Trial 2 Trial Day
◀ Day 10 Trial 2 Day 12 ▶

Day 11 - May 7, 2025

Judge Beverly J. Cannone · Trial 2 · 7 proceedings · 1,489 utterances

Day 11 of 36
Appearing:

Digital forensics expert Jessica Hyde testifies that the 'how long to die in cold' search occurred at 6:24 a.m., not 2:27 a.m. — then faces a methodical cross-examination exposing inconsistencies in her prior reports and best-practice failures in evidence collection.

Full day summary

Day 11 opens with Trooper Connor Keefe completing his testimony on chain of custody for physical evidence at 34 Fairview Road and the voluntary surrender of Jennifer McCabe's and Kerry Roberts's phones, before Yannetti's cross establishes that lead investigator Michael Proctor exercised singular control over all analytical work and report-writing. After a sidebar ruling excludes a Maryland Daubert decision that would have been used to preemptively attack Hyde's methodology, prosecution digital forensics expert Jessica Hyde takes the stand and delivers her central opinion: the 'how long to die in cold' search occurred at approximately 6:24 a.m. and was not user-deleted, directly contradicting the defense's 2:27 a.m. theory. Defense attorney Alessi then cross-examines Hyde for the remainder of the day, confronting her with her own May 2023 report calling the 2:27 timestamp 'unknown' and her June 2024 sworn testimony that 'we cannot tell' when the search occurred — positions she has since refined into a definitive 6:24 a.m. opinion. Alessi further establishes that O'Keefe's phone was never secured in a Faraday bag or placed in airplane mode, a best-practice failure Hyde acknowledges, and that Cellebrite removed the disputed 2:27 timestamp from its tools while offering no substantive explanation for the decision.

  • Yannetti establishes through Keefe that Michael Proctor wrote all investigative reports and controlled all analytical work, including video surveillance analysis and interview reports, without input from assisting troopers.
  • Judge Cannone excludes the Maryland Daubert ruling that would have impeached Hyde's prior exclusion in another jurisdiction, preserving only the defense's right to cross-examine on methodology.
  • Hyde testifies to a reasonable degree of scientific certainty that the 'how long to die in cold' search occurred at 6:24 a.m. and was not user-deleted — the prosecution's core digital forensics claim.
  • Alessi confronts Hyde with her own 2023 report calling the 2:27 timestamp reason 'unknown' and her 2024 testimony that the artifact 'cannot tell' when the search occurred, exposing the evolution of her conclusions.
  • Hyde concedes that O'Keefe's phone was not placed in airplane mode or a Faraday bag from 6:04 a.m. through at least noon on January 29, 2022, in violation of the best practices she herself described.
Jessica Hyde
“What I can state to a scientific degree of certainty is that that search occurred at 6:24 a.m. and was the last search in the tab that had been opened at 2:27.”
Hyde's definitive 6:24 a.m. opinion is the prosecution's central digital forensics claim and the direct target of everything the defense builds toward on cross.
Jessica Hyde
“We cannot tell by this particular artifact what time that search occurred.”
Hyde's own sworn testimony from June 2024 — that the browser state artifact cannot determine when the search occurred — is the sharpest contradiction of her current definitive opinion, and the defense's most effective impeachment of the day.
Jessica Hyde
“Correct. It is not in accordance with best practices. I agree.”
Hyde's concession that O'Keefe's phone was never properly secured undercuts the integrity of all phone evidence in the case and lands as the cross-examination's lasting structural point.

Connor Keefe - Direct/Cross

Trooper Keefe testifies about collecting physical evidence at 34 Fairview Road on January 29, 2022. The defense cross-examination establishes that lead investigator Proctor controlled all analytical work and report language.

Direct
Connor Keefe Hank Brennan
214 utt.

Trooper Connor Keefe, a Massachusetts State Police digital forensic examiner assigned to the Norfolk DA's homicide unit, testifies about two aspects of his involvement in the case. First, he met Jennifer McCabe and Kerry Roberts to obtain consent forms and their cellular devices, which he brought to the forensics lab for extraction using GrayKey — though he was not involved in analyzing either phone. Second, he describes arriving at 34 Fairview Road around 5:00-5:30 PM on January 29, 2022, where he assisted in processing evidence found by the MSP search team under Lieutenant Brian Tully's supervision. Keefe walked the jury through the physical evidence he collected and bagged that evening: a black Nike shoe (Exhibit 77), taillight pieces including two larger fragments and a smaller chip (Exhibits 78 and BB), and pieces of clear plastic (Exhibits 79 and 80). He explained evidence-handling procedures including bagging, sealing with red tape, and annotating bags with date, time, location, and collector information.

Cross
Connor Keefe David Yannetti
233 utt.

Attorney Yannetti cross-examines Trooper Keefe across three areas. First, he establishes details of the Jennifer McCabe phone consent form — dated February 2, 2022 at 12:08 PM — and enters it as Exhibit 81. Second, Yannetti emphasizes that lead investigator Michael Proctor controlled all analytical work: Proctor wrote the reports, analyzed the surveillance videos from C.F. McCarthy's and the Waterfall Bar & Grille (which Keefe and Bukhenik merely retrieved), and chose the language in interview reports — including a joint interview of Sarah Levinson that Keefe initially could not recall attending. Third, Yannetti questions Keefe about attending John O'Keefe's autopsy, establishing that the arm injuries were visible and uncovered, that the medical examiner was looking at the body, that no defense attorney or expert was present, and that Keefe provided information to Dr. Scordi-Bello during the examination. The cross ends abruptly after a sustained objection when Yannetti asks whether Keefe left without a homicide ruling.

+1 procedural segment

Procedural - Sidebar (Hyde Daubert Motion)

Judge Cannone hears argument on whether defense can use a Maryland court decision to cross-examine digital forensics expert Jessica Hyde about her methodology, ultimately excluding the decision but preserving the defense's right to cross-examine on methodology.

Procedural
Procedural - Sidebar (Hyde Daubert Motion) Robert Alessi
72 utt.

Defense attorney Alessi sought to introduce a certified Maryland court decision (State v. Herrera) in which Jessica Hyde's expert testimony on frequent location history data was excluded under Daubert. Alessi argued the decision was relevant to impeach Hyde's reliability regarding the 2:27 AM timestamp on Jennifer McCabe's phone, contending Hyde uses a 'surrogate' approach without access to Apple's proprietary source code. Prosecutor Brennan opposed, arguing the Maryland ruling involved an entirely different methodology (significant location data) unrelated to Hyde's anticipated testimony about Safari browser timestamps. After a recess to review the materials, Judge Cannone excluded the Maryland decision under Criminal Procedure Rule 2, citing lack of prior notice and finding its admission did not serve the rule's purposes of simplicity, fairness, and elimination of delay. The defense's rights were preserved, and Alessi retained the ability to cross-examine Hyde on her methodology.

Jessica Hyde - Direct

Digital forensics expert Jessica Hyde testifies about the timing of the "how long to die in cold" Google search on Jennifer McCabe's phone and whether any deletions occurred.

Direct
Jessica Hyde Hank Brennan
263 utt.

Prosecution expert Jessica Hyde, a digital forensics examiner and George Mason University adjunct professor, testifies about her analysis of Jennifer McCabe's phone. After extensive qualification testimony covering her credentials, certifications, and methodology, Hyde explains that the "how long to die in cold" search did not occur at 2:27 a.m. as reflected in the BrowserState.db timestamp — that timestamp represents when a Safari tab was opened or backgrounded, not when the search was performed. Using multiple forensic tools and manual database analysis, she concludes the search occurred at approximately 6:24 a.m., corroborated by artifacts in the KnowledgeC database and mobile Safari plist. Hyde further opines that the search was not user-deleted, explaining that its presence in the WAL file does not indicate deletion and that users cannot delete tab history through the interface. Finally, she testifies that phone call log gaps were not caused by user deletion but by iOS automatically maintaining only the 200 most recent calls per category.

Jessica Hyde - Cross

Defense attorney Robert Alessi cross-examines prosecution digital forensics expert Jessica Hyde, challenging inaccuracies in her reports about John O'Keefe's phone activity timeline and the meaning of the 2:27 a.m. timestamp on Jennifer McCabe's phone.

Cross
Jessica Hyde Robert Alessi
528 utt.

Robert Alessi conducts a methodical cross-examination of Jessica Hyde, attacking her credibility on multiple fronts. He first establishes that her report incorrectly stated no phone interaction after 12:20 a.m. on O'Keefe's phone, when prosecution witness Whiffin's own exhibit showed the device was locked at 12:32:09 — a 12-minute discrepancy Hyde cannot explain. Alessi then traces the evolution of Hyde's opinions on the 2:27:40 a.m. 'how long to die in cold' timestamp, using her own May 2023 report (calling the reason 'unknown') and her June 2024 testimony (stating 'we cannot tell by this particular artifact what time that search occurred') to show her conclusions have shifted. He highlights that Cellebrite removed the 2:27 timestamp from its tools while Magnet AXIOM — Hyde's former company — still displays it, and that Hyde's December 2024 report relied only on Cellebrite despite her own testimony that multiple tools should be used. The cross concludes with Hyde conceding that O'Keefe's phone was never secured in a Faraday bag or put in airplane mode, contrary to best practices she herself described.

Jessica Hyde - Redirect/Recross

Jessica Hyde's digital forensics testimony continues with redirect (addressing methodology and Cellebrite's timestamp removal) and recross (examining potential for evidence loss on an unsecured phone).

Redirect
Jessica Hyde Hank Brennan
94 utt.

Hank Brennan conducts redirect examination of Jessica Hyde to rehabilitate her testimony after cross. He establishes that Hyde was not asked to reach any particular conclusion and that her analysis was independent of the district attorney's office. Brennan addresses Cellebrite's removal of the disputed timestamp, eliciting that Cellebrite cited ambiguity and potential for misconstruing the data, and that AXIOM's own documentation also warns about misinterpretation. On the Faraday bag issue, Hyde explains situational reasons phones aren't immediately bagged — including using a deceased victim's biometrics — and confirms the lack of a Faraday bag did not affect her conclusions. Brennan then turns to O'Keefe's phone health data raised on cross, establishing that the last recorded movement was at 12:32:16 a.m. with no further movement until 6:04:01 a.m.

Recross
Jessica Hyde Robert Alessi
76 utt.

Robert Alessi reopens several threads from redirect on recross. He establishes that Cellebrite's release notes cited 'further research' as the reason for removing the 2:27:40 a.m. timestamp but provided no details about what that research entailed. He confirms that Magnet AXIOM still recovers and displays the 2:27:40 a.m. timestamp. Alessi then secures Hyde's concession that O'Keefe's phone was not placed in airplane mode, a Faraday bag, or Faraday box from 6:04 a.m. through at least noon on January 29, 2022, and that data can be overwritten on an unsecured phone — meaning evidence could have been lost. He briefly touches on McCabe's phone call log deletions before concluding with Hyde confirming that O'Keefe's phone was recording movement from 12:31:56 to 12:32:16 a.m., establishing the phone was in motion at that time.

◀ Day 10 Trial 2 Day 12 ▶