Ian Whiffin - Redirect/Recross

MR. BRENNAN: Good afternoon.

MR. BRENNAN: As a forensic analyst, do you study data?

MR. BRENNAN: Do you consider it a science?

MR. BRENNAN: Are you a criminal investigator like a police officer in your present role?

MR. BRENNAN: Are you a detective in your present role helping aid one side or another in an investigation?

MR. BRENNAN: At some point you and I spoke about reviewing phones.

MR. BRENNAN: You had begun your whole process in some of this work before you had met me.

MR. BRENNAN: And I'd asked you to look at Mr. O'Keefe's phone.

MR. BRENNAN: Did I ever tell you what you should look for?

MR. BRENNAN: Did I ever tell you what I wanted to see or what I wanted the results to be?

MR. BRENNAN: Did I ever share with you parts of the investigation that had nothing to do with your actual data analysis?

MR. BRENNAN: Would it be inappropriate or not helpful for an advocate to provide you information that might taint or influence your thinking when you're looking at data in a case?

MR. BRENNAN: When I asked you to look at data in this case, did I ever express any opinion whatsoever that I cared one way or another what your results would find?

MR. BRENNAN: Did I ever attempt to shape or influence your process by offering you information that had nothing to do with your assessment of data?

MR. BRENNAN: And so as a scientist, what a legal investigator or an advocate for either side thinks — is that relevant to you?

MR. BRENNAN: The data is the data.

MR. BRENNAN: The science is a science.

MR. BRENNAN: Now, counsel showed you some parts of your report regarding John O'Keefe's cell phone, didn't he?

MR. BRENNAN: You saw select pages from that report.

MR. BRENNAN: A few pages you were asked about.

MR. BRENNAN: But you wrote an entire report, didn't you?

MR. BRENNAN: And do you think that your entire report puts into perspective some of those select pages that you were shown?

MR. BRENNAN: I move to introduce Mr. Whiffin's entire report.

MR. BRENNAN: Do you still have your report with you, Mr. Whiffin?

MR. BRENNAN: Let's start with questions that counsel asked you about the battery. When you were trying to determine how the battery worked, you shared with the jury that you did certain testing.

MR. BRENNAN: What was the purpose of that testing?

MR. BRENNAN: When you put the batteries or the phone in the freezer, did it matter what the temperature of the freezer was when you put it in?

MR. BRENNAN: What was the purpose again of putting it in the freezer?

MR. BRENNAN: As you mentioned, you look at data through science.

MR. BRENNAN: And so did anybody ever share with you the important points of the decrease in temperature of the cell phone battery to try to influence your results?

MR. BRENNAN: Anybody try to tell you important points of the evening on January 29th, 2022, in an attempt to influence your studies on the fact that a battery — or a phone — when it gets colder, the battery temperature decreases?

MR. BRENNAN: So when you developed the graph of the battery temperature and you followed the progress of that temperature declining through the night, was there any other scope or focus of yours other than to simply track the data?

MR. BRENNAN: Similarly, when you looked at Health data, were you asked to try to see if the Health data could fit a certain theory or argument?

MR. BRENNAN: You were looking at the Health data — were you looking at it independently?

MR. BRENNAN: Now, it's not your opinion, and you're not taking a position on what the meaning of that data matching up is, are you?

MR. BRENNAN: No one's asked you to give an opinion about the coordination of data, have they?

MR. BRENNAN: So if the data just coordinates on its own, that has nothing to do with your opinion?

MR. BRENNAN: You mentioned when you put a cell phone in a colder environment like a freezer, you noted that the temperature goes down.

MR. BRENNAN: Do your studies also show that when the cell phone is taken out of a certain temperature and put in an increased temperature, the cell phone battery temperature goes up?

MR. BRENNAN: Okay. Do you have available for the screen the battery graph that we had on your PowerPoint?

MR. BRENNAN: If you could go back one to where it's just the chart, please. And if you could enlarge it, we'll start near the top.

MR. BRENNAN: Okay. At 20:43 on January 28, 2022, the battery temperature is 77°.

MR. BRENNAN: 8:43 p.m.?

MR. BRENNAN: 77°?

MR. BRENNAN: And if we look down to the last box on January 28, 2022.

MR. BRENNAN: So at 23:28 — that's 11:28 p.m.?

MR. BRENNAN: Okay. And now you were also tracking Health data, weren't you?

MR. BRENNAN: You were also tracking location information.

MR. BRENNAN: At 12:22, the battery temperature is 77°F.

MR. BRENNAN: And during that time — 12:22 — that is the time with the location data where we see Mr. O'Keefe's car traveling near Cedarcrest — isn't it?

MR. BRENNAN: And at 12:22 on January 29th, 2022 — where does the location data show Mr. O'Keefe's phone in progress?

MR. BRENNAN: And the travel that you're noting — is that consistent, given the speed, with being within a car?

MR. BRENNAN: And do you know whether or not that car had heat on?

MR. BRENNAN: You have Health data that the phone moves for a 20-second period, right?

MR. BRENNAN: That is after the Waze information stops — correction — so you have to watch the form. I know it's hard to orient. In your PowerPoint presentation, you are tracking the Waze information, aren't you?

MR. BRENNAN: And at some point that switches to more local location data.

MR. BRENNAN: So if we're following the phone through Waze at 12:24:25 — is it in a car moving at 16.6 mph?

MR. BRENNAN: At 12:24:26, according to the data, is it still in a car moving at 17 miles per hour?

MR. BRENNAN: Mr. Whiffin, can you pull up your PowerPoint and we'll start at 12:24:25? We could show the jury the progress of that phone.

MR. BRENNAN: Okay. And at 12:24:25, how fast is Mr. O'Keefe's cell phone moving?

MR. BRENNAN: Next page. 12:24:26.

MR. BRENNAN: Next page. 12:24:27.

MR. BRENNAN: Next page. 12:24:28.

MR. BRENNAN: 12:24:29.

MR. BRENNAN: 12:24:30.

MR. BRENNAN: 12:24:31.

MR. BRENNAN: 12:24:32.

MR. BRENNAN: 12:24:33.

MR. BRENNAN: 12:24:34.

MR. BRENNAN: 12:24:35.

MR. BRENNAN: 12:24:36.

MR. BRENNAN: 12:24:37.

MR. BRENNAN: And 12:24:38.

MR. BRENNAN: And at 12:24:38, that phone is stopped near the flagpole.

MR. BRENNAN: Then the location data gets more broad.

MR. BRENNAN: There is no movement at that time after the car stops. Is there any movement when the car stops at 12:24:38 — between 12:24:38 and

MR. BRENNAN: ? Is there any movement indicated on the health data?

MR. BRENNAN: At 12:31:57, does the phone demonstrate any movement?

MR. BRENNAN: 12:31:57.

MR. BRENNAN: How many seconds does that phone move for?

MR. BRENNAN: Correct. Okay. And that — is that the only time that the phone moves from the point it stops at the flagpole until the next morning?

MR. BRENNAN: 12:31:56 to 12:32:16.

MR. BRENNAN: And when that phone moves, you can't tell if it's walking a straight line or in a circle.

MR. BRENNAN: You don't know if the phone is pacing back and forth.

MR. BRENNAN: Can you tell how far a phone moves from its origin — from its original point — when you're counting steps?

MR. BRENNAN: John O'Keefe's phone stops moving. Do you know the next time it moves again?

MR. BRENNAN: Now, less than 5 minutes later — 12:37 — that battery in that cell phone gets another temperature reading, doesn't it?

MR. BRENNAN: Does it go up?

MR. BRENNAN: And it goes down to what degrees?

MR. BRENNAN: And over the next 8 minutes, does that temperature even or go up?

MR. BRENNAN: And then at 12:53 — that's about 21 minutes or so after that phone stops moving — what's the temperature? I'm sorry, at 12:53?

MR. BRENNAN: 61°. Yes. And over the next 14 minutes, does it drop again?

MR. BRENNAN: And at 1:36 a.m. that morning, it's down to 50°. And this health data shows that that phone hasn't moved. Does this health data show that this phone hasn't moved since 12:32:16?

MR. BRENNAN: Now, you had studies where you put the phone in a freezer, correct?

MR. BRENNAN: When you put the phone in the freezer, did you wrap it in anything?

MR. BRENNAN: Did you use any type of heat source that would slow down the process of the temperature dropping?

MR. BRENNAN: Let me ask a hypothetical. If a person — a human — was lying prone on a cell phone outside and had a body temperature directly touching the phone, in your opinion could that slow the process of the temperature decreasing as compared to just simply putting a phone in a freezer?

MR. BRENNAN: When you put the phone in the freezer, did you wrap it in any warmth?

MR. BRENNAN: Any clothing?

MR. BRENNAN: Now, you don't know the temperature, but you said there was a blizzard outside.

MR. BRENNAN: At 6:06 a.m., is there a change in the battery temperature of John O'Keefe's phone?

MR. BRENNAN: So there's a 7° drop in temperature at 6:06.

MR. BRENNAN: Were you shared any of the facts or information that has nothing to do with data and science? Were you shared any facts or information about what may have occurred to that cell phone and its exposure to colder air that morning, minutes prior to 6:06 a.m.?

MR. BRENNAN: Did anybody share information with you about that, sir?

MR. BRENNAN: If the phone was in an environment and it was exposed to further colder air or a drop in temperature, could it register a reading?

MR. BRENNAN: Sure. Let me ask a different question. The phone drops to 43°. John's phone at 6:06 — is there another change with this phone dropping in temperature?

MR. BRENNAN: Do you know what, if anything, happened as far as the environment that phone was exposed to seconds before 6:14?

MR. BRENNAN: Do you know if that phone at 6:15 was then placed in a warmer environment like a pocket or a car?

MR. BRENNAN: But your data shows at 6:35 there's an increase in temperature. Correct. Doesn't it?

MR. BRENNAN: So at 6:14 you don't know if there was any increased exposure, do you?

MR. BRENNAN: Now, if you look at the battery temperature at 6:06 a.m., it's 43°.

MR. BRENNAN: That's a change in temperature, isn't it? Your honor — is that a change in temperature from 1:36?

MR. BRENNAN: Looking at your health data, is there something happening relative to the phone at 6:04 to 6:11?

MR. BRENNAN: Can a phone record steps if it's being moved back and forth?

MR. BRENNAN: If you're shaking an object that moves the phone violently, could it record steps?

MR. BRENNAN: Now, at 6:14, the temperature is 37° and you just offered us that by 6:35 — over the next 21 minutes — the temperature goes up by 6°. Correct?

MR. BRENNAN: You don't know what was happening with that phone at 6:15, do you?

MR. BRENNAN: But what you do know is this health data at 6:15:14. Correct?

MR. BRENNAN: And that demonstrates what?

MR. BRENNAN: So the phone at 6:15 is again moving.

MR. BRENNAN: And after that it starts moving — wherever the phone may go, it starts getting warmer in temperature. Correct?

MR. BRENNAN: Now you shared with us location data and you explained the difference between Waze and other types of location data. I had asked you an opinion about where the phone was located based just on location data, nothing else. And when I asked you that opinion, I didn't ask you to a reasonable degree of scientific certainty, did I?

MR. BRENNAN: I asked you if it was consistent —

MR. BRENNAN: Based on location data alone, are you offering an opinion to a reasonable degree of scientific certainty where that phone was?

MR. BRENNAN: Based on the data you have — just on location data alone — is that location data consistent with that phone being in the flagpole area from midnight until 6:15 the next morning?

MR. BRENNAN: Is it also — given the broadness — consistent with it having been somewhere else?

MR. BRENNAN: Yet it is consistent.

MR. BRENNAN: You didn't just rely on location data for your opinion, though.

MR. BRENNAN: Did you rely just on location data for your opinion?

MR. BRENNAN: Did you also consider the health data?

MR. BRENNAN: And did you also consider the battery temperature?

MR. BRENNAN: In addition to location data, what are the other things you considered in your opinion to a reasonable degree of scientific certainty that that phone was at the flagpole the entire night from 12:30 until 6:00 the next morning?

MR. BRENNAN: Let me ask you some more questions about the health data. You were shown pieces of information on examination. You told us that the health data — well, the phone — was it your opinion the phone was in the car until it stopped at the flagpole?

MR. BRENNAN: At 12:31:56 and 12:32:16, does the data show — at what time? Sorry — 12:31:56 to 12:32:16. And the question is: does that demonstrate movement of the phone at that time?

MR. BRENNAN: You shared that you can't tell the direction or the distance of steps —

MR. BRENNAN: No, no, please. Pardon me. If that phone moved from the flagpole in a straight line away from the flagpole — like, for example, towards the house — wouldn't it have to move again before 6:04 to get back to the flagpole?

MR. BRENNAN: Does health data register when a phone moves?

MR. BRENNAN: I'll ask you some more detailed questions about your research into a phone that's been attributed to Jennifer McCabe. You looked at one piece of your report on the screen — and that was a phone call register.

MR. BRENNAN: Could you turn to that phone call register, please?

MR. BRENNAN: I would like to change it to the phone call register if possible.

MR. BRENNAN: Do you have the report that you could put on the screen regarding —

MR. BRENNAN: In the phone call register, you noted that there was a call at 12:14:36.

MR. BRENNAN: Have you found it? Is that you?

MR. BRENNAN: Thank you, Miss Gilman. Could you enlarge that, please?

MR. BRENNAN: The top part, the first four or five calls. Thank you. And we need it larger, Miss Gilman, please. All right, that's better. Thank you. On examination, you read that at 12:14:36, there was a phone call incoming.

MR. BRENNAN: That appeared to be from Jennifer McCabe.

MR. BRENNAN: At 12:14:36, the location information — is John O'Keefe's cell phone at Fairview Road by that point?

MR. BRENNAN: Yes. Is it?

MR. BRENNAN: Okay. And then at 12:18:47, there's another call — and again from Jennifer McCabe?

MR. BRENNAN: It's an outgoing call to Jennifer McCabe. Yes. 12:18:47. The location information — does that place Mr. O'Keefe's cell phone at Fairview Road?

MR. BRENNAN: Then at 12:29:44, there's an 8-second call that you said you believe is answered. Do you know if there was any conversation in that call?

MR. BRENNAN: And at 12:29:44, does the location information place John O'Keefe's cell phone somewhere?

MR. BRENNAN: Now, there is not a call — well, let me ask you the next call. What time is the next call?

MR. BRENNAN: And who's that call from?

MR. BRENNAN: Is that before or after John O'Keefe's health data stops?

MR. BRENNAN: At 12:37, you offered us that the cell phone battery temperature is decreasing.

MR. BRENNAN: How many calls have been made from the defendant to John O'Keefe by the time that cell phone battery starts dropping in temperature?

MR. BRENNAN: I want to turn now to some questions about your analysis of Miss McCabe's phone. You were asked about hash values, a way of trying to confirm the integrity of the data on an extraction.

MR. BRENNAN: When forensic analysts look at phones, do you sometimes get to actually see the phone?

MR. BRENNAN: Do you sometimes have to use an extraction, a copy of the phone?

MR. BRENNAN: Is it important to try to look and research or search the item to determine whether or not there's been any tampering?

MR. BRENNAN: You were asked if hash values is one way to do that.

MR. BRENNAN: And you were shown or read part of your report about hash values.

MR. BRENNAN: There's a second part to that, isn't there?

MR. BRENNAN: You didn't get a chance to share the second part, did you?

MR. BRENNAN: In this case, there was a hash value, wasn't there?

MR. BRENNAN: Now, just so we can understand simply, how is a hash value created during the extraction process? What does that mean in very simple terms?

MR. BRENNAN: You mentioned GrayKey. Is that a software or hardware that makes the copy of the phone?

MR. BRENNAN: How commonly is GrayKey used in the industry?

MR. BRENNAN: Did I hear you say that with GrayKey, the hash value is never authenticated?

MR. BRENNAN: Does GrayKey authenticate the hash value?

MR. BRENNAN: And is that common or typical in the industry?

MR. BRENNAN: Was there anything anomalous or untoward or different about the way this one was done?

MR. BRENNAN: Did the hash value from the GrayKey extraction match the hash value?

MR. BRENNAN: Anything irregular whatsoever about it?

MR. BRENNAN: Now, you don't just read software programs when they spit out reports, do you?

MR. BRENNAN: As an analyst, as one of the leaders of Cellebrite, do you have a history of being a researcher?

MR. BRENNAN: A history of study?

MR. BRENNAN: Have you written reports and papers for people to learn?

MR. BRENNAN: Okay. Is it sufficient to simply look at a report that is generated by Cellebrite or Magnet AXIOM or any other service and make conclusions just on the report?

MR. BRENNAN: No. Why do you think that's imprudent? Sorry. Why do you think it is not prudent to simply rely on a report?

MR. BRENNAN: And when you were considering the hash value and determining whether or not you thought there was anything wrong with the data — aside from the hash value, how do you make a determination whether or not this data has integrity, the data hasn't been tampered with, so to speak?

MR. BRENNAN: Did you try to summarize that perspective in the part of the report that wasn't read to you on examination?

MR. BRENNAN: Do you have an opinion to a reasonable degree of scientific certainty if there were any data integrity issues in the information you reviewed?

MR. BRENNAN: It was characterized on examination — there was a dispute about the time origin of the search "how's long to die in cold." Do you remember being asked the question about a dispute?

MR. BRENNAN: In your studies and in your position, is there any viable dispute in the forensic data scientific community about that issue?

MR. BRENNAN: Now, you got involved in this case because you received a complaint from a consumer.

MR. BRENNAN: Yes. Did you attempt to resolve that?

MR. BRENNAN: Other than that source, have you received any information, feedback, or opinions that would make this issue in any way a dispute?

MR. BRENNAN: I'm sorry, can you rephrase — other than that one person, that one consumer, have you received any information in the forensic community — which you're part of — any data, any information that would suggest that your conclusions are in dispute?

MR. BRENNAN: And since then, in your world — academic and research world, forensic data science — other than the person who originally raised the question, has there been any dispute brought to you by anybody about your conclusions about when the search actually happened?

MR. BRENNAN: Do you know Jessica Hyde?

MR. BRENNAN: Is she well known in the forensic community?

MR. BRENNAN: You were asked questions about your law enforcement background and the fact that Cellebrite is used as a forensic tool, often times by law enforcement.

MR. BRENNAN: Did you go into your company's software and change it to accommodate law enforcement?

MR. BRENNAN: Would you ever do such a thing?

MR. BRENNAN: Why wouldn't you do something like that?

MR. BRENNAN: In a prior proceeding, the printout from the software when it was showing the timestamp of the Safari search — was it labeled something in particular? Before the Cellebrite search was labeled "last visited time"?

MR. BRENNAN: And when it was labeled "last visited time," did it show 2:27 on the report?

MR. BRENNAN: Cellebrite, after research and consideration, removed that label.

MR. BRENNAN: Why was it important to remove that timestamp from the program in the software?

MR. BRENNAN: Does a company have concerns when consumers are confused about information?

MR. BRENNAN: Do companies have concerns if a consumer tries to manipulate the use of that information?

MR. BRENNAN: Are companies concerned that a label could be misleading for somebody who may not have a higher level of experience?

MR. BRENNAN: When that decision was made to change that for clarification, did you make that solely by yourself?

MR. BRENNAN: Who do you consult with and who's part of that decision process?

MR. BRENNAN: It was suggested that a separate software program — not the company you work for, Cellebrite — but Magnet AXIOM reflects this search as deleted. That's not entirely accurate, is it?

MR. BRENNAN: Would Magnet AXIOM reflect this search as deleted?

MR. BRENNAN: Does it have a label on it?

MR. BRENNAN: Is that "carved"?

MR. BRENNAN: Now, are you familiar with the Magnet AXIOM artifact reference guide when it talks about the dangers of relying on the timestamp?

MR. BRENNAN: Are you aware of the reference guide when it talks about Safari suspended tab state tabs?

MR. BRENNAN: And offers that since these are local tab states, results from this artifact may contain an earlier date and time compared to the results in the Safari history artifact if iCloud Safari synchronization —

MR. BRENNAN: Are you aware of the reference guide?

MR. BRENNAN: Are you aware that it cautions that a timestamp can be misinterpreted?

MR. BRENNAN: Sir, when you came to your opinion that the search for "how long to die in the cold" at 6:23 and 6:24 in the morning of January 29th, 2022, was the time that it was actually inputted — not 2:27 — in informing your opinion, did you consider both Cellebrite and Axiom software?

MR. BRENNAN: Did you consider other tools as well?

MR. BRENNAN: And tell us a little bit about your own tool.

MR. BRENNAN: And sir, when you were trying to examine these searches that in your opinion were 6:23 and 6:24 a.m., did you ever try to test it yourself and actually take a phone so you could either prove or disprove to yourself that that earlier timestamp didn't mean it was the time that it was searched?

MR. BRENNAN: And in your opinion, is that helpful in understanding how a timestamp earlier could relate to a later search?

MR. BRENNAN: Would you be willing to do a live demonstration for us on the screen and show us how that works?

MR. BRENNAN: Okay. How long would that take?

MR. BRENNAN: Okay. Could you show us?

MR. BRENNAN: Thank you. Thank you. Mr. Whiffin, I'd like to ask you a couple of general questions.

MR. BRENNAN: You mentioned with reference to location data that the scope of identifying a location of a phone can change depending on what information the phone is receiving. I'm sorry. You showed us a number of graphs and exhibits that show different circles. Some might be smaller, some might be larger than others.

MR. BRENNAN: And you share with us that location information is being received from a number of different sources.

MR. BRENNAN: Can you remind us again what can affect that location data as far as receiving some high accuracy, mid and low level? What could affect the receipt of that information?

MR. BRENNAN: You share with us there are some factors that can affect that location data.

MR. BRENNAN: In addition to being in a building like a house or a business, that's one way it can be affected.

MR. BRENNAN: And there are other ways as well, isn't there?

MR. BRENNAN: And could you share again the other ways that location information could change?

MR. BRENNAN: How about a body being on the phone? Could that affect location data?

MR. BRENNAN: If a human being was covering the phone so it wasn't exposed to the air, could that affect the location data?

MR. BRENNAN: Yes, you were shown exhibit 40. It was one select piece of the report. It was a graph. With the court's permission, I'd like to show exhibit 40.

MR. BRENNAN: Exhibit 40 has two circles. One darker, one white.

MR. BRENNAN: And do you remember being asked questions about this particular exhibit?

MR. BRENNAN: And in addition to this exhibit, is there other information in your report that wasn't shown to you that would put this in context?

MR. BRENNAN: Looking at this snapshot of 5 seconds, is this still consistent with your opinion that to a reasonable degree of scientific certainty, you opine that the cell phone was in the flagpole area the entire evening of January 29th, 2022?

MR. BRENNAN: When you provide a report with all the different graphs and explanations, do you expect it's going to be shared with the defense attorneys?

MR. BRENNAN: And you understand in this case, everything is shared.

MR. BRENNAN: And when you shared your report with this piece of information, did you include a summary chart that wasn't shown to you on examination?

MR. BRENNAN: Okay. May I approach?

MR. BRENNAN: Showing you your report. Do you recognize your report?

MR. BRENNAN: And what page are you on?

MR. BRENNAN: Do you recognize anything in particular as far as a chart on that page?

MR. BRENNAN: Does that chart help explain this photograph?

MR. BRENNAN: I'd move that chart into evidence. Any objection, Mr. Alessi?

MR. BRENNAN: Thank you. With the court's permission, I'd like Miss Gilman to show us the chart.

MR. BRENNAN: How long of a time period does that photograph encompass?

MR. BRENNAN: Okay. And what does this show us? Can you explain the chart that goes along with that photograph that was shown to you?

MR. BRENNAN: Does this chalk help represent that there can be changes in the location data but the item can remain dormant?

MR. BRENNAN: What is the exact point of the demonstration or this chalk? How does that help us understand the movement or the lack of movement of a cell phone?

MR. BRENNAN: If I could go back to exhibit 40, please. So, looking at your photograph that you were asked about, there are two different circles, one dark and one light.

MR. BRENNAN: And those circles are in different spots.

MR. BRENNAN: Based on the chalk or the chart you just showed us, are both of those different color circles consistent with a phone being in the same spot and not moving?

MR. BRENNAN: Now, finally, I want to turn back to the phone that was attributed to Jennifer McCabe, and you had shared with us your opinions about the time in which the searches at 6:23 and 6:24 were made.

MR. BRENNAN: And I asked if you could just show us live right now how it works that a person can open a tab and there's a timestamp, a time when it's open, and then make a later search but still retain the original timestamp.

MR. BRENNAN: Is that something you can do for us?

MR. BRENNAN: Okay. With the court's permission, I'd ask Mr. Whiffin to give us a live demonstration of this. Do you want the light off, Mr. Whiffin?

MR. BRENNAN: Thank you. Okay. Thank you, Dave. Okay.

MR. BRENNAN: To an untrained eye, can that development of a timestamp become confusing?

MR. BRENNAN: Is there any other reason that Cellebrite removed that process of timestamp other than to clarify that issue?

MR. BRENNAN: If an examiner simply made a report from Magnet AXIOM or Cellebrite or another software but didn't have the time or skill to actually go into the data, could they be easily confused by this?

MR. BRENNAN: Thank you. I have no further questions.

MR. BRENNAN: May we be seen while Mr. Whiffin is collecting his items?