Trial 2 Trial Day
◀ Day 10 Trial 2 Day 12 ▶

Day 11 - May 7, 2025

Judge Beverly J. Cannone · Trial 2 · 7 proceedings · 1,489 lines

Day 11 of 36
Appearing:

Digital forensics expert Jessica Hyde testifies that the 'how long to die in cold' search occurred at 6:24 a.m., not 2:27 a.m. On cross, Alessi probes limits of the BrowserState artifact and phone-preservation practices.

Full day summary

Day 11 opens with Trooper Connor Keefe completing testimony on evidence collected at 34 Fairview and the voluntary surrender of Jennifer McCabe's and Kerry Roberts's phones. On cross, Yannetti examines specific aspects of Michael Proctor's work: Keefe says he had no input into Proctor's Sarah Levinson report and that Proctor analyzed the C.F. McCarthy's video after Keefe obtained it. After Judge Cannone excludes an un-noticed Maryland decision while preserving methodology cross-examination, prosecution digital-forensics expert Jessica Hyde gives her opinion that the 'how long to die in cold' search occurred at about 6:24 a.m. and was not user-deleted. Alessi's cross probes Hyde's May 2023 'unknown' wording, the limits of the BrowserState artifact, Cellebrite's removal of the timestamp from automated parsing, and the phone's lack of Faraday isolation. Hyde maintains that those artifact limits did not change her broader opinion. On redirect, she says the lack of isolation had no impact on her conclusions and that potential overwrite or loss was theoretical rather than identified. On recross, Hyde says Cellebrite's release notes cited further research as the reason for the change but did not disclose details of that research.

  • Yannetti elicits that Keefe had no input into Proctor's Sarah Levinson interview report and that Proctor analyzed the C.F. McCarthy's video after Keefe obtained it.
  • Judge Cannone excludes the un-noticed Maryland State v. Herrera decision under Rule 2 while preserving Alessi's right to cross-examine Hyde about methodology; Brennan argues that the Maryland ruling concerned significant-location data rather than the Safari-timestamp methodology at issue.
  • Hyde testifies to a reasonable degree of scientific certainty that the 'how long to die in cold' search occurred at 6:24 a.m. and was not user-deleted — the prosecution's core digital forensics claim.
  • Alessi confronts Hyde with her May 2023 report calling the reason for the 2:27 timestamp 'unknown' and prior testimony that the BrowserState artifact alone cannot establish search time; Hyde maintains her broader opinion has not changed.
  • Hyde concedes that O'Keefe's phone was not placed in airplane mode or a Faraday bag from 6:04 a.m. through at least noon on January 29, 2022, in violation of the best practices she herself described.
Jessica Hyde
“What I can state to a scientific degree of certainty is that that search occurred at 6:24 a.m. and was the last search in the tab that had been opened at 2:27.”
Hyde's definitive 6:24 a.m. opinion is the prosecution's central digital forensics claim and the direct target of everything the defense builds toward on cross.
Robert Alessi
“We cannot tell by this particular artifact what time that search occurred.”
The prior testimony, read by Alessi and confirmed by Hyde, concerns the BrowserState artifact alone; it frames a limitation the defense used on cross while Hyde maintained her broader multi-artifact opinion.
Jessica Hyde
“Correct. It is not in accordance with best practices. I agree.”
Hyde's concession establishes a preservation-practice deviation and a theoretical risk that data on an active, unisolated phone could be overwritten; she maintained that the lack of Faraday isolation had no impact on her conclusions.
Video thumbnail for Day 11 — Keefe, Hyde 7h 14m
Watch this day Day 11 — Keefe, Hyde Watch with synced transcript →

Connor Keefe — Direct/Cross

Trooper Keefe testifies about collecting physical evidence at 34 Fairview Road. On cross, he describes his limited role in specific Proctor-related report and video-analysis work.

Direct
Connor Keefe Hank Brennan
214 lines

Trooper Connor Keefe, a Massachusetts State Police digital forensic examiner assigned to the Norfolk DA's homicide unit, testifies about two aspects of his involvement in the case. First, he met Jennifer McCabe and Kerry Roberts to obtain consent forms and their cellular devices, which he brought to the forensics lab for extraction using GrayKey — though he was not involved in analyzing either phone. Second, he describes arriving at 34 Fairview Road around 5:00-5:30 PM on January 29, 2022, where he assisted in processing evidence found by the MSP search team under Lieutenant Brian Tully's supervision. Keefe walked the jury through the physical evidence he collected and bagged that evening: a black Nike shoe (Exhibit 77), taillight pieces including two larger fragments and a smaller chip (Exhibits 78 and BB), and pieces of clear plastic (Exhibits 79 and 80). He explained evidence-handling procedures including bagging, sealing with red tape, and annotating bags with date, time, location, and collector information.

Cross
Connor Keefe David Yannetti
233 lines

Attorney Yannetti cross-examines Trooper Keefe across three areas. First, he establishes details of the Jennifer McCabe phone consent form, dated February 2, 2022 at 12:08 PM, and enters it as Exhibit 81. Second, Yannetti examines specific aspects of Michael Proctor's work as lead investigator: after reviewing a report, Keefe recalls participating in a joint Sarah Levinson interview with Proctor and testifies that he had no input into how Proctor wrote that report; Keefe also testifies that he obtained surveillance video but did not analyze it, while Proctor analyzed the C.F. McCarthy's video. Third, Yannetti questions Keefe about attending John O'Keefe's autopsy. Keefe testifies that the arm injuries were visible and uncovered, that the medical examiner was working on the body, that he gave known facts rather than a theory, and that no defense attorney or expert was present while he was there. The cross ends after an objection to Yannetti's question about whether Keefe left without a homicide ruling; the question is unanswered.

+1 procedural segment

Procedural — Sidebar (Hyde Daubert Motion)

In a Hyde methodology sidebar, Judge Cannone excludes the Maryland Herrera decision for lack of notice but preserves Alessi's right to cross-examine Hyde about the 2:27 AM timestamp analysis.

Procedural
Procedural - Sidebar (Hyde Daubert Motion) Robert Alessi
72 lines

Defense attorney Alessi sought to introduce a certified Maryland court decision (State v. Herrera) in which Jessica Hyde's expert testimony on frequent location history data was excluded under Daubert. Alessi argued the decision was relevant to impeach Hyde's reliability regarding the 2:27 AM timestamp on Jennifer McCabe's phone, contending Hyde uses a 'surrogate' approach without access to Apple's proprietary source code. Prosecutor Brennan opposed, arguing the Maryland ruling involved an entirely different methodology (significant location data) unrelated to Hyde's anticipated testimony about Safari browser timestamps. After a recess to review the materials, Judge Cannone excluded the Maryland decision under Criminal Procedure Rule 2, citing lack of prior notice and finding its admission did not serve the rule's purposes of simplicity, fairness, and elimination of delay. The defense's rights were preserved, and Alessi retained the ability to cross-examine Hyde on her methodology.

Jessica Hyde — Direct

On direct, Jessica Hyde testified that the "how long to die in cold" search occurred around 6:24 a.m., not at the 2:27 tab timestamp, and that the search and call-log gaps were not user deletions.

Direct
Jessica Hyde Hank Brennan
263 lines

Prosecution expert Jessica Hyde, a digital forensics examiner and George Mason University adjunct professor, testifies about her analysis of Jennifer McCabe's phone. After extensive qualification testimony covering her credentials, certifications, and methodology, Hyde explains that the "how long to die in cold" search did not occur at 2:27 a.m. as reflected in the BrowserState.db timestamp — that timestamp represents when a Safari tab was opened or backgrounded, not when the search was performed. Using multiple forensic tools and manual database analysis, she concludes the search occurred at approximately 6:24 a.m., corroborated by artifacts in the KnowledgeC database and mobile Safari plist. Hyde further opines that the search was not user-deleted, explaining that its presence in the WAL file does not indicate deletion and that users cannot delete tab history through the interface. Finally, she testifies that phone call log gaps were not caused by user deletion but by iOS automatically maintaining only the 200 most recent calls per category.

Jessica Hyde — Cross

Defense attorney Robert Alessi cross-examines digital-forensics expert Jessica Hyde on the wording and scope of her phone-analysis reports, including a lock-button artifact she had not reviewed and the limits of a BrowserState timestamp.

Cross
Jessica Hyde Robert Alessi
528 lines

Robert Alessi cross-examines prosecution digital forensics expert Jessica Hyde, challenging wording and scope in her reports about John O'Keefe's phone activity timeline and the meaning of the 2:27 a.m. timestamp on Jennifer McCabe's phone. Hyde acknowledged that a lock-button press can be an interaction, but said she had not reviewed or validated Ian Whiffin's specific artifact; she separately distinguished active user interaction from movement recorded by device data. Hyde maintained that her opinion on the 2:27 timestamp had not changed: her May 2023 report described the reason the BrowserState timestamp appeared as unknown, and she confirmed that the BrowserState artifact alone cannot determine when a search occurred. Alessi also addressed Cellebrite's removal of the 2:27 timestamp from automated parsing and the December 2024 report's reference to Cellebrite; Hyde testified that her analysis used at least four tools. The cross concludes with Hyde agreeing that O'Keefe's phone was not Faraday-isolated or put in airplane mode, which was not in accordance with best practices.

Jessica Hyde — Redirect/Recross

On redirect and recross, Jessica Hyde addresses Cellebrite's timestamp change and John O'Keefe's phone not being Faraday-isolated. She says isolation had no impact on her conclusions and overwrite or loss was theoretical, not identified.

Redirect
Jessica Hyde Hank Brennan
94 lines

Hank Brennan conducts redirect examination of Jessica Hyde to rehabilitate her testimony after cross. He establishes that Hyde was not asked to reach any particular conclusion and that her analysis was independent of the district attorney's office. Brennan addresses Cellebrite's removal of the disputed timestamp, eliciting that Cellebrite cited ambiguity and potential for misconstruing the data, and that AXIOM's own documentation also warns about misinterpretation. On the Faraday bag issue, Hyde explains situational reasons phones aren't immediately bagged — including using a deceased victim's biometrics — and confirms the lack of a Faraday bag did not affect her conclusions. Brennan then turns to O'Keefe's phone health data raised on cross, establishing that the last recorded movement was at 12:32:16 a.m. with no further movement until 6:04:01 a.m.

Recross
Jessica Hyde Robert Alessi
76 lines

Robert Alessi reopens several threads from redirect on recross. He establishes that Cellebrite's release notes cited 'further research' as the reason for removing the 2:27:40 a.m. timestamp but provided no details about what that research entailed. He confirms that Magnet AXIOM currently recovers and displays the 2:27:40 a.m. timestamp for the artifact; the recross exchange established the vendor display state, not the time of the search. Alessi then establishes that O'Keefe's phone was not placed in airplane mode, a Faraday bag, or a Faraday box from 6:04 a.m. through at least noon on January 29, 2022. Hyde agreed that data on an active phone outside a Faraday enclosure can be overwritten and therefore lost, while maintaining that the lack of a Faraday enclosure did not affect her conclusions. He briefly touches on McCabe's phone call-log deletions before concluding with Hyde confirming that O'Keefe's phone registered motion from 12:31:56 to 12:32:16 a.m.

◀ Day 10 Trial 2 Day 12 ▶