Commonwealth v. Read — Trial ArchiveRichard Green — Direct/Cross
691 lines(Court in session.)
(Defendant is present with counsel.)
(Jury in.)
JUDGE CANNONE: All right. Mr. Yanetti.
MR. YANNETTI: Thank you very much, Your Honor. The defense calls Richard Green.
RICHARD GREEN, sworn
JUDGE CANNONE: Good afternoon.
MR. GREEN: Good afternoon.
MR. YANNETTI: May I proceed, Your Honor?
JUDGE CANNONE: Yes.
DIRECT EXAMINATION BY MR. YANETTI:
MR. YANNETTI: Sir, if you pull that microphone as close to your face as you can so your voice will be kept up, and I'd ask you to state your name and spell your last name.
MR. GREEN: Sure. Richard Green. That's G-R-E-E-N.
MR. YANNETTI: And where do you live, sir?
MR. GREEN: I now reside in Coldwater, Michigan.
MR. YANNETTI: What do you do?
MR. GREEN: I own and operate a company called United States Forensics.
MR. YANNETTI: And what is United States Forensics?
MR. GREEN: Sure, we're a digital investigation firm. We have -- we're licensed in Florida and Michigan, but we do cases across the country.
MR. YANNETTI: All right. And again, I'd ask you to keep your voice up only because we have an air conditioner there, and we have jurors behind me that need to hear you.
MR. GREEN: Okay. I'll --
MR. YANNETTI: As best you can.
MR. GREEN: -- do my best here.
MR. YANNETTI: Yeah, as best you can. Now, you are president of that company, sir?
MR. GREEN: I am.
MR. YANNETTI: In addition to managing the company, what do you do on a day to day basis?
MR. GREEN: Well, I perform the majority of the investigations. I specialize in computer, cell phone, cloud, auto, video, metadata media, surveillance systems, things of that nature.
MR. YANNETTI: Do you work in conjunction with others?
MR. GREEN: Certainly.
MR. YANNETTI: Would you describe that please?
MR. GREEN: Certainly, well we do take cases from individuals. We prefer to take cases from attorneys. So we've also worked with numerous public defenders. We've worked with federal public defender. We've worked with law enforcement. So quite a variety of clientele.
MR. YANNETTI: Civil cases?
MR. GREEN: Yep. Civil and criminal. I would put it about 60 percent criminals, 40 percent civil.
MR. YANNETTI: Okay. And with -- on the criminal side, you've done both law enforcement and defense, correct?
MR. GREEN: Yeah, most of the law enforcement ones, though, have been more geared towards civil is when they had perhaps they were party to a suit, and it was just improper for them to use their own experts.
MR. YANNETTI: I see.
MR. GREEN: So that's where we've provided assistance.
MR. YANNETTI: Now, how long have you been involved in the field of data forensics, sir?
MR. GREEN: Sure. Well, my first case and testimony was 28 years ago. I'm not even sure we called it data forensics back then, but that was 28 years ago. And then about 16 years ago, started the company United States Forensics and been full time in the industry since that point.
MR. YANNETTI: All right. Now, you'd mentioned that you'd actually testified for the first time 28 years ago. That would have been 1996 if my math is correct?
MR. GREEN: That's correct.
MR. YANNETTI: You were qualified as an expert witness at that time?
MR. GREEN: Yes, sir.
MR. YANNETTI: In order to have been qualified as an expert witness, you must have had experience before that?
MR. GREEN: Yeah, it was specifically in computers. We didn't do much with cell phones back then. By about a decade or so in computer IT, networking, we actually built a line of computers, a lot of repairs. So I was pretty deep into the computer IT world at that point.
MR. YANNETTI: And you say you formed your company in 2006?
MR. GREEN: Correct.
MR. YANNETTI: And do you work full time, part time, what's your schedule?
MR. GREEN: It's been full time ever since.
MR. YANNETTI: Would you describe to the jury, please, your educational background, your training certifications, et cetera?
JUDGE CANNONE: Why don't we break it down into smaller sections?
MR. YANNETTI: Sure.
MR. GREEN: Okay.
MR. YANNETTI: First, with regard to your -- the training that you've received.
MR. GREEN: Sure, so the -- that would have to do with an associates of digital forensics.
MR. YANNETTI: Well, that would be your education, right? You received an associate's degree in digital forensics?
MR. GREEN: Correct.
MR. YANNETTI: Okay. So why don't we start with education, since you did.
MR. GREEN: Okay. Well, that was -- that was part of the work and more or less the formal training to get that degree, the certifications, which, again, this all kind of goes hand in Hand, but the certification training would be the CCE, which is computer -- certified computer examiner from the International Association of Criminal Investigation Specialists. I also have a certification as a computer crime related investigator cybersecurity as well as computer first responder. The training aspects in over the last 18 years on really a daily basis when I've worked, I've participated in listservs, done research into the newest developments in the computer forensics, and really, on usually a weekly basis, will target some training seminar. I found in this business, even if you took like six months off, you would start to get behind in this business. It changes that rapidly, and you really need to do continual training.
MR. YANNETTI: Okay. And again, your voice trailed off a little bit at the end so --
MR. GREEN: I'm sorry.
MR. YANNETTI: I'm sorry to keep reminding you, but I just want to make sure everybody hears. With regard to the amount -- you know, your caseload at USA Forensics, can you give the jury some idea of how many cases you handle on a yearly basis or you've handled historically?
MR. GREEN: Yeah, we average I would say between 100 and 120 cases a year. We probably get inquiries to about three times that amount.
MR. YANNETTI: Okay. And have you testified as an expert witness in the area of computer forensics since that 1996 first appearance?
MR. GREEN: Yeah, we've testified about two dozen times in various state and federal courts.
MR. YANNETTI: Okay. And when you say various states and courts, is that state court, federal court, both?
MR. GREEN: Both.
MR. YANNETTI: Now, directing your attention to September of 2022, were you contacted by somebody to become involved in this matter?
MR. GREEN: Yes, sir.
MR. YANNETTI: Do you remember who that was?
MR. GREEN: I believe it was Ms. Little.
MR. YANNETTI: Okay. What were you asked to do?
MR. GREEN: Well, there were three cell phones related to this case and to provide relevance with the data on those phones as it related to the incident on January 29, 2022.
MR. YANNETTI: Okay. And were you aware of the owners of those three phones?
MR. GREEN: Certainly. Karen Read, John O'Keefe, and Jennifer McCabe.
MR. YANNETTI: Now, I'd like to ask you first, if I can, about John O'Keefe's phone. How did you -- how did you receive the data from that phone if you remember?
MR. GREEN: Yeah, we received what's called an image file, and that's a forensic term that we use. Essentially, it's a copy of the data that's encapsulated into a single file. In this case, it was a ZIP file.
MR. YANNETTI: Did you examine that data?
MR. GREEN: I did.
MR. YANNETTI: What were your goals during your examination of John O'Keefe's phone? What were you -- what were you looking for? A Well, initially what was supported was the location data. We wanted to get an idea of when he had arrived, and anything else that we could tell from that as far as location.
MR. YANNETTI: And when you say when he arrived, do you remember the location that you were asked to learn when he arrived?
MR. GREEN: 34 Fairview.
MR. YANNETTI: In Canton?
MR. GREEN: Yes, sir.
MR. YANNETTI: All right. Were you able to determine, as a result of your examination, approximately when his phone arrived at 34 Fairview Road according to the location data?
MR. GREEN: Yes, sir.
MR. YANNETTI: And how did you do it?
MR. GREEN: Sure. Well, we -- I say we, so that's a proverbial we. I extracted the location cache data, which is stored in the -- on your phone, and it's in the certain location. We exported that out and then we use a tool called CellHawk, and we import it in there, so it can take literally, you know, thousands of data points and automate that process to specific GPS locations, and just as importantly, the range of accuracy that that location is reporting.
MR. YANNETTI: Okay. So according to the process that you underwent, what time did the location data indicate that John O'Keefe's phone arrived at 34 Fairview on January 29th of 2022?
MR. GREEN: So the first one right to the driveway was at 12:24 and 28 seconds.
MR. YANNETTI: 12:24 and 28 seconds?
MR. GREEN: Correct.
MR. YANNETTI: Now, if I asked you to filter John O'Keefe's location data within an accuracy of 3 feet using CellHawk, could you try to do that?
MR. GREEN: Yes, sir.
MR. YANNETTI: In fact, did you try to do it?
MR. GREEN: I did.
MR. YANNETTI: When?
MR. GREEN: Last night.
MR. YANNETTI: Who asked you to do that?
MR. GREEN: You did, sir.
MR. YANNETTI: If I may approach, Your Honor?
JUDGE CANNONE: Yes.
MR. YANNETTI: Sir, I placed a document before you. Could you familiarize yourself with that and look up at me when you're done?
MR. GREEN: (Witness complies.) All right.
MR. YANNETTI: Do you recognize that?
MR. GREEN: I do.
MR. YANNETTI: What is it?
MR. GREEN: So this is a screenshot from the CellHawk program. It has a kind of a central box here that says database settings, and this is where we apply a certain filter.
MR. YANNETTI: And what filter did you apply?
MR. GREEN: This was for the accuracy of less than or equal to 3 feet.
MR. YANNETTI: With regard to what?
MR. GREEN: John O'Keefe's location data.
MR. YANNETTI: Is that an exact -- is the -- I'm sorry. Is the data on that document exactly what you received when you, you know, use the CellHawk program to filter the data?
MR. GREEN: Yes, sir.
MR. YANNETTI: I would offer that, Your Honor.
MR. LALLY: No objection.
JUDGE CANNONE: No objection.
MR. YANNETTI: Oh, I'm sorry. I thought you said objection.
JUDGE CANNONE: So you need to give it to Madam Court Reporter.
MR. YANNETTI: I'm all flustered. Sorry.
(Whereupon Exhibit No. 652, Printout CellHawk Program, was marked as an exhibit.)
MR. YANNETTI: And if the witness could have that again.
MR. GREEN: Thank you.
MR. YANNETTI: With permission, I'd like to publish that, Your Honor.
JUDGE CANNONE: Okay.
MR. YANNETTI: So, Mr. Green, what are we looking at?
MR. GREEN: So that is the screenshot from the CellHawk.
MR. YANNETTI: And what can you tell us about what you learned from that exhibit?
MR. GREEN: Well, I'll just use the pointer here. It might help. You can see up in this part here where this is where we apply the filter for 3 feet or less. That'd be the accuracy, and then it actually returns zero results, meaning all of the data within there had an accuracy rating higher than that 3 foot. It could be 5 meters or 10 meters, but none of it was granular enough at a 3 foot or less accuracy level.
MR. YANNETTI: Okay. And if you had to put in an accuracy of within, say, 500 feet, what would you find?
MR. GREEN: Yeah, you would see then a large number of circles, each circle representing the meters that the accuracy would be related to. But what's really important to understand, though, is you don't want to look at just the middle of the circle. That accuracy indicates it could be anywhere in the circle. So if you saw one and it encompassed two or three houses, you could only draw that inference of somewhere in that circle. So it's a -- it's kind of like how the hurricane, they say, don't -- don't just look at the cone, right? Because it could be different than that. Also, the accuracy. This is Apple's best guess what the accuracy is. So it could actually be different than that. It's Apple is using a number of services, and they're giving back the best estimation that they can for the accuracy.
MR. YANNETTI: Okay. So we've talked about the location cache data and where it put John O'Keefe's phone in terms of arriving at 34 Fairview, but was there also Apple Health Data on John O'Keefe's phone during that time?
MR. GREEN: Certainly, yes.
MR. YANNETTI: Is Apple Health Data generally accepted within the forensic science community as being reliable?
MR. GREEN: Well, the Apple Health Data comes from something called Health Kit, but it's integral to the iOS system. So anyone that has an iPhone, you've probably seen Apple Health Data, and what is known to have extremely valuable data that the forensic tools work with and present to us. The degree of accuracy, it depends on the type of data that's being pulled out on the artifacts. For example, steps are known to have an accuracy around 98 percent on the actual steps occurring.
MR. YANNETTI: So if the Apple Health Data returns, for instance, steps -- 20 steps within a certain time period, 98 percent of the timeout was going to be right?
MR. GREEN: That's what studies have shown.
MR. YANNETTI: All right. May I approach the witness, Your Honor?
JUDGE CANNONE: Yes. A You want this back?
MR. YANNETTI: Mr. Green, I've placed another document before you. Do you recognize what that is?
MR. GREEN: Yes, I do. This is a -- this lists out Apple Health Data for -- that was from John O'Keefe's phone on January 29, 2022.
MR. YANNETTI: All right. That came from the data that you received, the image file of John O'Keefe's phone, correct?
MR. GREEN: That is correct.
MR. YANNETTI: I would offer that, Your Honor.
JUDGE CANNONE: Mr. Lally.
MR. LALLY: No objection.
(Whereupon Exhibit No. 653, Forensic Examination Report - John O'Keefe's Apple Health Data, was marked as an exhibit.)
MR. YANNETTI: With the Court's permission, may I publish that, Your Honor?
JUDGE CANNONE: Okay.
MR. YANNETTI: Specifically, I'd like to start with page two, record two. Mr. Green, are you wearing the right glasses to be able to see the scene -- the screen?
MR. GREEN: Yeah, I probably need bifocals here. I keep switching glasses, but --
MR. YANNETTI: Are you able to read what is on the screen? And if it's easier, you can look on your document in front of you. It's page two, record two.
MR. GREEN: Yeah, you know, I think I'm going to have to do that. I can probably still see good enough to do the laser one. I'm sorry, which record is this --
MR. YANNETTI: I'm looking for page two, record number two.
MR. GREEN: Okay. Yes, I have that in front of me.
MR. YANNETTI: Okay. What does record number two show on page two of John's Apple Health data?
MR. GREEN: Sure. So this is the number of meters. It's listed as 87.74 and the time is listed between 12:21 and 10 seconds. And there's a milliseconds after that, but I'll just round it off to the second, if you don't mind. So 12:21 and 10 seconds to 12:24 and 22 seconds.
MR. YANNETTI: Okay. And you said that it showed 87 meters traveled during that time period?
MR. GREEN: Correct.
MR. YANNETTI: And with regard to that same time period 12:21 and 10 seconds, and 12:24 and 22 seconds, please turn to page 5. And, Mr. Bates, if you would zoom in on record number two.
MR. GREEN: I have that.
MR. YANNETTI: Okay. What does record number two reflect?
MR. GREEN: It is the same time period and the steps taken is recorded as 80 steps.
MR. YANNETTI: Okay. And you said the same time period. So again, 12:21:10 to 12:24:22, correct?
MR. GREEN: Correct.
MR. YANNETTI: All right. Now I'd like to direct your attention to page four, record number one. And, Mr. Bates, if you could post that. And you're ready, Mr. Green, if you could tell the jury what that reflects.
MR. GREEN: Sure. So this indicates three sets of floors that represents elevation change. So it doesn't indicate to us up or down, but three steps in the time period for that is 12:22:14 to 12:24:37.
MR. YANNETTI: Okay. Did you say 12:21:14 to 12:22 -- I'm sorry -- 12:24:37?
MR. GREEN: Yeah, yeah. 12:22:14 to 12:47:37.
MR. YANNETTI: I see.
MR. GREEN: Yes.
MR. YANNETTI: And with regard to all of this data, the eighty steps and the three flights of stairs that you mentioned, is it possible to pinpoint where within the time frame that's given those steps or flights of stairs were ascended or descended? A No, the most granular we can get is the time period, and it doesn't -- it doesn't signify as any more likely at the beginning of the time period than at the end of the time period than at some time in the middle. If you think logically, like distance traveled, that doesn't happen at a split moment. It happens over a curt period of time. So it's -- time is a factor in that equation, and this is how the Apple records that data. You got to look at the time overall. Q Okay. So you don't know if it's the steps are bunched up toward the beginning or toward the end, or more evenly spread out?
MR. GREEN: No, I would not be able to tell you that.
MR. YANNETTI: All right. Now, we've discussed the Apple Health Data. I want to go back for a second to talk about the location data on the iPhone. Does that data that you've already talked about in terms of the arrival time that it gave for John O'Keefe's phone at 34 Fairview, does that arrival time fall within or outside the range of 12:21 and 10 seconds or 12:20 -- 12:21 and 10 seconds and 12:24 and 37 seconds?
MR. GREEN: Well, there is -- there certainly indicates an overlap, but it -- the health data is ending after the arrival and we can ...
MR. YANNETTI: Now, I'd like to discuss with you the concept of clocks used by apps on an iPhone.
MR. GREEN: Sure.
MR. YANNETTI: Are you aware of the three different clocks that are used by iPhone apps?
MR. GREEN: I am.
MR. YANNETTI: What are they?
MR. GREEN: We have -- so we have three separate internal clocks. You have a monotonic clock, a base band clock, and a wall clock.
MR. YANNETTI: Okay. And is the wall clock also called the display clock?
MR. GREEN: Yeah, that would be also a common name for that.
MR. YANNETTI: And what is the significance of the existence of three clocks regarding, you know, different times that may show up within these records?
MR. GREEN: Sure. Well, app developers can access Apple program library and they can call upon any of the clocks to use within their apps.
MR. YANNETTI: Okay. Now, in your investigation and examination of this case, did you find examples on this phone of different clocks being used?
MR. GREEN: So in this particular case, I had reprocessed the data with the newest version of the Axiom forensic program. It's similar to Cellebrite or competitors to Cellebrite, and it's -- we use both programs. And this newest version had a feature in there where you can filter for the Waze application. And again, just following up and seeing how this function would filter for the Waze application, and for the first time, we saw this monotonic timestamp being related to the Waze application.
MR. YANNETTI: Okay. I want to show you Exhibit 640.
MR. YANNETTI: If I approach, Your Honor?
JUDGE CANNONE: Sure.
MR. YANNETTI: I've placed Exhibit 640 before you, sir. Do you recognize what that is?
MR. GREEN: Yes, sir.
MR. YANNETTI: What is it?
MR. GREEN: So this is a screenshot from the Magnet Axion Program I was referring to it. It's the 8.1 -- actually, point looks like four two eight --
MR. YANNETTI: Keep your voice up, sir.
MR. GREEN: I'm sorry, yeah. So it's the newest version of the program. And we have a filter for the Waze app, and it's giving us the time stamps associated with it.
MR. YANNETTI: With the Court's permission, may I publish that?
JUDGE CANNONE: You may. A There we go.
MR. YANNETTI: And first of all, are you -- no, that might be probably too small?
MR. GREEN: Okay. Thank you. I'll go off of this one.
MR. YANNETTI: There we go. With regard to what we are looking at there on that part of the screen, what are we looking at, Mr. Green?
MR. GREEN: Okay. So this is listing details of this particular artifact, and you can see that this is bundled at the com.Waze on iPhone. That's a standard bundle type name where it always starts with com dot and then the application reference.
MR. YANNETTI: And what does that mean? When it says -- it's highlighted on the screen, com.dot.waze.iPhone, what does that mean that we're in right now?
MR. GREEN: Yeah, well, this is an artifact specifically related to the Waze program.
MR. YANNETTI: The Waze app?
MR. GREEN: Yes, sir.
MR. YANNETTI: All right. Go on.
MR. GREEN: Okay. And we can see here our entry for the monotonic time, the baseband time, and the display time.
MR. YANNETTI: And what did you notice about the relationship of the three of those?
MR. GREEN: Certainly. Well, most of us -- well, there's the monotonic is running a little over three minutes ahead of the display, so I think it's three minutes and one second give or take a little. So, you know, in a lot of cases, three minutes may not seem like much, but in this case, this struck me as important to --
MR. LALLY: Objection. Move to strike.
JUDGE CANNONE: Sustained. I'm going to strike that. Next question.
MR. GREEN: I apologize.
JUDGE CANNONE: That's okay.
MR. YANNETTI: You can hand that back to Madam Court Reporter.
MR. GREEN: Certainly.
MR. YANNETTI: And I'd like to go back to the Apple Health Data, Mr. Bates. If you could put that back up.
VIDEO PLAYBACK: What page?
MR. YANNETTI: This was to be page two, record number three.
MR. YANNETTI: And do you -- you don't still have that in front of you, do you?
MR. GREEN: Actually I do.
MR. YANNETTI: You do?
MR. GREEN: I do. Page two, record number three, sir. A Yes, sir.
MR. YANNETTI: What does that show?
MR. GREEN: All right. Okay. So this is another entry from John O'Keefe's data, cell phone data, and this records 25 meter -- 25.46 meters occurring between 12:31:56 and 12:32:16.
MR. YANNETTI: Okay. And directing your attention to page five, record number three, if you could tell the jury what that shows, and if we can have that displayed as well, Mr. Bates?
MR. GREEN: Certainly. So this is directly related to the distance, and this is recording 36 steps. And it's the same time period 12:31:56 to 12:32:16.
MR. YANNETTI: Okay. So we have 36 steps being taken according to Apple Health Data on John O'Keefe's phone for a time period that ends at 12:32:16?
MR. LALLY: Objection.
JUDGE CANNONE: Sustained. Ask it differently.
MR. YANNETTI: With regard to those 36 steps, do we know where within that time frame they were taken?
MR. GREEN: Sure, let me -- let me reread that here. We -- January 29, 2022, 12:31:56 a.m. It's actually 12:3156.109 a.m. and 12:32:16.507 a.m.
MR. YANNETTI: Okay. All right. So now I'd like to switch, if we can, to Jennifer McCabe's phone and your analysis of that. During the course of your examination when you reviewed data from her phone, did you find a particular artifact of interest?
MR. GREEN: Yes, I did.
MR. YANNETTI: What did you find?
MR. GREEN: We found a Google search that happened. First of all, the search was "hos long to die in cold" and it happened at or before 2:27 a.m.
MR. YANNETTI: All right. Where was that search found?
MR. GREEN: So that the artifact on that was called a Safari suspended tabs artifact, and there's a database associated with that called the browser DB database, and in a company file, which is by the same name, but ends in WAL, which stands for write ahead log. And the write ahead log is where the data first gets written to, and then at certain points, that data then gets committed and written to the main database.
MR. YANNETTI: All right. So that, if I'm correct, that browser state.db/wal file, that's a temporary file, right?
MR. GREEN: It's temporary by nature, but it's not -- that's not to -- it's integral. It's part of the way the SQLite functions. So it's not like a throwaway file. It's part of the way the whole system works.
MR. YANNETTI: And is it helpful to you when evaluating artifacts?
MR. GREEN: Certainly, yeah. The -- just by nature of it, we'll find a lot of the newest artifacts in that WAL file.
MR. YANNETTI: Now, how do you determine the timing in terms of the time stamp on the browser state.db WAL file?
MR. GREEN: Sure. So the WAL file has different rows and columns. You can kind of think of it as an Excel spreadsheet. And in this one particular column had a -- it was a time column that'd be the nature of the data going into it. And this -- the heading on this particular one was last viewed time.
MR. YANNETTI: Okay. Regarding that Google search for "hos long" and I say hos long, H-O-S long to die in cold --
MR. GREEN: Right.
MR. YANNETTI: -- found in the browser state DB WAL file, what was the date and time for that artifact?
MR. GREEN: Sure. So that's recorded in what's called aplicacao time, and it's actually the number of seconds since January 1, 2001. So you end up with this large number, and that gets converted to present to us something that's human readable and then you have to apply the offset for the local. So once you do all those calculations, we -- that's where we get the January 29, 2022 at 2:27 --
MR. YANNETTI: Okay.
MR. GREEN: -- in the morning.
MR. YANNETTI: And the specific, do you remember the number of seconds after --
MR. GREEN: I believe it's 40 seconds.
MR. YANNETTI: Two twenty-seven forty seconds?
MR. GREEN: Yeah.
MR. YANNETTI: Okay. And in what state did you find that artifact?
MR. GREEN: Yeah, so the specific artifact or it comes from a record, and the record number on this is 4028 I believe, and it was in a deleted state.
MR. YANNETTI: Okay. Now, what would you normally expect to find along with the artifacts, sir?
MR. GREEN: So you'd have the date and time, the URL, which the way the URL presents itself we know that as a Google search, but you also see a history of other places that tab has been.
MR. YANNETTI: And with this particular artifact, did you learn the full Internet history of websites related to that record?
MR. GREEN: No, that wasn't possible. We were only able to get the one website. I would say --
MR. YANNETTI: And --
MR. GREEN: I'm sorry, go ahead.
MR. YANNETTI: No, I interrupted you.
MR. GREEN: So we definitely got the one artifact, the Google search, and we have the time related to it, but we do not know everywhere else that tab had been.
MR. YANNETTI: Okay. What significance was there to you about the fact that the full Internet history related to that record could not be recovered?
MR. GREEN: Well, I wanted to do a little deeper dive into that, and so I used some various other database specific tools. One was called Belkasoft X, which has an excellent database viewer in it. Sanderson Forensics, which is known to specialize in this type of work, and --
MR. YANNETTI: ArtEx?
MR. GREEN: I'm sorry?
MR. YANNETTI: ArtEx?
MR. GREEN: You saved me, yes, ArtEx, which is a program known in the community for research.
MR. YANNETTI: And how did you sort of cross-reference the three of those together. How do you use them?
MR. GREEN: Yeah, so all three of those tools, along with Axiom and Cellebrite, which I did -- they do have a low level SQL viewer as well. So I looked at the data with all five of those tools, and I found it to be consistent amongst all the tools.
MR. YANNETTI: And in addition to using those tools, what else did you do?
MR. GREEN: So I wanted to get a little more context. One thing to with this artifact, it is deleted. And one thing about deleted data, sometimes you get it all back, sometimes you don't, sometimes you get a fragment. Deleted data makes it very difficult to give you the whole picture of what's happening. So in this particular case, I wanted to see how -- what other artifacts were around this time as it related to web history and particularly this browser database file.
MR. YANNETTI: And so what do you compare the 2:27 a.m. search to in order to gain more information?
MR. GREEN: Exactly.
MR. YANNETTI: I'm sorry.
MR. GREEN: What the information was? So what we found is that when we looked at a particular URL, a particular website that was visited, and then search using that URL, the browser state database entry is the last entry in all of that. So we could see searches, videos playing, there's an artifact called Knowledge C that records the user's activity, but the browser state is the very last entry on the items that we observed.
MR. YANNETTI: And did you find other examples of that that you can speak to before this jury?
MR. GREEN: Yes, I believe we have one printed out there.
MR. YANNETTI: Okay. May I approach, Your Honor?
JUDGE CANNONE: Yes.
MR. YANNETTI: I've placed a document before you, sir. If you could familiarize yourself with that and look up me when you're done.
MR. GREEN: I have it.
MR. YANNETTI: What is it?
MR. GREEN: Okay. So this is another screenshot from the Axiom program, and it is showing a search that we conducted for "Raining Men" and then it takes that search, and we have a couple different items on there. We set the date to begin in 1970 ending in 2100. In other words, we only want to see artifacts that had dates associated with them. And then we listed them from the newest date to the oldest date. And this particular one, again, it ends up with the Safari suspended tabs artifact being the very last in the series of dates and times.
MR. YANNETTI: All right. I'd like to go through that, but first I'd offer it into evidence, Your Honor.
JUDGE CANNONE: Any objection?
MR. LALLY: No, Your Honor.
(Whereupon Exhibit No. 654, Printout from Axiom Program - "Raining Men" Search, was marked as an exhibit.)
MR. YANNETTI: And with the Court's permission, may it be published, Your Honor, at this point?
JUDGE CANNONE: Yes.
MR. YANNETTI: Okay.
MR. GREEN: Okay.
MR. YANNETTI: So we have a number of calls here. Could you explain to the jury what's going on with that, et cetera?
MR. GREEN: Certainly. So I'm going to switch glasses out back here. Forgive me.
JUDGE CANNONE: Do you need the light on, sir, are you --
MR. GREEN: No, I'm fine, Your Honor. Thank you much. I can -- I can certainly do this. A So we are looking at here web related history. And also, I had the filter turned on for application usage because there are some log files, sort files that the iPhone keeps track of to record user interactions, and that can give us an idea of the history as well. And then, as I mentioned, we have it filtered, so that's only showing dates, that dates existed, and we took the earliest possible date to a date way in the future, and then it's listed, and next to the date and time, you'll see a little arrow, and it's skinny at the top and big at the bottom. That tells you it's going from small -- earliest time to latest time, and this particular view is showing us the last of that series because what's relevant and really important here is that the Safari suspended state tabs ends up being the last of the entries related to that, not one of the beginning of the entries related to that.
MR. YANNETTI: And what is the significance of this -- the Safari state tab being the last entry? What does that tell you?
MR. GREEN: Well, so it tells us the Internet history happened for that and the purpose of this tab on at least this particular iPhone with this very specific iOS version is to record the state of that tab when the user left that, and the whole purpose of that is, if you're on Safari, you're on a website and say you have to take a phone call or answer a text message and you navigate away from the Safari app, when you come back, it remembers where you were and allows you to pick off from there. It also allows you to hit the tab button and see what other tabs you might have open and navigate to one of those tabs.
MR. YANNETTI: All right. So as I see the last tab, am I correct that the time is 1/29/22, the same day at 2:27 and 38 seconds? Is that what it says on your --
MR. GREEN: I'm definitely getting a pair of bifocals. I apologize here. I feel a little silly. Yes, yes, on this particular one. So that is just moments before the Google search artifact.
MR. YANNETTI: The one that you previously talked about the hos long --
MR. GREEN: The hos long to die in the cold, yes.
MR. YANNETTI: All right. But all the other history of this particular artifact was before that time, correct?
MR. GREEN: Correct.
MR. YANNETTI: So with regard to what that tells you about when the "It's Raining Men" is either searched or accessed, was that after or before 2:27 and 38 seconds?
MR. LALLY: Objection.
MR. GREEN: I'm sorry. Can you --
JUDGE CANNONE: Sustained. A Okay. If you say it one more time.
JUDGE CANNONE: Ask it differently.
MR. YANNETTI: All right. Let me try and put it a different way. Given the time stamp which 2:27 and 38 seconds on January 29, for that Safari suspended state tab with the "It's Raining Men", what did that tell you about the timing of when "It's Raining Men" was accessed by the user?
MR. GREEN: Well, so the indications would be that that tab was brought up and then went away from to add to do another tab. So it can happen less than a second. It doesn't take long to open up a tab and start a new tab. It can be done very quickly.
MR. YANNETTI: I guess I'm not really phrasing this the right way to get I want. What I want is the timing of the interaction with "It's Raining Men" by the actual iPhone user. When did that happen?
MR. GREEN: Certainly. All the activity that we have is all prior to the recording of this -- of that time stamp --
MR. YANNETTI: Okay.
MR. GREEN: -- in the browser state.
MR. YANNETTI: All right. Now, with regard to this particular example where the browser state DB is, the last entry, so the activity happened before, was that unique to on this phone, or was -- were there many examples of this?
MR. GREEN: No, I found many examples of this exact behavior.
MR. YANNETTI: All right. Now, given your findings in researching these issues and how this user used this iPhone with this iOS, do you have an opinion to a reasonable degree of scientific certainty as the time -- as to the timing of that search for, "hos long to die in cold?"
MR. LALLY: Objection.
JUDGE CANNONE: Sustained.
MR. YANNETTI: Do you have an opinion to a reasonable degree of scientific certainty as to when "hos long to die in cold" was searched?
MR. LALLY: Objection.
JUDGE CANNONE: Sustained, I can see you at sidebar.
MR. YANNETTI: Thank you.
(Sidebar commences:
JUDGE CANNONE: The nature of the objection.
MR. LALLY: Reasonable degree of scientific certainty. I don't think this witness is qualified to give that kind of opinion.
JUDGE CANNONE: I agree.
MR. YANNETTI: Why would that be? I mean he's been working --
JUDGE CANNONE: You haven't qualified him anywhere in there an expert to scientific degree certainty.
MR. LALLY: If I can clarify, Your Honor, I have no issue with counsel asking him what his opinion is.
JUDGE CANNONE: Right.
MR. LALLY: Qualifying him in those terms, I don't think is appropriate.
MR. YANNETTI: Okay. Well, I'll take it if I can't get the --
JUDGE CANNONE: You cannot get the scientific certainty from this witness from the testimony I've heard. Okay.
end of sidebar.)
JUDGE CANNONE: So we're all set, Mr. Yanetti.
MR. YANNETTI: Yes, Your Honor.
MR. YANNETTI: Okay, sir. Do you have an opinion as to the timing of that first search for "hos long to die in cold"?
MR. GREEN: Yes, I do.
MR. YANNETTI: What is that opinion?
MR. GREEN: That that would have happened at or before January 29, 2022, at 2:27:40 a.m. in the morning.
MR. YANNETTI: And what is the basis for your opinion?
MR. GREEN: Again, by how this particular phone operates with that exact operating system, and comparing to other data on that phone and the way it presented it out -- itself is all consistent with that search happening at or before that time.
MR. YANNETTI: And what opinions or conclusions did you reach regarding how, if any, how the 2:27 a.m. search was deleted?
MR. GREEN: Well, we know that that's in a deleted state, and importantly, on that phone is we -- I (indiscernible) I use the proverbial we. I found a lot of other -- that would have been used or deleted artifacts between midnight and the early mornings on January 29, 2022.
MR. YANNETTI: Okay. Are you aware of any internal mechanisms that could have caused that deletion?
MR. GREEN: No, not -- not in this particular case. I know of no mechanism that would've that.
MR. YANNETTI: All right. And you mentioned deletion -- other deletions on the phone. I want to show you what has been marked, if I may approach, Your Honor, MMM for identification. Do you recognize what I've placed before you, sir?
MR. GREEN: Yes, sir.
MR. YANNETTI: What is it?
MR. GREEN: This is from Cellebrite. It's a program, again, like the Axiom that processes data, and this is a -- this lists out a -- that's a 623. This lists out a deleted call record.
MR. YANNETTI: Okay. Are you able to see from that record to whom the call was placed?
MR. GREEN: Yeah, well, we have the number, and I won't necessarily read it out loud here, but through searching -- and this is from the phone of Jeffrey McCabe.
MR. YANNETTI: Yep.
MR. GREEN: But through searching for that -- the number, I was able to see that it went to -- do you want me to say the name?
MR. YANNETTI: Sure.
MR. GREEN: Yeah, Uncle Brian A.
MR. YANNETTI: Okay. I would offer that into evidence, Your Honor.
MR. LALLY: Same objection as before, Your Honor, as when this was -- may we approach?
JUDGE CANNONE: Okay.
(Sidebar commences:)
MR. LALLY: Sorry. I just wanted to clarify. So it's the same objection as before as to the previous time when this particular item was offered as an exhibit, and that being that this is a one random piece pulled out of a phone extraction with no context, no content --
JUDGE CANNONE: So we needed to find, like, what exhibit number it is.
MR. YANNETTI: I've got it. That's where I'm going next.
JUDGE CANNONE: Okay. I would have liked to have known that first. We wouldn't have had to come to sidebar.
MR. YANNETTI: No, I understand. I was going to get it in a -- maybe I should've done it the reverse way. I should have introduced the full log and then --
JUDGE CANNONE: The full log's in evidence, right?
MR. LALLY: I believe so.
JUDGE CANNONE: It's the extraction of --
MR. YANNETTI: You mean the call log of Jennifer McCabe. I wasn't sure that it was in evidence. I got it -- I have it right now and was going to introduce it. If it has an exhibit number, I'd prefer to use that, obviously.
MR. LALLY: Right. And that's what I would prefer.
MS. LITTLE: Is that it? You have it.
JUDGE CANNONE: So I can't hear you at all, Ms. Little, and I don't know if you're saying something into the record, or if you're just informally talking to Mr. Lally.
MS. LITTLE: Sorry. I didn't mean to interrupt. I just wanted to see if we could see the actual exhibit because I don't think it's been presented in court.
MR. LALLY: Again, I didn't look for it yesterday, and I apologize for that.
JUDGE CANNONE: So it's Jen McCabe's call log?
MR. YANNETTI: Yes.
JUDGE CANNONE: Troy.
(The Court and Court Officer confer.)
COURT CLERK: Ninety-eight and ninety-nine.
MR. YANNETTI: Okay. I just want to make sure it's what I have. If I can take a look at it.
COURT CLERK: And 94, 95.
JUDGE CANNONE: Ninety-four and ninety-five.
COURT CLERK: Also.
JUDGE CANNONE: Also.
MR. YANNETTI: I wonder if it was piecemeal.
MR. LALLY: It was.
JUDGE CANNONE: All right. So I'm just going to let you put that in.
MR. YANNETTI: Okay.
JUDGE CANNONE: It'll have its --
MR. YANNETTI: All right. Thank you.
end of sidebar.)
JUDGE CANNONE: So, folks, we're trying to streamline the exhibit numbers. It looks like this may already be in evidence. It's got four different numbers, so I sort of wanted to keep it with that. We are so far removed from where it was that this will just come in as the next exhibit. So you will technically have it in evidence twice.
(Whereupon Exhibit No. 655, Cellebrite Extraction Report of Jen McCabe's 6:23 a.m. Call to Brian Albert (formerly MMM for ID), was marked as an exhibit.)
MR. YANNETTI: Thank you. May I approach again, Your Honor?
JUDGE CANNONE: Yes.
MR. YANNETTI: And I've placed one final document before you. If you can identify that for the jury, please?
MR. GREEN: Yes. This is another report generated out of Cellebrite. It's based on Ms. McCabe's cell phone data, and this lists out the call log with a number of deleted items and number of live items.
MR. YANNETTI: I would offer that, Your Honor.
MR. LALLY: If I get to see.
MR. YANNETTI: Sorry.
MR. LALLY: I think it's already in evidence as well.
MR. YANNETTI: Actually, it's -- I confirmed it's not. It's not yet in evidence. We looked at the exhibits that were specified.
(Whereupon Exhibit No. 656, Cellebrite Extraction - Jen McCabe's Call Log, was marked as an exhibit.)
MR. YANNETTI: Thank you. If you could hand that to the witness, and if I could have you the first of that exhibit displayed.
MR. YANNETTI: Okay. With regard to that exhibit, Mr. Green, what did you find that was unusual, if anything?
MR. LALLY: Objection.
JUDGE CANNONE: Sustained. Ask it differently, Mr. Yanetti.
MR. YANNETTI: Yes.
MR. YANNETTI: What did you find of note?
MR. GREEN: Certainly. What was the time frame of the deleted records. Now, I'll just talk about this particular report here. It starts at 5:33:47 in the morning, and on the second page we see it ends at 8:50 and 15 seconds, again, a.m. And then the normal recalls, what we call live data, then begins at 8:59 and 34 seconds, and goes on throughout the day with no more -- with no additional deletions.
MR. YANNETTI: And am I right that those are all in fact calls -- those are all phone calls?
MR. GREEN: Correct. Yeah, this is a call log.
MR. YANNETTI: And what was the difference between the calls that were at 8:59 and after on January 29, 2022, and the calls that were before -- after or before 8:50 a.m. on January 29th of 2022?
MR. GREEN: Yeah, well, it's the state they were found in.
MR. YANNETTI: And --
MR. GREEN: Deleted versus live data.
MR. YANNETTI: I'm sorry?
MR. GREEN: Deleted data at the earlier time and live data after the 8:59:34.
MR. YANNETTI: What percentage of phone calls were found deleted on Jennifer McCabe's phone prior to 8:50 a.m. on January 29?
JUDGE CANNONE: All right. I have to see you. Take this down for a minute, please. I have to see counsel.
(Sidebar commences:
JUDGE CANNONE: So unlike the other exhibits, none of these phone numbers are redacted.
MR. YANNETTI: Okay.
JUDGE CANNONE: And they've just been displayed on television.
MR. YANNETTI: I wasn't aware of that. We'll have to redact them.
JUDGE CANNONE: But you put it in.
MR. YANNETTI: No, I understand. I wasn't concentrating on that. I apologize. I didn't mean to do that.
JUDGE CANNONE: So you're no more displaying this --
MR. YANNETTI: That's fine.
JUDGE CANNONE: -- exhibit.
MR. YANNETTI: We're done.
JUDGE CANNONE: And I'm going to take it from your witness now.
MR. YANNETTI: Okay.
end of sidebar.)
JUDGE CANNONE: Sir, may I have that exhibit, please?
MR. GREEN: Yes.
(Sidebar commences:
JUDGE CANNONE: Tony should not have to find this. I couldn't see from a distance what the numbers were, but if you intend to put anything into evidence, the number is supposed to be redacted --
MR. YANNETTI: Of course.
JUDGE CANNONE: -- before it goes into evidence. This shouldn't happen, especially this late in the game. All right. So that needs to be redacted. It'll be right here on my desk. You're not to refer to it or display it anymore.
MR. YANNETTI: Can I ask questions about the content of it without displaying it and without talking about the particular phone numbers? I just want to conclude my examination.
JUDGE CANNONE: Yes.
end of sidebar.)
MR. YANNETTI: So, Mr. Green, I'm not sure if that question was clear, or if you understood it. If it's not, please let me know. But I had asked you from the first recorded call there that was listed as deleted until 8:50 a.m. or so, what percentage of calls were deleted on Jen McCabe's phone within that time period?
MR. GREEN: So we found no live data, so 100 percent of them would have been deleted.
MR. YANNETTI: Now, are you aware of the term spontaneous deletion?
MR. GREEN: No, sir. I know what the individual words mean, but in relation to digital forensics, I'm not familiar with that term.
MR. YANNETTI: And do you have an opinion as to how those calls would have been deleted from that phone?
MR. GREEN: Those who have been user deleted.
MR. YANNETTI: If I may have a moment?
JUDGE CANNONE: Sure.
MR. YANNETTI: I have no further questions. Thank you, sir.
CROSS-EXAMINATION BY MR. LALLY:
MR. LALLY: Good afternoon, sir.
MR. GREEN: Good afternoon, sir.
MR. LALLY: Now, do you know who a Ms. Jessica Hyde is?
MR. GREEN: I do.
MR. LALLY: Are you aware that she wrote a report in relation to this case?
MR. GREEN: Yes.
MR. LALLY: And specifically, in regard to the Google searches from Ms. McCabe's phone that you were just talking about?
MR. GREEN: Yes, sir, it was very specific about that search.
MR. LALLY: And have you had a chance to review that report?
MR. GREEN: I have.
MR. LALLY: You also know who a Ian Whiffin?
MR. GREEN: Certainly, yes.
MR. LALLY: And are you aware that he wrote several reports or submitted several items in relation to, again, the exact topic that you're testifying about in relation to the Google searches on Ms. McCabe's phone?
MR. GREEN: Yes, sir, I understand that.
MR. LALLY: And have you had a chance to review those materials as well?
MR. GREEN: Yes, sir.
MR. LALLY: And you understand that they both disagree with what your opinion is in relation to those searches, correct?
MR. GREEN: I absolutely understand that, sir.
MR. LALLY: Okay. Now, just as far as your qualifications and certifications go, I'm just having a difficult time. From the certifications that you have, at what point were you -- well, what if any certifications do you have with reference to Cellebrite as a tool as far as your use and interpretation of data from Cellebrite?
MR. GREEN: Certainly. So my certifications are much more broad. They have to do with a lot of the fundamentals in how we conduct the investigations, and what tools we should know, and when we need to know we need to do more work and such like that. Cellebrite, I do not have any specific Cellebrite certifications. They offer many of them, however, I -- I've participated in, god, I can't even count, hundreds of their training events that they offer, both Cellebrite, Axiom, Belkasoft, they all provide the community with fantastic support as far as that. And although certainly a class can be very good, but you really need to stay up to speed, you've got to participate in the most recent understanding being put out there. Even in the changes of their tools, will change from one version to another.
MR. LALLY: And so to the point as far as you have no certifications in regard to Cellebrite as a tool and how to use it, those kind of things?
MR. GREEN: That's correct, sir.
MR. LALLY: Okay. And in this specific instance, at any point did you reach out to Cellebrite to go over sort of your findings or your opinions in relation to this search?
MR. GREEN: I did.
MR. LALLY: And who, if anyone, did you speak with from Cellebrite?
MR. GREEN: As close as I can remember, I know it was Leo and I believe it was Santos.
MR. LALLY: And do you know what part of Cellebrite they work in and what they do?
MR. GREEN: Well, he was in the technical support and contacted him. He had informed me that they had elevated this up the -- to some higher level technical support when they came back. His comments to me, when I hear them, was that this --
MR. LALLY: I didn't ask for his comments.
MR. GREEN: Okay. I understand.
MR. LALLY: But at some point you talked to technical support; is that correct?
MR. GREEN: Absolutely.
MR. LALLY: And they indicated that they would refer you to actually Mr. Whiffin's team?
MR. GREEN: No, sir, they did not.
MR. LALLY: So you weren't told that you were referred to Mr. Whiffin's team, and you weren't contacted by anyone from Mr. Whiffin's team?
MR. GREEN: No, and I forget the exact date. A couple weeks ago, maybe a month ago, out of the blue, I got an email from Mr. Whiffin saying and I can't -- I don't want --
MR. LALLY: I'm not asking you --
MR. GREEN: I don't want to misquote him.
MR. LALLY: No, no, no. And I'm not --
MR. GREEN: Certainly --
MR. LALLY: -- I'm not asking you about any specific conversations that you had.
MR. GREEN: Okay.
MR. LALLY: What I'm asking and I'm asking about a time period more back in 2022.
MR. GREEN: I'm sorry. I couldn't quite hear you.
MR. LALLY: Back in 2022, did you reach out to Cellebrite in relation to this search and your opinions related to it?
MR. GREEN: Yes, sir.
MR. LALLY: And at that point was that the point that you spoke to someone from technical support?
MR. GREEN: Yes, sir.
MR. LALLY: And at that point, did someone from technical support actually refer you or tell you that they were referring you to Mr. Whiffin's team?
MR. GREEN: No, sir, I had absolutely no idea about that.
MR. LALLY: And so no one from Mr. Team -- no one from Mr. Whiffin's team reached out to you, and then you just never called them back. That didn't happen?
MR. GREEN: Not that I'm aware.
MR. LALLY: Now, you were asked to look at a couple different phones, and I'm assuming by counsel for the defendant, correct?
MR. GREEN: Can you say that once again? I'm sorry.
MR. LALLY: Sure. You were asked to look at three different phones is what your testimony was?
MR. GREEN: Correct.
MR. LALLY: And I'm assuming that was by some counsel for the defendant, correct? No one else asked you to look at these phones, correct?
MR. GREEN: Oh, correct. Yes, it was from the defense asked me to, yes.
MR. LALLY: And so the phones that you were asked to look at where Mr. O'Keefe's phone, the defendant's phone, and Ms. McCabe's phone, correct?
MR. GREEN: Correct.
MR. LALLY: Now, as far as Kerry Roberts's phone, were you ever asked to look at that?
MR. GREEN: No.
MR. LALLY: And with respect to the defendant's phone, was there any GPS location information or data that you observed in her phone?
MR. GREEN: So we had an indication that location had been using. There was something called Apple map tiles, and those probably when you use the Apple map app that it in order for it to work, it will create these little tiles or little pieces of pictures, and they get stitched together to give you the view that you see on your phone. Now, for that had to be working, we know location data had to be working. This particular location data, the location data cache, is known to only be present on the phone for a couple weeks. Now, what I don't know -- and, Mr. Lally, if I'm going too far, just please stop me. What I don't know, what measures were taken to preserve that data, whether it was put in airplane mode, whether the location services were turned off, whether it was put in a Faraday bag. And quite frankly, Mr. Lally, I don't know if they did all that, if the location data were to remain or not. I've never tested that. But all indications, it would have had location data on the day that it was seized, because we received the Apple map tile, but when I got the full extraction, there was no location data there. Now, I did observe --
MR. LALLY: So there was no GPS location data on the defendant's phone, correct? From what you observed?
MR. GREEN: And, again, if I'm --
MR. LALLY: All I'm asking you is --
MR. GREEN: There was -- I did find deleted location data from April of 2022.
MR. LALLY: Okay. Now, with respect to the defendant's phone, did you also find deleted web history data from the afternoon of January, 29 2022?
MR. GREEN: No, I'm sorry I didn't observe that.
MR. LALLY: Didn't observe it or didn't look for it?
MR. GREEN: You know, I really don't have a recollection if I specifically look for deleted data. I don't believe I did. I don't know if I would have had to have a cause to.
MR. LALLY: Now, with reference to you were asked a question about location accuracy within 3 feet, and you did some sort of thing last night on CellHawk using that tool; is that correct?
MR. GREEN: Certainly.
MR. LALLY: And you were asked to do that after Trooper Guarino testified yesterday; is that correct?
MR. GREEN: I understand he testified yesterday.
MR. LALLY: And so with relation to you creating sort of that document, and that's now been marked as an exhibit, was that something that Mr. Yanetti asked you to do in relation to Trooper Guarino's testimony yesterday?
MR. GREEN: Well, in all fairness you need to ask Mr. Yanetti. I can make an assumption here. I mean, if --
MR. LALLY: I'm not --
MR. GREEN: I'm not trying not to answer you, you know, but I was asked by Mr. Yanetti to perform that search.
JUDGE CANNONE: So, Mr. Lally, please be cognizant of the court reporter.
MR. LALLY: Yes, Your Honor.
MR. LALLY: So, Mr. Green, with respect to that 3 feet of accuracy, are you aware that what Trooper Guarino was testifying to in regard to that had absolutely nothing to do with phone applications or anything to do with data from phone or CellHawk or a tool or anything like that?
MR. GREEN: No, I don't know the full extent of what Mr. Guarino would have been testifying to.
MR. LALLY: And so you're not aware that his testimony was actually in regard to reviewing cruiser camera video from the Canton Police Department and photographs of where Mr. O'Keefe's body was and then mapping that using GPS, latitude and longitude --
MR. YANNETTI: Objection.
MR. LALLY: -- based on that within a 3 feet accuracy?
JUDGE CANNONE: The objection is sustained. Ask it differently.
MR. LALLY: Sure.
MR. LALLY: Are you aware of any of what Trooper Guarino testified to yesterday?
MR. GREEN: What you're mentioning, I may vaguely be remembered. Again, I'm not trying to not answer your question exactly. My conversation with Mr. Yanetti can -- is -- is 3 foot when it comes to GPS data, you know, can you tell 3 feet from GPS data? And no, it's not known to be that reliable, and particularly Apple location services. How that applies to the trooper's testimony, you know, I can't say with specificity. I'm happy to opine on location data, though.
MR. LALLY: There was no question before you, sir.
MR. GREEN: Okay.
MR. LALLY: But that's -- thank you.
MR. LALLY: If I may have a moment, Your Honor?
JUDGE CANNONE: Sure.
MR. LALLY: Now, sir, with reference to Safari and deleted tabs, isn't it true that there is no way for a user to delete a tab only to close it? Would you agree with that?
MR. GREEN: Yeah. Well, when you -- when you close a tab, all right, you're taking it out of the active state, and it's going to an inactive state and some people could call it deleted. Now, the Safari history allows you to go in and delete history by certain date ranges, but you can also go into specific websites that you visited and delete those. Now, you -- if you want me to continue. The WAL file itself, you can't open up a WAL file and say, I want to delete that record, but functioning the phone to the user interfaces will have an effect of deleting data within that WAL file.
MR. LALLY: And isn't it also true that Cellebrite uses that red X to annotate that the record is no longer active and has been recovered that make it incumbent upon the examiner, being you in this instance, to determine if it was actually deleted, correct?
MR. GREEN: Yes, sir. Thank you for asking. Yes.
MR. LALLY: That's all I'm asking, sir.
MR. GREEN: Okay, all right.
MR. LALLY: And you stated in your affidavit, in your testimony, that you use the Sanderson SQLite or SQLite Forensic Explorer to examine the Safari tabs DB associated with the -- with the WAL file log; is that correct?
MR. GREEN: Yes, sir.
MR. LALLY: Now, in your analysis using that Sanderson Forensic Explorer, was there an indication that "hos long to die in cold" was found in the WAL file?
MR. GREEN: Yes, sir.
MR. LALLY: Now, with regard to that, did you independently verify the cause of that timestamp that you observed there?
MR. GREEN: Yes, sir.
MR. LALLY: Now, is it your interpretation that the time stamp means the search appeared at that time solely based on the naming of the field in the database?
MR. GREEN: No, sir.
MR. LALLY: Now, can a WAL file contain items that are so new that they're not yet committed to the database?
MR. GREEN: Yes, sir, that's the purpose of it.
MR. LALLY: So the WAL file holds the newest information until it's merged to the database, including additions, deletions, changes, all of those items, correct?
MR. GREEN: That is correct.
MR. LALLY: Now, according to your affidavit, the device was in active use between 2:23 a.m. and 2:31 a.m., and just to be clear, I'm talking about Mr. McCabe's device, correct?
MR. GREEN: Correct.
MR. LALLY: And what other searches did you see at that time and where were they performed?
MR. GREEN: I'm sorry, can you repeat that? I couldn't quite hear.
MR. LALLY: What other searches did you observe in that time frame and where would they performed?
MR. GREEN: Well, there were a number of websites, including the "Raining Men" exhibit that we did. There was Ozone Basketball I believe. There was Hockomock (indiscernible). I can tell you that those similarly, the last entry with those there is the browser state DB file. It's not at the beginning. It's not at the end, and I have a couple thoughts on why that may be in regards to Ms. Hyde and Ms. Whiffin. I'm happy to share those with you.
MR. LALLY: I'm not asking you anything about that, sir.
MR. GREEN: Very good.
MR. LALLY: What I'm asking is, is it possible for a change request in the WAL to a SQLite database pertaining to one particular field leaving the other fields as what they were previously?
MR. GREEN: And I want to answer your question as well as I can, so can you repeat that one more time?
MR. LALLY: Sure. Is it possible -- is it possible for a change request in the WAL to a SQLite database pertaining to one particular field, leaving the other field as what they were previously?
MR. GREEN: I'm having a little trouble answering this. So if I'm understanding correctly, when the WAL file gets written to the database, could that have made the change ending with this deleted record, is that the question? Am I -- I'm sorry, I'm sorry. I want to answer you. I just --
MR. LALLY: That's okay.
MR. GREEN: -- a little lost on how you're asking that.
MR. LALLY: Do you not understand the question?
MR. GREEN: Sorry?
MR. LALLY: Do you not understand the question?
JUDGE CANNONE: Why don't you move on, Mr. Lally.
MR. LALLY: Sure.
MR. LALLY: Is it possible that the URL field, which has the website name, was updated to the newest search while the time stamp retained the original search; is that possible?
MR. GREEN: No, not the way, on this particular phone, in this particular iOS, and also with the user interacted with it, it would have been at the 2:27 or before the way this very specific iOS was happening that is consistent with all the other ones that I observed out there on the phone related to specific web searches and activity.
MR. LALLY: So was it possible that the search for "hos long to die in the cold" at 6:24 a.m. was the most recent search completed in the tab?
MR. GREEN: Well, not in that tab, but I certainly agree with you that there was a second search done at around that time.
MR. LALLY: Now, is it also possible that the search that you assert took place at 2:27 and 40 seconds in the morning is the same as the search that took place at 6:24:51 a.m. for that same search to have --
MR. GREEN: That's inconsistent with the actual data I'm seeing on this actual phone with this precise iOS version.
MR. LALLY: Now, as far as a search in Safari with the string as far as the SMOTOT.apple.com included, is it -- do you recall that search as far as being a suggestion from Apple from the iOS as far as the search with how long to digest food?
MR. GREEN: Okay. I didn't hear your whole question, but I heard the last part about how long to digest food. So I can opine on that. So my feeling on that is when the "hos long to die cold" was put in, that that was most likely an Apple suggestion, and I've done some testing now. The time period I'm doing my testing, I know it's after the fact that this would have actually occurred, but as I tested that on a live phone and using a Google search, I could see that how long to digest food would come up. I also noticed a -- the specific phrase, how long does it take to die from hypothermia. So as we do this Google search, we try to repeat what's being done, those are two suggestions that actually came up.
MR. LALLY: And so that was something that was a suggestion and not something that was actually searched, correct?
MR. GREEN: Yeah, no, I -- and I know that's different from my affidavit from about a year and a half ago --
MR. LALLY: That's what I'm about to ask you, sir.
MR. GREEN: -- in all fairness but --
MR. LALLY: That's entirely different from what you wrote in your affidavit, correct?
JUDGE CANNONE: One person, Mr. Lally.
MR. GREEN: I'm sorry.
JUDGE CANNONE: One person at a time.
MR. LALLY: Yes, Your Honor.
MR. GREEN: Okay. So, yeah, in fairness, I want to give you the -- my best knowledge as I understand it saying here today including after my review of Mr. Whiffin and Ms. Hyde's report. So I want to do everything I can to shine as much light and clarity on this as possible. So as I repeated, you know, since that time, and did the search, I would notice that that is one of the things that would come up, and it would have a little picture of like a dinner plate or something like that, and there was actually a similar, if not the same, picture found in the artifacts of that phone.
MR. LALLY: And so just to conclude, that's not what you said in your affidavit that was actually filed under pains and penalties of perjury with this Court, correct?
MR. GREEN: Yes. And on that day, that is what my true and proper belief was. Okay. It -- since further testing, I have found that I now believe that that was probably an automatic one, and if I've caused you any distress, I apologize.
MR. LALLY: You haven't caused me any distress.
MR. GREEN: Okay.
MR. LALLY: But what I'm asking, sir, is that you -- that's what you filed because that's what you thought at the time, correct?
MR. GREEN: Yes, sir.
MR. LALLY: And subsequently, you've done further testing, and that's shown that you were wrong, correct?
MR. GREEN: That is correct.
MR. LALLY: Now, according to your affidavit, there was a search for how long to digest food at 6:23:49 a.m. that precedes the search for how long to die in the -- the misspelling here would be the key -- clkd at 6:23:51 A; is that correct?
MR. GREEN: Yes, sir.
MR. LALLY: Now, is it possible that the how long to digest food was a predictive suggestion from Apple rather than a search entered by the user; is that also correct?
MR. GREEN: I don't know. I don't know the answer to that. I believe that it was -- if it had picked up an earlier search from 2:27 of "hos long to die in the cold" and then you went to retype it in, it may have then tried to give you something similar at the 6:23 and 6:24 timelines. Hopefully, that answers your question.
MR. LALLY: So steps -- going to Mr. O'Keefe's health data. Steps doesn't necessarily mean that someone is physically taking steps, correct?
MR. GREEN: Again, the research has done for this is steps tend to be a very accurate artifact.
MR. LALLY: So steps cannot also be coincided with, say, movement in a car or other sort of movement of the phone as far as the health data is concerned?
MR. GREEN: Sure. Well, I did, geez, quite some time ago, do some testing with an actual iPhone 11, the same make and model, and took a drive and tried to see if it would register steps. It did not. I sat in a chair and tried to duplicate how I thought I would walk to see if it recorded steps. It did not. I took the phone from the floor to the ceiling to see if it would record a flight of stairs. It did not. The only -- with that iPhone 11, same make and model that I got, it was very consistent with me actually doing and doing walking steps, and that was whether I had it in my shirt pocket, my pants pocket, or clipped onto my belt.
MR. LALLY: That's your testimony?
MR. GREEN: That is my testimony. Yes, sir.
MR. LALLY: Okay. Now, are you familiar with GPS native locations?
MR. GREEN: Yes, sir.
MR. LALLY: And GPS native locations takes -- its data as far as defining latitude and longitude from a number of different sources, correct?
MR. GREEN: Well, it -- true GPS, okay, it's going to take it from the GPS network. What you may be thinking of is assisted GPS, which the iPhone uses, and that assisted GPS will try to -- it kind of does a crowdsourcing. So it will look at cell towers, what's in range as far as like WiFis and a number of other devices, try to get you an enhanced GPS location, and give you the best data possible.
MR. LALLY: So it takes the GPS native locations within an Apple iOS device, takes it from four different sources; isn't that correct?
MR. GREEN: It tries to get from a variety of sources, like I just mentioned, not all would be available.
MR. LALLY: Now with regard, did you look at any GPS native location data with regard to Mr. O'Keefe’s phone?
MR. GREEN: Yes, sir.
MR. LALLY: And would you agree then that the GPS native locations didn't record any movement of that phone after 12:25 a.m.?
MR. GREEN: Twelve twenty-five. You know, I would have to look at the exhibit to see what the time of that last entry was. I don't want to misstate something to you, sir.
MR. LALLY: Now, you were asked about sort of the elevation change and three floors - ascending, descending, and saying that you couldn't pinpoint a time period or within that 12:21 to 12:24 time period from the health data; is that correct?
MR. GREEN: Correct. It happened somewhere within that time.
MR. LALLY: Could you pinpoint, more specifically, if you looked at the GPS native location data?
MR. GREEN: No. Well, we're talking Apple Health and GPS location. So I'm --
MR. LALLY: You said you couldn't do it --
MR. GREEN: I'm sorry. Which one are you asking about? Please -- please.
MR. LALLY: What I'm asking is you said you couldn't pinpoint it within the GPS health data. What I'm asking is, if you had looked at the GPS native location data, could you give a more specific pinpoint --
MR. YANNETTI: Objection.
MR. LALLY: -- as to where Mr. O'Keefe's phone was?
JUDGE CANNONE: I'm going to allow that.
MR. YANNETTI: May we be seen?
JUDGE CANNONE: Okay.
(Sidebar commences:
MR. YANNETTI: Mr. Lally did not do this intentionally, but he called it GPS health data. I think he's either talking about Apple health data or GPS location data, and that was --
JUDGE CANNONE: I heard him say -- I did not hear it as GPS.
MR. YANNETTI: Oh, that's what I heard.
JUDGE CANNONE: Okay.
MR. YANNETTI: So it's fine -- I don't have any problem with him just restating the question. I just want to make sure he's being given an accurate question. That's all.
JUDGE CANNONE: Okay.
MR. YANNETTI: Thank you.
end of sidebar.)
MR. LALLY: Now, to be clear, sir, you had indicated earlier in your testimony that the elevation change from 12:21, 12:24, you could not pinpoint where in that time period or specifically where in that time period the elevation change occurred, correct?
MR. GREEN: That's correct. It's a time range, yes, sir.
MR. LALLY: So what I'm asking is, had you looked at that in the GPS native location data, would you have been able to more accurately or specifically pinpoint when that occurred?
MR. GREEN: Okay. So the location are you --
MR. LALLY: Yes or no.
MR. GREEN: -- looking for a yes or no? I'm sorry.
MR. LALLY: Yes or no.
MR. GREEN: There was, yes, there was location data within that time period.
MR. LALLY: And are you aware that Mr. O'Keefe's phone from the GPS native location data was actually a half mile away from 34 Fairview Road at the time that it made those recordings in the GPS Apple Health Data?
MR. GREEN: Right. Yes, I understand he was using Waze and it had made that recording. I understand that. That's why the finding that three minute and one second offset brings into serious doubt if that time was accurate, and when you apply that to the location offset, then the Apple Health Data and the GPS all aligns. Now, I cannot -- I have not decoded Waze and found out what functions they were calling and all that. And I don't mean to indicate that I have. I mean that the latest version of Axiom is bringing that up as an artifact and a time stamp related to Waze, and in the case of here where minutes are important, I thought it proper that I bring this to the attention of the case as it -- as a possible explanation.
MR. LALLY: As a possible explanation?
MR. GREEN: As a possible explanation, sir, yes.
MR. LALLY: Now, the three different clocks that you were talking about, are you aware that those are actually associated to power usage and not applications?
MR. GREEN: Right. That power usage was directly related to the Waze application.
MR. LALLY: So it's your testimony that those three plots apply to the times in Waze; is that your testimony?
MR. GREEN: I'm saying that the time stamps were directly related to Waze. It was reported by Axiom. When you apply the filter and say show me every other artifacts Waze, these were artifacts that came up related to the Waze bundle. So I guess you need to give it the weight it deserves. Like I said, I've not decoded Waze. That's not something that has been done, but I think we need to consider the three minute offset as it applies to giving significance to the Apple Health Data and the Waze GPS.
MR. LALLY: Now, turning to Ms. McCabe's phone again as far as the search, what you indicated as last view time. Are you aware that that is actually related to a time that it was actually focused on the screen as opposed to your interpretation of it?
MR. GREEN: I'm aware that from that that appears to be the last state -- time and date it was focused, and when it was no longer was focused, that's when the timestamp was written. That's what's consistent with the other data on this particular phone on this very specific iOS.
MR. LALLY: Now, with regard to looking at this search, you mentioned that you used something called an ArtEx tool; is that correct?
MR. GREEN: Yes, sir.
MR. LALLY: And are you aware that's a -- that's a tool that was actually created by Mr. Ian Whiffin?
MR. GREEN: Absolutely.
MR. LALLY: And with regard to -- with regard to this specific issue, as far as how this interpret -- this data is being interpreted from the browser state DB versus the Knowledge C database and the WAL file and all of those -- the P list and all of those other kinds of things, as far as the misinterpretation of the data has then caused Mr. Whiffin, in further versions of Cellebrite, to revise that so that this kind of error can't occur?
MR. GREEN: Sure. Happy to answer that. So Mr. Whiffin's testing was not done with this specific version of the iOS. The iOS has been known to be changing the way this artifact works. To do proper analysis, the researcher that he is, he would have need to work with that same iOS. Now, in regards to the Cellebrite question, they have two versions of the Cellebrite Physical Analyzer. One is the standard physical analyzer that's been out for several years now. Probably is the majority use in the community. It's a tool that takes that raw data and it puts it into human terms that we can look at and understand and write reports like you've been seeing here. So they have the Cellebrite Physical Analyzer that's out there. I believe it's 7.68, but don't quote me on that. And then they have a new version that's come out called Insights, and this operates more on where you can put multiple cases in and that. It's only the Insight version that they have bothered updating and no longer reporting on that time. Their current physical analyzer program, and I tested this a few days ago, still reports on that search occurring -- well and that time stamp. So currently, Cellebrite is providing examiners, law enforcement, and people worldwide with two different versions giving two different results. That I can't speak to more than that other than I've tested that and I see how those programs are working now.
MR. LALLY: So my question, sir, yes or no, is, are you aware that Cellebrite has had to modify their software based on misinterpretation of data, as you've done in this case?
MR. GREEN: Yes, with the asterisk they updated one of two programs I think.
MR. LALLY: Nothing further, Your Honor.
MR. YANNETTI: No further questions.
JUDGE CANNONE: All right. Mr. Green, you are all set.
MR. GREEN: Thank you, Judge.
(End of testimony.)
JUDGE CANNONE: All right, jurors, that's it for today. Okay. All right, so jurors, we are going to send you home for the weekend. Please do not discuss this case with anyone. Don't do any independent research or investigation into this case. If you happen to see or read anything about this case, please disregard it. We are on track. We will get this case next week for your [unintelligible].
COURT OFFICER: All rise.
JUDGE CANNONE: All right, why don't I see counsel regarding scheduling. [unintelligible]: Jimmy, I'll see you in there.