Commonwealth v. Read — Trial ArchiveNicholas Guarino - Direct (Part 1)
356 linesMR. BRENNAN: May I call my next witness, please?
COURT CLERK: The Commonwealth calls Nicholas Guarino. Do you swear that the evidence you shall give the court and jury in this case shall be the truth, the whole truth, and nothing but the truth, so help you God?
MR. GUARINO: Thank you.
JUDGE CANNONE: You can — do you want to stand or sit, however you're most comfortable.
MR. GUARINO: Okay. Thank you, your honor.
JUDGE CANNONE: You may proceed.
MR. BRENNAN: Yes. Good afternoon.
MR. GUARINO: Good afternoon, sir.
MR. BRENNAN: Could you please introduce yourself to the jury?
MR. GUARINO: Yes. Uh, my name is Nicholas Guarino.
MR. BRENNAN: Mr. Guarino, where do you work?
MR. GUARINO: I work for the Massachusetts State Police at the Norfolk District Attorney's Office.
MR. BRENNAN: How long have you worked for the Massachusetts State Police?
MR. GUARINO: Uh, this is year 10 now.
MR. BRENNAN: How long have you been assigned to the District Attorney's Office?
MR. GUARINO: Uh, since November of 2019. So, uh, a little five-ish years. Six years.
MR. BRENNAN: I want to go backwards a little bit. Can you tell me a little bit about what you did before you began working for the Massachusetts State Police?
MR. GUARINO: Yes, sir. I was a Norwood police officer for almost 11 years.
MR. BRENNAN: So, how long have you been in law enforcement between being a Norwood police officer and a Massachusetts State Police officer?
MR. GUARINO: Uh, February of this year started my 20th year in law enforcement.
MR. BRENNAN: Did you go to school before you became a law enforcement officer?
MR. GUARINO: Yes, I went to Westfield State College — uh, Westfield State University.
MR. BRENNAN: Now, did you graduate?
MR. GUARINO: Yes, I did.
MR. BRENNAN: Can you remember what year you graduated?
MR. GUARINO: Yes, it was uh 2003.
MR. BRENNAN: Did you have a particular degree from Westfield State?
MR. GUARINO: Yes, I double majored. I got a major in criminal justice and mass communications.
MR. BRENNAN: When you began as a police officer with the Norwood Police Department, did you have to go into any type of specific training?
MR. GUARINO: Yes, I went to the uh police academy.
MR. BRENNAN: And how long is the police academy?
MR. GUARINO: Uh, six months, generally.
MR. BRENNAN: And briefly, what was taught at the academy?
MR. GUARINO: Uh, how to conduct investigations, uh, respond to calls, uh, they did a standard field sobriety testing week, uh, physical training, uh, Massachusetts law and criminal procedure.
MR. BRENNAN: When you began as a Norwood police officer, were you a patrol officer?
MR. GUARINO: Yes, I was.
MR. BRENNAN: And did you remain a patrol officer for the 10 or 11 years you were there?
MR. GUARINO: Yes. I was also uh part-time in the detail office.
MR. BRENNAN: But what does that mean?
MR. GUARINO: Uh, handling uh jobs when we're off, so uh filling details like road construction.
MR. BRENNAN: I'm sorry. When you left Norwood and began working with the Massachusetts State Police, um, based on your prior training, did you have to go through further training or were you ready to just begin?
MR. GUARINO: No, I had to go to the state police academy for six months.
MR. BRENNAN: After you got out of the state police academy, um, were you assigned to a barracks?
MR. GUARINO: Uh, yes, I was assigned to the South Boston barracks for my training. Uh, and then once my break-in training was done, I was assigned to the Holden barracks near Worcester.
MR. BRENNAN: At some point during your career with the Massachusetts State Police, did you start to receive any type of training in any specific field? I'm sorry. Did you receive any specialized training at the Massachusetts State Police after the academy?
MR. GUARINO: Uh, once I'd gone into the district attorney's office, yes.
MR. BRENNAN: And can you tell us a little bit about what type of specialized training you received when you were assigned to the Norfolk County District Attorney's Office?
MR. GUARINO: Yes. Uh, so I was hired by the District Attorney's Office. I do uh cell phone and computer forensics, as well as I'm a sexual assault investigator. Um, I had prior sexual assault investigator school done, and I went for uh digital forensics classes uh as part of my now daily duties.
MR. BRENNAN: In order to work with cell phone forensics, did you have any particular background in it at that point?
MR. GUARINO: I had taken some classes when I was at Norwood PD, but I didn't have any of the Cellebrite or AXIOM classes that I do now.
MR. BRENNAN: We'll talk about those in a minute so you can give a little more explanation. Did you ever receive a specific advanced degree in data forensics?
MR. GUARINO: No, I didn't.
MR. BRENNAN: Did you ever receive any specialized further degree, a master's in data forensics?
MR. GUARINO: No.
MR. BRENNAN: So, your training came while you were a Massachusetts State Police officer through the uh Massachusetts State Police?
MR. GUARINO: Yes, that's correct.
MR. BRENNAN: What type of courses did you take to learn about forensics?
MR. GUARINO: Uh, the first one I took was uh Cellebrite certified, uh, CCO — CCPA is their intro course — that teach you how to use the program and how to extract cell phones using the Cellebrite program.
MR. BRENNAN: There are a couple of words I want you to help us understand.
MR. GUARINO: Yes.
MR. BRENNAN: The first is an extraction. What is — as simple as you can — a cell phone extraction?
MR. GUARINO: Yes, uh, quite literally it is plugging the phone into specialized hardware or software and it pulls the data from that device to make a digital copy of it. So that way we can load it up later to look at it.
MR. BRENNAN: So when you extract the phone through a download, it basically mimics the content of the phone, but it's in a different shell. It's in a different form than inside the actual phone itself.
MR. GUARINO: Yes, exactly. That way we're not manipulating or changing any data while looking. Uh, because if we were to open the device, it would change data by going through the phone itself or computer.
MR. BRENNAN: Okay. When you plug it in, can you explain a little bit about what you're plugging it into?
MR. GUARINO: Yes. So, the main program and hardware that we use is GrayKey. It is again specialized software and hardware that once the phone's plugged into it, the software is able to extract the information if we have the passcode. If we don't have the passcode and the phone is supported, it's able to guess that passcode. Depending on how long — like for an iPhone, if you have a four-digit passcode, it could take months. If you have a six-digit, it could take up to 35 years.
MR. BRENNAN: So, does the phone have to be accessible to actually do that download through GrayKey? Do you have to be able to open the phone with the passcode?
MR. GUARINO: Uh, no. So, if we don't have the passcode and it's supported, it can guess the passcode without making the phone useless — after, say, for an iPhone, I believe it's 10 passcodes.
MR. BRENNAN: Is it a quicker process if you do have the passcode?
MR. GUARINO: Much — it would take hours to download the device depending on how much information is on it.
MR. BRENNAN: How do you ensure that the information that you extract from the actual device is accurate and the same when you're making a copy? How do you ensure the integrity of it?
MR. GUARINO: So, with GrayKey, it produces a progress report as it goes through its process. The only two fields that we can sort of amend in that PDF that it spits out is the ID number and then the investigator name. So after the data is pulled out, it creates a hash value which is like a digital fingerprint for that specific information. So if you had gone in to edit or change it, that digital fingerprint would change. It would change the big long string of numbers that it attaches to that file.
MR. BRENNAN: The digital fingerprint, is that the same thing you're referring to as the hash value?
MR. GUARINO: Yes, exactly.
MR. BRENNAN: And how do you ensure that the hash value of the product, the copy, is the same as what's on the phone?
MR. GUARINO: You can run the zip file that it creates with the information into a hash calculator and it will give the same hash as what is produced from the GrayKey PDF report. So if something had changed or there was an error with it, the hash would not be the same as what was given from the PDF. And that's how we would know that the data is not the same.
MR. BRENNAN: So if you download a phone and it has a hash value — this digital fingerprint — and then someone was to manipulate the phone and remove anything, even a period from that data, if it's run again will the hash value change?
MR. GUARINO: Yes, it would not be the same, because it will show — I'm sorry — even if it's just a period, yes, any alteration to that initial extraction, with that number it immediately would change.
MR. BRENNAN: So, if you have an item, a computer or a phone, and you put it through the GrayKey program, and you do an extraction, a copy, where do you store that copy of information? If it's not on the phone that you originally have, what do you do with it?
MR. GUARINO: So once the program pulls that information, we have to place it onto our secure server at the office, and we'll take any of the files that we're given via the extraction process, and it's saved there for us.
MR. BRENNAN: And so you copy it on another link or another digital file?
MR. GUARINO: Yes, we'll save it to the server at the district attorney's office.
MR. BRENNAN: Can it be put on a physical item like a zip drive or a hard drive?
MR. GUARINO: Yes.
MR. BRENNAN: If you put that download onto a zip drive or hard drive, how will you know if that information on the hard drive matches the same information you originally downloaded from the phone to the server through GrayKey?
MR. GUARINO: Again, like I said, you could run the hash value of that file again to correlate it with the PDF that we were given once GrayKey has given us the information. So that's how you would know all the information is the same, nothing has changed.
MR. BRENNAN: So, for example, if you download an iPhone and it has that digital fingerprint hash value attached to it and you make a copy or multiple copies, is the way to test whether or not those copies are exactly accurate is to look at the hash value of each copy?
MR. GUARINO: Yes. And copying the zip file would not change the hash value. The only way it would change is if you physically went into it and deleted information somehow.
MR. BRENNAN: So now that you have the item, say for example an iPhone, and you've downloaded it through GrayKey, which is hardware and software, and it's on a digital file, can you just open it up and start reading it like a report or a book, or do you have to do something else to it?
MR. GUARINO: No. Once it's pulled into that zip file, it has to be opened into another program. There are many forensic tools, but the ones at the office we use are Cellebrite or Magnet AXIOM. They're two brands. And then those programs make that information readable so we can actually look at it.
MR. BRENNAN: So if you were to download a forensic copy and you were to open it up without using that subsequent software, would you be able to read or see anything that's on that data?
MR. GUARINO: To be honest, I don't know because I've never opened one of those zip files.
MR. BRENNAN: Okay.
MR. GUARINO: To know what's actually in them.
MR. BRENNAN: After the extraction happens, after that copy is made, did you mention this further software you would use to be able to actually read the data?
MR. GUARINO: Yes. So, that's Cellebrite and Magnet AXIOM. They're two different programs, but those programs will make the information readable.
MR. BRENNAN: Are those the programs that you typically use?
MR. GUARINO: Yes, they are. And there are other programs out there, but those are the two that we normally use at the office.
MR. BRENNAN: Are they commonly used in the Massachusetts State Police?
MR. GUARINO: Yes, they are.
MR. BRENNAN: Are there other programs beyond Magnet AXIOM and Cellebrite that can be used to decipher the information so you can read it?
MR. GUARINO: Yes, there's many.
MR. BRENNAN: Okay. In your entire time with the Massachusetts State Police, have you used any other programs other than Magnet AXIOM or Cellebrite to look at cell phones?
MR. GUARINO: Yes. We have Sanderson forensic software that can look at databases that are in the phone to look at information. I don't normally use those because — I don't want to say — I'm probably not proficient enough that I would know this exactly means this, or I wouldn't want to confuse anything that I'm looking at.
MR. BRENNAN: When you look at the information after it's been through the extraction and then an analysis through the software, is the data still available if you want to look into the data from the zip file itself?
MR. GUARINO: Yes, yes. It's always available. Like I said, the data in the zip file that GrayKey gives us is never changed. It's just being loaded into another program so we can see it.
MR. BRENNAN: The software that you use, whether it's Cellebrite or Magnet AXIOM, does that do the work for you as a forensic examiner?
MR. GUARINO: Yes. So, as the program runs, I should say, it will bring up different tabs — phone calls, chats, photos, the databases — all different things that Cellebrite's software has run to pull this information out to make it easier for investigators to find what they're looking for.
MR. BRENNAN: Beyond the initial report that you can look at and look for the information if you wanted to as a data forensic examiner, could you look deeper beyond the production of those software programs?
MR. GUARINO: Yes, you could.
MR. BRENNAN: Forensic data analysis — when you look at these tools that provide these initial reports, is that the beginning or does it dig deeper when you're a digital forensic analyst?
MR. GUARINO: No. These reports are finding the low-hanging fruit in the proverbial tree. So, that's showing you the stuff that the program has set that most people are looking for. As I said, the phone calls, the chats. If you need to go deeper into it, as I said, there's other software out there where you can pull these databases and try to go through the code to find what you're looking for. Once you find something, you would have to corroborate it with other evidence or data to make sure what you're looking at is exactly what you're looking for.
MR. BRENNAN: Have you been involved in the download, extraction, and analyzing data on phones as your role with the Massachusetts State Police?
MR. GUARINO: Yes, that's my primary role.
MR. BRENNAN: What — in the DA's office currently? And how many years have you been in that role?
MR. GUARINO: Since November of 2019 — about 5 years now.
MR. BRENNAN: Have you worked on a number of different cases that involve forensic data?
MR. GUARINO: Yes, I have.
MR. BRENNAN: Is there a routine or a practice in your present role when you make a copy about what process you use and how you produce it in a case?
MR. GUARINO: I wouldn't say there's a normal process. It's all case dependent. A lot of cases we get, people want PDFs of the information, portable cases that we can create. So, it's basically the portable program that I'm using. That way, someone could find the information they're looking for. Or I give the raw information if requested.
MR. BRENNAN: What's the difference between PDF form and raw information?
MR. GUARINO: So, Cellebrite can create a PDF form of every bit of information in the phone. It could be like a 10,000-page PDF. It literally just lists everything that's in there. If I create a portable case, as I said, that is basically like me giving you the thumb drive and it's showing you exactly what I'm seeing and you can click on the tabs yourself from your own computer. And then if I give the raw file, that means someone has to go in and load it themselves to look for it.
MR. BRENNAN: Typically when you are producing evidence of discovery in a case, do you produce PDF or the raw file?
MR. GUARINO: As I said, it's all case dependent. Not all cases have forensic experts to come in to look at the information. So I'll supply whatever is requested. Normally the PDF or the portable case is what I give. But if more is requested, that's readily available.
MR. BRENNAN: And so the raw data — if requested — do you provide that as well?
MR. GUARINO: Yes, if requested.
MR. BRENNAN: In this case, were you involved in any type of forensic data extraction?
MR. GUARINO: Yes, I did the extractions of multiple phones and analyzed multiple phones.
MR. BRENNAN: In this case, you mentioned that there's a software and hardware, the GrayKey unit. Where's that located?
MR. GUARINO: That's located in the digital forensics laboratory, which is key card access and alarmed — excuse me — at the north DA's office.
MR. BRENNAN: Are there other cases — multiple cases that are occurring at the same time?
MR. GUARINO: Yes, we constantly have phones coming in and out and being worked on.
MR. BRENNAN: What if you have a phone and the GrayKey unit is being used? What do you need to do?
MR. GUARINO: We need to wait for that phone to finish. Because if we unplugged it, it would interrupt that data transfer and we could lose it. So we wait until the phone's done and then the next phone goes up.
MR. BRENNAN: Did you become involved in some way in this case?
MR. GUARINO: Downloading devices, sir.
MR. BRENNAN: Well, I'm asking generally. Yes?
MR. GUARINO: Sorry. Yes.
MR. BRENNAN: Were you involved in investigating this case as far as speaking to witnesses or going to the scene?
MR. GUARINO: No.
MR. BRENNAN: Can you describe the best you can what your role was relative to this case?
MR. GUARINO: Yes. So I was brought, as I said, phones from this case to have the data extracted and then have it ready in our Cellebrite program for the investigators to look at.
MR. BRENNAN: At some point were you provided a phone that you later identified as a phone belonging to Mr. John O'Keefe?
MR. GUARINO: Yes, I was.
MR. BRENNAN: Do you remember when you were provided that phone?
MR. GUARINO: Yes, it would be January 29th, 2022, about 7 to 7:30 p.m. that night.
MR. BRENNAN: Do you remember where you received that phone from?
MR. GUARINO: Yes. I was at the DA's office. I got it from Sgt. Bukhenik and Michael Proctor.
MR. BRENNAN: Do you remember about what time of night that was?
MR. GUARINO: As I said, about 7 to 7:30 p.m.
MR. BRENNAN: Thank you. When you received that phone, did you have the passcode?
MR. GUARINO: No, we didn't.
MR. BRENNAN: Without the passcode, what were your next steps?
MR. GUARINO: So the phone was placed in our digital forensics lab until we could get the passcode. I was told that a family member was going to be bringing it in so we could download the device.
MR. BRENNAN: Did you ultimately get that passcode?
MR. GUARINO: Yes, we did.
MR. BRENNAN: And do you remember when you received it?
MR. GUARINO: January 31st, 2022.
MR. BRENNAN: After you received the passcode for Mr. O'Keefe's phone, can you walk us through the process of what you did?
MR. GUARINO: Yep. So once the passcode's obtained, we'll unlock the phone and then plug it into GrayKey and then it's able to pull the full information from it without having to guess the passcode.
MR. BRENNAN: How long does that take?
MR. GUARINO: Again, depending on the size of the phone, a few hours.
MR. BRENNAN: After the information was downloaded, then what happened?
MR. GUARINO: We'd place it on our digital evidence server at the DA's office and then if the phone is evidence, it would go into evidence. If it was a consent, we'd give it back to the person who gave it to us immediately.
MR. BRENNAN: Did this phone go into evidence?
MR. GUARINO: Yes, it did.
MR. BRENNAN: When you downloaded the information through GrayKey, which you said was the hardware and software, does it produce a report with that digital imprint?
MR. GUARINO: Yes, it does. It produces a report from the time you plug it in to the process it completes, and then the amount of data, and then like I said that digital fingerprint hash value at the end.
MR. BRENNAN: And did you do that with this phone? [unintelligible] May I approach, your honor?
JUDGE CANNONE: Yes.
MR. BRENNAN: All right, I'm going to show you a document, sir.
MR. GUARINO: Okay. Sorry. Yes. Thank you.
JUDGE CANNONE: I'm sorry. Did you show it to Lally?
MR. BRENNAN: I'm sorry.
JUDGE CANNONE: Thank you.
MR. BRENNAN: Yes. I'm showing you a document. Could you look at both pages, please?
MR. GUARINO: Yeah. Okay.
MR. BRENNAN: Do you recognize that document?
MR. GUARINO: Yes. This is the —
MR. BRENNAN: A couple more if you don't mind. What is it?
MR. GUARINO: It's the GrayKey progress report that they give once the phone extractions are completed.
MR. BRENNAN: Do you recognize that as the report attributed to John O'Keefe's phone?
MR. GUARINO: Yes.
MR. BRENNAN: And does that document have that digital imprint, the digital fingerprint that you were talking about?
MR. GUARINO: Yes. So it's — yeah. So it's here on the back. I just want to see if it was in two places, but it would be here for the — sorry, it's cut off, but I put it up
MR. BRENNAN: — I'll ask you some questions.
MR. GUARINO: Okay.
MR. BRENNAN: I'd like to introduce this as an exhibit, please. DEFENSE COUNSEL: No objection, your honor.
JUDGE CANNONE: Okay. Thank you. Eighteen, mark.
COURT CLERK: Sorry.
MR. BRENNAN: May I show that exhibit to the jury?
JUDGE CANNONE: Yeah.
MR. BRENNAN: May I approach the witness to show him the pointer?
JUDGE CANNONE: Yes.
MR. BRENNAN: On this top button will be the pointer. The middle button will change the screen.
MR. GUARINO: Okay.
MR. BRENNAN: Can you walk us through what this report means?
MR. GUARINO: Yep. So here at the top — there it is. Again, it says GrayKey progress report, and then it gives the report generation date and time, and it is in UTC, which is — I'll get the exact definition — Universal Time Coordinates, I believe. So you'd have to minus 4 or 5 hours depending on daylight saving time. So this one would have been January — it's minus 5 — 1610 will be [unintelligible] for the actual time on the 31st. As we go down, device name is Johnny. The software version is the Apple iOS that was running at the time, the model number iPhone 11, and then if you were to look up the N104 AP — — is also a model number. The unique device ID.
MR. GUARINO: This one is what GrayKey assigns to the zip file that it creates, serial number of the phone, the unique chip ID, the Wi-Fi address, the Bluetooth address, and then the phone number. And then there's more information underneath.
MR. BRENNAN: Could we scroll that please?
MR. GUARINO: Thank you. This here is the IMEI, which is the International Mobile Equipment Identifier. It's not uncommon now to have multiple of those identifying numbers. The data partition size of the device, which is — excuse me — 83 GB. The lock state — if the phone was locked, it would say locked. This one is unlocked because we had the passcode. This was the GrayKey agent version for the software. And then this is the last time that the phone was backed up via iTunes or iCloud. This is the owner's name. You can have anything in this, but his phone had John O'Keefe as the iPhone owner name, and then the different accounts attributed to the phone.
MR. BRENNAN: Okay. Can you show us where the digital fingerprint is?
MR. GUARINO: Yep. It's down. So the top part here is literally every time it — when it's plugged in to every process that it completes until the progress report is generated. Here, there's the full file system that was created on this date and time, and then even though the partition size was 82 GB, it actually pulled 125 gigabytes of data. Underneath this, if you — on the next page — is that unique fingerprint right here. So it has two: a SHA-256 and an MD5. They're just two versions of hashing to show that the file — they're unique fingerprints and that's what these numbers are here. So there's one for the image of the extraction and then one for the keychain for the other documents that GrayKey creates.
MR. BRENNAN: And you mentioned that if anything has changed — even the period — that number and letter sequence will change as well.
MR. GUARINO: Yes, that's exactly right.
MR. BRENNAN: Did you have an opportunity to download and extract any other phones?
MR. GUARINO: Yes.
MR. BRENNAN: At some point, did you have an opportunity to download and extract a phone from the defendant?
MR. GUARINO: Yes, I did.
MR. BRENNAN: Do you remember when you received that phone?
MR. GUARINO: I got the phone the same time as I got Mr. O'Keefe's phone, on the 29th, around 7 to 7:30 at night.
MR. BRENNAN: And so you received both phones at the same time?
MR. GUARINO: Yes. From the same people.
MR. BRENNAN: Correct. Sgt. Bukhenik?
MR. GUARINO: Yes.
MR. BRENNAN: Trooper Proctor?
MR. GUARINO: Yes.
MR. BRENNAN: What did you do with that phone?
MR. GUARINO: Again, that was brought down to the digital forensics lab for holding until we could get into it, or warrant was written, or whatever legal process was going to be done so we could get that information.
MR. BRENNAN: Do you secure it?
MR. GUARINO: Yes, that room is locked with key card access that only myself and two others have. And it's also alarmed.
MR. BRENNAN: Do the case officers or investigators that aren't part of your unit have access to those items?
MR. GUARINO: No, the only ones that had access were myself, Trooper Connor Keefe, and then the director Samantha Vote. She's a civilian that runs our lab.
MR. BRENNAN: Okay. And at that point — were you able, after there was process, were you able to get into the phone at first?
MR. GUARINO: No, it wasn't supported by GrayKey, the phone model and number.
MR. BRENNAN: What do you mean it wasn't supported?
MR. GUARINO: So the software, even if we had a search warrant, we plugged it in, GrayKey wouldn't be able to recognize it because it just wasn't supported at that time.
MR. BRENNAN: When you say it wasn't supported, did this have anything to do with a passcode — well, for both?
MR. GUARINO: So we didn't have the passcode. So because we didn't have it, it wasn't supported for us to download that information from the device.
MR. BRENNAN: If you had a passcode, would it have been supported?
MR. GUARINO: Yes, it would have been.
MR. BRENNAN: So is there a process when you have a phone that you don't have a passcode for to be able to access the content of the phone?
MR. GUARINO: Yes, that's correct. We have to wait until we either have the passcode or the software and hardware is supported for the device where it can try to guess the passcode.
MR. BRENNAN: So let me ask you some questions about software in forensic data analysis. Does software change frequently, constantly?
MR. GUARINO: Yes.
MR. BRENNAN: When the software changes, does it advance? Does the software get better?
MR. GUARINO: Yes, it does.
MR. BRENNAN: At the time you first had the defendant's phone, the software you had was unable to access the contents.
MR. GUARINO: That is correct.
MR. BRENNAN: What do you do? Do you look for other software or do you wait for updates? What's the process?
MR. GUARINO: If there is another software out there, we will use it to try to get the information. If not, we are at the mercy of waiting for the developers to come up with the information for us.
MR. BRENNAN: Did you wait in this case?
MR. GUARINO: Yes, we did. We had to wait.
MR. BRENNAN: Ultimately, did software advance so that without a passcode you were able to access?
MR. GUARINO: Yes.
MR. BRENNAN: How long did you have to wait before you were able to access?
MR. GUARINO: I believe it was July of 2022 that the software had been upgraded enough that it was able to brute force or guess her passcode for the device.
DEFENSE: Objection.
MR. BRENNAN: Your Honor, may we approach, please. Thank you. Did you use software ultimately to open the defendant's phone?
MR. BRENNAN: And where does the device remain until you're ready to try again?
MR. GUARINO: In that locked digital forensics lab.
MR. BRENNAN: So when the software updates and advances, do you know that it will be successful, or you plug it in and you try?
MR. GUARINO: No. So on GrayKey they have a link where you can click and it brings up a whole matrix. So it shows every make and model of phone and then the software associated with it, and it says it can do a partial download, a full download, a password guess, and it tells us. So when there's a new update, we'll check that to make sure that the devices we have can be accessed.
MR. BRENNAN: Did you make an attempt to have the software access the phone without a passcode?
MR. GUARINO: Yes.
MR. BRENNAN: And how many times did you download?
MR. GUARINO: So there were two downloads. One — uh, one of the partial part of the phone, and then — in the same time that we had it plugged in, we had the password brute force guess software installed onto the phone to try to guess the passcode. So there were two downloads, one with very limited data and then one with the full file system extraction, which is everything on the phone that I can get.
MR. BRENNAN: May I approach?
JUDGE CANNONE: Yes.
MR. BRENNAN: I'm going to show you two documents. [unintelligible] — going to show you two documents. [unintelligible] The first one — do you recognize that document?
MR. GUARINO: Yes, I do.
MR. BRENNAN: Is that a result summary from GrayKey for a search of the defendant's phone?
MR. GUARINO: This is the initial extraction that we created before the password guess process went through.
MR. BRENNAN: I'd like to introduce this as the next exhibit, please.
MR. ALESSI: No objection, your honor.
JUDGE CANNONE: That's the original?
MR. GUARINO: Yes, this is the first one.
JUDGE CANNONE: Thank you. Exhibit 19.
MR. BRENNAN: I showed you a second document. Do you recognize that?
MR. GUARINO: Yes. This is essentially the same information except it goes further — all the password guess attempts — until we actually get all of the information from the phone.
MR. BRENNAN: I'd like to introduce this as the next exhibit, please.
MR. ALESSI: No objection, your honor.
JUDGE CANNONE: Exhibit 20.
MR. BRENNAN: Could I have the previous exhibit as well, please? Sir, I'm handing you back Exhibit 19, which was the partial download.
MR. GUARINO: Okay.
MR. BRENNAN: Exhibit 20, which was a subsequent download. You mentioned hash values change with the content of each download.
MR. GUARINO: Yes.
MR. BRENNAN: Are there hash values specifically assigned to each download?
MR. GUARINO: Yes, there is.
MR. BRENNAN: Are there the same number of digits in the digital fingerprint?
MR. GUARINO: No, they're not.
MR. BRENNAN: And explain again why they would be different.
MR. GUARINO: Again, the first one was the partial. It was only 45 gigabytes of data, so it has one number. The second download was 109 GB of data once it got the passcode. And again, that number is completely different. And again, like I said, the information is not the same, so the hash values won't be the same.
MR. BRENNAN: Were there two other phones that you ultimately analyzed?
MR. GUARINO: Yes, there were.
MR. BRENNAN: Let's start with the first one. Did you have an opportunity to create a file on a phone that came from Kerry Roberts?
MR. GUARINO: Yes, I did.
MR. BRENNAN: Now, you said it's a two-step process. First is the extraction, the copying, and then it's creating the file.
MR. GUARINO: That's exactly right.
MR. BRENNAN: With Kerry Roberts' phone, did you make the extraction? Did you plug it into the GrayKey?
MR. GUARINO: No, I didn't.
MR. BRENNAN: Who did?
MR. GUARINO: Trooper Connor Keefe. He went to meet with Kerry Roberts, received the device from her. He brought it back to the office and did the extraction. His name is also on the extraction GrayKey progress reports as well, and he wrote two state police reports regarding it.
MR. BRENNAN: How do you know what Trooper Connor Keefe did?
MR. GUARINO: Yes — I'm sorry. Yes, we do essentially the same job working together.
MR. BRENNAN: So he's in your unit?
MR. GUARINO: Yes, he is in the digital forensic unit. That's correct.
MR. BRENNAN: That phone — did it come with any paperwork, any forms?
MR. GUARINO: Yes, he had two signed waivers of consent from both parties, one for each device.
MR. BRENNAN: And so as far as the copying, the extraction — you did not do the extraction on Kerry Roberts' phone?
MR. GUARINO: No, I did not.
MR. BRENNAN: After it was plugged in and a copy was made, did you then access it?
MR. GUARINO: Months down the road.
MR. BRENNAN: Were you assigned at that point to analyze or look at any of the data on that phone?
MR. GUARINO: Initially, no.
MR. BRENNAN: At some point, did you create a file so that you could provide it to the parties?
MR. GUARINO: Yes, I did.
MR. BRENNAN: Was that upon request?
MR. GUARINO: Yes, it was.
MR. BRENNAN: And separately — let me ask it a different way. Was a phone from Jennifer McCabe extracted?
MR. GUARINO: Yes, it was.
MR. BRENNAN: Did you do the extraction?
MR. GUARINO: No, I did not.
MR. BRENNAN: Was the information, after being extracted, again provided to a digital file?
MR. GUARINO: It would have been. Yes.
MR. BRENNAN: Did you at some point later make a copy to provide to the parties?
MR. GUARINO: Yes, I did.
MR. BRENNAN: Can you tell us what a UFED reader is?
MR. GUARINO: So the UFED reader is a portable case that I can create through Cellebrite. Like I said, it's the exact same program that I would be viewing if I was sitting at my desktop, and it can be made into a thumb drive to give to defense, prosecution, investigators, whoever. And there's no chance for the data to be manipulated because it's just a reader.
MR. BRENNAN: When you have the digital file that's been extracted and then created into a PDF or form that can be read, can you print the entire file on paper if you'd like?
MR. GUARINO: Yes, you could.
MR. BRENNAN: Could you print it so it includes the entire content of the phone?
MR. GUARINO: Yes. It'd be thousands of pages, but yes, you could.
MR. BRENNAN: Is there any way to isolate particular things of interest that you might want? For example, if you wanted just the chats between two people, is there a way that you could have a program isolate just those chats and then give you all of them in a form that you could read?
MR. GUARINO: Yes. So you can go in and cherry-pick whatever information you're looking for to create into PDFs or other — it gives five, I think, different mediums you can have it output: HTML, portable cases, XML files.
MR. BRENNAN: If you wanted to create a document that had a number of people in communications, could you do that as well?
MR. GUARINO: Yes, you could.
MR. BRENNAN: So you can pretty much set the parameters how you want if you want to search for particular items.
MR. GUARINO: Yes, it's very generous that way — being able to search for keywords, phone numbers, whatever it is. And then you can export that out into a PDF so you can print it.
JUDGE CANNONE: One moment.
MR. BRENNAN: Okay. Did you go through the program and create a number of documents that isolated specific information that you wanted?
MR. GUARINO: Yes.
MR. BRENNAN: For example, did you go through and create a report for all of John O'Keefe's calls for a period of time?
MR. GUARINO: Yes, I did.
MR. BRENNAN: Did you go through the program and create a report for all of the calls between John O'Keefe and the defendant for a period of time?
MR. GUARINO: Yes, I did.
MR. BRENNAN: Did you go through the program and create a specific document that would show just the text messages between John O'Keefe and the defendant?
MR. GUARINO: Yes, I did.
MR. BRENNAN: And did you go through the phone and create specific separate documents for communications, phone calls, and text messages between Mr. O'Keefe and other people, not the defendant?
MR. GUARINO: Yes.
MR. BRENNAN: For example, Miss Roberts?
MR. GUARINO: Yes, that's correct.
MR. BRENNAN: Miss McCabe?
MR. GUARINO: Yep.
MR. BRENNAN: Did you go through any of the phones and create documents to show any text or conversation between parties not involving John O'Keefe?
MR. GUARINO: If directed, I could, but I don't believe I did.
MR. BRENNAN: When you took on the task of creating these documents, was it something you did on your own or something that you would wait for a request from a prosecutor or another officer?
MR. GUARINO: I would wait for a request. Again, my knowledge of most of the cases is very limited. So if they're looking for something specific, I can assist them. If they need some type of help, I can assist them, but normally I will open it up for them and they have a better knowledge of the case, so they know what they're going to be looking for. Everyone in our office is Cellebrite trained. Or if someone new comes in, that's the first thing they'll go to is Cellebrite training, so they know how to use this program, and it doesn't put the burden on myself and Trooper Keefe to try to find everything for every case.
MR. BRENNAN: Thank you, John. At this time, I'd like to conclude this witness's testimony, to be recalled again.
JUDGE CANNONE: You're in agreement with that, Mr. Alessi?
MR. ALESSI: We are, your honor. Subject to the recall.
JUDGE CANNONE: Okay. All right, Trooper. You're all set.
MR. GUARINO: Thank you, Your Honor.
JUDGE CANNONE: We'll see you again.
MR. GUARINO: Should I—
JUDGE CANNONE: You could just leave it right there. Thank you.