Ian Whiffin - Cross (Part 2)

MR. ALESSI: Thank you, your honor. May I approach?

MR. ALESSI: Thank you, your honor. If I may address the court. Mr. Brennan and I have agreed, as we did yesterday, to stipulate into evidence portions of Mr. Whiffin's March 2025 report. So, if I could have it marked.

MR. ALESSI: May I, your honor?

MR. ALESSI: Thank you. Morning, Mr. Whiffin. Good morning. And welcome back. Thank you. May I approach, your honor?

MR. ALESSI: Thank you, Mr. Whiffin. I've just handed you what is in evidence as Exhibit 43. And this is a portion of your March 2025 report. If you could just take a moment to look at it and, when you've had a fair opportunity to do that, I'd ask you to turn to page 28. Okay. And just, if you could, sir, just pick up your head and let me know when you're ready to proceed.

MR. ALESSI: Thank you. You ready, Mr. Whiffin?

MR. ALESSI: Thank you. So, what I'd like to do is, with your honor's permission, to publish pages 28, 29, and 30 and start with page 28. Okay. Thank you, your honor. Mr. Woll, and if you could enlarge the text down below as much as you can so the jury can see it. Thank you, Mr. Woll. So, Mr. Whiffin, this summary section of your report is a summary of the location section that you wrote in your March 2025 report. Correct.

MR. ALESSI: And it states the location data on this device contains a vast number of records while traveling between 12:19:33 and 12:24:38. These records all have a high horizontal accuracy value as well as bearing and speed information which conforms to the streets being traveled. Next paragraph. The device arrived outside 34 Fairview at 12:24:38 where it remained static for about 30 seconds. Do you see that, sir?

MR. ALESSI: And did I read that correctly?

MR. ALESSI: Did I read that correctly? Sorry.

MR. ALESSI: So, so, so at the end it says, "Show the device moving west from the roadside towards the house." That's what you wrote. Correct.

MR. ALESSI: I would like you to — Mr. Woll, if we could switch back to the timeline of Mr. Whiffin that we had published yesterday in Deck 79. Mr. Whiffin, if you could please. We just read that portion of your report that says at 12:25:30, the device bearing shifts to a westerly direction as location records also show the device moving west from the roadside towards the house. Did you put that in your timeline?

MR. ALESSI: It's kind of important information, isn't it?

MR. ALESSI: But it was important enough for you to write it in your report, but you didn't put it in the timeline. Correct.

MR. ALESSI: Now, if you could continue on your report, page 29. Mr. Woll, if we could put — and we're going to be flipping back and forth between the timeline and your report. Okay. If we could go to page 29, enlarge the text so the jury is able to read it along with us. We're going to start from the top. So the next says from the combination of device location and bearing it does appear that the device started to move towards the house. However, since the bearing information appears to be based on the location records rather than the direction the device is facing, it is difficult to say with any degree of certainty if the device actually moved. Did I read that correctly?

MR. ALESSI: So, so the first part is again a statement that the device has started to move toward the house. Now, if we could go to the next paragraph. This location data is immediately followed by 12 minutes of low accuracy records which offer no reliable location information. So, I just want to make sure I've got the time period here right. The 12 minutes is from 12:25, correct?

MR. ALESSI: And so 12:25 plus 12 is 12:37. So the range we're talking about here is from 12:25 through 12:37. Correct.

MR. ALESSI: Then if we could go to — Mr. Woll, please — back to the timeline slide 82. So I want to discuss with you the very top entry, health 12:31:56, where you have the entry start of health event, 36 steps, 25 m — and yesterday we agreed 25 m is approximately 84 ft. Correct.

MR. ALESSI: And that is what you have in the timeline. Let's understand what that means at that time period, 12:31:56. Do you recall writing in your March 2025 report that the device began moving for a period of 20 seconds?

MR. ALESSI: Yes. Now, if we could — Mr. Woll, go back to page 29 of the report. So what I want to do is go back to that paragraph up at the top — from the combination of device location and bearing, it does appear that the device started to move toward the house. However, since the bearing information appears based on the location records rather than the direction the device is facing, it is difficult to say with any degree of certainty if the device actually moved. So you're talking about difficulty saying with certainty, correct?

MR. ALESSI: But it is certainly possible that the device was at that location and was moving toward the house.

MR. ALESSI: Based on location data.

MR. ALESSI: Now what I'd like to do, please, is to stay on that report — and the third paragraph says the reason for such low accuracy location data at this time is not known, as there are many possible reasons why the accuracy was reduced. There's a little grammar issue there, but correct — in fairness to you, sir, we do that when we write long reports. But I think that your intention here is, you know, why the accuracy is reduced at this point.

MR. ALESSI: think that your intention here is, you know, why the accuracy is reduced at this point. Correct.

MR. ALESSI: Thank you. This could include reasons such as the device entered a building covered area, the result of weather conditions, geography, poor connectivity, or interference, to name a few. So those are the reasons you gave which could contribute to some low accuracy. Correct.

MR. ALESSI: And interesting — the very first reason you gave is that the device could be entering a building or covered area. And that phraseology could include a house. Correct.

MR. ALESSI: It could include a garage attached to the house. Correct.

MR. ALESSI: Then you go on in the next paragraph to say it is known that the device was not being used at this time — and is this time that include that 12-minute range, 12:25 to 12:37?

MR. ALESSI: So that's another reason why the accuracy could be a little bit on the lower side. Correct.

MR. ALESSI: Now the next paragraph says at 12:38:13 when the device begins recording higher — and that's relative to what it was recording before. It's not that it's high, but it's higher than what it was just moments before. Correct.

MR. ALESSI: The data centers on a location slightly closer to the house than the roadside. Although several records show the same center coordinate with differing accuracy radii, some of these location records are shown in the map below in white. So let's go down and look at what you had in your report for the area in white. In the area in white that you're referring to, there are two white circles. The largest one there. This, in fact, was a depiction that you included in your report on page 29. Correct.

MR. ALESSI: Interesting and notable. You did not include that depiction in your timeline that you discussed with the jury yesterday, did you?

MR. ALESSI: But it was important enough for you to put that depiction in your report. Correct.

MR. ALESSI: And notably, the larger white circle covers a substantial amount of the house at 34 Fairview. Correct.

MR. ALESSI: So given your testimony on direct yesterday with ADA Brennan, the phone of John O'Keefe, according to this depiction, could be anywhere within the largest white circle. Correct.

MR. ALESSI: And this depiction was not offered by you or the Commonwealth in your presentation to the jury yesterday. Correct.

MR. ALESSI: PowerPoint. Now, if we could go back, Mr. Woll, to page 29 of your report into the text. And if we can enlarge the text just a little bit, please, for the jury, Mr. Woll. So the paragraph that begins with — at 12:38:13 when the device begins recording higher accuracy information again, the data centers on a location slightly closer to the house than the roadside. Although several records show the same center coordinate with differing accuracy radii. Some of these location records are shown on the map in white below. And I repeated that just to tether — to connect this part of the text to that diagram with a big white circle. Have I done that correctly?

MR. ALESSI: Thank you, sir. The next paragraph: over the next few hours, the GPS coordinate and the associated accuracy radius jumps around numerous times between the house and the road. Did I read that correctly?

MR. ALESSI: And therefore, over the next few hours, according to your report, the phone of John O'Keefe could be in the house. Correct.

MR. ALESSI: Yes. The next paragraph. Well, we'll stop there for a moment and I would like to — Mr. Woll, put back, go down, scroll please to that diagram that's right below that text again. Yesterday you discussed the Waze application with ADA Brennan. Correct.

MR. ALESSI: And you stated that Waze location data is more accurate than the data that comes from the Apple apps like health data and location. Correct.

MR. ALESSI: Is Waze location data in your view accurate location data?

MR. ALESSI: Okay, I appreciate that correction. So when someone is using a Waze application, is the information they get through that Waze app accurate?

MR. ALESSI: And as a general matter, is the Waze application more accurate than the Apple information regarding location?

MR. ALESSI: Yes. Apple provides that information to Waze. Right.

MR. ALESSI: So you had testified yesterday that at a certain point the Waze application ceased functioning. Correct.

MR. ALESSI: But just because it ceased functioning, the Apple applications were still taking effect, and that's why you could make this depiction on this item that is on the screen now. Correct.

MR. ALESSI: If we could, Mr. Woll, go to page 30. In the — what I'd like to highlight, please, is the text. So if we can enlarge it up at the top. So you then state: while location data from this data source, cache SQLite, is usually able to identify the location of the device with a high degree of accuracy and reliability, these records are so close that making a distinction between the device's actual location on the front garden is impossible. Correct.

MR. ALESSI: Your words — impossible. Correct.

MR. ALESSI: Did you provide any of the information in that paragraph in your timeline or to the jury in your direct testimony

MR. ALESSI: Next paragraph. If the location records are limited to just the records between 00:25 — which is 12:25 — and 6 a.m., and with an accuracy radius of 10 meters or less, there are 46 records, all of which fall within the red circle shown below. Go ahead, Mr. Woll. You could scroll down. And that is the only depiction there that you included in your timeline yesterday. Correct.

MR. ALESSI: So you took one of two depictions in your summary of the location — this one in terms of your timeline presentation. Correct.

MR. ALESSI: Now, in terms of the timeline — and, Mr. Woll, if we could go back to the previous with the other depiction. It's on page 29. If we could enlarge that depiction, please. So, you testified that the flagpole and the fire hydrant are more down toward the small black circle. Is that correct?

MR. ALESSI: And yesterday you rendered an opinion that you believed that the phone was mostly in the location by the flagpole and the fire hydrant. Correct.

MR. ALESSI: May I, your honor?

MR. ALESSI: Thank you. If we could dim the lights again, please. Thank you. So if we can enlarge that depiction. So, Mr. Whiffin, yesterday you focused your testimony and your opinions on the smaller black circle. Correct.

MR. ALESSI: And you didn't discuss at all or disclose at all this depiction, and therefore didn't discuss or disclose at all the larger white circle. Correct?

MR. ALESSI: Right. Yeah. So the answer is no. Right. So the fair way to interpret — and this is what you put in your report, this is your depiction — is that based upon what you said yesterday, the phone could be at the very edge of the top of the circle. Correct.

MR. ALESSI: And the phone could also be at any point. So you can in theory put a phone anywhere around the very edges of that entire circle.

MR. ALESSI: Well, I'm just asking that according to your testimony yesterday, in this depiction, the phone could be anywhere in that location within the area of that white circle. Correct.

MR. ALESSI: I would like to now go back to the timeline, Mr. Woll, where we had left off, which is slide 82. And at the very top entry, you have health time 12:31:56. And then the description — start of health event, 36 steps, 25 meters — and we agreed about 84 feet. And this is where the device began moving toward the house for a period of 20 seconds. Is that correct?

MR. ALESSI: I want to focus on the time 12:31:56. Are you aware that a firm called Aperture on behalf of the Commonwealth has submitted a report that states that there was a trigger event at 12:31:56 that they refer to as the supposed collision? Are you aware of that?

MR. ALESSI: Sorry, you don't have to answer that. That's okay. Mr. Whiffin, are you familiar with a firm called Aperture?

MR. ALESSI: Are you familiar with a person by the name of Judson Welcher?

MR. ALESSI: But you're familiar with the firm Aperture?

MR. ALESSI: And do you know that the Aperture firm is working on this case?

MR. ALESSI: Right. And do you know that the Aperture firm has used your data in your report? Do you know that?

MR. ALESSI: Do you believe you saw something, or do you know that? they've used your data for a report in this matter?

MR. ALESSI: Do you recall receiving a report from Aperture?

MR. ALESSI: So, you reviewed a report from Aperture several months ago.

MR. ALESSI: And did you read the whole report?

MR. ALESSI: And you recall reading that entire PowerPoint presentation?

MR. ALESSI: Fair enough. Do you remember, as you sit here today, reading about a trigger of a number 11622? Do you recall reading that?

MR. ALESSI: What did you understand? The Aperture firm — that's retained by the Commonwealth — what do you understand they meant by trigger 11622?

MR. ALESSI: Do you recall the specific slide that discussed a trigger?

MR. ALESSI: Do you recall that, Mr. Whiffin?

MR. ALESSI: Okay. Would it help your recollection if I showed you a slide from that report that you said you reviewed, to refresh your recollection again?

MR. ALESSI: I'll bring that up to you, Mr. Lally, please. May I, Your Honor?

MR. ALESSI: Excuse me, Mr. Brennan. I'm handing you this document. Thank you. May I stand by the witness?

MR. ALESSI: Tell me when you've had a fair opportunity to take a look at that.

MR. ALESSI: Thank you. Does that refresh your recollection with regard to an Aperture report that discusses a trigger of 11622?

MR. ALESSI: Thank you. Pardon me.

MR. ALESSI: Thank you. And how does it refresh your recollection?

MR. ALESSI: And you recall the time of 12:31:38 now.

MR. ALESSI: Let's go back to your timeline slide 82. So you just spoke about trigger 11622 associated with a time of 12:31:38, and we are now at the timeline of 12:31:56. Correct?

MR. ALESSI: We are now going back to the timeline deck 82, and you see up at the top where it says health 3156. You see that, sir?

MR. ALESSI: And then it says start of health event, 36 steps, 25 m — which we have said is 84 feet or so — and this is when the device begins moving. Correct.

MR. ALESSI: And that is after the trigger of 11622. Correct?

MR. ALESSI: Let's go to the next entry on the timeline, which is 12:32:03. You see that? That's the Doppler entry.

MR. ALESSI: And then you state "pocket state cleared." Is the phone at that time in a pocket?

MR. ALESSI: You're saying at this point the camera is blocked.

MR. ALESSI: Does there have to be some human manipulation of the phone at 12:32:03 for that to happen?

MR. ALESSI: Is it more likely than not that there had to have been some human contact in action for this pocket state clearing event to occur?

MR. ALESSI: 12:32:04 is the next. It's a type "unlock" — device unlock with Face ID. You see that, sir?

MR. ALESSI: Is there some human action that has to occur for the device to unlock with Face ID?

MR. ALESSI: So, someone had to be looking at the phone.

MR. ALESSI: At 12:32:05, "application focus." What does

MR. ALESSI: Next entry, 12:32:06. We discussed this — excuse me — it says "read message." And that is associated with a Jen McCabe — it's the Jen McCabe message of 31:47. Correct.

MR. ALESSI: And does a human have to be reading that for that entry to be made?

MR. ALESSI: Next entry — "app lock" — 12:32:09 — end application focus, messages — and then it says "device locked with lock button." For the last time. That requires human interaction with the phone.

MR. ALESSI: And it actually requires somebody to take the cell phone and press the side button to do that.

MR. ALESSI: So there has to be some degree of coordination for that to occur — for a human to be able to have a hand — something that hits that button. Correct.

MR. ALESSI: Do you understand what the term "fine motor skill" means? Do you understand that? And would that person have to be using fine motor skills to do that?

MR. ALESSI: Next entry, 12:32:16. End of health event, 36 steps, 25 m — again, 84 feet. That is in your timeline because that's when you believe the end of the health event — the end of the 36 steps — occurred. Correct.

MR. ALESSI: May I have a moment, Your Honor?

MR. ALESSI: Thank you.

MR. ALESSI: Yeah, it would be helpful.

MR. ALESSI: Do you recall writing in your March 2025 report the following? "The final health activity of note on John's phone can be seen to have occurred between 12:31:56 and 12:32:16, during which 36 steps were recorded covering a distance of 25.4 m — again, that 84 feet — according to healthdbsecure.db." Do you recall writing that?

MR. ALESSI: And you used in your report "36 steps were recorded covering a distance of 25.4 m or 84 feet." Correct.

MR. ALESSI: Do you know a trooper named Nicholas Gino?

MR. ALESSI: Are you a little more than aware of him? You've worked with him on this case, haven't you?

MR. ALESSI: But isn't someone sending you files on a case you're working on, working with the person? Isn't that a fair conclusion?

MR. ALESSI: Do you recall reading any reports of Nicholas Gino?

MR. ALESSI: Does that mean you didn't read it, or you just don't recall reading it?

MR. ALESSI: Would it refresh your recollection if I showed you a portion of his report to determine whether you would have read it?

MR. ALESSI: Thank you. Moment, Your Honor, please.

MR. ALESSI: Thank you, Your Honor. Yes. Thank you. Show Mr. Brennan. Yes. I just want to make sure I've got the entire report — exhibit 66. Mr. Whiffin, I am — and may I stand by the witness?

MR. ALESSI: I am providing you with a document, and I would ask if that refreshes your recollection as to whether you've read a report of Mr. Gino.

MR. ALESSI: This — I'm sorry — this report.

MR. ALESSI: Have you ever had any conversations with Trooper Nicholas Gino?

MR. ALESSI: But you have — the answer is yes.

MR. ALESSI: Did Trooper Gino tell you that he measured the distance from the flagpole to the front door and it was 72 feet? Did he ever tell you that?

MR. ALESSI: Did you ever have a conversation with Trooper Nicholas Gino about the distance from the flagpole to the front door of 34 Fairview?

MR. ALESSI: So, is it maybe that you had a conversation with him in which he stated to you that that distance is 72 feet?

MR. ALESSI: So if we go back to what we were discussing earlier about the steps and the distance covered — and this is in your report of March 2025 where we've talked about this — the final health activity of note on John's phone can be seen to have occurred between 12:31:56 and 12:32:16. Is this the correct slide?

MR. ALESSI: So, let's take it down. Thank you, Your Honor. Let me start that over. The final health activity of note on John's phone could be seen to have occurred between 12:31:56 and 12:32:16, during which 36 steps were recorded covering a distance of 25.4 m, or 84 feet. 84 feet is greater than 72 feet. Correct.

MR. ALESSI: So, if the distance from the flagpole to the front of the house is 72 feet and your report notes 36 steps covering a distance of 84 feet, that would put those steps within the house.

MR. ALESSI: Let's continue on with the timeline. Slide 83. We now have Doppler 12:33:14, and then Doppler "pocket state." Do you recall in your report adding a word to this — that your report said "pocket state detected"? Do you recall writing that?

MR. ALESSI: But the "detected" word is not on that slide, is it?

MR. ALESSI: What does "pocket state detected" mean?

MR. ALESSI: May I have a moment, your honor, to switch? Thank you.

MR. ALESSI: I was just going to check that. I think the answer is going to be no, your honor.

MR. ALESSI: I would now like to change gears a bit and go to temperature with an iPhone. You recall that discussion in your direct testimony?

MR. ALESSI: Mr. Woll, if we could please have the slide deck, but a different page — slide 60. And just tee it up, but please don't put it on the screen yet. iPhones don't record ambient or environmental temperature where the phone may be at any given time. Correct?

MR. ALESSI: But the iPhones, including the iPhone of John O'Keefe, log the temperature of the battery inside of it. Correct?

MR. ALESSI: And as a result of that function, examiners and folks like you can use the battery temperature of an iPhone to identify increases or decreases in temperature within the environment that the iPhone is physically located in. True?

MR. ALESSI: And that's right out of your report, right? Your March 2025 report makes that very statement. Correct?

MR. ALESSI: The battery temperature of an iPhone generally matches the pattern of the rise and the fall of the thermometer temperature. Correct?

MR. ALESSI: And when an iPhone is in a locked state with little activity occurring on the device, the battery temperature is heavily affected by the ambient temperature in the environment — again, matching the pattern of the rise and the fall of the thermometer temperature. Right?

MR. ALESSI: And what I just read is right out of your March 2025 report. Correct?

MR. ALESSI: And you actually establish this in various temperature testing and test scenarios in your March 2025 report. Correct?

MR. ALESSI: Let's discuss those two tests. You had an appendix to your report that discussed two test scenarios with regard to temperature. Correct?

MR. ALESSI: Can I ask — I'm sorry, Mr. Whiffin, do you have your report with you, sir?

MR. ALESSI: I'd be happy to provide him with a copy of his report so we can have him follow along.

MR. ALESSI: Would that be helpful, Mr. Whiffin?

MR. ALESSI: Yes. May I?

MR. ALESSI: Thank you. There you go. Mr. Whiffin, feel free at any time to reference that report. Thank you. And if you could turn to page 77.

MR. ALESSI: So, are you ready, sir?

MR. ALESSI: Thank you. So, let's look at test scenario one. Test scenario one, you took an iPhone — am I remembering correctly, the same model as John O'Keefe's? Um, believe John O'Keefe was a

MR. ALESSI: I used an iPhone 10, but sufficiently similar for purposes of this experiment. Correct?

MR. ALESSI: So, it's the same iOS version — the software inside the phone — just a different model. Yes?

MR. ALESSI: So, you state that you placed the iPhone inside a freezer. Correct?

MR. ALESSI: And now if we could, Mr. Woll — if we can put that — do we have that in — it would be page 77? And if we could enlarge that chart, please — enlarge it just a little bit more. We're not concerned with the text at this point, so we can just get the chart as large as possible. Thank you. So, what I'd like to do is focus on January 29th — um, excuse me. This is your experiment. When did you do test scenario one, approximately the date?

MR. ALESSI: Correct. So what you did here was you took the phone, you put it inside a freezer. What was the temperature of the freezer?

MR. ALESSI: Let's look at some of the data that you have from this. Let's start at the 17:10 time frame where it's placed in the freezer, and you've got — and we're going to go with Fahrenheit, if that's okay with you.

MR. ALESSI: Thank you. 73.4° F. Correct?

MR. ALESSI: And then if you go all the way down to 17:25, which would be 15 minutes. Correct?

MR. ALESSI: Can you state what the drop in temperature is of the battery temperature in just 15 minutes in a freezer?

MR. ALESSI: So it drops 50° F in just 15 minutes. Correct?

MR. ALESSI: And is it fair to say that if you do the math, that's about a little over 3 and a half degrees per minute? And if — your honor, if he wants to use a calculator or just accept my estimate, whatever your honor thinks is appropriate.

MR. ALESSI: That sounds fair. So, it's about 3.33° F per minute drop. Correct?

MR. ALESSI: Now let's go to the next page of your report, page 78 — test scenario two. And in test scenario two, you took the same phone with the same software and you placed it outside at a temperature of 33.8° F. Correct?

MR. ALESSI: And we could enlarge that, please, Mr. Woll. And if you could just scroll up — well, just leave it there, that's fine. So if we take the time that we start out with a control temperature — then we've got a battery temperature at 9:02, and this is the battery temperature of the iPhone. Correct?

MR. ALESSI: And we've got 66.2° F. Correct?

MR. ALESSI: So is it fair to call that a baseline for purposes of what this chart is?

MR. ALESSI: Okay. So we'll just refer to 66.2. And then if we go from 9:02 down to 9:15 — a period of 13 minutes. Correct?

MR. ALESSI: So at 33.8° F and 13 minutes, what is the drop in temperature in degrees? What's the drop?

MR. ALESSI: Right. So is it — does it go from 66.2 to 35.6?

MR. ALESSI: And sir, so I don't have to have you do the math on the fly, I've calculated that drop at 30.6. Does that sound about right?

MR. ALESSI: So you got a drop of 30.6° in just 13 minutes at an outside temperature of 33.8° F. Correct?

MR. ALESSI: We're going to come back to this, but what I'd like to do is compare these two test scenarios. The one we just saw at 33.8° F, where it dropped 30.6° in just 13 minutes — again, in an outdoor temperature of 33.8° F — and then test scenario one in a freezer, where it dropped 50° in just 15 minutes. Now let's go to slide 60, which was in your slide presentation yesterday — of what you stated was the temperature change in the iPhone of John O'Keefe on the morning of January 29th. You with me, sir?

MR. ALESSI: Thank you. So, if we start out at 12:13, we see a battery temperature of 82° F. Correct?

MR. ALESSI: Then it drops a little bit to 77, a little bit to 72. And what I want to focus on is keeping the starting point for my questions here at the 12:37 time period on the morning of January 29th — and that's 72° F. Correct?

MR. ALESSI: So if you take the time period from 12:37 to 12:53, that's a 15-minute interval. Correct?

MR. ALESSI: The phone only drops 11° F in 15 minutes. Correct?

MR. ALESSI: If you then go to 12:37 and give it a little bit more time — down to 1:36 a.m. — the temperature — and that's just about an hour, right?

MR. ALESSI: And the temperature drops from 72 to 50 — only a 22° drop in an hour. Correct?

MR. ALESSI: Now if you compare this chart and the drop in temperature — for example 12:37 to 12:53, in 15 minutes it's only dropping 11° — to your experiments, where with the first scenario, with a freezer, it dropped 50° in a 15-minute period. Is it correct to say that there was a much more dramatic drop in temperature in your test scenario one than what actually occurred on John O'Keefe's phone for the time period we just covered on January 29th?

MR. ALESSI: And then with regard to even test scenario two, where the temperature is 33.8° F — that's the ambient outdoor temperature, right? At that temperature — just above freezing — you've got a — sorry, below freezing. I'm sorry. It's below freezing. What is freezing in Fahrenheit?

MR. ALESSI: And it was -5° C at the time, right? But do you — would you agree that — and I want to be fair to you, because I know you use Celsius —

MR. ALESSI: Okay. Fair enough. So in any event, in your experiment at 33.8° F, you're getting a drop in your experiment in 13 minutes of 30.6°, right?

MR. ALESSI: But much less drop in temperature on slide deck 60 of the actual iPhone of John O'Keefe on the morning of January 29th. Correct?

MR. ALESSI: Do you know what the temperature was in Canton on January 29th, 2022?

MR. ALESSI: Don't you think that that would be an important piece of information in analyzing where the phone of John O'Keefe was on the morning of January 29th?

MR. ALESSI: So, you didn't think it was important even though you issued a report discussing the temperature of the iPhone, and you did two test scenarios — one in a freezer, one in an ambient temperature of slightly above 33° — and you didn't think it important to take the final step to see whether there was anything to be gained from that comparison to determine where that phone was located?

MR. ALESSI: The information that you create from your digital forensics analysis, including everything that's in the slide, in your report, including battery — sir, I'll go back to the question. In digital forensics, you work with law enforcement often.

MR. ALESSI: And you work in law enforcement in investigating cases, do you not?

MR. ALESSI: And so often times the law enforcement is using your digital forensics information to help them solve cases.

MR. ALESSI: You didn't suggest to anybody in law enforcement that they might want to take a look at this temperature information to assist in determining where this phone could have been based on the temperature. You never raised that with them?

MR. ALESSI: And do you know whether any law enforcement person was aware that you had done all this temperature analysis?

MR. ALESSI: So you create a report as part of this case, and you deem the temperature important enough to do two test scenarios, important enough to put it in a slide presentation to this jury — yet there's no discussion of that between you and any member of law enforcement as to what it means.

MR. ALESSI: Oh, so there were discussions.

MR. ALESSI: Oh, who?

MR. ALESSI: Oh, tell me — who did you discuss this temperature information with?

MR. ALESSI: You're hesitating. I can't hear you. Who did you discuss it with?

MR. ALESSI: Attorney Brennan.

MR. ALESSI: You discussed temperature with prosecutor Brennan.

MR. ALESSI: It was in your report, but you said you discussed — which is it?

MR. ALESSI: Oh, sir, I'm not suggesting what you just stated. I'm just trying to get information. You mentioned the verb "discussed," didn't you, in your answer moments ago?

MR. ALESSI: Isn't "discussed" a verbal thing? It's not a written thing.

MR. ALESSI: Yes. Oh. So there was a discussion — a verbal discussion — with Attorney Brennan about temperature in your preparation for trial?

MR. ALESSI: Was there any interest at all as to what this could actually mean for the potential location of Mr. O'Keefe's phone on these very important time periods on January 29th — that might assist in determining at various times whether Mr. O'Keefe is in a covered building based upon the temperature, rather than outside in a nor'easter on January 29th?

MR. ALESSI: The question is, was there any discussion about the investigative value of what you had done in determining where that phone could have been on key time periods on the morning of January 29th?

MR. ALESSI: No, it wasn't part of the discussion we went through. You may recall, in my questioning, in your report you stated that it was possible that the phone could be inside the house at 34 Fairview based upon that big white circle. You testified that the low accuracy at certain points could be because of it entering a covered building.

MR. ALESSI: And yet, you do a temperature experiment to track the very accurate temperature change of an iPhone and it doesn't match up — the actual data — with either of your test scenarios, and you don't raise that with anybody.

MR. ALESSI: Did you ever put together in any kind of form your test scenario one, your test scenario two, and the actual temperature chart of the iPhone of Mr. O'Keefe?

MR. ALESSI: As in compare the two. Exactly — compare the two and reach any conclusions about location. Because you spent time — did you not, sir — a lot of time in your reports on location of the phone?

MR. ALESSI: But yet with all that data, all that testing, all the experiments that you did, you didn't include in your slide presentation, and you didn't include in your report, what that could mean for the location of the phone. Did you, sir?

MR. ALESSI: Let me see if I can ask it in a different way. Nowhere in your slide presentation — did you bring up, by the way, in your slide presentation yesterday, your battery temperature at all? Your tests, not the tests?

MR. ALESSI: Right. So you didn't even raise, yesterday in your presentation, where the phone might be located — you didn't even raise the experiments that you did.

MR. ALESSI: Did you — did you yesterday in your presentation to the jury in any way discuss your battery test scenario one and two from your March 2025 report?

MR. ALESSI: Right. So there was no detail given at all — you just mentioned that it occurred, but no detail in your discussion at all. And are you aware, with regard to the battery temperature, that battery temperature in investigations can be used to determine locations of phones at certain times? Are you aware of that?

MR. ALESSI: So you have never used battery temperature information, in all your years, in any way, for any investigation of a case, in determining location of a phone.

MR. ALESSI: Oh. So battery temperature and the chart that you gave — that is up there — in your opinion has no relevancy to the topic of where a phone might be to investigators in a case. Is that what you're saying?

MR. ALESSI: Is that what you're saying, Mr. Whiffin?

MR. ALESSI: That's not my question though, sir. And I appreciate your answer. My question is, you work with law enforcement investigators regularly.

MR. ALESSI: Isn't this information of potential relevance based upon your experience with investigations? Isn't this information at least potentially relevant in investigations?

MR. ALESSI: Thank you. But you didn't include a discussion of it in your testimony yesterday. Correct?

MR. ALESSI: I just want to be clear. On a final point as regards temperature — were you aware of the temperature in Canton on January 29th, 2022?

MR. ALESSI: May I have a moment to switch topics? Thank you, your honor. Thank you, Mr. Whiffin. I'll be right back. Uh, your honor, if I may, I have one last point to make with temperature. If we could put slide 60 back up, please. Mr. Whiffin, if you'll bear with me, I just have one final set of questions. If you look at this chart, under January 29th, at 12:13, battery temperature of 82°. But then going down — what I'd like to start with is 12:37 again, and this is a key time point, 12:37. You've got a temperature of 72°, and then 8 minutes later, the temperature only drops 6°.

MR. ALESSI: Again, using 12:37 as what I refer to as the baseline — you go all the way down and you see to 12:53 a temperature drop of only 11°. Do you see that?

MR. ALESSI: Thank you. That — excuse me, your honor. One moment.

MR. ALESSI: The final data point on this slide, Mr. Whiffin, and thank you for bearing with me on this. At 1:36, there's a temperature of 50° F.

MR. ALESSI: Several hours later at 6:06 — four and a half hours — the temperature drop is only 7°.

MR. ALESSI: I'm switching. May I have a brief moment?

MR. ALESSI: Thank you. May I approach, your honor?

MR. ALESSI: May I have exhibit 42, please?

MR. ALESSI: It's okay. Thank you. We've got it. Thank you, Tori. I'll hand it to the witness. Mr. Whiffin, I've handed you exhibit 42.

MR. ALESSI: Do you recognize exhibit 42 from your March 2025 report?

MR. ALESSI: And sir, just take whatever time you need to familiarize yourself with the exhibit before I start asking you questions. I'm going to be very brief, and you look at what you need to, but I'm going to be focusing on just under "detailed analysis communications," paragraph three — excuse me, page 43, the top three or four entries. Tell me when you're ready, sir.

MR. ALESSI: Thank you, your honor. May I have 43, which is in evidence, public?

MR. ALESSI: Thank you, your honor. Mr. Woll, please. And if you could enlarge — don't need the text. So if we can just go to detailed analysis, communication, call history. And now if you could just super-enlarge the first few entries. Yes, that is great. So what I want to do is just cover the information here. Whose phone is the subject of the entries on this chart?

MR. ALESSI: And if we start with the first entry, reading left to right: 12:14:36, end time 12:15:20, incoming call from Jen McCabe, duration 44 seconds. You see that, sir?

MR. ALESSI: And is that a call that is answered?

MR. ALESSI: If you go to the next entry — 12:18:47 to 12:19:23 — outgoing call, duration 36 seconds to Jen McCabe, duration 36 seconds. Do you see that, sir?

MR. ALESSI: Is that a call that is answered?

MR. ALESSI: Well, how is it that you can tell the first one was answered but not the second one?

MR. ALESSI: Okay, fair enough. So, if we go to the third entry — 12:29:44, 12:29:51, incoming call from Jen McCabe. You see that, sir?

MR. ALESSI: Thank you, your honor. May I approach, please?

MR. ALESSI: I have a replacement.

MR. ALESSI: So, your honor, I have a replacement exhibit 42, redacted, obviously to replace exhibit 42, and it's per stipulation with Mr. O'Brien.

MR. ALESSI: So, may I present it to Mr. Whiffin?

MR. ALESSI: You're welcome, Mr. Whiffin. May I publish, your honor?

MR. ALESSI: And Mr. Woll, if you could again please enlarge. We're going to be focusing on the top entry of the chart again. May I, your honor?

MR. ALESSI: Mr. Whiffin, we had started going through the top three entries. The first one you had indicated was answered. The second one, as I understand it, you could not tell. Is that correct?

MR. ALESSI: And then the third entry, reading left to right: 12:29:44, end time 12:29:51, incoming call, duration 8 seconds, from Jen McCabe. Correct?

MR. ALESSI: Okay, your honor. Mr. Woll, can you enlarge that pursuant to the judge's order?

MR. ALESSI: If we have to, uh, Mr. Woll, knock off the final right-hand column. That's insignificant.

MR. ALESSI: Okay, that's fine. Thank you. May I?

MR. ALESSI: Thank you. So I want to now go to the last one for this exhibit 42. It's uh reading from left to right: 12:29:44, 12:29:51, incoming call, duration 8 seconds, from Jen McCabe. Again, restated — duration 8 seconds. Correct?

MR. ALESSI: Given that it's an incoming call, you can conclude that that was answered. Correct?

MR. ALESSI: Now, if we could go back down and focus on just the first three by way of example — Mr. Woll, just as her honor has requested, enlarge it as large as possible. Those three, after the first three.

MR. ALESSI: Just take the first three by way of example. All right, Mr. Whiffin, you should feel free to look at the hard copy exhibit 42 if that's more helpful to you. But what I want to do is focus on — starting at start time 12:33:35, reading across: activity, incoming call, unanswered, and then to the right: Karen Read. Do you see that, sir?

MR. ALESSI: And do you see the same types of entries for 3409 and 3438?

MR. ALESSI: And those calls are unanswered. Correct?

MR. ALESSI: So in contrast to the — and now, Mr. Woll, we can go back to the chart, trying to capture all six, and enlarge those one last time. Thank you. So in the first one at 1436, and then skipping one to 2944, those are answered, but then starting — excuse me — at 3335 and 3409, those are unanswered. Correct?

MR. ALESSI: You can take that down, Mr. Woll. Thank you. May I have a moment, your honor, to switch topics? Mr. Whiffin, when did you start working on this case? What was the date?

MR. ALESSI: On this case.

MR. ALESSI: So, over a year and a half. Correct?

MR. ALESSI: How many times have you been in Norfolk County?

MR. ALESSI: So you were here once previously, correct? Do you recall yesterday discussing what you had done with an iPhone — driving around and then moving it with your hand?

MR. ALESSI: In the year and a half that you've been on this case, did you ever take an iPhone and do the same activity on the route that you were discussing yesterday between 34 Fairview and One Meadows?

MR. ALESSI: And with regard to your time on this case — what was the result of that?

MR. ALESSI: May I, your honor?

MR. ALESSI: Mr. Whiffin, I am now going to proceed to a different topic. Do you recall discussing the Google search — "how long to die in the cold"?

MR. ALESSI: And you discussed that in your direct testimony. Correct?

MR. ALESSI: You were a police officer for years before getting into the data forensic analysis of cell phones. Correct?

MR. ALESSI: You were a response officer of the South Yorkshire Police from 2004 to 2009. Correct?

MR. ALESSI: You continued policing with the Calgary Police, working patrol. Correct?

MR. ALESSI: You work frequently with law enforcement.

MR. ALESSI: Indeed. Law enforcement is the predominance of your work. Correct?

MR. ALESSI: What percent?

MR. ALESSI: 80%. Your work is used in investigations for law enforcement. Correct?

MR. ALESSI: In your area of work, you use and apply various forensic methods — that data is extracted from a cell phone. Correct?

MR. ALESSI: And you have various forensic methods to analyze that data. Correct?

MR. ALESSI: And that data that you analyze is often used by law enforcement in their investigations, right?

MR. ALESSI: But it also is, from your experience. Correct?

MR. ALESSI: Your analysis.

MR. ALESSI: So your analysis is typically used by law enforcement on the cases you work. Correct?

MR. ALESSI: And you know that is going to be the case oftentimes when you're doing your analysis. Correct?

MR. ALESSI: And forensic software is used to gain access to people's devices. Correct?

MR. ALESSI: Such as cell phones. Right?

MR. ALESSI: So, there's something called an extraction process from a cell phone that you discussed in your direct testimony.

MR. ALESSI: Now, I'm not going to go into too much detail because it would be covering old ground, but I want to cover some of it.

MR. ALESSI: It's important, is it not, that the extraction process on a cell phone be performed correctly?

MR. ALESSI: And that's so that the data that's extracted from a cell phone is complete. Correct?

MR. ALESSI: So that the data is correct. Correct?

MR. ALESSI: And so that the data is reliable. Correct?

MR. ALESSI: And forensic examiners and people in your area of work need to ensure that the extraction file has not been tampered with. Correct?

MR. ALESSI: Because if an extraction file has the possibility of tampering, then the information and data from it can be unreliable. Correct?

MR. ALESSI: And there's a generally accepted methodology for how to perform an extraction of data from a cell phone. Correct?

MR. ALESSI: One of the key ways to determine whether the data extracted from a cell phone is valid and has integrity is to evaluate whether the extraction process created what is called a hash value.

MR. ALESSI: Correct. And a synonym for a hash value is a hash signature.

MR. ALESSI: Correct. And a hash value or hash signature — I'm just going to use hash value. Is that acceptable to you?

MR. ALESSI: Thank you. So, a hash value is unique and usually consists of a long string of numbers and letters that's generated from the data file from a cell phone using a computer algorithm.

MR. ALESSI: And one of the computer algorithms is SHA-256.

MR. ALESSI: And is it a fair analogy to state that a hash value can be thought of as a fingerprint for a data file from a cell phone?

MR. ALESSI: And is it also a rough analogy that a hash value can function like the seal on a milk container? In other words, if you open the milk container and the seal's broken, the same analogy can be provided that if you don't have a valid hash value, then there is a question with regard to the contents of a cell phone, just as there might be concern about the contents of a milk carton. Is that a fair general analogy?

MR. ALESSI: Correct?

MR. ALESSI: Thank you. Now, if a data file is altered in any way, the hash algorithm is going to produce a different alphanumeric string than the previous hash value for that same alleged data.

MR. ALESSI: So that alphanumeric string is important because if it's different, then it means something happened to that data.

MR. ALESSI: And isn't it important for examiners — anybody in data forensics — to know whether or not the data they're looking at has a valid hash value?

MR. ALESSI: But you would agree that it's much better to have a valid hash value for data than not.

MR. ALESSI: You would like to see the hash value matching.

MR. ALESSI: Now, once data from an iPhone is properly extracted and you get a hash value, the examiners of the data seek to parse and decode the data to try and make some sense of the data in a more user-friendly format so that a report can be created for investigators.

MR. ALESSI: Do you recall preparing a report for the iPhone belonging to Jen McCabe dated December 2024?

MR. ALESSI: And in that report you discussed your views of a Google search of "how long to die in the cold."

MR. ALESSI: And in that report, you rendered various conclusions about that Google search.

MR. ALESSI: And you rendered various conclusions about what is called a timestamp.

MR. ALESSI: And the timestamp that was in question was 2:27:40 a.m. on January 29th on Jen McCabe's phone.

MR. ALESSI: And the question that you were looking at is that timestamp that appeared in the data — that timestamp of 2:27:40 a.m. — whether that belongs to the Google search "how long to die in the cold."

MR. ALESSI: And you testified yesterday with regard to that very issue.

MR. ALESSI: Now, in your report of December 2024, you discussed the hash value of that cell phone. Correct?

MR. ALESSI: Yesterday in your direct testimony, you didn't mention anything about the hash value with regard to Jen McCabe's phone, did you?

MR. ALESSI: The answer is no.

MR. ALESSI: However, isn't it correct that in your report of December 2024, you had an issue with the hash value from the data from that phone?

MR. ALESSI: So you didn't note that it was not possible, with the GrayKey extraction — the PDF containing the extraction hash, its value being unsigned — that was not an issue in your report?