Day 6 - April 29, 2025

Hank Brennan methodically rebuilt Ian Whiffin's testimony on redirect after Robert Alessi's cross-examination. Brennan first established that he never told Whiffin what to look for or attempted to influence his conclusions. He then walked the jury through O'Keefe's phone data second-by-second — the car decelerating from 16.6 mph to 0 mph at the flagpole at 12:24:38, 36 steps recorded from 12:31:56 to 12:32:16 with no additional steps recorded until 6:04 a.m., the battery temperature declining from 82°F to 37°F, and 432 steps recorded at 6:04-6:11 a.m. followed by a temperature increase. On the McCabe phone, Brennan addressed the hash value issue raised on cross, with Whiffin explaining that GrayKey puts the hash in an unsigned PDF, that the supplied value matched, and that his cross-database review found no anomaly that led him to identify a data-integrity problem. Whiffin testified that he did not believe a dispute remained about the search occurring at 6:23-6:24 a.m.; he also described an examiner in Europe whose similar timestamp question was resolved by applying the same logic and theory, and said people had confirmed his research. Whiffin testified that Cellebrite removed the timestamp formerly presented under a 'last visited time' label after its forensic research group validated his research. The proceeding ended at lunch recess before a planned live demonstration.

ADA Hank Brennan continued redirect examination of Cellebrite expert Ian Whiffin, addressing two areas raised during Robert Alessi's cross-examination. First, Brennan walked Whiffin through location data accuracy, establishing that varying circle sizes on Exhibit 40 reflect the phone refining its GPS accuracy over time — not actual device movement — and that weather, geography, interference, and even a body covering the phone can affect location precision. Whiffin introduced a supporting chart from page 22 of his report showing five consecutive records with identical coordinates but accuracy narrowing from 43 meters to 7 meters in 8 seconds, all consistent with the phone remaining stationary at the flagpole. Second, Whiffin performed a live demonstration on a phone running iOS 15.2.1 — matching Jennifer McCabe's version — showing the jury in real time that Safari's BrowserState database only creates a record when a tab is closed, and that the 'last viewed' timestamp reflects when the tab was first opened, not when subsequent searches were performed.

Robert Alessi conducted a brief recross focused on two points. First, Whiffin agreed that Magnet AXIOM — which he described as reliable — still displays the 2:27 a.m. timestamp that Cellebrite removed from its products. Second, Alessi questioned the live demonstration just shown to the jury. Whiffin said he had been doing that type of demonstration for two years, initially conducting the same type of testing in late 2023, and said the live version was the same demonstration except for different search terms. He said he altered it ‘Right now.’ In response to Alessi's final compound question that the alteration occurred after Cellebrite removed the timestamp, Whiffin answered yes. Alessi then ended the recross.