Day 6 - April 29, 2025

Hank Brennan methodically rebuilt Ian Whiffin's testimony on redirect after Robert Alessi's cross-examination. Brennan first established that he never told Whiffin what to look for or attempted to influence his conclusions. He then walked the jury through O'Keefe's phone data second-by-second — the car decelerating from 16.6 mph to 0 mph at the flagpole at 12:24:38, the 36-step movement from 12:31:56 to 12:32:16, the steady battery temperature decline from 82°F to 37°F with no warming that would indicate the phone entered a building, and the 432 steps recorded at 6:04-6:11 a.m. followed by temperature increase. On the McCabe phone, Brennan addressed the hash value issue raised on cross, with Whiffin explaining GrayKey's unsigned PDF is standard practice, the hash matched, and cross-referencing multiple databases revealed no tampering. Whiffin testified there is no remaining dispute in the forensic community about the search occurring at 6:23-6:24 a.m., and that Cellebrite removed the misleading 'last visited time' label after team validation. The proceeding ended at lunch recess before a planned live demonstration.

ADA Hank Brennan continued redirect examination of Cellebrite expert Ian Whiffin, addressing two areas raised during Robert Alessi's cross-examination. First, Brennan walked Whiffin through location data accuracy, establishing that varying circle sizes on Exhibit 40 reflect the phone refining its GPS accuracy over time — not actual device movement — and that weather, geography, interference, and even a body covering the phone can affect location precision. Whiffin introduced a supporting chart from page 22 of his report showing five consecutive records with identical coordinates but accuracy narrowing from 43 meters to 7 meters in 8 seconds, all consistent with the phone remaining stationary at the flagpole. Second, Whiffin performed a live demonstration on a phone running iOS 15.2.1 — matching Jennifer McCabe's version — showing the jury in real time that Safari's BrowserState database only creates a record when a tab is closed, and that the 'last viewed' timestamp reflects when the tab was first opened, not when subsequent searches were performed.

Robert Alessi conducted a brief recross of Ian Whiffin focused on two points. First, he confirmed that Magnet AXIOM — which Whiffin agreed is a reliable forensic tool — still displays the 2:27 a.m. timestamp that Cellebrite removed from its products. Second, Alessi pressed Whiffin on when he prepared the live demonstration just shown to the jury, eventually getting Whiffin to confirm that the demonstration was altered after Cellebrite had removed the 2:27 a.m. timestamp from its programs. The exchange was pointed but brief, ending after Alessi secured the concession.