Latest / Parsing the Truth: One Byte at a Time / Karen Read 1-1: Richard Green Affidavit

Transcript

Karen Read 1-1: Richard Green Affidavit · Parsing the Truth: One Byte at a Time

0:01
Join former FBI Senior Forensic Examiners Becky Passmore and
0:05
Stacey Eldridge as they dig into the world of digital forensics
0:08
one bite at a time. Now leading their own consulting
0:11
firms and educating the next generation of cyber sleuths,
0:14
these badass babes of digital forensics bring sharp insight,
0:18
real world case experience, and a dose of humor to the bits and
0:21
bites that build today's investigations.
0:23
From deep dives into business e-mail compromise and ransomware
0:26
attacks, Becky's specialty to cracking the complexities of
0:29
iPhone forensics, Stacy's obsession, this podcast delivers
0:33
insider knowledge for professionals, students, and
0:36
true crime techies alike. If you've ever wondered what
0:39
really happens when the digital trail is all that's left, TuneIn
0:42
and start parsing the truth. Hi, I'm Stacey Eldridge and I
0:53
provide digital forensic services and expert witness
0:56
testimony through my business, Silicon Prairie Cyber Services.
1:00
Hello, I'm Becky Passmore, Co Founder of Root Forensics and I
1:04
also provide digital forensic and expert witness services
1:07
through my company Becky. And I are both former FBI senior
1:11
forensic examiners and we totaled it up and we have about
1:14
45 years of digital forensics and cybersecurity experience
1:18
between the two of us. Yes.
1:20
We are dedicated to educating the next generation of digital
1:25
forensic examiners. We do this by teaching digital
1:28
forensics at the university level and by sharing real world
1:31
insights through our podcast, Parsing the Truth One Bite at a
1:35
Time. The week where we discuss the
1:38
digital forensics and artifacts in today's modern crimes.
1:42
And today we've got a special episode for you.
1:44
Becky. What rabbit hole are we going
1:47
down today? We are beginning our series on
1:51
the first Karen retrial. We've joked in the past about
1:54
we'll be doing 52 part series of the Karen Reed trial, but we
2:00
believe we are going to be able to cut it down to far fewer
2:03
episodes than that. In our first Karen Reed series,
2:07
we are going to focus on the first trial that occurred in
2:11
2024, 2020. And so, Stacey, do you want to
2:14
start us off with some background on the Karen Reed
2:17
case? Yeah, the Karen Reed case is
2:19
certainly one of the most talked about cases from 2024.
2:23
It's the Commonwealth, the state of Massachusetts versus Karen
2:27
Reed. The digital forensics in this
2:29
case is fascinating, and it's generated significant attention
2:33
and debate. And perhaps that's an
2:36
understatement. Karen Reed is accused of the
2:38
death of Boston Police Officer John O'Keefe, who was found dead
2:42
outside his home in Canton, MA on January 29th, 2022.
2:48
The prosecution has its theory of what happened, but the
2:52
defense brought in digital evidence that they think tells a
2:55
different story. And that's where today's episode
2:58
begins. We are going to walk through the
3:01
affidavit from Richard Green. He is a digital forensics expert
3:06
with United States Forensics and the defense brought Green in to
3:10
analyze cell phone data from two key individuals, Jennifer McCabe
3:15
and John O'Keefe, and he analyzed reads data as well.
3:20
Now Greens affidavit was filed in April 2023 and so this was
3:24
before the Karen Reed trial actually started in 2024.
3:29
So let's start with the basics. If you want to follow along,
3:33
check for the link to the affidavit in our show notes or
3:37
the QR code on the screen. So why did Richard Green file
3:40
this affidavit in the 1st place? This affidavit was filed in the
3:44
support of the defense's motion to subpoena additional
3:48
information. We have AQR code on the screen
3:50
for that motion and we'll and we will link to it in the show
3:53
notes. His affidavit is cited in this
3:57
motion where the defense is asking the court to order the
4:00
production of cell phone records and data from two key witnesses,
4:05
Jennifer McCabe and Brian Albert.
4:09
There were more requests in that motion, but we're going to focus
4:12
on this aspect the defense wanted those records and the
4:18
reasons why are detailed in Richard Green's affidavit.
4:23
So let's dive into that affidavit now.
4:25
In .5 of Green's affidavit, he states that his analysis
4:29
revealed significant sculpatory evidence during the review of
4:35
the search history which was present on Jennifer McCabe's
4:38
iPhone. And he cites those in the
4:42
artifact details of the information where there is a
4:46
search term house long to die in the cold, and that is time
4:53
stamped at 2:27 AM. Now, what makes this exculpatory
4:58
is the biggest question. And it's important to keep in
5:00
mind this is information is coming from Jennifer McCabe's
5:04
phone, not Karen Reed's phone. We have to step back to the
5:08
state's narrative to understand why this matters.
5:11
The state claimed Reed backed her SUV into O'Keefe outside the
5:18
Albert's residence and then left him to die there when she left
5:23
1236 Reed. McCabe and Carrie.
5:28
Roberts arrived back at the Albert residence at 6:00 AM.
5:32
So if someone searched for House long to die in cold at 2:27 AM,
5:39
this means someone was searching for information on death by cold
5:45
exposure hours before anyone claimed to know O'Keefe with
5:50
outside or missing. This is completely contradictory
5:54
to the state's narrative. Yep.
5:57
So Green continues and he indicates that this data is
6:00
coming from the browser state dot DB dash wall ual in Database
6:08
Record 4208. He explains that the purpose of
6:12
the browser state dot DB is to record information about the
6:17
tabs open in Safari and that it will allow a user to return
6:21
later and continue browsing. He also states that tabs can be
6:25
deleted by the user. Now when he states that the user
6:29
can delete tabs, I'm not exactly sure what he's referring to.
6:34
People can close tabs. You can hit the X on the tap to
6:38
close it. I don't know if people refer to
6:41
this as deleting tabs. Becky, have you ever heard
6:44
anybody saying I'm I'm deleting my tabs in my browser?
6:47
No, it's only referred to as closing out a tab in your
6:50
browser, not necessarily deleting it.
6:54
So that's our experience, but as forensic examiners, we've never
6:57
referred to the deletion of tabs in the browser by the users.
7:02
But he continues in his affidavit and Green states that
7:05
the user later deleted that that 2:27 AM search.
7:11
But this whole thing raises an important question.
7:14
Can one record from one artifact tell the complete story?
7:20
In digital forensics, context matters as single digital
7:24
artifact, whether it's a time stamp, a search query, or Agps
7:28
coordinate rarely tells the whole story.
7:31
Digital evidence exists within complex systems where multiple
7:35
data points must corroborate each other to establish
7:39
reliability. First off, there are many things
7:42
happening on the devices simultaneously, especially on
7:46
phones. And devices generate multiple
7:48
logs or database entries nearly simultaneously.
7:52
And the time stamps could be exactly the same or only off by
7:56
a millisecond or two. And as we all know, surfing the
7:59
Internet creates multiple data points, and that's related to
8:03
the history, the cache, the cookies, and more.
8:07
Examining only one source risks missing the complete picture.
8:12
And then there's time. It's always complex, and time
8:15
records can be affected by time zone settings, daylight savings
8:20
changes, system clock errors, and different records on the
8:24
same device can be stored in different ways.
8:27
Think local time versus UTC time and even different formats.
8:33
And then there's the distinction between people versus the
8:37
machine. Not all digital activity
8:39
reflects intentional user behavior.
8:42
There are a lot of things going on in the background that the
8:45
user has no control over and certainly doesn't know they are
8:49
occurring. It's vital that we as digital
8:52
forensic examiners work to determine was it the user or was
8:56
it the device? Devices are messy.
8:59
We never find data in pristine, untouched condition.
9:03
Files can be corrupted, partially overwritten, or
9:06
affected by normal system operations.
9:09
One artifact may represent incomplete or degraded data, so
9:17
our work requires comparing multiple independent data
9:21
sources to verify findings. When these sources conflict,
9:26
examiners must determine which data is most reliable and why.
9:32
In practice, a single data point means little without examining
9:37
related system files, application logs, user activity
9:41
records, metadata, and so on. Only when multiple artifacts
9:46
consistently point to the same conclusion should digital
9:50
evidence be considered reliable. Digital forensic work is
9:55
detective work, not fortune telling.
9:58
One clue suggests a lead. Multiple corroborating clues
10:02
help establish facts. Green continues to discuss
10:06
events occurring on the phone shortly before that 2:27 AM sort
10:11
Sir. And he included the following
10:13
details that the iPhone was unlocked between 2:23 and 2:31
10:19
AM and that there were text messages sent at 2:25 AM AM and
10:24
a couple of screenshots were deleted at 2:26.
10:28
And then he lists the search for House Long to Die in cold was
10:32
entered at 2:27 AM. Now he goes on later to discuss
10:37
the discovery of some additional searches, and those were how
10:41
long to die in Kikti and House Long to Die in cold again
10:48
occurring after 6:23 AM and those are included in Exhibit 2
10:53
if you want to check that out. And you can see that the search
10:56
results that he's discussing came from com dot apple dot
11:01
mobile safari dot P list. This P list file stores user
11:05
configuration data. It can have some identifiers and
11:09
settings. So think preferences really.
11:11
And additionally, it maintains a record of search queries entered
11:16
through the Safari search bar. And this is the search field
11:20
that appears, appears right above the keyboard and it came
11:25
out in iOS 15 and it has continued on since then.
11:29
Now the search bar having it searches recorded here is new to
11:34
iOS 15. And so these phones are on iOS
11:37
15 dot something. So it is a relatively new
11:39
artifact to consider in this examination.
11:42
And Mr. Green also included some evidence from Safari cash
11:46
records that indicate that the user conducted a search for how
11:51
long long does it take to digest food?
11:53
And that's shown in Exhibit 3. So in .12 of the affidavit,
11:58
Green moves away from Internet related activity and discusses
12:03
detail and discusses deleted call logs.
12:07
It's important to keep in mind that the extraction of McCabe's
12:11
phone occurred on February the 2nd, 2022 and she did receive
12:16
approval to delete personal text conversations with her daughters
12:21
before turning the phone in. This is definitely something a
12:25
forensic examiner should keep in mind when approaching the
12:29
examination. I would certainly think a review
12:33
of missing row IDs would be warranted to determine what
12:37
timeframes these texts are missing, IE where and when are
12:43
the gaps here, but green doesn't address any deleted text.
12:48
Green indicates that there were significant deletions of call
12:52
data by the user of McCabe's iPhone.
12:56
It's important to note that the database listed in this
12:59
affidavit is call history dot storedata dot DB, but the
13:05
correct database is actually call history dot storedata.
13:10
There is no DB extension. You can see in exhibit 4 that
13:14
the artifacts he is discussing actually do come from call
13:20
history dot stored data based on the path provided in the
13:24
exhibit. Now he goes on to document the
13:27
following details about these deleted call records.
13:31
The first thing he talks about is that from October 24th, 2020
13:36
through January 27th, 2022 that there is only FaceTime call data
13:43
that that's recorded and that this was parsed out by Axiom.
13:46
And then the day before John O'keefe's death, January 28th,
13:51
he said that there was no call log data found in the call
13:55
history dot store data dot DB. Again, he mistakenly puts that
14:00
dot DB in there, but he does indicate that this is a main
14:03
storage location. And he also indicates that he
14:05
found some indications of the calls in the Knowledge C
14:09
database and that the Knowledge C database records various user
14:13
activity. But he didn't go into any
14:15
details about what exactly he found in the Knowledge C
14:18
database. In this affidavit, he lists that
14:21
on January 29th, there were 18 deleted call entries from the
14:26
time between 5:33 AM and 8:50 AM.
14:31
He also noted of those 18 calls, he called out three of them
14:36
separately, that the six O 3 AM 911 call was deleted.
14:41
There were two calls at six O 7 and 6 O 8:00 AM to Nicole Albert
14:47
that were deleted. And I guess there's one more, a
14:50
6:23 AM call to Uncle Brian A was deleted.
14:55
He just wanted to call those out specifically for whatever
14:58
reason. And then he said that normal
15:01
call activity began again on the 29th at 8:59 AM and it continued
15:07
through February 10th, which is when she turned her phone in.
15:11
There's a couple of things here that I found interesting.
15:14
He states that only FaceTime call data was present going back
15:19
to October 24th, 2020, but there are no call logs from the day
15:25
before January 28th. But he notes that there's 18
15:29
deleted calls from the morning of January 29th and that normal
15:34
call activity resumes on after 8:59 AM.
15:37
But so here's the thing to keep in mind, whether it's a phone
15:41
call, FaceTime video, FaceTime audio, all of these logs, these
15:47
events are tracked in the same database and the same table
15:50
within that database. So records are going to be cut,
15:54
kept until the Max maximum number is reached, and then they
15:56
start being deleted in a or removed in a first in first out
16:01
fashion. And unfortunately, this Exhibit
16:04
4 begins right at the deleted calls on McCabe's phone from the
16:11
29th. So there's no inclusion of
16:14
anything from the day before, none of those old FaceTime
16:17
calls. I personally would have liked to
16:19
see more context to include those older calls he was talking
16:24
about, and he's also just presenting the data as it
16:27
appeared to be parsed by the tool.
16:30
From what I can tell, there's no raw table data being presented
16:34
in this exhibit. Right, so you may also be able
16:38
to find traces of calls in the inner actions C dot DB, but none
16:45
are specifically mentioned here. The interactions C dot DB is a
16:50
nice database to get, you don't need a full file system
16:54
extraction to get it. It's basically keeping track of
16:58
interactions and the contact information.
17:04
You can even see data sent in a message.
17:07
Who wouldn't be? Now, that wouldn't be very
17:09
helpful for these call records, but it could be provide some
17:12
clues related to deleted text messages.
17:15
But deleted text messages aren't discussed in this affidavit.
17:19
Green then describes the additional deletions he detected
17:23
on McCabe's phone. He was able to make this
17:25
determination by reviewing O'keefe's and Reid's phone call
17:30
logs. He found that there are 17 calls
17:33
listed in O'keefe's phone to from McCabe's phone, but only
17:39
one of these call records was found on McCabe's phone.
17:43
He also found that there were 8 calls listed in Karen Reed's
17:48
call logs to or from McCabe, but only two of these calls were
17:53
found in McCabe's phone call logs.
17:56
Now, Green stated that since he was unable to recover a complete
18:00
accounting of all of the records, he would need to obtain
18:03
call detail records from McCabe's cell phone carrier.
18:06
So he could cross reference that with what I was able to actually
18:09
extract from her phone. Let's kind of dig into the
18:12
exhibits related to the call logs real quick.
18:15
So First off, as we've mentioned, there's Exhibit 4,
18:18
what has some call records from McCabe's iPhone.
18:23
They begin on the 29th at 5:33 AM and at the top show the 18
18:28
deleted calls with the last deleted call record having a
18:33
time stamp of 8:50 AM. The next call that's not deleted
18:38
begins at 8:59 and then the calls continue with the through
18:43
the day ending at 6:27 PM. Moving on to Exhibit 5, these
18:48
are the calls logged on O'keefe's phone that were two or
18:52
from McCabe's phone and he answered, you know somebody
18:57
answered on that phone. 3 calls at 12:14, 12/18 and 12:29 AM on
19:04
the 29th. The next call that came in at
19:06
12:40 one 10 AM was not answered.
19:10
The calls continued but we're not called but were not answered
19:15
at 124159124312461247 and 12:50 AM.
19:23
The calls then stop until an incoming call from Mccabes phone
19:27
is received at 50405 AM. Yeah.
19:32
And so then Exhibit 6 contains the calls logged on Reed's phone
19:38
that were to or from McCabe's phone.
19:41
Reed calls McCabe at five O 5 O 1:00 AM.
19:46
It's not answered, but McCabe calls read back 13 milliseconds
19:51
later. What's really interesting is
19:53
that the first call listed on 1/29 to or from McCabe on Reed's
19:59
phone is. At 5 O 5:00 AM, which is after
20:03
the McCabe iPhone called O'keefe's phone.
20:06
This is supposed to be a list of all the calls on Reed's phone
20:10
that were to or from McCabe. On McCabe, Green notes that
20:17
there was call to O'keefe's phone one minute before Reed's.
20:22
And so Green also notes that there was a screenshot of a
20:25
contact Uncle Brian that was created on 1/29/2022 at six O
20:32
8:00 AM and later deleted at 12:53 PM.
20:36
The significance of the screenshot remains to be unseen,
20:39
but it does demonstrate that someone was using the McCabe
20:43
iPhone at six O 8:00 AM, according to this affidavit.
20:48
Now Green changes his focus to location data.
20:51
In .16, he indicates that the McCabe phone arrived at the
20:56
Albert's residence where the O'Keefe body is later found when
21:00
it arrived and was there from 12:18 AM until 1:47 AM.
21:07
Then he notes when they're leaving that at 2 O 3:00 AM,
21:12
they turned right onto Lawrence St. which is before Pleasant St.
21:18
which intersects O'keefe's residence.
21:21
And then the course was reversed.
21:23
Not sure of the significance of that other than he wanted that
21:28
noted, right? And it's also highlighted that
21:31
the phone is present in the McCabe residence at 2:27 AM.
21:36
When Green alleges that someone was searching for House Long to
21:40
die in cold, Green moves on to the Apple health data.
21:44
Of course, we knew that was coming, right?
21:46
And he documents that the only steps that were logged on
21:49
O'keefe's phone were from 12:11 AM AM until 12:32 AM on the
21:56
29th. And so now you got to pay
21:58
attention to this next part, OK? He also states that O'keefe's
22:02
iPhone location data had a first ping near the Albert residence
22:09
at 10 AM. And O'Keefe arrived at the
22:12
Albert residence at 12:24 AM in a car.
22:17
They were driving, not walking there.
22:19
And then you can take a look at this health data that he
22:22
presented from both Mccabes Phone and O'Keefe Phone in
22:26
Exhibit 8. Now, as the affidavit concludes
22:29
in .20, Green seems to be asking for the ability to make, as he
22:34
calls it, a proper forensic image or extractions of the
22:38
devices, as well as asking for any potential backup sources
22:43
like computers and the cloud. So let's say he receives
22:47
approval to do this second extraction for any of these
22:52
devices, but the results are going to be different for so
22:56
many reasons. Simply put, as time goes on, you
23:00
lose data. When you reboot the phone, you
23:03
lose data. And that's still even assuming
23:05
that law enforcement still has any of these phones.
23:09
And they have have been returned to the owner.
23:12
Now finally in .21, he's asking for cell phone carrier records
23:18
since they are maintained independently of the device.
23:21
And that totally makes sense to ask for those.
23:23
Sure. So what is the significance of
23:25
this affidavit? Let's break down the key points.
23:28
The 2:27 AM Google search is the core exculpatory claim.
23:33
Green found evidence that someone searched House Long to
23:37
die in cold at 2:27, 7:00 AM on January the 29th, 2022.
23:43
This is 3 1/2 hours before O'keefe's body was discovered at
23:48
6:00 AM. According to the prosecution's
23:50
narrative, no one should have known O'Keefe was outside dying
23:55
in the cold at 2:27 AM. This search occurring before the
23:59
bodies discovered suggest someone inside the the McCabe
24:04
home knew O'Keefe was outside in distress.
24:08
Green claims this search was subsequently deleted by the
24:12
user. Then there are the numerous call
24:14
log deletions from McCabe's iPhone.
24:17
McCabe's phone showed 18 deleted calls between AM and 8:50 AM on
24:24
January the 29th. Cross referencing with O'keefe's
24:27
phone shows 17 calls to or from McCabe listed on O'keefe's
24:33
device, but only one appears on McCabe's phone.
24:36
Cross referencing with Reed's phone shows 8 calls calls to or
24:40
from McCabe listed on Reads device, but only two appear on
24:44
Mccabes phone. Green states his professional
24:47
opinion a user was engaged in efforts to tamper with, alter,
24:52
destroy and or hide information or evidence.
24:56
And that's a direct quote. Now, there's also some
25:00
suspicious timeline and anomalies.
25:03
Or call it unusual. Use the word you like.
25:05
But so there's the fact that McCabe's phone called O'keefe's
25:08
at 5 O 4:00 AM, but Reed is not logged as calling McCabe until 5
25:15
O 5:00 AM. The question is, why is McCabe
25:19
calling O'Keefe before Reed contacts McCabe, asking, you
25:24
know, McCabe, where, where is O'Keefe?
25:26
I'm looking for him now. Could this just be a timing
25:29
discrepancy issue? Are the times slightly different
25:33
slash off slash drifting on the devices?
25:36
There's also the thing where McCabe's phone location data
25:40
shows that it was at the McCabe residence at 2:27 AM during the
25:44
alleged Google search. So keep that in mind.
25:47
And O'keefe's Apple Health data shows steps logged from 12:11 AM
25:53
to 12:32 AM only. But remember he arrived via a
25:58
car are after 12:11 AM. Now green requests you know a
26:03
proper forensic imaging or extractions of the devices.
26:07
He wants cell phone carrier records so he can verify what
26:10
was deleted and he's also asking for potential backup sources for
26:15
the computers and the cloud. So that's what he's done in this
26:19
affidavit. Some stuff to consider some
26:22
stuff that he wants. But remember, this affidavit is
26:25
essentially arguing that the digital evidence he's writing
26:29
points to foreknowledge of O'keefe's condition by the
26:33
McCabe iPhone user, and that there was also the systematic
26:38
deletion of incriminating records.
26:41
Right. So this affidavit and this
26:43
entire case are a master class in why examining a single
26:48
artifact or even a single device in isolation is insufficient.
26:54
Green didn't just analyze Jennifer McCabe's iPhone.
26:58
He cross referenced it against John O'keefe's phone and Karen
27:02
Reed's phone in an attempt to identify discrepancies.
27:06
Then he used those discrepancies as justification to seek the
27:10
call records from the cellular provider.
27:12
Green didn't only document the search at 2:27 AM, he also
27:17
included the searches at 6:23 AM.
27:20
These times would seem to conflict, but he did.
27:23
He documented both. This demonstrates an important
27:26
principle. Don't hide conflicting evidence.
27:29
Document everything and let the interpretation be debated with
27:34
complete transparency. And you will definitely get to
27:36
see this debate play out during the trial.
27:39
However, this affidavit wasn't just a report.
27:43
It was filed in support of a motion to compel production of
27:48
additional evidence. Green documented why the defense
27:51
thought there was someone else responsible for the murder of
27:54
O'Keefe and why they needed additional data.
27:57
We have to remember that digital forensics doesn't exist in a
28:00
vacuum. Examiners must understand how
28:03
their findings support legal strategies and why thoroughness
28:07
matters for court proceedings. Understanding this case teaches
28:11
examiners that their job isn't just to extract data.
28:15
It's to analyze, corroborate, contextualize, and honestly
28:20
present findings that can withstand scrutiny in high
28:23
stakes legal proceedings. The difference between competent
28:27
and exceptional digital forensics lies in leaving no
28:30
stun unturned. Excuse me, no stone unturned,
28:34
and no assumption untested. And that, of course, assumes a
28:38
perfect world where time and money are not an issue.
28:41
But you get my point right Now, what can we expect from the
28:46
Commonwealth, the state of Massachusetts, in response?
28:49
We would expect them to go through Green's affidavit with a
28:52
fine tooth comb and really scrutinize his statements and
28:57
artifacts that he's using to support his statements.
29:00
We would expect them to dig in not only to the browser state
29:03
dot DB and that com dot apple dot mobile Safari P list, but
29:09
all of the records related to Safari Internet history in an
29:12
attempt to confirm or refute that 2:27 AM search for House
29:17
Long to die in cold. And then we would likely expect
29:21
them to dig deeper into some of those similar searches that he
29:25
reported occurring at 6:23 AM. With regards to the deleted call
29:30
records, I would first and foremost expect the Commonwealth
29:34
to point out the fact that there is no call history dot store
29:39
data dot DB. The correct database is actually
29:42
call history dot store data. Because there is no DB extension
29:46
at the end of that database, they could attempt to determine
29:51
if these missing call records were intentionally deleted.
29:54
They might also take the time to cross reference the call logs
29:58
between the three devices and then conduct an additional
30:03
comparison against the cellular provider records, as the court
30:07
did indeed approve this request for these records.
30:11
The Commonwealth also might dive a little deeper into the Apple
30:16
Health data, considering that the motion that this affidavit
30:21
supported stated it suggests that Mister O'Keefe was not
30:26
struck with her vehicle and instead entered the Albert
30:30
resident just after midnight where he was beaten and then
30:34
left for dead on Brian Albert's. Front lawn and again, another
30:38
direct quote from the motion. So I think it'll be really
30:42
interesting to see how this plays out in court and see what
30:45
else we can learn about the artifacts that have already been
30:47
mentioned. And I'm sure they're going to be
30:50
other artifacts that will be introduced by both sides.
30:53
Now you can tell from the motions file that the McCabe
30:56
iPhone search for House long to die in cold will undoubtedly
31:01
play into the defense's theory of events.
31:03
Right. So join us next week on Thursday
31:06
morning on Spotify or YouTube. We're parsing the truth one bite
31:09
at a time. We'll continue to dive into
31:11
Karen Reed's trial and breakdown the testimony of four different
31:15
digital forensic examiners that testified as expert witnesses
31:19
during the first Karen Reed trial.
31:22
Until next time, stay safe, stay sharp, and as always, keep
31:25
parsing the truth one bite at a time.
31:29
If you enjoyed this episode, make sure to follow us to get
31:33
notified the next time a new episode drops.
31:36
If you can do more, head on over to parsingthetruth.com and
31:40
donate by clicking on the donate button.
31:43
Parsing the Truth is a nonprofit organization and we are raising
31:46
money to send a new digital forensic examiner to I Asus
31:50
training next year in Orlando. Thanks.