Commonwealth v. Read — Trial ArchiveNicholas Guarino — Redirect
106 linesREDIRECT EXAMINATION BY MR. LALLY:
MR. LALLY: Trooper Guarino, you were asked about your qualifications as far as certifications that you received and prior trainings, correct?
MR. GUARINO: Yes.
MR. LALLY: What are some of the areas that you received certifications in?
MR. GUARINO: Cell phone -- report creation, extraction, cell phone repair, the Berla motor vehicle forensics, advanced database, classical casa(ph), but it's a Cellebrite made class that goes deeper into the database searching SQLite programming to write code to do your own searches, things of that nature.
MR. LALLY: Now, at any point in time, did Trooper Proctor ever tell you that he retrieved Mr. O'Keefe's cell phone directly from 34 Fairview Road?
MR. GUARINO: No, he didn't.
MR. LALLY: Is it your understanding or subsequently, did you learn that Kerry Roberts actually recovered the phone from Mr. O'Keefe's body from the grass under his body at 34 Fairview Road when he was placed onto a scoop stretcher?
MR. GUARINO: I don't know who got -- recovered the phone that morning, but I know --
MR. YANNETTI: Objection.
JUDGE CANNONE: I'll allow it. A I don't know.
JUDGE CANNONE: So your answer is you don't know who recovered it? A No, I just know that it was found underneath his body and then taken to Canton PD.
MR. LALLY: Now with regard to that, as far as the location data post 6:15 a.m., what, if anything, did you observe in reference to that?
MR. GUARINO: There was some intermittent native locations that showed at the Canton PD. It's there for a handful of different points, and then it shows it back at our office when I put it into the digital evidence lab, powered on to plug.
MR. LALLY: Did you receive the phone from Trooper Proctor with that either in airplane mode or a Faraday bag?
MR. GUARINO: I don't remember offhand.
MR. LALLY: There were no locations or GPS locations that you observed from the phone from that approximately 11- something a.m. until you retrieved it or received it, excuse me, at 7:30 p.m. on the 29th?
MR. GUARINO: There's like I said, there's only the handful that showed it at it at Canton PD, and then when it's back at the office that night. And then, if it wasn't in airplane mode, it would have been something I would have done. So I don't remember if Proctor did it before he gave it to me, or if I did it after.
MR. LALLY: Now, the other troopers in your unit and the detective unit with Norfolk DA's office, are they as well versed on cell phone abstractions and cell phone data as you are?
MR. GUARINO: No.
MR. LALLY: And so again, how many people within your specific unit actually perform data extractions for a forensic analysis of cell phone?
MR. GUARINO: Myself, Trooper Connor Keefe, and everyone has been trained in how do you Cellebrite and to do these extractions, they all just sort of dump them on my desk and say, do this phone for me, so.
MR. LALLY: Now, as far as what you provide to the invest -- one of the investigating troopers, such as Trooper Proctor, can you explain to the jury sort of that process of how you -- what if any differences there are between what you're looking at, as far as the device when you're extracting the information and what you provide to the trooper.
MR. GUARINO: So when I plug into GrayKey or Cellebrite or whatever tool I'm using to extract the data, it creates that ZIP file, and then I open it up in Cellebrite or Axiom. The guys are only trained in Cellebrite, so that's what I open the extractions initially in for them. If there's something that we find that they don't understand and that I want to look more into, I'll load into Axiom as well. But that's normally how it would go.
MR. LALLY: Now, is there any way from the version or the extraction that you provide to the trooper, is there any way for that or any trooper to change or manipulate that data from what is initially contained on the phone?
MR. GUARINO: Well, in essence, you could, but you'd have to go in -- so once I create like that UFED reader, which is the portable case, you would have to go into the folders and then delete stuff, which would change all of the data. And then when I would load it up later, it probably wouldn't work right. That's why we saved the encrypted extraction onto the server. So if anything ever messes up, we can go back and reload it, and I can create whatever reports I need with it.
MR. LALLY: And so from your view of the data and the phones in this case, what, if anything, did you observe in regard to any manipulation of data or deletion of data or removal of data from what you observed?
MR. GUARINO: From the encrypted files that we have, none, and then we didn't have pass codes for the phones, for John O'Keefe's until the 31st and then again for Ms. Read's until, geez, like I said, August, once the program is able to open it.
MR. LALLY: Now, you were asked questions about Mr. Green's affidavit. Following your review of Mr. Green's affidavit, what if any steps did you take in relation to what was indicated in there?
MR. GUARINO: So as I said, I didn't really go through the phones much when we first got them. I don't know everything about the case as the investigators do, so I got his report, and I went through it, and basically just went step by step. So he says this happened, I went to confirm, and if it didn't, then I need to find out why he was either incorrect or slightly off and either just completely wrong or just misinterpreted the data and that was it.
MR. LALLY: And in addition to yourself going through some of the data, who, if anyone, did, you contact to assist or to also, in addition, go through the data specifically as it related to the searches for Ms. McCabe's phone?
MR. GUARINO: So initially when I first found it, I spoke with Chris Vance of Magnet Axiom Forensics -- excuse me -- Magna Forensics. He's their head technical guy for Axiom for -- he's like their forensic specialist. So he was at the cybercrime conference. I brought him --
MR. YANNETTI: Objection.
JUDGE CANNONE: I'm going to allow this. A I brought the extraction there, and I said, "Hey, this is what I'm seeing. This is what it parsed out. Why are we seeing it marked this way?" And he goes, "Well, first off, you have to look exactly where it's coming from - the browser state."
MR. YANNETTI: Objection.
JUDGE CANNONE: I'll strike that last part. What he told you.
MR. GUARINO: Okay. A After reviewing the data, we saw that it came from the browser state db file and dot WAL file, I should say, at the end. So it set off a lot of red flags, and then from there, we contacted Cellebrite and ultimately Jessica Hyde.
MR. LALLY: And ultimately, Mr. Whiffin as well; is that correct?
MR. GUARINO: Yes, that's -- he came in after Cellebrite. I reached out to them, and they escalated it up. And he reached out to us to say -- to help us.
MR. LALLY: Now, with respect to the health data that you were asked about, again, if you could explain to the jury when something in there in the health data says steps, what exactly does steps mean?
MR. GUARINO: As I said before, the phone is seeing movement. It doesn't necessarily mean you're taking steps. If you have the iWatch paired to it, you're going to get a greater level of accuracy. And I would be more apt to believe that steps are being taken where it because it's going to also bring your heart rate. So if you're taking a large amount of steps, it's going to correspond.
MR. LALLY: Now, you were asked a lot of questions on cross- examination about just the health data and just the health data. Why is it that you look beyond just the health data?
MR. GUARINO: Well, you have the GPS points as well as health data, and we're trying to look at everything together as a whole. If we take one artifact and say, well, this means this, you could have five others that disclaim it, so that's why we look at all of this stuff.
MR. LALLY: Now, from that same information, as far as the GPS data that indicated that Mr. O'Keefe's phone arrived at 34 Fairview Road at 12:25 a.m., correct?
MR. GUARINO: Yes.
MR. LALLY: Now, as far as the clocks or the three different clocks that was presented to you that's now been marked for identification, you indicated those were not accurate; is that correct?
MR. GUARINO: Well, the file that it's coming from is not accurate. So it came from a power log file that the database it pulled from. So it's telling you the power of the phone. So when I looked at that, that also shows the battery level, and that's how I was able to show that, or see, I should say, that John O'Keefe's phone never turned off. It dropped down to about 17 percent battery level from being under his body was actually saved it from dying overnight. Then it also shows the time stamps of when it gets plugged in and as it goes up. That has three different time stamps. That's what that is from. That is not when Waze had started. That is not when the address is put in. That is strictly for the power log. It has nothing to do with anything else.
MR. LALLY: And so again, just sort of to that point, what if any connection do those time stamps in the thing the document mark for identification Mr. Yannetti showed you, what if any relationship does that have to the time stamps contained within either the Waze or the GPS native locations or anything else that you were testifying about before?
MR. GUARINO: It's literally showing that Waze has been opened and that it's pulling power from the phone, and that's -- that, is it, that is nothing else.
MR. LALLY: Now, with regard to you were asked questions about Ms. McCabe signing a consent for extraction on February 2, 2022, correct?
MR. GUARINO: Yes.
MR. LALLY: And Ms. Kerry Roberts, she did the same on the same date; is that also correct?
MR. GUARINO: Yes, I believe so.
MR. LALLY: Now, the entirety of those extractions from both Ms. McCabe's phone and Ms. Roberts' phone, those were both provided well in advance of the dates that counsel was indicating, correct.
MR. GUARINO: That is correct?
MR. LALLY: Now, in regard to the Cellebrite extraction in regard to Mr. Green's affidavit, Cellebrite has periodically updates their -- the versions of their software, correct?
MR. GUARINO: That is correct.
MR. LALLY: And if you could, could you speak a bit about sort of the update in those versions and how that pertains to this case and specifically Ms. McCabe's searches?
MR. GUARINO: So the initial report that I created with version 7.53 did not have that item to be able to be taken out. I was told by Cellebrite that 7.55 was the version that was enabled. Mr. Green used version 7.61, so that's why he presented itself then.
MR. LALLY: May I just stop you there for one second? The version that Mr. Green used, was that available at the time that you did the initial extraction?
MR. GUARINO: No, it wasn't available for like a year later. It was like ten upgrades later.
MR. LALLY: I'm sorry, sir. Continue.
MR. GUARINO: So again, he did the extraction. He looked at it. Finds this artifact that's parsed out. And then I had to go back in and scramble to say, well, why didn't I see it the first time when that report -- why didn't it pull? So I reloaded the 7.53 version. It's not there. And then when I load it into 7.61, it is. So there's just issue with the software at the time.
MR. LALLY: So, sir, with regard to those Google searches, what if any opinion did you have as to when those Google searches were conducted?
MR. GUARINO: When Ms. McCabe told us that it happened at 6:23 and 6:24 and then there was a third one later, at 10:35 that, again, if she reopened that browser window, it's going to reload the search and then that was it. Those are the three times that I saw in the phone extraction that were real searches.
MR. LALLY: And why is it that you -- it's your opinion that they occurred at 6:23 and 6:24 in the morning, and not 2:27?
MR. GUARINO: Well, it's physically impossible to search two things at once. Her phone, she's searching the daughter's basketball at 2:27, and then she's searching "It's Raining Men" and a few other things on her phone listening to music, and I think then she goes to bed a few hours later. So at the -- I was told as the defendant asked her to search for those terms, that's when we believed that they were done.
MR. LALLY: Now, as far as WAL files or write ahead log, having things listed as deleted, if you could just speak a little bit more about that. As far as why would something be listed as deleted in a WAL file, and what does that mean?
MR. GUARINO: Again, the user has no input on how a WAL file is deleted. It's an automated thing that the database does to clean up. It just it auto deletes after either programs are closed. It reaches a max data allotment for that page, that is it.
MR. LALLY: And that would include any sort of call log history that was contained in the write ahead log or the WAL file as well?
MR. GUARINO: That is correct.
MR. LALLY: And so what if any opinion you have as to those phone calls that you were shown in relation to the contact listing Ms. McCabe's phone as Coco, as far as whether or not they were user deleted?
MR. GUARINO: Well, again, what the defense showed me was limited thing. I know there's -- should be two other locations that that phone call was listed from looking at it myself, so I don't know why they gave me just the two deleted things, but there should be other spots in the database where that phone call was there. So I don't believe that it was user initiated. It was phone initiated.
MR. LALLY: And that's in reference to the write ahead log sort of first in/first out as far as data that comes in; is that correct?
MR. GUARINO: That's correct.
MR. LALLY: Now, again, as far as your unit was concerned, you were the only one who created any Cellebrite reports in relation to any of the phones in this case with the exception of the defendant's phone that was created by the attorney general's office following their extraction of privileged material, correct?
MR. YANNETTI: Objection.
JUDGE CANNONE: So objection is sustained as to the form. This seems a good place to stop. So, jurors, we'll take the luncheon break. There is a chance that we may be able to go a full day tomorrow. So just think about that at lunch, and if there's any emergency that would prevent you from being able to go a full day.
(Jury out.)
(Court in recess.)
(Court in session.)
(Defendant is present with counsel.)
(Jury in.)
JUDGE CANNONE: All right. So jurors, when we were doing scheduling, and I know scheduling has changed a lot in this case. But my main goal is to get this case to you folks by next week when we all want the case to you by next week. So originally on the 21st, we were either going to do a whole and then we couldn’t do a whole day, and there was all this back-and-forth, and it was a half a day and it was because I had something scheduled in this courthouse that was not going to be continued, through forces that we weren't aware of some -- it is going to be continued tomorrow. So in light of that, I would like us, and we will be doing a whole day. I understand that for one of you, you planned on an earlier stop to the weekend or a vacation day or something from the afternoon on, but really, all I'm asking of you is to go from instead of a one o'clock stop to a four o'clock stop, and where, I guess, fourteen of you are able to do that, we're going to do that. So tomorrow will be a full day. I don't know who I'm inconveniencing but I apologize for that. Because when I said emergency, an early start for the weekend was not an emergency. All right. Could we call the witness back, please.
COURT CLERK: Trooper, same thing. Just be mindful of the step up and you remain under oath.
MR. GUARINO: Thank you.
JUDGE CANNONE: All right. Mr. Lally.
MR. LALLY: Thank you, Your Honor.
MR. LALLY: (By Mr. Lally) Good afternoon, sir.
MR. GUARINO: Good afternoon.
MR. LALLY: So with reference to this case, this investigation, who, if anyone besides you, created any Cellebrite reports or extractions from any of the phones involved in this case?
MR. GUARINO: Other than the AG's office, it was just myself.
MR. LALLY: And now you had mentioned that there was some deleted material from the defendant's phone from the afternoon of January 29, 2022; is that correct?
MR. GUARINO: Yes, that's correct.
MR. LALLY: And what was that that was deleted?
MR. GUARINO: There was some search items that were not there in the phone, but found cookies related to said searches and websites visited.
MR. LALLY: So as far as search terms or web history, were those the areas that were deleted?
MR. GUARINO: Yes, that's correct.
MR. LALLY: I have nothing further, Your Honor.
JUDGE CANNONE: Oh, okay,
MR. YANNETTI: Nothing further. Thank you.
JUDGE CANNONE: Okay. So we brought you back for that, Trooper. Thank you very much.
MR. GUARINO: Thank you.
JUDGE CANNONE: All right.
MR. GUARINO: Thank you. Your next witness, Mr. Lally.
(End of witness testimony.)