Latest / Parsing the Truth: One Byte at a Time / Karen Read 1-8: Nick Guarino Testimony P2

Transcript

Karen Read 1-8: Nick Guarino Testimony P2 · Parsing the Truth: One Byte at a Time

0:01
Join former FBI Senior Forensic Examiners Becky Passmore and
0:05
Stacey Eldridge as they dig into the world of digital forensics
0:08
one bite at a time. Now leading their own consulting
0:11
firms and educating the next generation of cyber sleuths,
0:14
these bad ass babes of digital forensics bring sharp insight,
0:18
real world case experience, and a dose of humor to the bits and
0:21
bites that filled today's investigations.
0:23
From deep dives into business e-mail compromise and ransomware
0:26
attacks, Becky's specialty to cracking the complexities of
0:29
iPhone forensics, Stacey's obsession, this podcast delivers
0:33
insider knowledge for professionals, students, and
0:36
true crime techies alike. If you've ever wondered what
0:39
really happens when the digital trail is all that's left, TuneIn
0:42
and start parsing the truth. Parsing the Truth One Bite at a
0:53
Time is proud to welcome our first sponsor, ACE Forensics.
0:57
They are based near Chicago and they've been building systems
1:01
since 1983. ACE Forensics delivers high
1:05
performance digital forensics workstations, laptops and
1:08
servers to justice agencies across the United States and
1:12
around the world. They offer unmatched value and
1:15
the industry's only five year digital forensics warranty.
1:20
ACE Forensics build the systems digital forensics software
1:23
deserves. If you're procuring digital
1:26
forensics equipment, reach out to them for a competitive quote.
1:29
Now on to our episode. Welcome back to parsing the
1:33
truth one bite at a time. I'm your Co host, Stacey
1:36
Eldridge, and with me, as always, is Becky Passmore.
1:39
And we are the podcast that focuses on digital forensics in
1:43
today's modern crimes. Whether you're here to Get the
1:47
facts of the digital evidence or learn more about the artifacts,
1:50
we've got you covered. Becky, what are we up to today?
1:53
So today. We are continuing our series on
1:56
this first Karen Reed trial. In this week's episode, we are
1:59
continuing to walk through the testimony of Trooper Nicholas
2:03
Garano. Garino.
2:05
Carino, a digital forensic examiner with state police.
2:08
Last week, we covered his direct testimony, during which the
2:12
prosecutors asked him questions. This week, we'll be covering
2:16
both his cross examination by the defense and the
2:19
prosecution's redirect. Let's start with the cross
2:22
examination, which opened with a challenge to Garino's
2:26
credentials and qualifications. OK.
2:29
The defense established as they were starting off their cross
2:32
examination of Garino that he graduated from Westfield State
2:36
in 2003 with a double major in criminal justice and mass
2:40
communications. The defense stated he chose not
2:44
to major in computer science. They specifically said that
2:47
chose he chose not to. I found that interesting
2:50
personally. That's very interesting.
2:52
And then they went on to his employment history.
2:54
He worked as a Norwood patrolman for 10 years before becoming a
2:59
state trooper in 2015, where he spent four years in the patrol
3:04
division until 20/19. The defense noted that he also
3:08
had completed over 20 online courses and webinars, including
3:12
courses titled Introduction to Computer Networks and
3:16
Introduction to Cell Phone Investigation.
3:18
They stated he holds no degrees in computer forensics or
3:21
computer science and has no publications in the field and
3:25
has never taught a course in computer forensics either.
3:30
Immediately, it sounds like the defensive strategy is to point
3:33
out that he lacks the educational background for this
3:36
position. They're not saying it outright,
3:39
but they're implying it. They are pointing out that he
3:42
doesn't have any sort of computer or technology related
3:45
degree. They're also pointed out that he
3:47
took many online classes while computer science degrees were
3:51
around when he was attending college, They there weren't any
3:56
digital forensic degrees offered back then.
3:58
Yeah, he's only a, well, he's a couple of years younger than I
4:01
am, Becky. So you know, it said he
4:03
graduated in 2003 when I looked at his CV.
4:06
So that's that's just how it was 20 plus years ago.
4:09
Right. There were no digital forensic
4:11
degrees and it was a lot of times an IT degree or a computer
4:17
science degree. So back then people thought if
4:20
you wanted to be in law enforcement, you need a criminal
4:22
justice degree. And many people still think that
4:25
today. But we're here to tell you that
4:27
if you want to get into digital forensics in law enforcement,
4:30
you are going to need some sort of technology focused bachelor's
4:35
degree. Yep.
4:35
So, so if people are coming to you as a current digital
4:38
forensic examiner, especially if they're younger, haven't got
4:41
their bachelor's degree yet, you might want to share that that
4:45
nugget with them as well. So let's get some other stuff.
4:49
You know, regarding the jury, I'm not sure that the jury is
4:53
going to think any less of him because he attended online
4:56
classes. Today's universities offer
5:00
entire degree programs exclusively online.
5:03
I mean, I teach exclusively online.
5:06
Some of my students have a choice depending, you know.
5:07
Some are in person and online, but I teach exclusively online
5:11
and you have a mix of students in your class as.
5:15
Well, I have students that live all around the state of Arkansas
5:19
and outside of the state of Arkansas and take the degree
5:22
solely online. Yeah, and the same thing holds
5:25
true for digital forensics vendors.
5:27
A lot of them offer their training online and I was
5:30
looking for some training from magnet forensics.
5:33
And so for example, they really offer very little in person
5:37
training anymore. I would say if I was going to
5:41
air on this high side, maybe 1/3 of their training is in person,
5:45
but but they have a ton of online classes now.
5:48
Some are on demand and some are live online.
5:51
But but this is just how the direction that the world is
5:54
moving. Because also if you don't have
5:55
to travel to training that saves on your training budget.
5:59
So you just sit in your office and not have that travel
6:02
expense, but you can get the training that you need.
6:05
So I will say regarding, you know, the mentioning of the
6:09
webinars and stuff, I think there is a difference in my
6:13
opinion of attending an actual training class where you earn
6:17
those CPS, CPS versus a webinar that's free or like a free
6:23
event. There's tons of great summits
6:25
going on in the spring every year.
6:28
Now, I'm not saying those aren't valuable, they totally are.
6:30
There could be a lot of great things with great knowledge.
6:34
But you know, I think you've got to take some of those training
6:38
courses every once in a while where you can earn those Cpes,
6:42
and you tend to need that anyways for any certifications
6:45
that you want to renew as well. That's right.
6:48
That's right, to the testimony the defense moved into Carino's
6:52
report writing and a chain of custody issue.
6:56
The focus was on a report he wrote on February the 4th, 2022,
7:00
just six days after O'Keefe was found.
7:03
That report stated that Trooper Proctor and SAR and a Sergeant
7:08
responded to the unattended death of John O'Keefe at 34, and
7:13
that Proctor secured O'keefe's phone while on scene.
7:17
And so the defense challenged whether that phrase, while on
7:20
scene, implied that the phone was recovered at 34 Fairview Rd.
7:26
Greenough disputed that interpretation, stating he
7:29
didn't know where the phone was actually retrieved from.
7:33
And the defense argued that this ambiguity undermined the chain
7:37
of custody. And the two sides went back and
7:40
forth at this for some length. Personally, I think it's it
7:43
seems kind of odd to challenge the chain of custody on John's
7:48
phone. I'm not sure what the game I
7:49
mean here would be, but I'm not a lawyer.
7:52
But they wanted, that's the decision they made to do this.
7:55
But again, maybe they're just trying to poke holes into some
7:59
of the reliability of what Greeno is writing and
8:03
documenting in his reports now. Like when I kind of step back
8:06
and think about it, I think there's two places to get
8:09
physical evidence. You can either seize it on scene
8:13
or on site if you if you like that terminology better or
8:17
someone's bringing it to the police station.
8:21
And I think even if you know, an officer responds to a call and
8:24
they're going to someone's house because they called them and
8:27
told them to come there versus like a search warrant, that
8:30
police officer or the agent is still on scene, whatever that
8:34
location may be. But again, in those situations,
8:38
that's kind of a consent to search situations.
8:41
But again, it's either, you know, somebody in the law
8:43
enforcement agency is physically going somewhere to collect
8:46
something or somebody is bringing it into the station.
8:49
Sure. I don't know.
8:50
Am I missing something here, Becky?
8:51
No, I think, I think your, your defense strategy is sometimes
8:57
working on playing on words. So they're just going to play on
9:00
a word and make the witness maybe feel uncomfortable.
9:05
So yeah. The defense then moved to the
9:08
timeline of Garino's analysis. They established that Garino did
9:12
not report on John O'keefe's location data until April the
9:16
2020 until April 2023, and did not report on Apple Health data
9:22
until the spring of 2023. Garino disclosed that his April
9:26
2023 report was written after he became aware of defense expert
9:32
Richard Green's affidavit David, which had analyzed O'keefe's
9:36
location and health data. Yep, and we talked about Richard
9:40
Green's affidavit. So if you have not listened to
9:43
that episode on the podcast, go ahead and jump into that because
9:47
that was basically our first full length episode regarding
9:50
the Karen Reed trial, the first trial.
9:53
Now back to this case. The defense also noted that no
9:58
member of the State Police's homicide team had looked at or
10:02
reported on any location data for anyone present at 34
10:07
Fairview Rd. prior to Green's affidavit.
10:11
Greenough did indicate that he loaded the data into Celebrite
10:16
for Trooper Proctor to review earlier in the investigation,
10:20
but the formal reporting came later.
10:23
And I will say this is not unusual.
10:27
Typically the digital forensic examiner is going to stage
10:30
something for review by the investigation officer.
10:34
So in this situation, it's celebrate and they're generating
10:37
celebrate reader reports. And then, you know, the
10:41
investigating officer gets the report.
10:44
They the reader report whatever they're looking at.
10:46
And then the digital forensic examiner will wait for the case
10:50
agent, the investigator to respond back and say, you know,
10:54
what else do they want them to dig into?
10:56
Do they need anything else? And that tends to happen after
11:00
that an initial review. And Greeno so testified to this
11:04
procedure in open court. And I have also personally
11:07
experienced this type of workflow when I was in the FBI.
11:10
Yeah. Absolutely.
11:12
The next. The defense questioned how the
11:15
phone was handled after it was seized.
11:18
Garano confirmed that placing the phone in airplane mode or a
11:22
Faraday bag would have prevented further location data from being
11:25
recorded. He acknowledged that neither
11:27
method had been used as of 6:15 AM on January the 29th and that
11:33
the continued recording location data until 11:56 AM that day.
11:40
Now, Becky, I'm not a day-to-day iPhone user.
11:44
I do a lot of testing with them and I examine a lot of them.
11:48
But I'm I'm not using it like a as a person using an iPhone.
11:51
But when I did some testing on my iPhone that was closest to
11:55
this one, I know that the default setting for when I
11:58
turned on airplane modes did not turn off the GPS or location
12:04
data. I don't know like you use an
12:06
iPhone, so have you noticed that?
12:09
Like if you put it into airplane mode, does your GPS
12:12
automatically go off? Not necessarily if I put it in
12:15
airplane mode. I mean, I could put it in
12:17
airplane mode right now. Until you put it in airplane
12:20
mode, it does not take off Wi-Fi signal or Bluetooth.
12:23
And that's pretty standard anymore that keeps it on because
12:27
you want to use that stuff on the airplane.
12:29
For sure. So no, you know, and and again,
12:33
it's probably version based like what type of iPhone was being
12:37
used at the time, right? Yeah, yeah, your mileage may
12:40
vary, so, but I think that's just something to be aware of.
12:43
OK, You've got it into airplane mode.
12:46
You're having them double check that Wi-Fi and Bluetooth are
12:50
off. Well, now they're going to have
12:51
to go to another step to make sure that GPS location data is
12:56
also off because it may not be off by default.
13:00
And, you know, we're trying to keep things really pristine here
13:03
and do best practice. Are you, you know, the main
13:06
reason for getting it into airplane mode and getting that
13:08
Wi-Fi and Bluetooth shut off situation is to, you know,
13:13
eliminate that risk of that remote wipe.
13:16
But again, as you can see what's happening here in this trial,
13:19
they're saying, well, why is all of this GPS data logging?
13:23
What procedures weren't followed?
13:25
So that's how it's coming into play here.
13:28
I did see in some of my research that you could say Hey Siri shut
13:33
off. I think, I don't know if you
13:34
have to say, I can't recall now say like, hey, shut off GPS or
13:38
location and you could do that while the phone is locked,
13:41
allegedly. So that might be something for
13:46
listeners to experiment and, you know, based on on your findings
13:50
and what you want to do in your agency, maybe tell people, Hey,
13:54
if it's locked, try Hey Siri, you know, disable the location
13:58
and, and see how that works. You know, otherwise, as I
14:01
mentioned in the testimony, you can put the cell phone in a
14:05
Faraday bag. And then as we're kind of
14:07
educating people here, make sure when you put that cell phone in
14:09
the Faraday bag that it's completely sealed.
14:13
Do not have the cord sticking out of it before like power
14:16
charging, because then that will act as a antenna.
14:20
So that's not good either. I'm hopefully, you know, the
14:22
idea is that, that you can quickly get the phone to the
14:26
evidence lab and then they can handle it properly.
14:29
So the battery's not going to die while it's in that Faraday
14:32
bag. And that's another reason you
14:34
have it in airplane mode, because if you can't get it in
14:36
airplane mode, it's constantly searching for the signal and
14:40
it's going to die very quickly. Now, we've also heard people say
14:45
for years, like if you can't get the Faraday bag, you can put the
14:48
phone in a paint. Paint can Disclaimer Make sure
14:51
there is no paint in the paint can.
14:54
Right. And then there's the old trick
14:58
of, you know, aluminum foil, the foil lined potato chip bag.
15:03
I think that is your absolute last choice is to use the potato
15:07
chip bag. Again, there should be no potato
15:10
chips in the bag. It should be cleaned out.
15:13
You use what you got. You're trying, but I'm kind of
15:16
mentioning the potato chip bag back-to-back to back in the day
15:20
and conspiracy theories and, and all of that stuff again.
15:23
But hey, you know, get a few Faraday bags, share those around
15:27
and, you know, protect that phone.
15:29
That's the point of all this long conversation here.
15:31
Anyways, continuing back to the testimony, Reno confirmed that
15:35
by 6/15/30 6:00 AM, it could not have been O'Keefe moving the
15:41
phone since he was already incapacitated at that point, and
15:45
that means that any movement registered after that time would
15:49
have been caught caused by someone else handling that
15:52
device. Yeah.
15:53
So the defense then challenged Carino's interpretation of the
15:56
health Apple health data, specifically the step and stair
16:00
climbing entries. He acknowledged that 170 steps
16:05
recorded between 12:11 and 12:21 AM and could not be pinpointed
16:11
to a specific moment within that window, and the same was true
16:15
for the 80 steps recorded between 12:21 and 12:00 24 AM.
16:20
Then regarding the stair climbing data, Greeno maintained
16:24
that Celebrite showed a specific timestamp of 12/20, 2:14 AM for
16:32
ascending or descending 3 floors.
16:35
The defense pressed on whether those stairs could have been
16:37
ascended closer to the start of the time window, which could
16:41
still place O'Keefe at 34 Fairview Rd. shortly after
16:46
arrival. Greeno's position was that
16:49
Celebrite gave him this specific data point and he relied on it.
16:54
Now I reviewed his written report and we'll link to that in
16:58
the show notes, but he does not know a specific artifact or a
17:03
database that he was looking at for that data point.
17:06
But if it's coming from one database, if that database only
17:10
ever contains ascended floors, but if it's coming from a
17:13
different database, then that database can can contain flights
17:19
that go, and that database can contain flights that go either
17:23
up or down. But that database logs the
17:27
actual direction in that record. So regardless if you are
17:32
reviewing the actual raw data from the database, you can make
17:37
a determination if it's up or down.
17:39
It is never ever either or. The tools might just not parse
17:44
it out for you and you might not know what they are telling you.
17:48
That's right. The defense then got Garino to
17:50
agree to two specific statements.
17:53
First, his conclusion was that John O'Keefe could not have been
17:57
at 34 Fairview Rd. at 12/20 2:14 AM because Waze placed him on
18:05
Oakdale Rd. approximately a half a mile away at that time.
18:11
Second, this Waze data led him to disregard or fail to
18:16
attribute the hell Apple health data stair climbing entry to
18:20
O'Keefe at the at the moment. From there, the defense moved
18:24
into another significant area of discussion or testimony, and
18:29
this is the three clock discrepancy in iPhone
18:33
timestamps. They're asking a lot of
18:35
questions about the three clocks.
18:38
So the defense is asking whether the apps on an iPhone can pull
18:42
timestamps from three different clocks.
18:45
Now, when the line of questioning begins, Greenough is
18:48
first thinking based on his to answer more along the lines of
18:51
the way that time is stored on the iPhone, such as in UTC time
18:56
or Mac absolute time. And you have to remember this is
18:59
cross, so you don't know what's coming and you're just, you
19:02
know, let's be real, you're saying the first thing that pops
19:05
into your head. Most of the time they're saying
19:07
clock. He's thinking time.
19:09
And in digital forensics, you really.
19:11
We don't have to spend a lot of time discussing clocks.
19:15
The focus is always has been on time, like what format is it
19:19
stored in? How do I parse it out?
19:22
What time zone are we talking about?
19:24
That sort of situation. But once Garino understood the
19:28
question, he identified the three clocks, and he identified
19:32
them as monotonic date time, the baseband date time, and the
19:36
display date. Time the Defense introduced
19:38
Exhibit 640A, print out from John O'keefe's phone Extraction
19:43
referencing Process 3434, which was identified as a Waze
19:48
artifact. That exhibit showed that the
19:52
monotonic clock read 2:22 AM, while the base band and display
19:58
clocks were 3 minutes earlier. Garano admitted he did not know
20:04
which clock. Waze was using when it placed
20:07
O'keefe's phone on Oakdale Rd. at 12:22 AM.
20:13
And you've got to wonder here if the defense was implying that
20:16
this three minute discrepancy could potentially explain the
20:19
conflict between the Waze location data and the Apple
20:23
health data showing the stair climbing.
20:25
At the time during his testimony, Grito did not agree
20:31
with that conclusion. He attempted to explain that
20:34
Exhibit 640 was coming from the power log file, and that power
20:38
log file has nothing to do with GPS data, but the defense did
20:42
not allow him to fully explain his position.
20:45
So we'll see if the prosecutor caught this and asked him to
20:49
clarify some of this information during the redirect.
20:51
Right. So the defense then moved to ask
20:53
questions about Jennifer McCabe's phone data which became
20:56
a spicy area of the cross examination.
21:00
Reno confirmed he generated a Celebrate full file system
21:04
extraction report from Mccabes phone dated May 31st 22 under
21:10
Celebrate version 7.53 dot 0.29. This report.
21:15
Remember, this is a Celebrate report only, not the actual
21:19
extraction. This defense noted that the
21:22
report didn't contain anything close to a full file system
21:27
extraction, and it had been filtered to return only Jen
21:32
McCabe's communications with Karen Reed, Carrie Roberts, John
21:37
O'Keefe and Kaylee Furbish. Garano said that was not
21:41
correct. He said it was not correct.
21:43
There were a couple of objections from the prosecution
21:47
then. When Garano was asked if the
21:49
full forensic image of Jennifer McCabe's phone was not shared
21:54
with the defense until they requested it in October 22,
21:58
2022, Garano said that was not correct.
22:01
Yeah, I noticed the the lawyers still say like full forensic
22:05
image a lot in this trial. So, you know, we'll have us die
22:08
hard. I don't know if they completely
22:10
understand the difference, but maybe that's why it was not
22:13
correct because they there was no full forensic image.
22:17
I don't know if we're getting, you know, into that tit for tats
22:20
for the situation. But anyways, Greedo admitted he
22:23
did not look at McCabe's phone extracted extraction until he
22:27
was prompted to do so by the Richard Greene affidavit and in
22:31
Garino's April 24, 2023 report. So that's not too far after that
22:35
affidavit was released. That is when he formally and for
22:39
the first time disclosed the three Google searches that have
22:43
been talked about a lot in this trial that came from McCabe's
22:46
phone. And so the 1st 2 searches are
22:48
the how long to die or excuse me, house.
22:52
I got the time stamps mixed up here, but there's two of them.
22:55
So there's the house long to die in cold and then how long TD in
23:01
kick D. And he documented both of those
23:03
in his report. And then he also reported that
23:07
there was a record showing an unanswered call at 6:23 AM that
23:11
had a 0 duration for the time. And then that was found in the
23:16
call history wall file and it was also marked as deleted by
23:21
celebrate. So 1/3 search.
23:23
House Long to Die in Cold was found in the browser State dot
23:28
TB wall file using a newer version of Cellbrite Physical
23:32
Analyzer version 7.61.0.12. That third search at 2:27 AM was
23:40
marked as deleted by Celebrate. The defense also introduced
23:45
evidence of two deleted calls from Mccabes phone to her sister
23:49
Nicole, listed in the context as Coco, one at six 0742 seconds AM
23:56
lasting 9 seconds and one at six O 8:17 AM lasting 7 seconds.
24:02
Both answered and both marked as deleted by Celebrite.
24:07
The defense then pressed him to admit that neither of those
24:10
searches was provided in his April 24th 322 report.
24:16
The defense pressed Carino. On whether these items were
24:20
marked as deleted and he confirmed that they were, but he
24:24
was attempting to explain the context behind the deletion
24:27
markings, but the defense redirected him to simply confirm
24:31
what the label said and if the label said deleted.
24:35
The defense also showed him a document on a laptop which
24:39
Greeno said was incomplete and he had not created that PDF and
24:43
he and that that PDF had no source and the defense pointed
24:47
out that his name was on it. Greeno clarified that his name
24:50
would appear because he generated EU Fed extraction, but
24:55
he stated he did not not personally create that
24:58
particular document. So this seems like another good
25:01
point regarding the items being marked as deleted, that should
25:06
be revisited during the redirect.
25:08
So we'll see what happens last examination.
25:10
Closed with questions about Karen Reed's phone data You know
25:14
confirmed that no phone calls were deleted from Reed's phone
25:17
on January the 29th, 2022 between 12:00 AM and 4:30 AM.
25:23
She called only her parents two or three times and she conducted
25:26
did no Google searches between 12:00 AM and 5:00 AM.
25:30
Now, Garino did note. That several Google searches
25:33
were deleted from Reed's phone in the afternoon of January, but
25:38
confirmed there were no deleted calls.
25:39
And he stated that he received a version of Reed's phone report
25:44
from the AG's office, but he could not speak to what had been
25:48
redacted from it. Now we moved to the.
25:50
Redirect, which was conducted by the prosecution.
25:54
The Commonwealth gets a chance to clarify anything that came up
25:57
during the cross examination. Carino's qualifications came up
26:01
again briefly and he outlined his certifications in cell phone
26:05
report creation, extraction and cell phone Repair.
26:10
Burla Motor Vehicle Forensics and an advanced Celebrate
26:14
database course called Casa, which covers deeper database
26:18
searching on the question of the.
26:20
Phone recovery and the chain of custody.
26:23
O'grono was asked about it and he stated he doesn't know who
26:25
recovered O'keefe's phone that morning.
26:27
He only knew that it was found underneath O'keefe's body and
26:30
that it was then taken to Canton PD.
26:33
So I mean, if he knows that, then again, that's why he's
26:36
saying on scene. Makes sense to me personally.
26:39
The prosecution then. Asked about location data after
26:42
6:15 AM, Garino stated he observed intermittent native
26:47
locations, meaning original on device file path data parsed by
26:52
Celebrate, showing the phone at Canton PD for a handful of data
26:57
points. Then back at the office, when he
26:59
placed it into the Digital Evidence Lab and powered it on,
27:03
no GPS locations appeared from approximately 11:00 AM until he
27:08
received the phone at 7:30 PM on the 29th.
27:12
OK, so it looks like at. Some point they did some extra
27:15
steps and got the GPS location data to stop logging disabled
27:21
what have you. So that's great that they got
27:23
that fixed. Now, regarding the airplane
27:26
mode, they testified about, you know, the fact that it was
27:29
placed in airplane mode at some point, though Greeno couldn't
27:32
recall whether Trooper Proctor had done so before handing it
27:36
off or whether he did it. It would seem to me that perhaps
27:40
it was done before Greeno received it since the there were
27:46
no more locations logged at 11 AM.
27:49
And then they had some discussion about who in his unit
27:52
perform cell phone extractions and Greeno noted that it was
27:57
only himself and one other trooper that performed the data
28:00
extractions and forensic analysis of the cell phones.
28:03
Now there are other troopers that they have been trained in
28:07
celebrate and how to use the reader reports and things like
28:10
that, but it sounds like the actual extractions and probably
28:15
even the analysis is delegated to Garino in most cases on the
28:21
question of. Data integrity.
28:22
Garino explained that manipulating extracted data
28:25
would require entering the folders and deleting files,
28:29
which would alter all associated data and likely cause the
28:33
extraction to break. All extractions are stored as
28:36
encrypted files on a server, allowing reports to be recreated
28:40
if needed. He observed no manipulation or
28:43
deletion in the encrypted files in this case.
28:46
He also did note that. They did not have the passcodes
28:49
for the phones initially, not for O'keefe's phone, they didn't
28:52
get that until the 31st of January.
28:54
And then for McCabe's phone, they didn't have that until
28:58
August and they didn't get that until the programs that I
29:02
believe it was Gray key was able to determine what the passcodes
29:05
were to get into those phones, the prosecution.
29:08
Asks Carino to walk through his review of Richard Greene's
29:12
affidavit. He explained that he had not
29:15
gone through the phones in detail because he was not as
29:18
familiar with the case details as the investigators were.
29:22
Once he received Greene's report, he went through it step
29:26
by step, confirming each claim or determining why it was
29:30
correct, partially incorrect, or misinterpreted.
29:33
He also stated that in. Reviewing the data, he ended up
29:36
consulting with Chris Vance of Magnet Forensics.
29:39
He said he was a head forensic specialist there and they were
29:43
discussing this at a cybercrime conference.
29:46
He showed Vance what he was seeing and asked why it was
29:50
being marked in a certain way now.
29:52
An injection came along and prohibited Greeno from sharing
29:55
what Vance told him now. From there, Greeno contacted
29:58
Celebrite and then this whole entire matter was eventually
30:02
contracted out to Jessica Hyde, who had already testified as a
30:06
third party to examine the data. And it was also escalated to Ian
30:11
Whiffen of Celebrate. And Ian Whiffen also testified
30:15
in this case before Trooper Garino as well.
30:18
But basically these two other examiners were brought in
30:22
because in my opinion, it seems to be because of that 2:27 AM
30:26
alleged search for the house long to die in cold that was
30:29
found on McCabe's phone. Now, nothing was really said in
30:33
open court as to why. So you've got to draw some
30:38
conclusions there based on what they testified about.
30:41
Now, what was the strategy behind it?
30:44
Did the state want the additional examiner's to bolster
30:46
their case since they disagreed with Green's conclusion?
30:50
Did they feel it would be more powerful to have someone from
30:53
celebrate saying that they disagreed with conclude with
30:56
Greene's conclusions regarding that 2:27 AM search of House
31:00
Long to die in cold Again, some of these are decisions that are
31:03
being made as part of the prosecution's strategy.
31:07
What do they feel they need to be said and shown in the
31:12
courtroom in order to demonstrate that Karen Reed is
31:15
guilty beyond a reasonable doubt?
31:17
The health data is. Discussed once again, Garino
31:20
clarified that the steps category in Apple Health data
31:24
indicates the phone detected movement, not necessarily that
31:28
actual steps were taken. He stated that an Apple Watch
31:32
pair to the phone would provide greater accuracy me because it
31:36
would also record heart rate, which would correspond with
31:40
elevated step counts. Then when asked why?
31:43
He looked just beyond the health data.
31:46
Gruno explained that all the artifacts, GPS points, and the
31:50
health data need to be considered together as a a
31:52
whole. He notified or he noted that one
31:56
artifact might suggest one thing, but five others could
32:00
contradict it, which is why everything is reviewed
32:04
collectively now. I love the fact that he got to
32:06
say this in open court. You can't just look at 1
32:10
artifact in isolation. We've said that before, we'll
32:13
say it again. We're saying it now and we'll
32:14
keep saying it, but you have to examine the totality of the
32:19
evidence and the artifacts, in your case, the GPS.
32:23
Data indicated that O'keefe's phone arrived at 34 Fairview Rd.
32:28
at 12:25 AM. The prosecution then addressed
32:32
the document the defense had introduced, which showed three
32:35
different timestamps which the defense had suggested were
32:38
related to ways. We now clarified that these
32:43
timestamps came from the power log file, a database tracking
32:47
battery levels and power consumption, and it had nothing
32:50
to do with the Waze navigation or GPS positioning.
32:55
The power log showed O'keefe's phone never turned off.
33:00
Overnight, the battery dropped to approximately 17%, and Carino
33:04
noted that the phone being under O'keefe's body actually helped
33:08
preserve it from dying. The timestamps in that document
33:12
reflect when and the phone was plugged in and charging, and the
33:16
entries show only that Waze was drawing power from the phone,
33:21
not when it was opened or when an address was entered.
33:25
Now regarding. This celebrate software
33:28
versions. The prosecution asked Greeno to
33:31
explain how differences in versions affect what is visible
33:35
in the reports. Here's the keyword reports now.
33:39
Greeno's initial report was created using version 7.53 and
33:45
it did not parse the house long to die in cold search that it
33:48
was logged a timestamp of 2:27 AM from that browser state dot
33:53
DB wall file. Now Celebride informed him that
33:57
starting in version 7.55, that's when the capability to parse out
34:02
that record from the browser state dot DB was first enabled.
34:07
Now, defense expert Richard Green used version 7.61.0.12,
34:14
which is why the artifact appeared in his report, but not
34:18
in Garino's original report that version 7.61 was not available
34:25
at the time that all of these initial extractions and initial
34:30
reports were being generated. They said it came about 10
34:34
upgrades later. So when Greeno reloaded his
34:37
extraction in version 7.53, the artifact was still not present,
34:41
but when he loaded it in version 7.61, it was present.
34:46
Greeno's opinion? On the timing of the caves
34:48
Google searches was that they occurred at 6:23 and 6:24 AM
34:54
with a 3rd at 10:35 AM, not at 2:27 AM as the defense
34:59
suggested. He stated it is physically
35:01
impossible to search for two things simultaneously.
35:04
McCabe's phone so she was searching for about her
35:07
daughter's basketball team and listening to music.
35:10
He stated his belief that the searches attributed to the
35:13
defendant's request occurred a few hours after 2:27 AM,
35:18
consistent with what McCabe herself described now regarding
35:23
the wall. File and the deleted call log
35:25
entries. Greeno explained that the
35:27
entries marked as deleted in a wall file are removed
35:32
automatically by the system, not by the user.
35:35
And this happens either when the program closes or when a maximum
35:40
data allowment for that page is reached.
35:43
So he's restating the stuff that he said originally in his direct
35:48
testimony regarding the the wall files and how they work.
35:52
Now regarding the calls to the contact listed as Coco and
35:56
McCabe's phone, Greenough stated that there should be two
35:59
additional locations in the database where those calls
36:03
appear. He did not believe that this
36:06
deletion was user initiated and characterized it as phone
36:11
initiated because of the wall files first in first out process
36:17
that it uses to redirect closed. After the on lunch break, with
36:20
Greeno confirming he was the only one who created celebrate
36:24
extractions in this case aside from the AG's office, he
36:28
confirmed that deleted material was found on defendant's phone
36:33
from the afternoon of January 22.
36:35
Specifically, search items were not present on the phone itself,
36:39
but cookies related to those searches and the websites
36:42
visited were recovered. The deleted content pertained to
36:46
search terms and web browsing history.
36:49
And it was is the cookies related to those searches and
36:52
visited websites that were found?
36:54
Yeah. So this is the.
36:55
Conclusion of Garino's testimony in the first Karen Reed trial,
37:00
we've discussed all all three portions of it, right, the
37:03
direct, the cross examination and the redirect.
37:07
Becky, looking back on all of his testimony, is there anything
37:11
you want to loop back around to to kind of dig into a little
37:15
more or just food for thought? Yeah, so.
37:19
You know, to educating our listeners about just being aware
37:24
how the justice system works and the court strategies work and
37:29
how you will be asked questions on direct.
37:32
And then you have a cross examination and don't get
37:35
frustrated and aloof and defensive because your
37:41
prosecutor will come back around and redirect and ask questions
37:45
to clarify some things. And just understand that, you
37:50
know, they, that part of the strategy is still trying to
37:54
attack someone's education. Even though, like you said early
37:58
on, we see so many of courses being offered completely online,
38:03
very well taught online does not, should not minimize the the
38:08
education that people receive just because it's taken online
38:11
instead of in person. And just to be don't put.
38:15
I don't know. What his CV said, but just don't
38:17
put that utility. Took it online.
38:18
Just listening with the class right?
38:20
Exactly that solves. That problem for everybody.
38:22
Right, sure. Now for the title, because like
38:25
you know, we have a couple of different virtual summits going
38:28
on right now and you know the title of it is Virtual Summit.
38:31
So obviously you can't change the name of that.
38:34
But if you're taking a regular course, like a week long course,
38:38
don't put that you took it online and that just eliminates
38:40
that, right? It doesn't matter how you
38:44
received it, no matter where you were sitting when you did it.
38:48
Education is education. And if you learn something from
38:51
that education, you take something from that education
38:54
and you know, work it in to what you do on a daily basis, then it
39:00
it shouldn't be minimized. Yeah, yeah.
39:02
And I think. Our digital forensics community
39:04
is really great about getting the facts out to everyone else,
39:08
and they don't want everything behind a paywall.
39:12
So there are lots of free opportunities.
39:15
That's why they have these virtual summits because even
39:17
though a virtual summit might be put on by a vendor is, you know,
39:21
by far examiners out in the field doing actually actual
39:25
work. And they are coming on to
39:27
present information and research.
39:29
And it's all driven by the fact that they had to figure out
39:32
something for a case. And so now they're here to share
39:36
what they figured out. So you don't have to repeat
39:39
those same steps and go through all that time.
39:42
It's a lot more time effective. And again, it's helping make
39:45
sure as an as an industry, as a forensic science discipline,
39:49
that we are getting things right, right and and that.
39:53
Continues our education, right That's part of part of your you
39:58
know, credentials is your continuing of education.
40:02
And so there's nothing wrong with taking courses online.
40:05
And so sometimes you just have to sit through and let the
40:09
defense attack what you have and you cannot minimize it because
40:14
it's as important as, you know, a four year.
40:18
College and going and attending every class in person.
40:22
It's still important, yeah. Well, and of course, once the
40:26
tables are turned and, you know, the defense is bringing up their
40:30
primary witnesses and doing their direct examinations, the
40:33
prosecution is going to come back and do the exact same thing
40:36
when they cross examine that, which they're just going to be
40:39
like poke, poke, poke, poke, poke because they're trying to
40:42
just draw attention to, you know, like mistake, mistake,
40:48
misattribution. You know, they're just trying to
40:50
be like, oh, look, you know, I think they're just the strategy
40:53
is to get people to think there's a mistake, another
40:56
mistake. Oh man, they're messing up all
40:57
the time. Like how reliable is anything
41:00
that they're doing? And so that's that's just their
41:02
job. Both sides do it.
41:03
So I mean, we're just talking about Greeno's testimony here.
41:06
So in this case, it was the defense trying to poke holes and
41:10
everything that he did. That's right all.
41:12
Right, well, if you are enjoying these episodes, please leave us
41:16
a review wherever you are. It really helps us to expand our
41:21
reach. And until next time, stay safe,
41:24
stay sharp, and as always, keep parsing the truth one bite at a
41:27
time. If you enjoyed this episode,
41:31
make sure to follow us to get notified the next time a new
41:35
episode drops. If you can do more, head on over
41:38
to parsingthetruth.com and donate by clicking on the donate
41:42
button. Parsing the Truth is a nonprofit
41:45
organization and we are raising money to send a new digital
41:48
forensic examiner to I Asus training next year in Orlando.
41:52
Thanks. Yeah.
41:57
Yeah, yeah, yeah, yeah, yeah, yeah, yeah.