Commonwealth v. Read — Trial ArchiveJessica Hyde — Cross
643 linesCROSS-EXAMINATION BY MR. ALESSI:
MR. ALESSI: Good afternoon, Ms. Hyde.
MR. ALESSI: I noticed you had some documents with you. Could you just state what is in front of you so I know that I might be able to help expedite this if I know what you have in front of you?
MS. HYDE: Absolutely. I have the first digital forensic analysis report I completed for the previous trial.
MR. ALESSI: Do you have a date? There's several of them.
MS. HYDE: I do. It's the first one, I apologize. This is the one I believe it's May -- I don't remember the day off the top of my head.
MR. ALESSI: May of 2023?
MS. HYDE: May of 2023, obviously. Then I have the second one. This was the one that was used in the pretrial motion.
MR. ALESSI: December 2024?
MS. HYDE: December of -- yes, that's correct. Very nice. Then I have the third one, this is the final one regarding the phone that was identified as Ms. McCabe's. And then I have the fourth one, which is the phone of Mr. O'Keefe, and then I do have the opinion from State vs. Herrera, but if we don't need that, that's fine.
MR. ALESSI: Okay. Very well. I appreciate you telling me that. In March -- and you recall on your direct examination, Attorney Brennan asked you questions going to your experience and qualifications. Do you recall that those questions?
MR. ALESSI: And you were involved in a case, it was actually a murder trial, in the state of Maryland in a case called State v. Herrera as recently as March of 2025, correct?
MR. ALESSI: Attempted murder. And in that particular case, you had attempted to offer various opinions for the Court, correct?
MR. BRENNAN: I object.
JUDGE CANNONE: You have to move along from this case from what you're talking about. You have to move along from that Maryland case.
MR. ALESSI: So with regard, do you recall another case from the state of Massachusetts, Arrington case, in which you submitted a pro se amicus. Do you recall that case?
MR. ALESSI: And is it correct that in that case, you submitted arguments on behalf of the prosecution in that case?
MS. HYDE: I submitted an amicus brief which is not on behalf of anybody. It's a friend of the Court.
MR. ALESSI: Right. But the friends of the court, you took a position in that, quote, friends of the court brief, correct?
MR. ALESSI: Right. And the position you took on the evidence was that the frequent location history data is reliable and should be used; is that correct?
MS. HYDE: The statement is that frequent -- I do not have that amicus in front of me. It has been a year and a half since I read it, but that amicus does discuss frequent location history records, and I want to be clear, it speaks to both bias on both sides and the negative and positive of submitting it. It was an unknown bias writing and it was not specifically in support of the prosecution.
MR. ALESSI: So you are testifying in this case on behalf of the prosecution, correct?
MR. ALESSI: And the prosecution is paying you for your services in this case; is that correct?
MR. ALESSI: And with regard to this case, you have been paid and have been on this case since May of 2023, correct?
MR. ALESSI: With regard to the various reports that you have submitted in this case, you have mentioned one which is a report with regard to the iPhone of John O'Keefe; is that correct?
MR. ALESSI: And you have in that report you have made a statement, have you not, that from 12:20:50 a.m. on January 29th of 2022, and after, there is no indication of interaction with the device; is that correct?
MS. HYDE: There is no indication of user interaction with the device. It is all received until about 6:04 a.m. when there is again Apple health data that picks up.
MR. ALESSI: But I'll ask it again. And you can feel free to turn to page 1529 in that report.
MR. ALESSI: Page 15 1-5 29.
MR. ALESSI: Would you like the page number for it or the page and --
MR. ALESSI: No, no.
MR. ALESSI: It's at page 1529 or page 7.
MR. ALESSI: So page 7, you see there's a heading interactive phone activity, correct?
MR. ALESSI: And at the top it says, "Using a variety of different artifacts, we can see active interaction with a mobile device --
COURT REPORTER: Mr. Alessi.
JUDGE CANNONE: Yeah, you have to slow down.
MR. ALESSI: Okay. Sorry about that. I'm just trying to move it along, but I will be slower. I'll repeat.
MR. ALESSI: "Using a variety of different artifacts, we can see active interaction with the mobile device until 12:20:50 a.m. ET." Do you see that statement?
MR. ALESSI: And then if you skip down, I'm going to skip a couple of sentences, to the paragraph under the chart, and this is the key part.
MR. ALESSI: It says, "From that point," and I'm understanding that point to be the 12:20:50 a.m., correct?
MR. ALESSI: You need to say yes or no. I'm sorry.
MR. ALESSI: "There is no indication of interaction with the device." Did I read correctly?
MR. ALESSI: So I am going to -- and you believe that statement is correct?
MR. ALESSI: I'm sorry. I'm just asking if that statement is correct, not if you have other information, but is that statement correct?
MR. BRENNAN: I object.
JUDGE CANNONE: Can you answer that, Ms. Hyde? Can you answer that yes or no?
MR. ALESSI: Did I read that correctly?
MR. ALESSI: If we could, Your Honor, have a document that is put up already in evidence and publish Exhibit 39.
JUDGE CANNONE: Okay.
MR. ALESSI: And it will be -- thank you. And if we could go to slide 82, please.
MR. ALESSI: Ms. Hyde, if I could draw your attention to the entry that is -- it says 3209 under app lock, but we know that the 00 is a 12, so it's 12:32:09 a.m. on January 29, 2022, and I'm going to read what it says in red and this is a timeline of Mr. Whiffin. Do you know Mr. Whiffin?
MR. ALESSI: And so he put a red dot, "He said device locked with lock button for the last time." Do you see that?
MR. ALESSI: And you know that to lock a phone, you actually have to hit the side button with regard to an iPhone to make it lock; do you know that?
MR. ALESSI: And that is an interaction with a phone, is it not?
MR. ALESSI: So that means that that interaction with the phone occurred at 12:32:09, correct?
MS. HYDE: I did not review that specific artifact. I cannot attest to Mr. Whiffin's exam only to my own.
MR. ALESSI: So do you have any reason to believe that what is in evidence in this case that Mr. Whiffin has produced, and that -- do you have any basis to contest the fact that the device was locked with a lock button for the last time on the phone of John O'Keefe at 12:32:09 as you sit here?
MR. ALESSI: Don't you think it would've been appropriate to be accurate, as a digital forensic analyzer, on the topic of the last -- of an indication of interaction with the device, don't you think it would've been appropriate to look at that 12:32:09 in any of the tools you said you used on direct?
MR. ALESSI: I understand you didn't. My question is you make a statement -- well, let me back up. You -- do you understand that in this case, as in many cases, that matters of seconds in activity can be determinative of a case? Do you understand that from your experience?
MR. ALESSI: So it's important, therefore, to get activity right in -- for any data forensic examiner when they're issuing reports about activity particularly of a decedent; is that important?
MR. ALESSI: So isn't it correct that the statement that you make on page 7 of your report, that from that point, 12:20:50, there is indication of interaction with the device is incorrect?
MS. HYDE: I cannot make that without going back and reviewing and validating the artifact you just produced from Mr. Whiffin. I would need to validate that in order to respond to that.
MR. ALESSI: But as you sit here, you have no basis to contest what Mr. Whiffin has stated that there was a lock button on the side of the phone of Mr. O'Keefe a full 12 minutes after you say there was no interaction with the device; is that correct?
MR. ALESSI: Is there anything that had prevented you from reviewing that in that data before you wrote this report?
MR. ALESSI: My question is --
MS. HYDE: I don't know if that artifact -- I have not reviewed that artifact, so I cannot speak to an artifact I have not reviewed, and I did not -- that is not my report. That's Mr. Whiffin's report, so I cannot speak to that without going back and reviewing that evidence.
MR. ALESSI: Is it the interaction with the device a lock button readily available to you in the data that you have and had in your possession when you wrote this report?
MR. ALESSI: Thank you. If you could please turn to the same report, page 1528, which is your Page No. 6, and I just want you to please go to just put a placeholder in that, and if you could now just go to the conclusion, which is your page 50, 5-0. Let me know when you're there.
MR. ALESSI: So in the conclusion, you state that starting at 12:01 a.m. on January 29, 2022, the mobile phone was in use with activity of Waze navigating to 34 Fairview Road Drive, Canton, MA, active interaction with the screen, steps, audio playing, text messages, and calls until 12:31 a.m. EST on January 29, 2002. Did I read that correctly?
MR. ALESSI: That statement is also incorrect, isn't it?
MR. ALESSI: Do you believe that statement is correct or incorrect?
MS. HYDE: I believe that the statement is correct regarding those artifacts that are mentioned in that statement, yes.
MR. ALESSI: Okay. If you could, please. If you could turn to page 1535 of the same report.
MR. ALESSI: I will. I will -- I'll just --
MR. ALESSI: You're welcome. If you could turn to your page 13.
MS. HYDE: Thirteen, Roger. Yes, I'm there. And do you see an entry that says 12:31:56 which is the same time in the conclusion but I'm going to develop it. A I believe I know where you're going that that --
MR. ALESSI: Wait. I'm sorry I need to ask --
MR. ALESSI: I appreciate you looking to help, but if I could I'd appreciate it.
MR. ALESSI: Thank you. So it's got health steps and it has steps 36, duration 20.9 or 20.398 seconds. Did I read that correctly?
MR. ALESSI: So if you look at this data point in your report on page 13, the steps began at 12:31:56, but they ended 20.39 seconds later at 12:32:16; is that correct?
MR. ALESSI: So therefore your statement and your conclusion, if you could go back to 50, and this is in your conclusion, your statement there is that the steps -- the mobile phone's use activity including steps until 12:31 a.m. EST. That should read until 12:32:16, correct?
MS. HYDE: It depends on your interpretation of interaction. As a user is walking, they're not actively interacting with their device. It's movement that is, it's not direct interaction with the screen. But I would agree to your view that that could be interpreted as needing an additional 20 seconds.
MR. ALESSI: Is it the more correct way to state the conclusion that the active interaction when it comes to steps is not calibrating using the screen, but the phone is calculating steps taken; isn't that correct?
MR. ALESSI: I understand.
MR. ALESSI: But the sentence reads, "includes steps," and the more accurate way to have stated that would have been to put 12:32:16 instead of 12:31 a.m., correct?
MS. HYDE: I'm sorry. You just said 12:30 -- I did this to the minute, not to the second. Could you rephrase what you were stating?
MR. ALESSI: I'll state it again.
MR. ALESSI: You're welcome. So is it the more correct way to state this important data point in your conclusion instead of saying active interaction with the screen in steps, et cetera until 12:31 a.m. EST, the 12:31 should be 12:32 because the steps that you have on your page 13 by what you concede is the duration of 20 would have brought it to 12:32:16, correct?
MS. HYDE: I would state that depends -- I believe either is a correct way to state that. Based on interactivity, based on your interpretation, your definition is more correct.
MR. ALESSI: Okay. Thank you. And it's not my interpretation, I'm reading from your report.
MS. HYDE: Your interpretation that 12:32 is a more correct representation of interaction is based on your theory that interaction concludes when the steps end, and I'm saying both would be acceptable.
MR. ALESSI: Okay. So last follow-up on this.
MR. ALESSI: Isn't it correct that it isn't my theory when the steps end --
MR. ALESSI: Let me just finish.
MR. ALESSI: If we talk over each other, the stenographer is not going to get both of us.
MR. ALESSI: So it's not my theory, it's just the simple math from an entry you've made on page 13 that the steps began at 12:31:56. They ended 20.398 seconds after that which just doing the simple math is 12:32:16. Did I do the math correct?
MR. ALESSI: Thank you very much. So now what I'd like to do is to go to page 1528 of your report.
MR. ALESSI: Yes. And I appreciate that you go page number, so I can center it in on the lower one and then I'll go immediately to the one. So it's your page 6, Ms. Hyde.
MR. ALESSI: You're welcome. Just let me know when you're there?
MR. ALESSI: If you could please go to Apple health data steps.
MR. ALESSI: And we've been talking about steps because you've put them in a report, correct?
MR. ALESSI: So let's go to an important data point therefore in your report in the chart which is the second entry which is, as you've stated 12:21:10 a.m. Do you see that?
MR. ALESSI: And you note under the data that John O'Keefe's phone registered 80 steps at 12:21:10. Did I read that correctly?
MR. ALESSI: And those 80 steps constituted 191.253 seconds as you state, correct?
MR. ALESSI: And is my math correct so that the jury understands this perhaps a little better --
MR. ALESSI: -- that 191.253 seconds equals 3.2 minutes?
MR. ALESSI: Approximately.
MR. ALESSI: Right. Understood. So am I reading this entry correctly, stating what the data shows that 80 steps were taken by the phone -- Mr. -- whomever had the phone of Mr. O'Keefe, there were 80 steps taken at 12:21:10 a.m. on January 29, 2022, for a length of time of 3.2 minutes?
MR. ALESSI: That's what the phone registered. Very well. Now what I'd like to do is to turn to the phone of Jennifer McCabe.
MR. ALESSI: And that is, for your reports, you don't date your report so I can't give you a date. But it says --
MR. ALESSI: Exactly.
MR. ALESSI: It's three. And there is -- bear with me. I'm accommodating your page reference, and I'll have it soon for you. It is your page 7. And let me know when you are there.
MR. ALESSI: Are you aware of an issue regarding the time of an interactive phone activity on Jennifer McCabe's phone at 5:07 a.m.? Are you aware of that issue, and particularly a communication to a person named Coco. Are you aware of that?
MR. ALESSI: Absolutely.
MR. ALESSI: And you can tell that because in your report, on page 11, you list a 5:07:21 a.m. call to a Coco as outgoing, correct?
MR. ALESSI: Have you discussed that call with any member of the Commonwealth?
MR. ALESSI: And again, this call is at 5:07 a.m. on January 29th of 2022, correct?
MR. ALESSI: There is no duration listed for that call. And if you just follow my questions, if you can, yes or no; is that correct, there's no duration you have listed?
MR. ALESSI: So what I want to do is to also note that that omission is not the only omission of durations from this report or - - I'll state it differently. Let me withdraw that. There is no population of the duration column for any call from 12:14:30 a.m. on January 29, 2022, all the way through this 5:07:21 call, and you don't start listing durations until 8:59:34 a.m.; is that correct?
MR. ALESSI: I understand. Mr. Brennan can handle those on his redirect. A Absolutely.
MR. ALESSI: So there's not a population of duration of calls after numerous early calls and phone -- as you call it, interactive phone activity, nothing populated in this report until 8:59:34; is that correct?
MR. ALESSI: All right. Now, what I'd like to do is to turn to the 2:27:40 artifact that had -- that was the discussion of much discussion on direct, and I am going to refer to that as an artifact. Is that a parlance that is familiar to you?
MR. ALESSI: And if I refer to that as a time stamp also, is that a parlance that's familiar to you?
MR. ALESSI: So I can refer to 2:27:40 as a time stamp, and you would find that parlance acceptable?
MR. ALESSI: Thank you. So I'm going to do that. Just to keep it simple, I'm going to refer to it as a time stamp. Now, you've been on this case working for the Commonwealth since May of 2023, correct?
MR. ALESSI: So you've been on this case for two years, correct?
MR. ALESSI: But you started on this case in May 2023. You issued a report in --
MR. ALESSI: -- May of 2023, correct?
MR. ALESSI: You issued a report in December of 2024, correct?
MR. ALESSI: Right. And you issued more reports in 2025, correct?
MR. ALESSI: So all of that activity has been on this case, correct?
MR. ALESSI: That has all on behalf of the prosecution, correct?
MR. ALESSI: None of that work has been done on behalf of the defense, correct?
MR. ALESSI: So let us now go to the time stamp of 2:27:40. Your opinions on what is the meaning of that time stamp have varied from May of 2023 until today; is that correct?
MR. ALESSI: Let's cover that issue.
MR. ALESSI: Let's turn to your May 2023, report. Isn't it correct that the report -- and your findings were pursuant to a request from Detective Lieutenant Brian Tully?
MR. ALESSI: And how many interactions have you had with Lieutenant Detective Brian Tully on this case, approximately?
MR. ALESSI: Is it more than five?
MR. ALESSI: Is it more than ten?
MR. ALESSI: Is it more than 20?
MR. ALESSI: So somewhere between ten and twenty, would that be fair?
MR. ALESSI: But it was more than ten?
MR. ALESSI: So the issue was your use of various forensic tools that revealed a time stamp, a 2:27:40 a.m. time stamp on January 29, 2022; is that correct? Is that a fair characterization of an issue you looked at?
MR. ALESSI: So if you could go to page 5 of that report, and I would ask that you go to the last paragraph that starts with, "In the instance of the Google search," and let me know when you're there.
MR. ALESSI: So it reads, "In the instance of the Google search, 'hos long to die in cold' that was recovered from the write ahead log associated with the X browser state DB SQLite database with the time stamp of 2:27:40 a.m., was marked by Cellebrite as having this time stamp and being deleted." Did I read that correctly?
MR. ALESSI: So you used the word that that Google search "hos long to die in cold" was associated with the time stamp of 2:27:40 a.m., isn't that what your words are in this report?
MR. ALESSI: Right. And in terms of page 3, if you could go back of your report, under relevant findings?
MR. ALESSI: It starts with, "There were two searches of interest that took place on the iOS device," and we're talking about Jennifer McCabe's device, correct?
MR. ALESSI: That's identified to you as Jennifer McCabe. And that's you talked about on direct examination, right?
MR. ALESSI: It's not a mystery as to whose it is. It's not like you don't know, right?
MR. ALESSI: Right. But your conclusion is the device you've been working on and analyzing for two years is the device of Jennifer McCabe?
MR. ALESSI: Do you have a different conclusion as to whose the device is?
MS. HYDE: I have always am very, very careful that I do not -- I did not assess the ownership. That was information that was given to me, not information that I personally assessed.
MR. ALESSI: So are you uncertain as whether the device you've been working of for two years is the --
MS. HYDE: The device that I have been working on for two years is the device that was identified to me by the Massachusetts State Police, Detective Tully, as belonging to Jennifer McCabe when I began working and received that device as stated in the evidence analyze section on this same page.
MR. ALESSI: So let's go, and we're talking about again, to get back to the center of gravity, we're talking about a time stamp of 2:27:40 a.m., correct?
MR. ALESSI: And when you issued your first report in May of 2023, the time stamp you were looking at was 2:27:40 a.m., January 29, correct?
MR. ALESSI: Right. So what I'd like to do -- you said multiple time stamps. What times are in the multiple categories?
MS. HYDE: What I was tasked to do was to look at the times -- the search -- the Google search history -- I'm sorry. Not Google search. The Safari history which includes Google searches associated with those two search terms within that twelve hour period. That was the particular task, not the task of looking at the 2:27, just for clarity.
MR. ALESSI: And I appreciate that, but my question wasn't that. My question was I thought I heard you on direct examination, which is why I repeated the question when I heard it on direct, but I'll ask you the question.
MR. ALESSI: You looked at and talked about on direct two potential times where a Safari search, which includes Google, one of which was 2:27:40, and the other one was 6:23 a.m.; is that correct?
MR. ALESSI: Right. So we're just talking about two times, 2:27:40 and then 6:23; is that correct?
MS. HYDE: So you are only talking then about the one -- we're also talking about 6:24 a.m. I am.
MR. ALESSI: Okay. So --
MR. ALESSI: Fair enough. So you've got 2:27:40, you've got 6:23 and you got 6:24 that you were looking at, correct?
MS. HYDE: There are other time stamps that exist in the realm of what I was looking at, but those ones correct are the ones that are relevant in this report.
MR. ALESSI: Exactly. And that's what we're talking.
MR. ALESSI: We're talking about this report?
MR. ALESSI: And so if you look under relevant findings at the very bottom paragraph, you say, second sentence, "A Google search for, 'how long to do in cold,' at approximately 11:23 a.m. and then 'hos long ti die in cold' took place at 11:24?"
MS. HYDE: That is in UTC. I apologize for not having the time stamp format there, but that is the UTC time. The UTC time equivalent in Eastern local time would be 6:23 and 6:24.
MR. ALESSI: So to be clear in your report you wrote, "11:23 a.m. and 11:24," and you didn't put UTC next?
MR. ALESSI: And there's a significant difference between 11:23 and 2:27:40 correct?
MS. HYDE: Eleven twenty-three is UTC, so it's equivalent in Eastern time would be 6:23. The artifact of 2:27 is already in local time, so that is in Eastern time. So what we would be comparing is 2:27 and 6:23 and 6:24 to be appropriate, taking into account the data storage and which ones are in UTC and which ones are in local time.
MR. ALESSI: I understand your explanation now.
MR. ALESSI: But in this report, there is no UTC time down. You have two additional times in addition to the two times -- two different numbers added to the two, correct?
MS. HYDE: The UTC was a typo. It should say UTC next to those, and the chart shows all of those artifacts in EST, and is clearly labeled that they're all in EST.
MR. ALESSI: So you would agree that it's better stated to state it a different way than you have in your report?
MS. HYDE: I would say that both are equivalent. I should have had UTC there, but, yes, it's easier for the audience to speak in EST. I would say forensic examiners typically communicate in UTC, but we translate for our reports. And I should have either communicated that in EST or included UTC. I will definitely contend that.
MR. ALESSI: So in terms of your May of 2023 report, your first report in this matter.
MR. ALESSI: You on page 5, in the sentence underneath the block paragraph state, "In the instance of the Google search, 'hos long to die in cold' that was recovered from the write ahead log associated with'"
MR. ALESSI: "The X browser state with a time stamp of 2,027 40 a.m. was marked by Cellebrite as having this time stamp and being deleted." Did I read that correctly?
MR. ALESSI: Now, let's move ahead to page 7 of your report.
MR. ALESSI: Up at the top above conclusion, "Importantly at this time," you state, "testing shows great inconsistency with time stamps parsed from this file. It is, however, definitive that the page existed in a text?"
MR. ALESSI: "While a definitive reason as to why the time stamp is listing the time of 2:27:40 is unknown, the time is inconsistent with the time stamps associated with the same search." Did I read that correctly?
MR. ALESSI: So as of May 2023, you said the definitive reason as to why the time stamp is listed as 2:27:40 is unknown, correct? I'm just asking is that what you wrote "unknown"?
MS. HYDE: I believe that the wording here is -- sorry. I know I use the word unknown. It says, "While a definitive reason as to why the time stamp listing is the time of 02:27:40 is unknown -- sorry.
COURT REPORTER: Can you slow down?
COURT REPORTER: And say that again.
MR. ALESSI: So you used the word unknown, your word in your report?
MR. ALESSI: Okay. So now what I'd like to do is go on to the first proceeding in this matter. Do you remember giving testimony in a proceeding about a year ago under oath?
MR. ALESSI: I am now going to go to that testimony, and if at any point you would like to have a copy of that, if it's -- if Your Honor would like, I will do it, but I'm going to start and then we'll see how it goes. So bear with me a moment. Do you recall in that testimony stating that you processed the image in several forensic tools, "I used Cellebrite, Physical Analyzer," and then you list many other tools. Do you remember giving that testimony?
MR. BRENNAN: Could we have a page and line number?
MR. ALESSI: I'm sorry, Mr. Brennan. I thought I had given it, 1–12. My apologies if I didn't. It's June 14, 2024, page 1–12.
MR. BRENNAN: Thank you.
MR. ALESSI: You're welcome.
MR. ALESSI: So do you recall giving testimony about the various tools used for this time stamp?
MR. ALESSI: And do you recall stating that those tools were commonly used digital forensic tools that are very standard; do you recall that?
MR. ALESSI: What it be helpful to refresh your recollection if I showed you that?
MS. HYDE: It would be great. I would greatly appreciate that because I do not recall the precise wording, but I know that I spoke to the tools that I used.
MR. ALESSI: May I approach, Your Honor?
JUDGE CANNONE: Yes. Mr. Alessi, you offered a transcript. Do you have the whole transcript?
MR. ALESSI: I have the whole transcript if that helps.
JUDGE CANNONE: It might speed things along.
MR. ALESSI: Agreed.
MR. ALESSI: So, Ms. Hyde, I'm going to give you a transcript so you --
MR. ALESSI: You're welcome. So --
MR. ALESSI: May I approach, Your Honor?
JUDGE CANNONE: Yes.
MR. ALESSI: Thank you.
(Counsel confer.)
MR. ALESSI: Yes, please.
MR. ALESSI: What I wanted to do, and the reason I said 112 is that's where we started with my previous question.
MR. ALESSI: So I'm not going to repeat the question, but just to orient you so you have a fairer context for the questioning.
MR. ALESSI: So I started at the bottom of 112, now I'm moving to 113 and I'm starting with line 7; do you see that?
MR. ALESSI: And it says, "Yes, they are commonly used digital forensic tools that are very standard for other forensic examiners to use on mobile exploitation." Did I read that correctly?
MR. ALESSI: And then if you go down to line 22, you testified in that proceeding, "So it's important to use multiple tools so you can see the results from different table, different data sets and be able to compare those results and enhance those with manual analysis." Did I read that correctly?
MR. ALESSI: And then going up to page 114, line 5 --
JUDGE CANNONE: Slow down a little bit, Mr. Alessi, please.
MR. ALESSI: I will, Your Honor. Thank you.
MS. HYDE: "Yeah, that's very, very typical for me to process with multiple tools to ensure that I'm getting the most complete interpretation from forensic tools. Of course, you go beyond that with your analysis, but it's absolutely pertinent to that." Do you -- did I read that correctly? A That is correct.
MR. ALESSI: And then lastly for this section at page 114, 17, "The Sanderson tool is meant to look at specific type of data structures called the SQLite database, SQLite data bases are very nuanced, and this particular tool allows you to take that database and explore it at a deeper level than the other forensic tools allow." Did I read that correctly?
MR. ALESSI: Thank you. Now, if we could go to page 124 of the very same testimony. And feel free to go back a page just so you can see to page 123 that the topic is the 2:27:40 time stamp associated with "hos long to die in cold".
MR. ALESSI: Absolutely.
MR. ALESSI: Page 123 at 13, but if you need to go back further, feel free.
MR. ALESSI: You're welcome. So what I want to do is start with page 1–23, and this is your testimony. On line 16, "I have them in the time stamp order that is associated with the artifact." You use that word associated again, correct?
MR. ALESSI: Did I say that correctly?
MR. ALESSI: And that's associated with the Google search "hos long to die in cold" and a 2:27:40 a.m. time stamp, correct?
MR. ALESSI: Now if you turn the page of the testimony, you state that that then that on page 124, line 1, "The browser state DB is an artifact that speaks to when tabs are moved. So when you're using your browser and you open different tabs, you may have a search that this time pertains to the time that the tab moved. It could be lots of things."
MR. ALESSI: Did I read that correctly?
MR. ALESSI: Not one thing, you said it could be lots of things, correct? A That is correct.
MR. ALESSI: And then you go on in line 10, and you talk more and then you go down to the bottom. You go down to line 20, and you testify, "We cannot tell by this particular artifact what time that search occurred."
MR. ALESSI: Did I read that correctly?
MS. HYDE: That -- it's specifically pertaining to that particular artifact they give in browser state DB, that does not tell us what time a search occurred. That is correct.
MR. ALESSI: Right. So you stated and it was your statement that we cannot tell by this particular artifact what time that search occurred, correct?
MR. ALESSI: Okay. So now let's -- now let's keep going.
MR. ALESSI: If you go to page 129 of this transcript.
MR. ALESSI: At the top.
MR. ALESSI: Line 1, "2:27 isn't necessarily one time when the tab was closed. That's in my report. I say it's undetermined." Do you remember we were just reading --
MR. ALESSI: -- your May 23 report?
MR. ALESSI: Because there is a lot of things that can cause that time stamp to be there, including tab being moved, tab being minimized, the next sentence. "I don't know exactly what caused the tab to get that particular entry, but it's not that time stamp is not indicative of the time of the search or any URL that's visited, but the first part of it is I don't know exactly what caused the tab to get that particular entry." Did I read that correctly?
MR. ALESSI: Thank you. Now if we could turn to page 130 of your testimony.
MR. BRENNAN: I need to object.
JUDGE CANNONE: All right. I'll see you both.
(Sidebar commences:
JUDGE CANNONE: What's the objection?
MR. BRENNAN: I've never seen anything like this. He's not impeaching the witness with a prior statement. He's going through testimony, and he's taking pieces of the testimony, and he's trying to create the illusion that somehow this applies to a certain predicate, and it doesn't. So what he's doing is he's taking a piece of her analysis, and he's stepping -- this is throughout the transcript, without filling in what it pertains to, or what it describes or explains, certain opinions or background with the transcript. This isn't impeachment material. This is creating a ghost that there is something that's uncertain. If he's going to impeach her, he should ask her questions if there's an inconsistent statement, he can confront her with the inconsistent statement. If he's going to talk about her testimony out of context and try to relate it something to pages later, that is unfair portrayal. She will need to be able to explain, or he can talk about what it pertains to. It's so incongruent the way he is doing this. It creates an illusion of something that is not an inconsistent statement at all.
JUDGE CANNONE: So are you laying a foundation for an ultimate question?
MR. ALESSI: It is, Your Honor, and the inconsistent statement are one of many. She testified she did a chalk on how she can determine that the 2:20 -- that that tab and the search was at 6:20. She's made clear to me the inconsistent statement. I'm was doing it this way because I thought this was Your Honor's suggestion as to how to do it, but she's already made the inconsistent statement. I'm going through each inconsistency. The only other way to do it is to improperly conflate a methodology for going to an inconsistent statement would refresh her recollection and ask her each time, did you make this statement in your testimony? Do you recall? No, I don't. Would it be helpful to show you what your testimony is?
COURT REPORTER: Counsel.
JUDGE CANNONE: Slow down.
MR. ALESSI: Yeah, I'm almost done with it. I'm sorry. My apologies, Christine. I'll go slower. I'm trying to do this expeditiously which is why I thought Your Honor suggested giving her the test. This is my last question on this testimony. It's the last one.
MR. BRENNAN: But it's taking pieces that are totally separate without explanation and context. There are a number of databases she looks at. He's picking and choosing certain parts of her testimony with no explanation what it means and trying to prepare that storyline that there's something inconsistent when there's not. This isn't confronting the witness on a prior inconsistent statement, it's trying to pick out individual pieces of information that don't connect to try to reach an accusation or a conclusion. I can't even follow what he's doing. It makes absolutely no sense.
MR. ALESSI: Well, the witness can follow it, and she's basically following it quite easily. Here is the evidentiary point. The evidentiary point is first of all she's the one that's going through all the databases. She's following it perfectly along. She said she can follow it. Secondly, I'm entitled on cross-examination to pick parts of someone's testimony. It's sufficient in context for her that she hasn't complained once. And lastly, Your Honor, he has redirect --
JUDGE CANNONE: Right. So I agree with you. I just wanted to make a record.
MR. ALESSI: Okay.
JUDGE CANNONE: So he can impeach the way he wants it. It may not be clear to everybody what he's impeaching, but you get a chance. There were times that she said yes, but I'd like to explain and Mr. Alessi said you can do that on redirect.
MR. BRENNAN: Okay.
JUDGE CANNONE: So that's how we'll go about it.
MR. ALESSI: Thank you, Your Honor.
end of sidebar.)
MR. ALESSI: Thank you for your patience, Ms. Hyde.
MR. ALESSI: What I'd like to do is go back to your testimony in the first proceeding, and we can go back to 1–30.
MR. ALESSI: Thank you. So I am going to go back just because there's been some time to get some context. So we're talking about the 2:27:40 a.m. time stamp, correct, at this page location?
MR. ALESSI: You're absolutely correct. We've been talking that -- bear with me.
MR. ALESSI: I think this may be the second to last or the last. So there you testified with regard -- this was when you were referring to an artifact. You've agreed that time stamp is a fair synonym. You say on line five, "That means it wasn't in the regular database. It was the write ahead log, and to Cellebrite's credit, they -- that tool absolutely parsed the write ahead log and displayed it where the other tools did not." So am I correct -- did I read that correctly, number one?
MR. ALESSI: So am I correct that here what you're stating is Cellebrite was actually showing the 2:27:40 a.m. time stamp at that time during your testimony --
MR. ALESSI: So I just wanted to establish that --
MR. ALESSI: -- and you had given Cellebrite credit for actually showing that time stamp at that time of 2:27:40 at the time of your testimony back in June 2024, correct?
MR. ALESSI: Okay. So now let's go to page 1-36.
MR. ALESSI: One thirty-six, yes.
MR. ALESSI: And on line 12, you note that so Cellebrite and Magnet Axiom and then you elaborate, both Cellebrite Physical Analyzer, which is a physical tool, right, of Cellebrite?
MR. ALESSI: And Magnet Axiom another specific tool, correct?
MR. ALESSI: Both have file system viewers that then have SQLite database viewers. And you skipping down to line 17. You talk about they don't allow for deep analysis of the write ahead logs which is why in my analysis I used the specialized Sanderson forensic browser for SQLite, correct?
MR. ALESSI: So is it fair to say that what you did up to this point in June of 2024, with regard to the 2:27:40 a.m. time stamp on January 29, 2022, you applied a variety of tools to analyze the issue of when did the Google search occurred that you used the word associated with a Safari Google search "hos long to die in the cold"?
MR. ALESSI: So let me see if I can ask the question --
MR. ALESSI: -- a different, more simple way.
MR. ALESSI: You're welcome. So you used a variety of tools to analyze that "hos long to die in the cold" search, correct?
MR. ALESSI: Plus manual analysis and testing. All right. Now let's leave the testimony.
MR. ALESSI: And let's go to your next report. And your next report is December 2024 --
MR. ALESSI: -- do I have the chronology correct, Ms. Hyde?
MR. ALESSI: So in December of 2024, just approximately six months ago, you issued another report, correct?
MR. ALESSI: And you've got the request for that report also from the Norfolk District Attorneys, correct?
MR. ALESSI: And you state in regard -- well, that report regarded the analysis of the same time stamp, correct?
MR. ALESSI: The 2:227:40 time stamp?
MR. ALESSI: And in that report under relevant findings, you state - - and this is December of 2024, so it's from your May 2023, report it's approximately a year and seven a year and a half is that approximately for your May 23rd report?
MR. ALESSI: Approximately a year and a half?
MR. ALESSI: A so year and half after what we just reviewed in your May 23rd report and then just months after the testimony of June, right, so about six months after --
MR. ALESSI: -- the testimony what we just went through, you went and looked at this issue again, correct?
MR. ALESSI: And isn't it correct that when you were asked to look at the same time stamp, in December of 2024, that Cellebrite removed the time stamp from their tools?
MR. ALESSI: Okay. And that time stamp was the subject of extensive reports and testimony that you participated in the first proceeding, correct?
MR. ALESSI: And even though that time stamp, 2:27:40 a.m. that showed up in Cellebrite tools, Magnet Forensic Axiom showed up, that was removed by Cellebrite, correct?
MS. HYDE: Cellebrite no longer reports it. The evidence is still in the data. I want to be clear just that it doesn't change the data. They just removed it from their automated parsing and reporting.
MR. ALESSI: Right. So they --
MR. ALESSI: -- removed it from their automatic parsing and reporting, correct?
MR. ALESSI: However, your former company, Magnet Forensic Axiom, still shows it, correct?
MS. HYDE: Magnet Axiom Forensics currently shows it as a carved artifact and still shows that and gives a description in the artifact reference guide as to what they believe causes that artifact.
MR. ALESSI: I'm going to ask a question --
MR. ALESSI: Magnet Axiom Forensics, where you used to be director of forensics --
MR. ALESSI: -- still shows that time stamp, correct?
MR. ALESSI: But Cellebrite doesn't in their --
MR. ALESSI: -- automated tools?
MR. ALESSI: And you would agree that Magnet Forensics is a very reputable company, correct?
MR. ALESSI: Let's go back to your December 2024 report. Do you recall just moments ago when we went through your testimony in June of 2024 in the first proceeding where you stated various times how it was I'll use the term best practices to use multiple tools to analyze the time stamp?
MR. ALESSI: And you've used many tools to analyze --
MR. ALESSI: -- that time stamp and you've testified to those many tools on your direct examination, correct?
MR. ALESSI: However, in December of 2024, when you returned to analyze the 2:27:40 time stamp, how many tools did you use to analyze that time stamp? Can you give me just a number? How many tools?
MR. ALESSI: Well, in your report -- let's go to your report which your report says. So in your report, you state that under relevant findings, do you not, that review of data from Cellebrite shows that the artifact of a Google search from the Safari suspended state tab with the search term "hos long to die in cold" -- I'm going to skip over in addition to my own previous report, no longer shows a last visited time.
MS. HYDE: I think that that is not clear. The skipping there makes it sounds like my report no longer shows that and that's not what's being stated.
MR. ALESSI: That's a fair statement. That's a fair statement. Let me rephrase it.
MR. ALESSI: You're welcome. In this report, you speak about Cellebrite's release reports, correct?
MR. ALESSI: The notes, you referred to that?
MR. ALESSI: And that release note states that Cellebrite has removed the time stamp value from records, and I'm assuming that's a reference to Cellebrite.
MS. HYDE: Cellebrite no longer parses that result. That is the statement in this report, correct.
MR. ALESSI: Right. And so I'm going to go to page 4 of you report.
MR. ALESSI: And I'm going to go down, all the way down to the conclusion. In that report, is there a reference to any company other than Cellebrite in this entire report?
MR. ALESSI: Okay. Thank you. Now, let's go to your prior testimony in the first proceeding where you said that it was important to use multiple tools.
MR. ALESSI: Do you still stand by your position that you've given today and that you gave in June that it's important to use multiple tools?
MR. ALESSI: Now, let's go back to the issue of the extraction of Jen McCabe's phone. And what I want to do is to cover a concept and see if I've got this correctly. Are you familiar with the phrase Apple source codes?
MR. ALESSI: Absolutely. No worries, sir. Are you familiar with the phrase Apple's source codes?
MR. ALESSI: And isn't it a fact that Apple keeps its source codes proprietary, meaning very few people have access to it?
MR. ALESSI: Closed source?
MR. ALESSI: They keep it so close that they call it closed source?
MS. HYDE: And it's not just Apple. Lots of tools are close source. That just means that the code isn't available like it would be for the tool I mentioned earlier, iLeap, that's an open source tool. Anyone can look at the code. For Apple, we cannot go look at the code that makes your phone run, that's correct.
MR. ALESSI: And isn't the case -- and I refer to that as the MB postulate. It's a shorthanded, but I don't need to have you refer to it that way.
MR. ALESSI: I'm going to skip it.
MR. ALESSI: Let's go on basically the concept that Apple has a -- has source codes that are closed sources. So I'd just refer to them as Apple closed sources. Wouldn’t the best information about when a search occurred, what it's associated with, wouldn't the best information be in the Apple source code to answer that question?
MS. HYDE: It is acceptable in digital forensic science and in accordance with the NIST Science Foundation papers to conduct testing to determine how the functionality of something works. You do not need access to the source code to be able to speak to an artifact.
MR. ALESSI: My question isn't that. My question is, isn't the best place one -- the best place to go is to the Apple source codes themselves, or are you saying these Physical Analyzer tools are just as good in the information they pull, they're just as good as an Apple source code?
MS. HYDE: Those are very, very -- those are incongruent statements. Apple source code is not a healthy way to do an examination because it would be so onerous, and we do not know the level of documentation. We don't know the language. That is not necessarily the most effective way to determine what data is. Forensics tools parse results on how data is. They don't interpret them. The examiner interprets them and provides meaning. And I would like to state that those three things should not be conflated. They are very individual concepts.
MR. ALESSI: I think you misunderstood my question.
MR. ALESSI: My question is this. Isn't the best source for information about data in an iPhone contained within Apple source codes?
MS. HYDE: Not necessarily. Because that doesn't -- operational performance is a better source in a practical sense to being able to determine what something is as opposed to zillions, and, no, I don't know the number because it's close source, lines of code that may or may not have different levels of documentation. Apple themselves wouldn't be able to -- any individual there who has access wouldn't know every feature of how every element works. Testing through the methodologies described in NIST is the accepted methodology in our science; not revealing the source code.
MR. ALESSI: I'm going to try it a different way. I understand what you're saying is, if I got it correct, you can correct me, are you saying that these physical tools make it easier to interpret and view the data?
MR. ALESSI: Okay.
MS. HYDE: I spoke about manual testing and checking the functionality and what results. Parsed tools -- again, these are three separate concepts. The concept of code and actually reviewing code to make a determination is different from parsed tool results is different from doing testing and validation. Those are separate concepts. They should not be commingled as if they equate to each other.
MR. ALESSI: So have you ever learned of -- have you spoken with Mr. Whiffin?
MR. ALESSI: Have you ever spoken to Mr. Whiffin about whether the Apple source codes are the best source of information to cut out topics like time stamps? Have you ever spoken --
MR. ALESSI: All right. I want to move on to -- and you regard Mr. Whiffin as a reputable --
MS. HYDE: Mr. Whiffin is a reputable forensics examiner, and I've actually reviewed his work in other instances and peer- reviewed his papers.
MR. ALESSI: So you have regard for his --
MR. ALESSI: We have to wait for each other.
MR. ALESSI: It's all right. No worries. So you regard, have regard, for the opinions of Mr. Whiffin generally, correct?
MR. ALESSI: And you believe he has a solid reputation, correct?
MR. ALESSI: Now, let's turn to the history DB database. You are familiar with history DB? I'm sorry. History DB, are you familiar with that phrase?
MR. ALESSI: Okay. Did any of the "hos long to die in cold" searches appear in the history DB?
MS. HYDE: In this instance, no, we do not have artifacts in the history DB of either of those two searches.
MR. ALESSI: So I want to just repeat that in a different way. So the history DB, is that considered a valid and valuable source of information in an iPhone?
MR. ALESSI: But the "hos long to die in cold" searches we've been discussing do not appear in that history DB, do they?
MR. ALESSI: You spoke about PYF PDF on your direct testimony. Do you recall that?
MS. HYDE: I do. It's the Python framework for PDF. It is a GitHub tool one can download from GitHub to utilize to create PDFs using Python code. So a developer and a tool would integrate that to create a PDF.
MR. ALESSI: And the PYF PDF can have the variables set, correct?
MS. HYDE: Yes, the Python script allows the developer to set things such as their name that they created the document, yes.
MR. ALESSI: I want to go to the extraction of Jen McCabe's phone that you talked about on direct examination. Is the hash value signed or unsigned?
MS. HYDE: A hash value isn't signed. I believe the question you're asking me is the Adobe document that contained - the PDF that contained the hash value? So you're ask me if that's signed because a hash value is something that matches. A hash value isn't signed.
MR. ALESSI: Let me ask it this way. Is there any hash value associated with Jen McCabe's phone that is unsigned?
MS. HYDE: That is not a valid question. I apologize. We don't refer to hash values as being signed or unsigned. We would refer to the PDF that contains that value as being signed or unsigned.
MR. ALESSI: Have you ever read a report of Mr. Ian Whiffin in this case?
MS. HYDE: I have, but I have to be clear I have not read all of Ian's reports, I've only read some so I don't know -- I've read some of his earlier reports.
MR. ALESSI: Do you recall reading a report of Mr. Whiffin where he references a hash value being unsigned associated with the iPhone of Jennifer McCabe?
MS. HYDE: Can I see said report so I can validate if I did or did not? I'm not sure based on just that, because I wouldn't - - I wouldn't use the term hash value being signed. I did see a report in which Mr. Whiffin spoke to the PDF not being signed.
MR. ALESSI: I want to try to shortcut this and work off your last statement. You're now saying you do recall seeing a report of Mr. women where he said a PDF was unsigned?
MS. HYDE: I need to see -- I do remember him referencing the PDF. I would need to see the report, especially since the characterization of hash value being unsigned is not a term of art that I am familiar with in our field.
MR. ALESSI: Let me ask you if you agree or disagree with this statement. "This value can be used to compare with the original hash calculated at the time of extraction in order to validate the extraction data. However, this requires authentication of the original hash value which is not possible with GrayKey extractions as the PDF containing the extraction hash value is unsigned. Therefore, this hash value could be used as a suggestion of authentication, but cannot be guaranteed 100 percent." Do you agree or disagree?
MR. ALESSI: Right. But it's nonetheless unsigned, correct?
MS. HYDE: The PDF is not signed. That is a correct statement. GrayKey PDFs that purport that value or not in Adobe signed document.
MR. ALESSI: Do you know the history from the -- of the extraction of Jen McCabe's phone; it's a yes or no?
MS. HYDE: Can you provide more clarity? Do you mean from the time the image was made? Do you mean from the time the device was received, because I don't know the information pertaining to the receipt of the device into evidence, and then when the -- I only have the documentation of the image forward. So I want to be clear about what period we're talking about.
MR. ALESSI: It's an excellent point, and I am going to follow up with some questions.
MR. ALESSI: And an extraction, doesn't the extraction from the phone start with the raw data, raw image. You tell me when someone brings a phone in, what's the first step that gets taken in order to do a full file extraction? What's the first step?
MS. HYDE: It depends. There has got to be steps with regard to network isolation. I need to know if the device is AFU or BFU at that point. So I don't have that information from this case if that is the question. I get from the image forward.
MR. ALESSI: So what I'd like to do, and this may be my last section of questioning. I'd like you to describe the ideal situation as to getting the most reliable data from an iPhone from the start. What's the most reliable way to do it?
MS. HYDE: I would say the most reliable way is following the recently released SWIG-DE Scientific Working Group on Digital Evidence document on best practices of evidence handling preservation and imaging. I may have that title slightly out of order, but it is a document released this January.
MR. ALESSI: And tell me what that is.
MS. HYDE: Sure. In that, the first thing -- from which point are we starting? Are we starting, like, extracting the data, using a tool, or are we talking on scene taking the device into evidence?
MR. ALESSI: The latter.
MS. HYDE: Okay. So the first thing you're going to do is you're going to ensure that you are isolating the device. This is also going to depend on condition from the network. So typically this would be done with a Faraday enclosure in a best practice, however, there are alternative ways of isolating from the network, such as disabling all of the communication protocols such as Wi-Fi, airplane mode, et cetera. The next step once you've isolated out -- you also want to make sure you're continuing battery stat. So if the device is on, you want to keep it powered on. If it's off, you want to keep it powered off. That's the general statement. So the best way to do that is to attach a battery charger just like when you -- your battery runs low, you plug in a charger in the back of these battery packs. We do that before we put it in the Faraday bag. A Faraday bag is an enclosure that blocks signals from coming to the device. This is so a remote wipe command couldn't be sent or so that more data isn't received to the phone because phones are live and constantly obtaining data. So we're going to have it with a battery pack in the Faraday, presuming it was on. Again I don't know the status of this device. The next steps are going to depend on what state that device is and what make and model that device is, and what the current support for that device is. There are multiple types of extraction methods of phones. In the modern-day on iOS, a full file image, what we had on the device is in question in this case is considered the gold standard because it has the most robust information. So at this point, the next question is what's the best image type, and that's going to depend on if we have the passcode or if we don't have a passcode.
MR. ALESSI: If I could?
MR. ALESSI: And I'm going to allow you to --
MR. ALESSI: I want to break it down for the jury. So what I now want to do, you stopped at a certain point, but we've talked about securing -- what I would call securing the phone, right, and then making sure that there's note data swiped. You talked about airplane mode, Faraday bag, Faraday box, right? Do you know whether any of those protocols were followed for either the iPhone of Jen McCabe or John O'Keefe?
MS. HYDE: As I mentioned, I was not there for those processes. I don't have documentation of it. As mentioned, what started were my receipt of the device is from the image.
MR. ALESSI: Exactly. So you don't know?
MR. ALESSI: Fair enough. But do you have a little bit of hint as to whether the phone of Mr. John O'Keefe was properly secured in airplane mode, a Faraday bag, or a Faraday box based upon your own report of the iPhone of John McCabe? Can you determine that from page 5 of your report?
MS. HYDE: Obviously, there is data signals that are still being made and created. I believe that is what you are referring to. So the assumption is that I don't know at which point a Faraday bag is employed, but I also want to be clear, I don't know when -- I don't have information outside of the digital forensics realm about this case, so I don't know precisely when the phone was taken into custody by law enforcement.
MR. ALESSI: Fair enough. So assume that Mr. O'Keefe was deceased around the latest 9:00 a.m. on January 29, 2022, isn't there activity on that phone - health data activity - up to around noon of January 29, 2022?
MS. HYDE: Health data activity would continue to be reported regardless if the device was isolated from the network or not. Health data has to do with the movement of the device, so if the device was being moved, even within a Faraday bag, that data would still be populated.
MR. ALESSI: How about location data?
MS. HYDE: Location data is unlikely to be reported in a device that is Faraday enclosed, but I do know what location data you're referring to, so I cannot speak in absolutes without having a better reference to the artifacts in question. If you're saying it's in my report, I'll look at it. But, again, I never knew when the phone was seized, so it was not part of my initial analysis. Do I have permission to look at that time, ma'am?
JUDGE CANNONE: Yes.
MR. ALESSI: It is a big report.
MR. ALESSI: Pardon me?
MS. HYDE: It was at the bottom of my stack. I had to lift up the other ones to find it. All right. So --
MR. ALESSI: Your Honor, may I assist and point her to a page?
JUDGE CANNONE: Sure.
MR. ALESSI: If you could turn to that report on your page 47, and continue on to page 50?
MS. HYDE: I do see incoming data that is consistent with the device not being Faradayed such as the receipt of SMS messages, notifications from Ring, et cetera.
MR. ALESSI: So the iPhone of Mr. O'Keefe was not secured in a manner you described before we got into this as would be the best practice with regard to getting the most accurate data from the phone. That is once it comes in, that it's to be either put in airplane mode, Faraday bag or a Faraday box; is that correct? By your own report, you see activity --
MS. HYDE: I do see activity. It was not Faradayed. Faraday prevents wiping of the device and additional data. So actually we actually in this instance, it doesn't appear that the device was at risk of wipe because it was not wiped, and we actually have more data because we get to see the data that continued to come into the device. I'm not saying that's in accordance with best practice. I'm saying that's what I see based off of what you just had me review in the data.
MR. ALESSI: It sounds like you're trying to justify --
MR. ALESSI: You tell me. It sounds like you're trying to justify the fact that it wasn't secured; am I correct?
MS. HYDE: No, you're incorrect. I'm just state we have -- you asked if we had more data or less data. We actually have more data with it not being Faradayed, but, no, best practice would be to Faraday. I one hundred percent agree.
MR. ALESSI: My question wasn't is there more or less data. My question was simply doesn't your own report, your own report --
MR. ALESSI: -- show activity up until noon on January 29, 2022?
MS. HYDE: Correct. And for clarity, my scope was until noon, so I don't know if there was activity beyond that.
MR. ALESSI: Right. But as far as your scope goes, I want to be clear, there is activity --
MR. ALESSI: -- on the phone?
MR. ALESSI: -- which shows that it was not put in airplane mode, it was not put in a Faraday bag, and it was not put in a Faraday box, and that failure is not best practices?
MS. HYDE: Correct. It is not in accordance with the best practices. I agree. I would have Faradayed it.
MR. ALESSI: Thank you. So --
MR. ALESSI: That's all. I have am no further questions. Thank you for answering my questions, Ms. Hyde.
JUDGE CANNONE: All right. Mr. Brennan, any redirect?
MR. BRENNAN: Thank you.
JUDGE CANNONE: Whenever you're ready.
MR. ALESSI: Thank you, Mr. Brennan.
MR. BRENNAN: You're welcome.