that phone, right? Because you described where it was found, where it was taken and who had possession of it, correct?

145 2:44:49

MR. GUARINO: I said -- it never said where it was taken. I said the phone was recovered on scene by Trooper Proctor. Again, I don't know where it was recovered from. I did find out later it was at Canton PD.

146 2:45:00

MR. YANNETTI: Well, hold on a second. Again, we're focusing on your report.

147 2:45:04

MR. GUARINO: I know I'm reading it.

148 2:45:05

MR. YANNETTI: As opposed to details you want to fill in now, okay?

149 2:45:07

MR. GUARINO: Okay.

150 2:45:07

MR. YANNETTI: With regard to you just testified that you never said where it was taken yet, previously you said it was taken to you, was it not?

151 2:45:16

MR. GUARINO: No, I said recovered from the scene/location.

152 2:45:21

MR. YANNETTI: Did Trooper Proctor take the phone to you and hand --

153 2:45:25
154 2:45:25

MR. YANNETTI: -- it to you?

155 2:45:25

MR. GUARINO: Yes, he did.

156 2:45:26

MR. YANNETTI: Okay. So it was taken to you, correct?

157 2:45:29

MR. GUARINO: That is correct.

158 2:45:29

MR. YANNETTI: All right. So you described in your report where it was found, because you said, "while on scene," correct?

159 2:45:37

MR. GUARINO: Correct.

160 2:45:38

MR. YANNETTI: And where it was taken, it was taken to you correct?

161 2:45:42

MR. GUARINO: Yes, sir.

162 2:45:43

MR. YANNETTI: And who had possession of it, which was initially Trooper Proctor in terms of your observations, and then you, correct?

163 2:45:49

MR. GUARINO: That is who brought me the phone to the DA's office, yes.

164 2:45:53

MR. YANNETTI: And you would agree with me the chain of custody of a piece of evidence is an important detail in any criminal investigation, isn't it?

165 2:45:59
166 2:46:08

MR. YANNETTI: Would you agree with me that someone reading your report or listening to it, as the jury listened today, would understand you to be saying that Michael Proctor seized John O'Keefe's cell phone at 34 Road in Canton?

167 2:46:24

MR. LALLY: Objection.

168 2:46:24

JUDGE CANNONE: Sustained.

169 2:46:24

MR. YANNETTI: All right. I'd like to ask you some questions about the extraction that you discussed in that same February 4, 2022, report, the very same report. In that report, after you name the tools that you use to extract data from the phone, you indicated that a copy of that cell phone extraction was placed on a state police server, or was it a DA's office server?

170 2:46:53

MR. GUARINO: DA's office server.

171 2:46:54

MR. YANNETTI: Okay. On a server so that it could be accessed there, correct?

172 2:46:57

MR. GUARINO: That is correct.

173 2:46:58

MR. YANNETTI: But that extraction you placed on the server did not include all the potential data on John O'Keefe's phone, did it?

174 2:47:07

MR. GUARINO: How do you mean?

175 2:47:09

MR. YANNETTI: Well, didn't you indicate in your report that the extraction was not inclusive of all potential data contained within the device?

176 2:47:21

MR. GUARINO: No, that's not true.

177 2:47:22

MR. YANNETTI: Well, the extraction that you did contained communications, iOS messages, phone calls, social media communications between John O'Keefe and Karen Read, correct?

178 2:47:36

MR. GUARINO: Yes, that's correct.

179 2:47:37

MR. YANNETTI: And it contained communications between John O'Keefe and Jennifer McCabe?

180 2:47:42

MR. GUARINO: Yes, that's true.

181 2:47:43

MR. YANNETTI: It contained communications between John O'Keefe and Kerry Roberts?

182 2:47:49

MR. GUARINO: I can't recall.

183 2:47:51

MR. YANNETTI: All right. But it did not include any communications between John O'Keefe and Julie Albert, did it?

184 2:47:56

MR. GUARINO: Again, I can't recall.

185 2:47:58

MR. YANNETTI: And again, I'm talking about that initial extraction. That initial one didn't include any communications between John O'Keefe and Chris Albert, did it?

186 2:48:05

MR. GUARINO: I only created one extraction of John O'Keefe's phone.

187 2:48:09

MR. YANNETTI: All right. That extraction report also did not include any location data, did it?

188 2:48:17

MR. GUARINO: No, it did.

189 2:48:19

MR. YANNETTI: You didn't note any location data in that initial report, did you?

190 2:48:24

MR. GUARINO: In the February 4, report?

191 2:48:25

MR. YANNETTI: Correct.

192 2:48:26

MR. GUARINO: I didn't go through the data at that point.

193 2:48:28

MR. YANNETTI: All right.

194 2:48:29

MR. GUARINO: This is just my extraction report saying that I got the phone. It was extracted and placed onto the server, and then I wrote, this report is not inclusive of all potential evidence -- excuse me -- potential data contained within this evidence.

195 2:48:42

MR. YANNETTI: When was the first time that you reported on location data in this case?

196 2:48:48

MR. GUARINO: I don't remember.

197 2:48:49

MR. YANNETTI: It wasn't until April of 2023, correct?

198 2:48:53

MR. GUARINO: Oh, there was a reason for that.

199 2:48:55

MR. YANNETTI: Well, I didn't ask you if there was a reason for it, sir. You understood my question, didn't you?

200 2:49:00

MR. GUARINO: That's correct. My first report regarding was in January.

201 2:49:04

MR. YANNETTI: And we're talking about John O'Keefe's phone now here?

202 2:49:08

MR. GUARINO: Yeah.

203 2:49:09

MR. YANNETTI: You did not report on the location data on John O'Keefe's phone until April of 2023, correct?

204 2:49:15

MR. GUARINO: I didn't look at the extraction initially.

205 2:49:18

MR. YANNETTI: And you also did not report on any Apple Health data until the spring of 2023, correct?

206 2:49:27

MR. GUARINO: Again, I didn't look at the phone extraction. Trooper Proctor would have looked at it. I would have loaded it and given it to him.

207 2:49:33

MR. YANNETTI: Okay. So Trooper Proctor had access to the phone first, and then you took care of it, correct?

208 2:49:39

MR. GUARINO: He had access to the extraction that I would load into Cellebrite for him to look at, but you can't change the data. That is correct.

209 2:49:45

MR. YANNETTI: Okay. And you would agree with me that you didn't address John O'Keefe's health or location data in any formal report until that April 23, report, correct?

210 2:49:57

MR. GUARINO: That's correct. I never went through it.

211 2:49:58

MR. YANNETTI: Right. And you submitted your report in April of 2023, after you became aware of an affidavit filed by the defense expert Rick Green in which Mr. Green extracted and analyzed John O'Keefe's location data and his movements according to Apple Health Data; isn't that correct?

212 2:50:16

MR. GUARINO: Yes, that is correct.

213 2:50:18

MR. YANNETTI: Before Rick Green submitted that affidavit, no member of the state police homicide investigation team, including you, had ever looked at, or at least reported on the location data for anyone present at 34 Fairview, correct?

214 2:50:35

MR. GUARINO: For the devices that we had, sir?

215 2:50:35

MR. YANNETTI: The -- for John -- for John O'Keefe's device, for Jennifer McCabe's device.

216 2:50:43

MR. GUARINO: I can't speak to that. I don't know.

217 2:50:45

MR. YANNETTI: All right. But you didn't, correct?

218 2:50:47

MR. GUARINO: Again. I didn't look at the extractions until later.

219 2:50:50

MR. YANNETTI: Right. So you hadn't looked at John O'Keefe's location data in particular prior to Richard Green pointing out the location data in his affidavit, correct?

220 2:51:03

MR. GUARINO: Again, I don't -- I can't -- I don't know. I wasn't asked to look for that data when I did look at it.

221 2:51:08

MR. YANNETTI: (Indiscernible), correct?

222 2:51:08

MR. GUARINO: Yes, there's no report until then.

223 2:51:10

MR. YANNETTI: All right. Same with Jennifer McCabe's location data, you didn't report on that either, correct?

224 2:51:15

MR. GUARINO: I didn't look at Jen McCabe's phone.

225 2:51:15

MR. YANNETTI: All right. You didn't report on Brian Albert's or Colin Albert's, or Brian Higgins' location data, would you agree with that?

226 2:51:22

MR. GUARINO: I didn't have any of their phone extractions to get that data, so I wouldn't be able to anyways.

227 2:51:26

MR. YANNETTI: But when you finally did check the location data, I want to ask you about your testimony on direct examination that you believe that at a certain point with regard to John O'Keefe's phone, the accuracy of the GPS points was within 3 feet; do you remember that testimony?

228 2:51:48

MR. GUARINO: Yes, sir.

229 2:51:49

MR. YANNETTI: All right. Can you show me where in any of your reports you specify that the GPS points are accurate within 3 feet?

230 2:52:01

MR. GUARINO: I don't know. I don't have it in front of me. In my reports or the Axiom report?

231 2:52:06

MR. YANNETTI: You reports. Yeah, no, any -- reports that you have in front of you or any that you reviewed. Where is that?

232 2:52:11

MR. GUARINO: What do you -- that I wrote?

233 2:52:13

MR. YANNETTI: Is it in writing anywhere, sir?

234 2:52:14

MR. GUARINO: Yes. I wrote in my report that we believe we were within 3 feet of the latitude and longitude points that were mapped in SARTopo when we went to --

235 2:52:22

MR. YANNETTI: Which report is that?

236 2:52:22

MR. GUARINO: That is the second report that I did, sir.

237 2:52:25

MR. YANNETTI: The May of 2023 report?

238 2:52:28

MR. GUARINO: May 9, 2023.

239 2:52:32

MR. YANNETTI: All right.

240 2:52:37

MR. YANNETTI: If I may just have a moment.

241 2:52:38

MR. GUARINO: Yep. It's page -- it'll be page 4 or 5. It should be in the top there. Paragraph 9. You can read it if you'd like.

242 2:52:56

MR. YANNETTI: Hang on. Would you agree with me in paragraph 9, there is nothing that mentions that the accuracy is within 3 feet?

243 2:53:14

MR. GUARINO: From the program?

244 2:53:16

MR. YANNETTI: No. I'm asking you about a report that you authored that you just mentioned to this jury.

245 2:53:23

MR. GUARINO: It's in paragraph -- paragraph 12, I'm sorry. It says, "Trooper Proctor and I began to measure."

246 2:53:28

COURT REPORTER: I'm sorry. That was a little too fast. A I'm sorry. I wrote, "Trooper Proctor and I began measuring the -- "

247 2:53:35

MR. YANNETTI: I'm not asking you to read it.

248 2:53:36

MR. GUARINO: Oh, okay.

249 2:53:36

MR. YANNETTI: You were mentioning paragraph 12 and you --

250 2:53:37

MR. GUARINO: Yes, sir.

251 2:53:37

MR. YANNETTI: -- and you were talking about one particular spot in that, correct?

252 2:53:41

MR. GUARINO: Yes, that is the spot that we --

253 2:53:42

MR. YANNETTI: All right.

254 2:53:43

MR. GUARINO: -- pointed on our --

255 2:53:44

MR. YANNETTI: Now, with regard to John O'Keefe's phone, would you agree with me that it's important to properly handle and secure a cell phone that is seized in connection with a homicide investigation?

256 2:53:56
257 2:53:56

MR. YANNETTI: Was it important in this investigation to properly handle and secure John O'Keefe's cell phone since he was the homicide victim?

258 2:54:06

MR. GUARINO: I mean, it was. We locked it in a secure evidence lab.

259 2:54:11

MR. YANNETTI: All right. Well, you testified that the first time you reported on in your investigation or your evaluation of the location data, that was in your April 24, 2023, report?

260 2:54:26

MR. GUARINO: Correct. A Yes, sir.

261 2:54:27

MR. YANNETTI: And in that report, you revealed that you looked at his location data using Axiom software, correct?

262 2:54:34

MR. GUARINO: Yes, sir.

263 2:54:35

MR. YANNETTI: And Axiom is a competitor of Cellebrite?

264 2:54:38

MR. GUARINO: You could you say that. Yeah.

265 2:54:40

MR. YANNETTI: And Axiom is relied on by law enforcement across the country?

266 2:54:44

MR. GUARINO: I believe so.

267 2:54:45

MR. YANNETTI: And you relied on it here in terms of this issue of the location data, did you not?

268 2:54:49

MR. GUARINO: I used multiple programs, but, yes, I used Axiom as well.

269 2:54:53

MR. YANNETTI: And regarding the location data that you examined with regard to John O'Keefe's phone, you noticed or you noted, I should say, that after a period of no speed having been registered for a period of time, John O'Keefe's cell phone started registering movement at 6:04 or 6:15 a.m.?

270 2:55:14

MR. GUARINO: 6:15 a.m.

271 2:55:15

MR. YANNETTI: 6:15 a.m. And that's actually 6:15 and 36 seconds, correct?

272 2:55:19

MR. GUARINO: I don't have it in front of me, but I believe that's correct.

273 2:55:21

MR. YANNETTI: Sounds right?

274 2:55:21

MR. GUARINO: Yeah.

275 2:55:21

MR. YANNETTI: And at that point, his phone registered a speed of .0484 meters per second?

276 2:55:28

MR. GUARINO: I just want to confirm.

277 2:55:30
278 2:55:35

MR. GUARINO: Is that the second report or the first report? I'm sorry. Here it is, yep, .0484.

279 2:55:42

MR. YANNETTI: Point zero four eight four meters per second?

280 2:55:44
281 2:55:45

MR. YANNETTI: And that's at 6:15 and 36 seconds?

282 2:55:47

MR. GUARINO: Yes, it is.

283 2:55:48

MR. YANNETTI: All right. So now, as you were examining that data, sir, you certainly knew from this investigation by that point that when the phone was moving, according to that data, at 6:15 and 36 seconds on January 29th of 2022, John O'Keefe had already been found mortally wounded and incapacitated, correct?

284 2:56:10

MR. GUARINO: From the voicemail message, that's how I was able to -- I don't know the exact time frames that he was found and transported, but I know 6:08 from Ms. Read's voicemail that the 911 call is made.

285 2:56:23
286 2:56:24

MR. GUARINO: And they are on scene.

287 2:56:25

MR. YANNETTI: I think we're talking over each other here --

288 2:56:26

MR. GUARINO: Yeah.

289 2:56:27

MR. YANNETTI: -- because what I'm asking is you knew that by 6:15 and 30 seconds in the morning on January 29, John O'Keefe had already been incapacitated and mortally wounded. That was my question.

290 2:56:41

MR. GUARINO: Oh, yes, that's -- sorry. I misunderstood.

291 2:56:44

MR. YANNETTI: So you knew from your investigation that that mean -- meant it could not have been John O'Keefe moving with his phone at 6:15 and 36 seconds, correct?

292 2:56:53

MR. GUARINO: That is correct.

293 2:56:54

MR. YANNETTI: It had to be somebody else, correct?

294 2:56:56
295 2:56:57

MR. YANNETTI: Would you agree with me that once investigators took possession of John O'Keefe's phone, any movement of his phone after that would not help in your homicide investigation, would it?

296 2:57:10

MR. GUARINO: I don't understand.

297 2:57:13

MR. YANNETTI: Well, in other words, John O'Keefe's been incapacitated.

298 2:57:16
299 2:57:16

MR. YANNETTI: Somebody from law enforcement seizes his phone. Would it help your investigation, or the investigation of the Norfolk detective's unit to track and record location data on that phone after 6:15 a.m.?

300 2:57:35

MR. GUARINO: Well, it's there. I did look at it. It goes to the Canton PD and then later comes to the office.

301 2:57:39

MR. YANNETTI: (Indiscernible.) I didn't ask if it's there. I know it's there. I am asking you, does that help you in your investigation of a potential -- or of a homicide, to track the phone and have that location data recorded on the phone after John O'Keefe could not have been the one moving with it?

302 2:58:00

MR. GUARINO: No, not necessarily.

303 2:58:01

MR. YANNETTI: In fact, if the phone is manipulated in some way after investigators take possession of it, that could potentially harm an investigation, couldn't it?

304 2:58:15

MR. LALLY: Objection.

305 2:58:16

JUDGE CANNONE: Sustained.

306 2:58:18

MR. YANNETTI: Well, to preserve the integrity of the data on the phone as it existed before the police took custody of the phone, there is a way to stop the phone from recording location data, again after the police take custody of the phone, isn't there?

307 2:58:37

MR. GUARINO: Yes, if you can place it into airplane mode.

308 2:58:39

MR. YANNETTI: Yes. You mentioned on direct examination that it could be accomplished by putting the phone into airplane mode, correct?

309 2:58:45

MR. GUARINO: That is correct, sir.

310 2:58:46

MR. YANNETTI: But when that phone was seized, no investigator put the plane into airplane mode that early morning, because you know that location data was found on that phone, correct?

311 2:59:02

MR. GUARINO: I don't know when it was placed in airplane mode.

312 2:59:04

MR. YANNETTI: But you know it wasn't by 6:15 a.m., correct?

313 2:59:07

MR. GUARINO: That is correct.

314 2:59:07

MR. YANNETTI: All right. And there's also another way to prevent any signal from entering or exiting the phone. You'd agree with that?

315 2:59:14

MR. GUARINO: Yes, there is.

316 2:59:14

MR. YANNETTI: During your direct examination, you mentioned the concept of a Faraday bag.

317 2:59:18

MR. GUARINO: That is correct, sir.

318 2:59:19

MR. YANNETTI: A Faraday bag has special fabric that blocks electromagnetic signals entirely, does it not?

319 2:59:24

MR. GUARINO: Yes, sir.

320 2:59:25

MR. YANNETTI: So putting the phone into a Faraday bag would be another way to stop the phone from recording location data while the phone's in police custody, correct?

321 2:59:33

MR. GUARINO: Yes, sir.

322 2:59:34

MR. YANNETTI: And you'd agree with me that during that early morning hours, as of 6:15 a.m. and thereafter, no investigator in this case put that phone into a Faraday bag on January 29, correct?

323 2:59:46

MR. GUARINO: Not to my knowledge.

324 2:59:48

MR. YANNETTI: In fact, after John O'Keefe's cell phone started registering movement at 6:15 and 36 seconds in the morning on January 29, it continued to record location data the rest of the morning until 11:56 and one second a.m. on January 29, correct?

325 3:00:06

MR. GUARINO: I don't know the exact end time, but I know it does have GPS data points throughout the day.

326 3:00:26

MR. YANNETTI: So you would agree with me that for several hours after the police had the phone, it was not put in a Faraday bag and it was not put into airplane mode, correct?

327 3:00:37

MR. GUARINO: That is correct.

328 3:00:38

MR. YANNETTI: All right. Now with regard to the voicemails that you've previously testified to and that the jury has heard and they've been introduced into evidence. You had testified on direct examination that Karen Read's phone connected to the WiFi at 1 Meadows Ave. at approximately 12:36 in the morning?

329 3:01:05

MR. GUARINO: Yes, sir.

330 3:01:06

MR. YANNETTI: So you can testify based on that, that by 12:36 in the morning, Karen Read was not at 34 Fairview, correct?

331 3:01:16

MR. GUARINO: That's correct.

332 3:01:19

MR. YANNETTI: And that was the first of those voicemails that you testified to, correct? That was the I hate you voicemail?

333 3:01:28

MR. GUARINO: Yes, that's 12:37, correct.

334 3:01:30

MR. YANNETTI: Okay. And that voicemail and every other voicemail that the jury heard, was left after Karen had left 34 Fairview, correct?

335 3:01:44

MR. GUARINO: Yes, sir.

336 3:01:45

MR. YANNETTI: And except for the one at, you know, after 6:00 in the morning, the four minute one when she went back, you heard that one, but all the other ones were apparently left when she was at 1 Meadows, correct?

337 3:02:00

MR. GUARINO: I can't speak to where she was, but.

338 3:02:03

MR. YANNETTI: But she wasn't at 34 Fairview, correct?

339 3:02:04

MR. GUARINO: Yes, that's correct. She wasn't at 34. And you would agree with me, based on those voicemails and what you know about them and what we've just discussed, that no one at 34 Fairview, including Jennifer McCabe, could have witnessed Karen Read outside that residence at 12:45 a.m., correct? A No, I don't believe so.

340 3:02:39

MR. YANNETTI: So you would agree with me? No one could have, including Jennifer McCabe, could have seen her at 12:45 at 34 Fairview?

341 3:02:45

MR. GUARINO: As I said, she auto connects to the WiFi at 12:36, so, no, she would have been there.

342 3:02:50

MR. YANNETTI: All right. Now we've talked about the findings of or the fact that you reviewed the findings of Rick Green by reading the affidavit that he submitted, correct?

343 3:03:07

MR. GUARINO: Yes, sir.

344 3:03:08

MR. YANNETTI: And you learned in that affidavit that Rick Green was able to track not only when John O'Keefe arrived at 34 Fairview, but also the route that he and Ms. Read, took to get there on January 29, correct?

345 3:03:21

MR. GUARINO: I don't recall his report fully, but.

346 3:03:24

MR. YANNETTI: You learned that he was able to accomplish that by examining the data from the app Waze that you spoke of, correct?

347 3:03:30

MR. GUARINO: Yes, I did find that myself.

348 3:03:32

MR. YANNETTI: All right. And Waze is spelled W-A-Z-E, correct?

349 3:03:35
350 3:03:35

MR. YANNETTI: All right. And you've previously testified it's a commonly used app for driving directions and navigation?

351 3:03:41

MR. GUARINO: Yes, sir.

352 3:03:44

MR. YANNETTI: And regarding your analysis of the phone, you learned that there was Apple Health data from John O'Keefe's phone on January 29th of 2022, correct?

353 3:03:53

MR. GUARINO: That is correct.

354 3:03:54

MR. YANNETTI: And Apple Health data can reveal a number of steps that a person has taken during a given time period, as well as whether that person is going up or downstairs, correct?

355 3:04:05
356 3:04:09

MR. YANNETTI: And on John O'Keefe's phone, you learned that there was Apple Health data that tracked his steps from the time he's seen on surveillance video leaving the Waterfall Bar and Grill and moving forward after that, correct?

357 3:04:22

MR. GUARINO: I don't know anything about the Waterfall Bar video. I just have the time stamp from the phone showing it at around 12:12 --

358 3:04:32
359 3:04:32

MR. GUARINO: -- at the waterfall.

360 3:04:33

MR. YANNETTI: And it actually was between twelve-eleven and nine seconds, and then the ending period of that first time period was twelve-twenty-one and five seconds? And --

361 3:04:44

MR. GUARINO: Oh, yes, from the health, thank you, yes. Yeah.

362 3:04:46

MR. YANNETTI: Okay. From the Apple Health. And the data showed that he took a total of 170 steps between that time period, correct?

363 3:04:53

MR. GUARINO: That's what the phone registered, yes.

364 3:04:55

MR. YANNETTI: All right. And regarding those 170 steps, isn't it true that this data from Apple Health signifies that hundred and seventy steps took place at some point during that ten minute approximate time period?

365 3:05:14
366 3:05:15

MR. YANNETTI: So is it your understanding that those 170 steps all took place at 12:11?

367 3:05:23

MR. GUARINO: No. Again, like I said, the phone is a high tech pedometer. It doesn't mean that steps were taken. It means the phone was manipulated in a way that it believed it was moving and taking steps.

368 3:05:33

MR. YANNETTI: Oh, I see your objection. Okay. So --

369 3:05:35

MR. GUARINO: Sorry.

370 3:05:36

MR. YANNETTI: Yeah, let's assume they were steps for the purpose of this discussion here.

371 3:05:39

MR. GUARINO: Yeah.

372 3:05:39

MR. YANNETTI: Okay. Because -- and they could have been steps, correct?

373 3:05:41

MR. GUARINO: They could have been, yes.

374 3:05:43

MR. YANNETTI: All right. So let's assume --

375 3:05:43

MR. GUARINO: But no one way to prove.

376 3:05:43

MR. YANNETTI: Let's assume that for now.

377 3:05:45

MR. GUARINO: Okay.

378 3:05:46

MR. YANNETTI: Assuming there are 170 steps taken, that could have meant that John O'Keefe took 170 steps beginning at 12:11 within that time period, correct?

379 3:06:01

MR. GUARINO: It's saying -- again, the time frame that he gave me is 12:11 to 12:21?

380 3:06:05

MR. YANNETTI: Right. Yeah, so in other words, he couldn't started walking at 12:11, correct?

381 3:06:09
382 3:06:10

MR. YANNETTI: All right. But he also could have taken that 170 steps closer in time to 12:21, correct?

383 3:06:15

MR. GUARINO: Well, at that point, he's in the car.

384 3:06:17

MR. YANNETTI: I'm not asking about where he was --

385 3:06:20

MR. GUARINO: He could not have been, no.

386 3:06:22

MR. YANNETTI: -- I'm just -- I'm just asking about with -- what the data shows.

387 3:06:24

MR. GUARINO: And I'll say no.

388 3:06:25

MR. YANNETTI: If it shows 170 steps between 12:11 and 12:20 -- 12:21, and strictly based on the data, you don't know where those 170 steps took place within that ten minutes, correct?

389 3:06:40

MR. GUARINO: To a degree, yes.

390 3:06:41

MR. YANNETTI: Okay. And it's possible it could have been toward the beginning, toward the end, or maybe fairly evenly spaced, right? You just know that there are hundred seventy steps that were taken in that ten-minute time frame, correct?

391 3:06:52

MR. GUARINO: Again, that's assuming that they are steps.

392 3:06:54

MR. YANNETTI: Right. And again, I'm asking you from the data itself.

393 3:06:58

MR. GUARINO: Again, the phone says it steps, doesn't mean they are.

394 3:07:00

MR. YANNETTI: All right. Well, the Apple Health data also showed a total of 80 steps between 12:21 and 12:24?

395 3:07:06

MR. GUARINO: Correct.

396 3:07:07

MR. YANNETTI: As part of your investigation of this case, were you aware that there was a 12:23 text message from Ryan Nagle to Julie Nagle in which Ryan texted his sister Julie he had arrived at 34 Fairview?

397 3:07:20

MR. LALLY: Objection.

398 3:07:21

JUDGE CANNONE: Sustained. You can ask it differently.

399 3:07:23

MR. YANNETTI: In any case, you would agree with me that 12:23 is between 12:21 and 12:24, correct?

400 3:07:29

MR. GUARINO: That is correct.

401 3:07:30

MR. YANNETTI: And that is the 12:21 to 12:24 time frame, where the Apple Health data showed that the user of John O'Keefe's phone took 80 steps, correct?

402 3:07:38
403 3:07:39

MR. YANNETTI: All right. Now John O'Keefe's Apple Health data also showed that he climbed up or down three flights of stairs between 12:21 and 12:24, correct?

404 3:07:48
405 3:07:49

MR. YANNETTI: And that's the same period in which the data reflects 80 steps, correct?

406 3:07:54

MR. GUARINO: It's off by about 12 seconds. It's 12:22:22. I'm sorry. 12:24 and 22 seconds was the ending for the stamps, but 12:24 and 37 seconds.

407 3:08:04

MR. YANNETTI: Okay. Approximately?

408 3:08:05

MR. GUARINO: Approximately, yes.

409 3:08:05

MR. YANNETTI: All right. And regarding going up and down those three floors, Apple does not provide data precise enough to determine when within that range the three floors were transversed, correct?

410 3:08:17

MR. GUARINO: No, there was a second point at 12:22 and 14 seconds that had specifically on stairs.

411 3:08:24

MR. YANNETTI: Okay. And you would agree with me that -- and again, assuming that they were stairs as Apple Health data reflects, those stairs could have been ascended or descended toward the beginning, toward the end, or throughout that three minute time period, correct?

412 3:08:41

MR. GUARINO: In this case, no, because there's a set point that's in the Cellebrite report that shows it's 12:22 and 14 seconds.

413 3:08:48

MR. YANNETTI: All right. Finally, his Apple Health data also showed a total of 36 steps between 12:31:56 and 12:32:16, correct?

414 3:08:57

MR. GUARINO: Yes, that is correct.

415 3:08:57

MR. YANNETTI: All right. So I would like to direct your attention to your May 9, 2023, report, which is the second report that you wrote that we've already referenced?

416 3:09:08

MR. GUARINO: Yes, sir.

417 3:09:08

MR. YANNETTI: Specifically paragraph 15.

418 3:09:11

MR. GUARINO: Okay.

419 3:09:12

MR. YANNETTI: You wrote that O'Keefe's health data in Cellebrite shows him ascending, descending three flights of stairs at 12:22 and 14 seconds. Did I read that accurately?

420 3:09:24

MR. GUARINO: Yes, sir.

421 3:09:25

MR. YANNETTI: And the native locations in Cellebrite and the cached locations in Axiom both show O'Keefe's phone location by the intersection of Oakdale Road and Pine Cone Road, which is in front of 36 Oakdale and which is approximately a little over a half mile from 34 Fairview. Did I read that section essentially correct?

422 3:09:44

MR. GUARINO: Yes, sir.

423 3:09:45

MR. YANNETTI: All right. Do you stand by the statement that he ascended and descended three flights of stairs precisely at 12:22 and 14 seconds?

424 3:09:55

MR. GUARINO: I'm going by what Cellebrite has given me from that time point, and that's what I used.

425 3:10:01

MR. YANNETTI: Isn't it true that what the Apple Health data actually state is that John O'Keefe's phone went up and down three flights of stairs sometime within the time period that began at 12:22:14 and ended at 12:24:37?

426 3:10:16

MR. GUARINO: I don't -- I can't speak to it. I don't know. This is what, again, I'm looking at the report. This is what the information that is parsed out of the phone is giving me.

427 3:10:23

MR. YANNETTI: Right. I'm just asking about the data itself. It gives you that time period and tells you three flights of stairs, correct?

428 3:10:28

MR. GUARINO: Yes, that is correct.

429 3:10:29

MR. YANNETTI: All right. So assuming that those three flights of stairs were ascended or descended closer in time to 12:22:14, which was within that time period, that would still give him time to arrive at 34 Fairview within a couple of minutes later, would it not?

430 3:10:51

MR. GUARINO: I'm sorry, the time?

431 3:10:53

MR. YANNETTI: Yeah. So we have a time period that you've agreed with which is 12:24:14 ending at 12:24:37, right? A little over a couple of minutes? Two minutes and twenty-three seconds.

432 3:11:06

MR. GUARINO: Yeah, about that.

433 3:11:07

MR. YANNETTI: All right. So the three flights of stairs again, just according to the data, could have been ascended or descended at the start of that time period, correct?

434 3:11:19

MR. GUARINO: No. I'm confused what you're trying to say. So you're saying that he's at the house already at 12:22?

435 3:11:26

MR. YANNETTI: I'm not asking about the house. I'm asking about the data.

436 3:11:27

MR. GUARINO: No, I know, but I'm asking about the -- when you're saying he arrives in that data range.

437 3:11:32

MR. YANNETTI: No. What I'm -- what I'm --

438 3:11:33

MR. GUARINO: I'm confused.

439 3:11:34

MR. YANNETTI: I'm strictly asking you just to look at the data.

440 3:11:37

MR. GUARINO: Yeah.

441 3:11:37

MR. YANNETTI: And you agree with me, whenever there's a time period in Apple Health terms either steps or stairs, you can't pinpoint just from the data when they occurred within that time period, correct?

442 3:11:48

MR. LALLY: Objection. Your Honor, it may be helpful if counsel could refer to which data he's talking about and not just keep saying --

443 3:11:54
444 3:11:55

MR. LALLY: All I'm hearing is data.

445 3:11:56

MR. YANNETTI: I thought --

446 3:11:58

JUDGE CANNONE: Do you know which data Mr. Yannetti is referring to specifically?

447 3:12:01

MR. GUARINO: I'm slightly confused. I know you said that that time frame that I wrote in my report for that 12:21 to 12:24, and then, as I stated before Cellebrite shows a specific time point of 12:22 and 14 seconds when the stairs are ascended/descended. So that's -- that's why I'm confused.

448 3:12:18

MR. YANNETTI: Right. We're going to get to that.

449 3:12:20

MR. GUARINO: Okay.

450 3:12:20

MR. YANNETTI: I'm not asking you about that. I'm asking you about the fact that there's a time period and you can't place where within that time period, just based on that data itself.

451 3:12:27

MR. GUARINO: That's what's recorded and shown to me. So again, I -- that's what it's showing. I can't say otherwise.

452 3:12:32

MR. YANNETTI: Your conclusion was that John O'Keefe could not have been at 34 Fairview Road at 12:22 and 14 seconds because Waze put him on Oakdale Road about a half mile away, correct?

453 3:12:44

MR. GUARINO: Twelve. Yes, correct.

454 3:12:45

MR. YANNETTI: All right. And that caused you to disregard the Apple Health data or to attribute it not to steps or to stairs, because he was a half mile away between that 12:22 and 12:24 time period, correct?

455 3:13:00

MR. GUARINO: Yes, I attribute it to movement.

456 3:13:02

MR. YANNETTI: All right. So I want you to assume for a moment, Trooper, that John O'Keefe's phone location actually showed him on Oakdale Road three minutes earlier, at 12:19 a.m., okay? If you -- do you have that in mind?

457 3:13:19

MR. GUARINO: Okay.

458 3:13:20

MR. YANNETTI: All right. With that assumption, would you agree with me that the Apple Health data about him taking eighty steps and climbing up or down three floors at 34 Fairview Road would make more sense?

459 3:13:34

MR. LALLY: Objection.

460 3:13:34

JUDGE CANNONE: Sustained.

461 3:13:34

MR. YANNETTI: May we approach, Your Honor?

462 3:13:36
sidebar IPhone Clock Hypothetical Limits
463

(Sidebar commences:

464

MR. LALLY: Your Honor, the Commonwealth would submit it's an improper question. It's asking a hypothetical of this witness and asking hypothetical --

465

JUDGE CANNONE: Asking what?

466

MR. LALLY: A hypothetical and asking for situations, but he's also asking a hypothetical that's not borne out by any evidence.

467

MR. YANNETTI: So it will be. That's the whole purpose of the hypothetical. I'm going to get into this with the trooper. There are three separate photos, and I can show this to -- it's Mr. Lally. There are three separate clocks on an iPhone 11. One is monotonic tone, the other is baseband time, the other is display date and time. All of them have different times on them. They can vary by seconds. I have an example on John O'Keefe's phone right here where they vary by three minutes. This Trooper is not going to know which clock was used.

468

JUDGE CANNONE: Okay. You can do that, but you can't ask him if something makes more sense than something else.

469

MR. YANNETTI: Okay. I can move on from that.

471

MR. YANNETTI: Thank you.

472

end of sidebar.)

473 3:15:21

MR. YANNETTI: Sir, are you aware that apps on an iPhone may pull data from three different clocks when they're time stamping location data?

474 3:15:37

MR. GUARINO: You mean like Mac absolute time or Apple --

475 3:15:40

MR. YANNETTI: I'm asking you. Are you aware --

476 3:15:42

MR. GUARINO: Multiple time stamps that are in an iPhone, correct.

477 3:15:45

MR. YANNETTI: That's not my question. My question was, are you aware that an app on an iPhone may pull data by choosing from three different clocks when it time stamps location data?

478 3:16:01
479 3:16:02

MR. YANNETTI: What are those three separate clocks?

480 3:16:04

MR. GUARINO: It depends on the program. It could be the Mac absolute time. It could be the Unix epoch time. And sorry, there's, like, two others, I don't remember them all off the top of my head.

481 3:16:15

MR. YANNETTI: What about with regard to John O'Keefe's actual iPhone, did you research what clocks were available for apps to pull data from?

482 3:16:26

MR. GUARINO: No, I didn't.

483 3:16:29

MR. YANNETTI: Are you aware that those three clocks can vary in time?

484 3:16:35
485 3:16:38

MR. YANNETTI: Sometimes for a matter of seconds.

486 3:16:42

MR. GUARINO: What do you mean? So --

487 3:16:43

MR. YANNETTI: In other words, the three clocks could be seconds apart, correct?

488 3:16:47

MR. GUARINO: I would have to see the data.

489 3:16:48

MR. YANNETTI: All right. And you would agree with me that sometimes the clocks could be off by three minutes, correct?

490 3:16:57

MR. GUARINO: No. Again, I would have to see the data.

491 3:16:59

MR. YANNETTI: May I approach?

492 3:17:00

JUDGE CANNONE: Yes. Mr. Lally, did you get a chance to look at that?

493 3:17:03
494 3:17:03

MR. YANNETTI: Okay. Trooper, I'm going to place this before you and ask you to review it, directing your attention specifically to what is marked "Process 3434."

495 3:17:51

MR. GUARINO: Okay.

496 3:17:51

MR. YANNETTI: Do you see the process 3434 highlighted in blue on what I've placed before you?

497 3:17:58

MR. GUARINO: Yes, sir.

498 3:17:58

MR. YANNETTI: And with regard to the right side of that exhibit, do you also see process 3434 with more information on the right side?

499 3:18:08
500 3:18:08

MR. YANNETTI: And do you see the three different clocks that are listed on that printout?

501 3:18:17

MR. GUARINO: I do.

502 3:18:18

MR. YANNETTI: What are those three different clocks?

503 3:18:19

MR. GUARINO: I'm sorry. It's a bit blurry. Mono -- monotonic, date time, baseband date time, and then a display date time.

504 3:18:29

MR. YANNETTI: And looking at that, do you recognize that as being information that was available from John O'Keefe's phone from the extraction?

505 3:18:38
506 3:18:39

MR. YANNETTI: I would offer that as an exhibit, Your Honor.

507 3:18:42

JUDGE CANNONE: Any objection, Mr. Lally.

508 3:18:44

MR. LALLY: No, Your Honor.

509 3:18:48

JUDGE CANNONE: Okay. What are we going to call that, Mr. Yannetti? How are we going to refer to that?

510 3:18:55

MR. YANNETTI: It could be called, you know, a printout regarding 3434.

511 3:19:00
512 3:19:02

MR. YANNETTI: Or a print out from John O'Keefe's phone.

513

(Whereupon Exhibit No. 640, Printout from John O'Keefe's Phone, was marked as an exhibit.)

514 3:19:08

JUDGE CANNONE: Thank you.

515 3:19:09

MR. YANNETTI: Thank you.

516 3:19:11

MR. YANNETTI: Now you have Exhibit 640 in front of you, sir. Looking at 640, is it clear to you that those three clocks were not in sync regarding that one process number?

517 3:19:23
518 3:19:24

MR. YANNETTI: In fact, the monotonic clock regarding this particular Waze artifact from John O'Keefe's phone says 2:22 a.m. while the baseband and display clocks have time stamps three minutes earlier, correct?

519 3:19:41
520 3:19:42

MR. YANNETTI: So if there's a three minute difference between the clocks -- well, strike that. Do you know with regard to that 2:22 a.m. location data on Waze, do you know which clock Waze was using for that or the iPhone was using with Waze?

521 3:19:59

MR. GUARINO: I don't. I didn't look through cell(ph) or Axiom. I was using Cellebrite for that.

522 3:20:04

MR. YANNETTI: Okay. But certainly that would have been available to you, had you looked at it, correct?

523 3:20:09

MR. GUARINO: Well, this is the -- the artifact you showed me is from the power log. It has nothing to do with the GPS, so it's not correct.

524 3:20:16

MR. YANNETTI: You could have looked at that exhibit, right, the information in that exhibit to see the three different clocks, sir?

525 3:20:22

MR. GUARINO: Yes, but I can explain why this is incorrect.

526 3:20:25

MR. YANNETTI: All right. Maybe Mr. Lally will ask you. All right?

527 3:20:28

MR. GUARINO: Sounds good.

528 3:20:28

MR. YANNETTI: But you would agree with me if there's a three minute difference between the clocks and you don't know which clock was used to put John O'Keefe's phone on Oak Dale Road at 2:22 a.m., that could explain --

529 3:20:42

MR. YANNETTI: If I may just have a moment.

530 3:20:47

MR. YANNETTI: It's not 2:22 --

531 3:20:48

MR. GUARINO: I know what you meant.

532 3:20:49

MR. YANNETTI: Mr. Jackson, thank you. I'm sure everybody else did.

533 3:20:52

MR. YANNETTI: With regard to the three minute discrepancy between the clocks and you've -- you've said you don't know which clock Waze was using to put John O'Keefe's phone on Oakdale Road at 12:22 a.m., that could explain the discrepancy between the Apple Health data and the Waze data, could it not?

534 3:21:11
535 3:21:12

MR. YANNETTI: But as you sit here today, you don't know whether Waze was relying on the baseband display or monotonic clock, correct?

536 3:21:20

MR. GUARINO: Again, it's not -- it can't be used for that.

537 3:21:24

MR. YANNETTI: Now, you're aware that Jennifer McCabe signed a consent form on February 2nd of 2022, for her cell phone to be imaged?

538 3:21:31
539 3:21:32

MR. YANNETTI: And a full forensic extraction was performed on that phone sometime shortly after February 2nd of 2022?

540 3:21:39

MR. GUARINO: I don't remember the exact date. I didn't download her phone.

541 3:21:42

MR. YANNETTI: But in any case, you generated a Cellebrite full file system extraction report on May 31st of 2022, correct?

542 3:21:50
543 3:21:50

MR. YANNETTI: And you were aware that that Cellebrite report was the one that was turned over to the defense in this case, correct?

544 3:21:56

MR. GUARINO: That is correct.

545 3:21:57

MR. YANNETTI: But you'd agree with me that that extraction report didn't contain anything close to the full file system despite the name on it, correct?

546 3:22:06

MR. GUARINO: It did.

547 3:22:07

MR. YANNETTI: Well that report was filtered to return only Jen McCabe's communications with Carrie -- Karen Read, Kerry Roberts, John O'Keefe, and (c) correct?

548 3:22:17

MR. GUARINO: That is not correct.

549 3:22:18

MR. YANNETTI: Did Michael Proctor instruct you to pull only those communications?

550 3:22:22

MR. LALLY: Objection.

551 3:22:23

JUDGE CANNONE: Sustained.

552 3:22:24

MR. YANNETTI: You didn't seek to obtain any of Jennifer McCabe's communications with her sister, Nicole Albert, did you?

553 3:22:32

MR. GUARINO: I didn't go through. Like I said, didn't go through Jen McCabe's info.

554 3:22:35

MR. YANNETTI: And you didn't seek to obtain any of her communications with her daughter, Allie Albert, did you? I'm sorry. Allie McCabe.

555 3:22:44

MR. LALLY: Objection. May we approach?

556 3:22:45
sidebar Phone Extraction Question Objection
557

(Sidebar commences:

558

JUDGE CANNONE: So the objection?

559

MR. YANNETTI: The objection, Your Honor, is that what counsel has said is simply untrue. The entire extraction on Ms. McCabe's phone was provided to counsel. There were different grand jury exhibits that parsed out specific communications, but there was also a grand jury exhibit which had the entire extraction on which counsel received in June of 2022, when the defendant was arraigned.

560

MR. YANNETTI: We're talking about the initial extraction in February of 2022.

561

MR. LALLY: Correct.

562

MR. YANNETTI: That's what I'm talking about.

563

MR. LALLY: Correct.

564

MR. YANNETTI: So I mean that's for cross-exam -- for redirect.

565

JUDGE CANNONE: To tell me exactly your question again. I sustained it on different grounds.

566

MR. YANNETTI: He didn't seek to obtain any of the communications with Nicole Albert, Allie McCabe. You know, I was going to ask about Brian Albert as well.

567

JUDGE CANNONE: Okay. But that was after he had said he didn't do anything with John O'Keefe's phone, right? That's why I sustained it.

568

MR. YANNETTI: No, I understand. Okay.

569

JUDGE CANNONE: Okay. All right. So we'll move on.

571

end of sidebar.)

572 3:24:16

MR. YANNETTI: You would agree with me that the full forensic image of Jennifer McCabe's phone was not shared with the defense until it was requested by us in October of 2022, sir?

573 3:24:30

MR. GUARINO: That is not true.

574 3:24:33

MR. YANNETTI: When you wrote your report on April 24th of 2023, in response to an affidavit provided by Rick Green the defense forensic computer expert, it was in that report that you finally disclosed for the first time the existence of three Google searches by Jennifer McCabe, correct?

575 3:24:54

MR. LALLY: Objection.

576 3:24:55

JUDGE CANNONE: All right. So ask that differently.

577 3:24:57

MR. YANNETTI: Prior to April 24th of 2023, you had not reported in any formal manner with anything that was shared with the defense about the existence of three Google searches by Jennifer McCabe, correct?

578 3:25:13

MR. GUARINO: I never looked at Jennifer McCabe's phone.

579 3:25:15

MR. YANNETTI: And so was there anybody else from your unit, or anybody else that you worked on that provided that material to us?

580 3:25:23

MR. GUARINO: Not that I know of.

581 3:25:26

MR. YANNETTI: Page 2, if I may just have a moment.

582 3:25:37

MR. YANNETTI: Your Honor, we have don't have a printout, but I have --

583 3:25:50

JUDGE CANNONE: So don't --

584 3:25:52

MR. YANNETTI: May I approach with that?

585 3:25:58

JUDGE CANNONE: Approach the witness with that?

586 3:26:01
587 3:26:01

JUDGE CANNONE: Okay. Show it to Mr. Lally first.

588 3:26:03

MR. YANNETTI: So I'm going to place this before you without destroying the computer.

589 3:26:16
590 3:26:17

MR. YANNETTI: Sorry, Trooper. Take a moment to familiarize yourself with that. Do you understand or can you tell the jury what that is?

591 3:26:27

MR. GUARINO: Yep. This is a -- did you put it in a PDF? This isn't one I gave to you. This is a PDF version of the UFED reader report that I gave. So I gave a portable Cellebrite version to you. This is a copy of it and I can't -- I will not testify that anything in this is correct because this could have been filtered.

592 3:26:49

MR. YANNETTI: But your name is on there, is it not, sir?

593 3:26:52

MR. GUARINO: Yes, it is.

594 3:26:56

MR. YANNETTI: All right. What's the date?

595 3:27:03

MR. GUARINO: May 31, 2022.

596 3:27:08

MR. YANNETTI: Thank you. Okay. You'd agree with me with regard to that April 24th of 2023, report on page 2, you state, "In my initial Cellebrite UFED reader report," and then you put, "Version 7.53.0.29," that was created on May 4th of 2022, the search history for Jennifer McCabe's phone had two Google searches in Safari, correct?

597 3:27:36
598 3:27:37

MR. YANNETTI: And you list out, "How long ti die in cikd," at 6:23:51, and "Hos long to die in cold," at 6:24:37, correct?

599 3:27:48

MR. GUARINO: That is correct.

600 3:27:49

MR. YANNETTI: And by the way, with regard to the timing of those two particular searches, you are aware, are you not, that Jennifer McCabe placed a call to Brian Albert at 6:23 and zero seconds?

601 3:28:00

MR. GUARINO: I don't have it in front of me. I don't.

602 3:28:25

MR. YANNETTI: May I approach, Your Honor?

603 3:28:37

JUDGE CANNONE: Yes. A Thanks.

604 3:28:45

MR. YANNETTI: All right, sir, I've placed before you a document. Could you familiarize yourself with that and then tell the jury if you recognize what it depicts?

605 3:28:53

MR. GUARINO: I have a call log that says 20888 with no name at 6:23, that's incomplete because there should be three other records accounting for this call.

606 3:29:08

MR. YANNETTI: Okay. But that record itself reflects a call from Jennifer McCabe's phone at 6:23 and zero seconds?

607 3:29:18

MR. GUARINO: I don't know. There's no number on here, so I can't tell that. It just says it's a call log with one call that's not answered at 6:23 in the morning with doesn't say who it's from or who it's going to.

608 3:29:31
609 3:29:31

MR. GUARINO: It also is incomplete, because there should be two other records with this. This is from the call history store data WAL marked as deleted.

610 3:29:40

MR. YANNETTI: It's marked as deleted. Does it give a duration?

611 3:29:44

MR. GUARINO: It just says, "Duration. Zero seconds."

612 3:29:46

MR. YANNETTI: Okay. And does it reflect that it was unanswered?

613 3:29:50

MR. GUARINO: It does.

614 3:29:51

MR. YANNETTI: Okay. May I have that marked for identification, please?

615 3:30:02
616

(Whereupon Exhibit MMM, Extracted Call, was marked for identification.)

617 3:30:02

JUDGE CANNONE: Thank you.

618 3:30:05

MR. YANNETTI: Did you investigate whether a call was placed from Jennifer McCabe to Brian Albert at 6:23 in the morning and zero seconds?

619 3:30:14

MR. GUARINO: I didn't look at any specific calls that morning. I created a Cellebrite report. That's about it.

620 3:30:19

MR. YANNETTI: Did you eat -- did you ask either Ian Whiffin or Jessica Hyde to look into that issue?

621 3:30:25

MR. LALLY: Objection.

622 3:30:25

JUDGE CANNONE: Sustained.

623 3:30:27

MR. YANNETTI: You would agree with me that that call and the record of that deletion of that call is nowhere in your April 24, report, correct?

624 3:30:33

MR. GUARINO: I believe it's in my May 9, report.

625 3:30:35

MR. YANNETTI: All right. But I asked about your April 24, report, sir.

626 3:30:39

MR. GUARINO: I didn't address anything regarding phone calls in my April 24, report.

627 3:30:42

MR. YANNETTI: All right. Now going back to when you began your examination around May 4th of 2022, you were looking for information on -- did you look on Jennifer McCabe's phone back in May 4th of 2022?

628 3:30:56

MR. GUARINO: Did I physically open the phone or did it?

629 3:31:00

MR. YANNETTI: Did you review the data at all?

630 3:31:02

MR. GUARINO: From? I'm confused. For on the cell phone itself or from the report?

631 3:31:06

MR. YANNETTI: Either way.

632 3:31:07

MR. GUARINO: No, her phone was returned to her, and then we had the extraction. I did not utilize the extraction at all.

633 3:31:15

MR. YANNETTI: You never included the two searches that we discussed the, you know, "how long ti die in cikd," and "hos long to die in cold," in the full file system extraction that was turned over to the defense, did you?

634 3:31:32

MR. GUARINO: They were included.

635 3:31:35

MR. YANNETTI: Well, page 6 of your April 24, 2023, report goes on to state that when you switch to a new version of Cellebrite and --

636 3:31:43

MR. GUARINO: Sorry.

637 3:31:44

MR. YANNETTI: -- that dropped out.

638 3:31:45

MR. GUARINO: Yeah, it was the phone call -- the power log.

639 3:31:56

MR. YANNETTI: Page 6 of your April 24, 2023, report says that when you switch to a new version of Cellebrite Physical Analyzer, which was version 7.61.0.12, you found an artifact from the browser state DB WAL file for a global search of "Hos long to die in cold," at 2:27 and 40 seconds, correct?

640 3:32:18
641 3:32:45

MR. YANNETTI: May I approach?

642 3:32:45
643 3:32:45

MR. YANNETTI: Trooper, I'm placing before you what has been marked as Exhibit 99. Do you recognize that?

644 3:32:51
645 3:32:52

MR. YANNETTI: And what is that?

646 3:32:53

MR. GUARINO: It's the searches that were done at 6:23 regarding the misspelled, "how long to die in the cold."

647 3:33:00

MR. YANNETTI: Okay. And it's actually, "hos long to die in the cold," right?

648 3:33:03
649 3:33:03

MR. YANNETTI: H-O-S.

650 3:33:04

MR. GUARINO: Yep, that was --

651 3:33:05

MR. YANNETTI: That was marked by Cellebrite as deleted, was it not?

652 3:33:09
653 3:33:10

MR. YANNETTI: All right. And your April, 24 2023, report goes on to mention two deleted calls to Jen McCabe's sister Nicole who was saved as Coco in her phone, correct?

654 3:33:23

MR. GUARINO: I'd have to see it, but I believe so.

655 3:33:25

MR. YANNETTI: May I approach?

656 3:33:26

JUDGE CANNONE: Yes. A Thank you.

657 3:33:38

MR. YANNETTI: Showing you what's been marked Y for identification. If you'd familiarize yourself with that and look up at me when you're done.

658 3:33:44

MR. GUARINO: (Witness complies.) Okay.

659 3:33:46

MR. YANNETTI: Is -- does that show the two deleted calls to Jen McCabe's sister Nicole who was saved as Coco in her phone?

660 3:33:55

MR. GUARINO: I don't know who it's coming from, but it does say it's going to Coco and then again coming from WAL files, correct.

661 3:34:00

MR. YANNETTI: All right. And your report doesn't mention it, but what was the duration of those two calls according to that log?

662 3:34:12

MR. GUARINO: On this sheet here, it says nine seconds for the first one and then seven seconds for the other.

663 3:34:16

MR. YANNETTI: All right. And those calls, both of them, which actually had durations, were marked answered by Cellebrite, correct?

664 3:34:27
665 3:34:28

MR. YANNETTI: May I offer that, Your Honor?

666 3:34:30

JUDGE CANNONE: Do you have an objection?

667 3:34:33

MR. LALLY: It was already in, but.

668 3:34:34

JUDGE CANNONE: I'm sorry?

669 3:34:35

MR. LALLY: I believe it's already --

670 3:34:37

COURT CLERK: It's Y for identification.

671 3:34:41

MR. LALLY: I believe Ms. McCabe's phone calls and all of that is already marked as an exhibit months ago.

672 3:34:48

MR. YANNETTI: Your Honor, I don't think there's any harm in marking this, and I want to display it.

673 3:34:57

JUDGE CANNONE: I'll let you display it. If it's already in evidence, I just don't want duplicates.

674 3:35:00

MR. YANNETTI: I understand.

675 3:35:01

JUDGE CANNONE: So without -- what I'll do is I'll let you display it, and then, Mr. Lally, at some point you find where this is, and we will mark this like A to whatever the number is.

676 3:35:14

MR. YANNETTI: Thank you. All right. Mr. Bates, if you could display what was marked Y for identification.

677 3:35:26

MR. YANNETTI: And, Trooper, with regard to what is displayed on the screen now, is that consistent with what I had just handed to you?

678 3:35:35

MR. GUARINO: Yes, it is.

679 3:35:36

MR. YANNETTI: All right. And with regard to the first entry there, you had stated that it doesn't say -- you said, it doesn't say who was making the call. Is that your testimony?

680 3:35:59

MR. GUARINO: Yes, it just says right here.

681 3:36:01

MR. YANNETTI: Yep, two.

682 3:36:02

MR. GUARINO: I'm guessing that's the last four of the number since this is the rest of blurred, and then, yeah, that's it.

683 3:36:06

MR. YANNETTI: And you know that that oh-two-oh-four last four minutes, that is to somebody who was listed as Coco in the phone, correct?

684 3:36:15

MR. GUARINO: I don't know any of these phone numbers or people.

685 3:36:18

MR. YANNETTI: But you previously testified these two calls were somebody -- to somebody who named Coco in the phone?

686 3:36:23

MR. GUARINO: Oh, yeah, from the sheet you gave me that shows it.

687 3:36:26

MR. YANNETTI: Okay. And the time of the first call was 6:07:42; is that right?

688 3:36:31

MR. GUARINO: That's correct.

689 3:36:32

MR. YANNETTI: And you testified that that's the one that had the duration of nine seconds?

690 3:36:36
691 3:36:37

MR. YANNETTI: Listed as answered?

692 3:36:39

MR. GUARINO: Correct.

693 3:36:40

MR. YANNETTI: And deleted, correct?

694 3:36:44

MR. GUARINO: Yes and no. And I can explain, if you'd like.

695 3:36:46

MR. YANNETTI: It's listed as deleted, is it not?

696 3:36:49

MR. GUARINO: There's a reason why.

697 3:36:50

MR. YANNETTI: Is it listed as deleted?

698 3:36:51

MR. GUARINO: It is. But there's a reason why.

699 3:36:52

MR. YANNETTI: All right. With regard to the second call that appears to be to the same number or at least the same last four digits?

700 3:37:00
701 3:37:01

MR. YANNETTI: And in the sheet in front of you, that's also to Coco, correct?

702 3:37:06
703 3:37:07

MR. YANNETTI: And that has a time stamp of 6:08 and 17 seconds, correct?

704 3:37:11

MR. GUARINO: That is correct.

705 3:37:12

MR. YANNETTI: That also has a duration, and that's of seven seconds?

706 3:37:14
707 3:37:15

MR. YANNETTI: Also listed as answered?

708 3:37:17
709 3:37:17

MR. YANNETTI: And also marked deleted, correct?

710 3:37:21

MR. GUARINO: Yes, and there's a reason.

711 3:37:22

MR. YANNETTI: And are you aware that Ms. McCabe made other calls that morning, which were in fact marked unanswered by Cellebrite?

712 3:37:37

MR. GUARINO: Again, I'd have to see what you're referring to.

713 3:37:40

MR. YANNETTI: So as you testified to here today, you are -- you have no memory as to whether or not she made a number of other calls that were marked deleted, sir?

714 3:37:50

MR. GUARINO: There are a number of calls that morning. I have not memorized all of them.

715 3:37:56

MR. YANNETTI: And again, Your Honor, if I may approach to show something that's on a computer screen.

716 3:38:11

JUDGE CANNONE: Okay. A Thank you. Got it.

717 3:38:12

MR. YANNETTI: Okay. I've placed before you what appears to be a PDF document on a computer screen, if you'd familiarize yourself with it and look up at me when you're done.

718 3:38:21

MR. GUARINO: (Witness complies.) Okay.

719 3:38:23

MR. YANNETTI: What does that appear to be, sir?

720 3:38:25

MR. GUARINO: An incomplete PDF of the call logs from whoever's call log this is.

721 3:38:30

MR. YANNETTI: Okay. And do you see in that PDF that there were a number of calls that were marked unanswered by Cellebrite?

722 3:38:43

MR. GUARINO: Again, I can't testify to any of this, because I can't confirm that where this data came from. There's no source file. This is completely -- it's incomplete. So I do see what you're talking about in that column, but I don't know where any of this data is from, or who made this.

723 3:39:00

MR. YANNETTI: Is your name on it?

724 3:39:01

MR. GUARINO: At the very top, it would show my name no matter what, because I created the UFED and the extraction. I did not create this PDF.

725 3:39:11

MR. YANNETTI: Sir, the answer to my question is, your name is on that document, correct?

726 3:39:14

MR. GUARINO: It is, but I didn't create it.

727 3:39:15

MR. YANNETTI: Right. And with regard to the calls that were marked unanswered, would you agree with me that Cellebrite had them with durations of zero seconds?

728 3:39:26

MR. LALLY: Objection.

729 3:39:27

JUDGE CANNONE: Can you agree with that? Can you answer that question? If you can, please answer it.

730 3:39:33

MR. GUARINO: With the data given here, I can't because like I said I don't know -- I don't know where they got this from, Your Honor.

731 3:39:39

MR. YANNETTI: So who created that document?

732 3:39:41

MR. GUARINO: I don't know.

733 3:39:43

MR. YANNETTI: So are you testifying that nobody in law enforcement created that document or nobody -- no forensic expert for the Commonwealth created that document?

734 3:39:51

MR. GUARINO: I created the extraction and made a UFED reader report which is basically a portable Cellebrite version that I use at the office. I gave that to defense. I don't know who created this PDF version of data with specific things. I did not.

735 3:40:07

MR. YANNETTI: Was it Michael Proctor?

736 3:40:08

MR. GUARINO: No. As I said, I was the only one that created any Cellebrite related reports in this case.

737 3:40:18

MR. YANNETTI: Well, I'd like to ask you some questions about my client's cell phone, sir.

738 3:40:23

MR. GUARINO: Okay.

739 3:40:26

MR. YANNETTI: On Tuesday, when Mr. Lally was questioning you, he had you point out and read some text messages that were on her phone between John O'Keefe and her, correct?

740 3:40:36

MR. GUARINO: Those messages were taken from John O'Keefe's phone.

741 3:40:41

MR. YANNETTI: Okay. Would you agree with me when he was pointing out those text messages to you, he skipped about 40 pages of messages at one point?

742 3:40:51

MR. GUARINO: I don't know. I believe their text messages went back all the way to 2020 or something ridiculous in his phone.

743 3:40:56

MR. YANNETTI: Right. He started reading them, and he skipped ahead about 40 pages, did he not?

744 3:41:00

MR. GUARINO: I have no idea.

745 3:41:02

MR. YANNETTI: Michael Proctor seized my client's phone on January 29th of 2022, did he not?

746 3:41:07

MR. GUARINO: He did.

747 3:41:08

MR. YANNETTI: And you would agree with me that certainly as of six days later, your February 4, report, you had not yet been able to access the content of the phone, correct?

748 3:41:19

MR. GUARINO: That's not true.

749 3:41:22

MR. YANNETTI: At some point you were able to access the content of the phone, correct?

750 3:41:26

MR. GUARINO: Yes. On January 31.

751 3:41:28

MR. YANNETTI: Of 2022?

752 3:41:30
753 3:41:30

MR. YANNETTI: All right. You later became aware that Michael Proctor was searching through my client's phone in August of '22 -- '22, correct?

754 3:41:38

MR. GUARINO: The actual device itself or the extraction report?

755 3:41:44

MR. YANNETTI: Either one, sir.

756 3:41:45

MR. GUARINO: I have -- I'm sorry, Miss Read's phone?

757 3:41:47

MR. YANNETTI: Yeah. Yeah.

758 3:41:48

MR. GUARINO: Yeah. We didn't --

759 3:41:49

MR. YANNETTI: Did you take John O'Keefe's phone?

760 3:41:51

MR. GUARINO: Yes, that's why I was confused. Sorry.

761 3:41:52

MR. YANNETTI: I apologize. I'm not trying to confuse you.

762 3:41:55

MR. GUARINO: Yeah.

763 3:41:55

MR. YANNETTI: With regard to my client's phone, which is where we started --

764 3:41:59

MR. GUARINO: Yeah.

765 3:42:00

MR. YANNETTI: -- you're aware that Michael Proctor was searching through her phone in August of 2022?

766 3:42:05

MR. GUARINO: Of the extraction report created, correct.

767 3:42:10

MR. YANNETTI: Were you made aware that on January 1st of 2023, the defense requested a full forensic image of Karen Read's phone, which was in your possession?

768 3:42:21

MR. GUARINO: I don't know the date, but a request was made for the phone extraction, yes.

769 3:42:25

MR. YANNETTI: And have you seen a forensic image or Cellebrite a report of the forensic image from Karen Read's phone?

770 3:42:33

MR. GUARINO: The redacted version that I received back from the AG's office, yes.

771 3:42:37

MR. YANNETTI: Okay. And would you please tell the jurors how many phone calls were deleted from Karen Read's phone from January 29th of 2022?

772 3:42:48

MR. GUARINO: None.

773 3:42:49

MR. YANNETTI: And if you'd please tell the jurors, other than to John O'Keefe, to whom did Ms. Read place phone calls between 12:00 a.m. and 4:30 a.m. on January 29?

774 3:43:02

MR. GUARINO: Her parents twice. There -- two or three times there's calls to her parents, and that's it.

775 3:43:09

MR. YANNETTI: And how many Google searches did she do from 12:00 a.m. until 5:00 a.m.

776 3:43:22

MR. GUARINO: I don't believe there were any.

777 3:43:24

MR. YANNETTI: And how many Google searches were deleted by Ms. Read at any point on January 29th of 2022?

778 3:43:35

MR. GUARINO: I can't speak to that because we got a redacted version of the report, so I don't know what was taken out by the AG's office. I don't know what files they went in to remove. So I only have what I was given.

779 3:43:46

MR. YANNETTI: Leaving that aside, sir, with regard to all of the data that was provided to you, how many Google searches did you see or find that Karen Read deleted from January 29th of 2022?

780 3:44:00

MR. GUARINO: A few.

781 3:44:01

MR. YANNETTI: During what time period?

782 3:44:03

MR. GUARINO: The afternoon. But again, I -- there was artifacts that I found that weren't date and time stamped, and there were some that were with corresponding time stamps but I can't say for sure when that was done.

783 3:44:18

MR. YANNETTI: Okay. But you saw no deleted calls, correct?

784 3:44:22

MR. GUARINO: No, not that I know of.

785 3:44:23

MR. YANNETTI: All right. If I may have moment?

786 3:44:26
787 3:44:26

MR. YANNETTI: No further questions. Thank you.

788 3:44:28

JUDGE CANNONE: Mr. Lally.

Continue to next page Nicholas Guarino — Redirect