Latest / Parsing the Truth: One Byte at a Time / More with Larry on the Thing About Pam

Transcript

More with Larry on the Thing About Pam · Parsing the Truth: One Byte at a Time

• 0:01
  Join former FBI Senior Forensic Examiners Becky Passmore and
• 0:05
  Stacey Eldridge as they dig into the world of digital forensics
• 0:08
  one bite at a time. Now leading their own consulting
• 0:11
  firms and educating the next generation of cyber sleuths,
• 0:14
  these badass babes of digital forensics bring sharp insight,
• 0:18
  real world case experience, and a dose of humor to the bits and
• 0:21
  bites that filled today's investigations.
• 0:23
  From deep dives into business e-mail compromise and ransomware
• 0:26
  attacks, Becky's specialty to cracking the complexities of
• 0:29
  iPhone forensics, Stacy's obsession, this podcast delivers
• 0:33
  insider knowledge for professionals, students, and
• 0:36
  true crime techies alike. If you've ever wondered what
• 0:39
  really happens when the digital trail is all that's left, TuneIn
• 0:42
  and start parsing the truth. Welcome back to Parsing the
• 0:53
  Truth One bite at a time. We are continuing our
• 0:55
  conversation with Larry McClain this week in our Thing about
• 0:59
  Pam's series. This is episode 4.
• 1:01
  If you haven't caught episodes one through 3, go ahead and
• 1:05
  check those out. We are starting back up with
• 1:08
  what did the police find out when the fingerprints came back?
• 1:12
  TuneIn now. And the phone rings like, yeah,
• 1:14
  the Prince come back and the the suspect who was killed by the
• 1:19
  victim. Because remember, that's what we
• 1:21
  think at this time. Pam up is a Lewis Gumpenberger.
• 1:24
  Well, Gumpenberger is not Smith. Right, that's a little.
• 1:27
  Bit unusual name and. It struck my head like I know
• 1:30
  that name, I know that name. They know that name.
• 1:33
  So I I used our favorite forensic non forensic.
• 1:36
  Tool. I googled it and I realized I
• 1:39
  knew the name. Because years ago, he was
• 1:41
  driving intoxicated. Mr. Gumpenberger crossed the
• 1:43
  center line, hit a car, which hit another car, which hit
• 1:46
  another car. That third car happened to be an
• 1:49
  FBI car. And so there was a civil suit.
• 1:51
  And field office called me one day and said, hey, we have this
• 1:55
  accident. The guy's name is Gumpenberger.
• 1:57
  You know, his vehicle's at this tow yard.
• 1:59
  Can you go out and take some photos?
• 2:01
  Because the name was so unusual, it stuck in my head and then
• 2:04
  when I. Googled it.
• 2:05
  I We discovered immediately that because.
• 2:08
  Of that accident, Mr. Gumpenberger really had, I
• 2:11
  think, the functioning mental capability of a of a 12 year
• 2:14
  old. He was still very keen like.
• 2:16
  He couldn't walk long distances. He he really needed care out of
• 2:20
  line is he was completely incapable of planning and
• 2:24
  executing the crime as we was being presented to us.
• 2:27
  So that was our first like, oh, that and a 911 call.
• 2:31
  Something right, something right?
• 2:33
  But how do you know two stars collide?
• 2:35
  Think about it. What's the Yeah, except for
• 2:37
  cameras. For them best.
• 2:39
  Easiest crimes to get away with. Easiest strong term.
• 2:43
  But if you kill someone randomly that you have no connection to,
• 2:46
  you just pick them out of a hat. That's a hard sound.
• 2:49
  That's a hard investigation. Before it used to be.
• 2:52
  So how did these two stars collide?
• 2:55
  How did they come together? If this story isn't working out?
• 2:57
  And when we plot that geolocation information, sure
• 3:00
  enough, Google Earth opens up in one little pen.
• 3:04
  Out of Mr. Gunpenberger's apartment.
• 3:06
  And was there. For a period of time.
• 3:08
  So to make a Long story short, we think she was driving areas
• 3:12
  looking for someone to lure to the dust.
• 3:14
  She had a whole scheme. She was pretending to be a
• 3:16
  Dateline NBC producer and she would ask them if they would.
• 3:20
  Come and record a 911 call fake 91 call as an actor and they
• 3:25
  would be paid a. $1000 The only reason we know this is she tried
• 3:29
  it before then and the person who was going to be the victim.
• 3:34
  Got in the car and started to go with.
• 3:36
  Her. And then had her turn around,
• 3:39
  jumped out of the. Car and said I want nothing to
• 3:41
  do with it. Now, now when you know I don't
• 3:43
  want to be involved. This her spider sense.
• 3:45
  Went off. It was a woman in Carol.
• 3:46
  Alfred in her Spidey. Sense went off and she's like,
• 3:49
  this ain't right, this doesn't feel right.
• 3:51
  So she, you know, Pam Hub's driving around her neighborhood.
• 3:54
  She lives in a mobile home. Community Pam Hub pulls up.
• 3:56
  Hey, you got a minute? I got a minute.
• 3:58
  How'd you like to make $1000? Yeah, I'd like to make $1000.
• 4:03
  Well, I'm a producer with Dateline.
• 4:04
  NBCI think she even used the real producer's name, her own
• 4:09
  face from Betsy's and, you know, gets in the car.
• 4:13
  They began to drive. She's really feel nervous.
• 4:15
  In fact, I. Don't know if this comes out
• 4:17
  anywhere. But she told me that she grabbed
• 4:19
  a knife and had putted up her hoodie.
• 4:21
  And anyway, they're leaving the trailer, the mobile home
• 4:24
  community, and she's like, yeah, I tell you, I forgot to do
• 4:27
  something for my dogs or lock my door or whatever.
• 4:29
  So they turn around and they go back.
• 4:31
  She jumps on. She's like, you're a weirdo.
• 4:32
  Get out of here, lady. But she had a camera.
• 4:35
  I mean, I think she points to the camera and you see Pam like
• 4:37
  freaking Outback up and getting out of there.
• 4:39
  But it gets to the plate. She.
• 4:41
  It's clear that video is still out there.
• 4:43
  Now she called the county Police Department.
• 4:46
  She lived in the county, and they came out and took a little
• 4:48
  informational report. Like that's weird.
• 4:50
  What? It was a road guy.
• 4:52
  He goes by the house, knocks on the door, no one's home.
• 4:55
  And then nothing ever became of it.
• 4:57
  There's no crime that's been committed.
• 4:59
  It was just some odd circumstances.
• 5:00
  Not. Saying either way, whether that
• 5:02
  was right or wrong. But after the Mr. Guttenberger's
• 5:06
  killed and everything's blowing up on the news and there's
• 5:09
  cameras everywhere, the deputies like good boy, you know, and he
• 5:13
  calls one of his detectives who calls us.
• 5:15
  That's how we put it together. And I happened to be there.
• 5:18
  We. Brought Miss Alfred in and she
• 5:20
  was an incredible witness and we did a photo lineup and and sure
• 5:23
  enough, she picked Pam out like that.
• 5:27
  But anyway, they kind of. Digressed I think on you guys a
• 5:30
  little bit, but. The the the initial thing is, so
• 5:32
  we knew from Miss Alfred, we believed.
• 5:35
  That what Pam's telling us is not right.
• 5:38
  This is she's not a. Victim.
• 5:39
  We don't know for sure. We got to still treat her like
• 5:41
  1. She's free, she's out there
• 5:43
  doing whatever. And so we're waiting on the
• 5:46
  search warrant. We plan the search warrant.
• 5:48
  And when that geolocation that died, that Latitude 1, she
• 5:52
  dropped on Mr. Gunfenberger. I've told the story.
• 5:54
  Before, but I'll tell it to you guys.
• 5:56
  You know, I'm in the lab and it's kind of like this evening.
• 5:58
  So I'm sitting in there in the lab and I've you know, I've got
• 6:02
  I've got 3 forensic machines. We're spoiled.
• 6:04
  Don't hate the player, hate the game right?
• 6:06
  I've got like 2 threads and another HTCI but you know, I've
• 6:10
  got machines going and laptops time.
• 6:12
  So the you know the. Big Blue ball.
• 6:14
  Comes up and the pins drop and then I look at the pin and I
• 6:18
  real, I literally, I'm like, it's right on Mr. Gumpenberger's
• 6:22
  apartment. So Mr. Gumpenberger had this
• 6:24
  traumatic brain injury, and according to his mom, his poor
• 6:27
  mom, he would just when he wasn't, he worked at a.
• 6:30
  Place that gave jobs to people with disabilities named like
• 6:33
  pack boxes. But when he wasn't working, he
• 6:35
  just kind of sat out front, you know?
• 6:37
  Plastic launcher just smoking all day and you know there was
• 6:43
  this chair you can sit on Google.
• 6:44
  Earth, I think. My memory.
• 6:47
  And so now I got the pin right there.
• 6:49
  But my point to it is I immediately looked at that.
• 6:52
  How did these two stars completely unconnected collide?
• 6:56
  And now I knew, I knew. And it was a moment I never
• 7:00
  forget this. I got goosebumps talking about
• 7:02
  it. I.
• 7:03
  Leaned. Back in my chair and it was like
• 7:06
  8. At night or something.
• 7:07
  I was the only one that I we of course.
• 7:09
  You're the only one in the lab. I mean, we're working at non.
• 7:12
  Stop. You know I'm.
• 7:13
  Working at work and I got to find something, you know, make
• 7:16
  sure this is right. Is she a victim?
• 7:18
  Is she not? And I just sat back and I hate
• 7:22
  to say I took a victory. Lap.
• 7:23
  But I did. I sat.
• 7:24
  There for a minute and I'm like, I know no one else knows.
• 7:28
  But I know shame, shame. I know your name.
• 7:31
  Like you did, and you went and found this guy just like you
• 7:35
  tried to do to Kelford. And I can prove and I sat there
• 7:39
  for a minute and then I picked up the phone and I called back
• 7:42
  to the PD because remember, our lab is the joint lab separate in
• 7:46
  the same city but different building hosted at the county
• 7:49
  police. Department and I have my
• 7:51
  Lieutenant picks up the phone and it happened to be having a
• 7:54
  meeting on the case. They got the whiteboard and the
• 7:56
  strings and their war room in it.
• 7:58
  We got people running everywhere and and I said, hey you.
• 8:04
  Is every where's everybody at? And he said we're all in here.
• 8:06
  We're actually, you've just interrupted or we're having a
• 8:08
  briefing. Not a briefing I needed to be at
• 8:10
  because I was doing my thing. And I said I'm going to send you
• 8:12
  a. Picture because I screenshotted
• 8:14
  him and you know, it's funny, I find myself getting a little
• 8:19
  quite emotional. But looking back, it was a very
• 8:21
  proud moment for me because we'll just take it away, but
• 8:24
  you'll get it in a funny way. So I'm sending you something.
• 8:26
  I want you to open this e-mail. And I sent that screenshot with
• 8:29
  that pin right on his apartment, and they knew what I was
• 8:31
  working. And he goes, yeah, hang on, let
• 8:34
  me get my e-mail. And he wasn't.
• 8:36
  He tells me I'm not as tech savvy, You know, he's trying to
• 8:38
  figure it out. And he clicks on it in a massive
• 8:42
  chew. I mean just like.
• 8:45
  Holy and then my Lieutenant said about time you did something
• 8:50
  because you know the joke was we go to so much training.
• 8:53
  I was gone. They they acted like I never was
• 8:56
  there working. You know, they're like they'd
• 8:58
  call because I didn't always tell them.
• 8:59
  They're like, where are you at? I'm in Alabama.
• 9:03
  I've been here for once. You know, like what you know,
• 9:06
  like so. So yeah, my boss acted like I
• 9:09
  just went to training all the time.
• 9:11
  But to be honest and, and he was they they knew.
• 9:14
  That's why we go to training all the time.
• 9:16
  Because when the big one happens, you're like, I know
• 9:19
  what to do and so. We could show that the stars.
• 9:22
  Aligned and then. Really.
• 9:24
  You know we're talking. About the digital.
• 9:25
  Evidence there was so. Much digital evidence.
• 9:28
  I mean, so much evidence. It was a great team effort.
• 9:31
  There was physical evidence. There's just a ton of evidence.
• 9:34
  It would take days to tell, tell the story or episodes to tell
• 9:37
  the story. But the really that mobile
• 9:40
  device because she either had it in her hand when she called 911.
• 9:43
  And when she was driving around, it was in that cup holder and.
• 9:47
  That. Was what?
• 9:48
  Allowed us to tie and then just on the phone piece because we
• 9:53
  could tie that in and as soon as you see that Jill, you know, we
• 9:56
  see her driving. All driving all.
• 9:59
  Over and then we see her in the gum and burger location and then
• 10:06
  immediately it goes from there right back to the house.
• 10:11
  Straight to her house. That comes up.
• 10:14
  I'll get to that in just a second, but that's going to
• 10:16
  become important. But we can take her right to the
• 10:18
  house. We we can track that and that's
• 10:20
  going to become important for some video evidence.
• 10:22
  If you help remind me. But but the other thing was now.
• 10:25
  I had her drive around now we had.
• 10:27
  Miss Alford said she tried to get me in the car and said the
• 10:30
  same stuff, you know, kind of thing.
• 10:32
  So now. That was six days before the
• 10:34
  murder is when she went and tried to get Miss Alford.
• 10:36
  Now, we're going to share with you Carol Alford's call to the
• 10:40
  police after she managed to get out of Pam Hupp's SUV.
• 10:44
  And we're also going to share the video footage from her
• 10:48
  security camera system. And I was just out with my dog
• 10:56
  and I had a lady right by my house.
• 10:59
  She waved at me and then she drove across the street into the
• 11:01
  court and come flying back to my house.
• 11:04
  And she asked me, she says, do you babysit?
• 11:06
  I said no, I don't like this and she says oh, and she's like,
• 11:11
  well I'm from date night and we're doing paying your
• 11:14
  neighbors, you know, driving within your neighbors to pay
• 11:16
  your neighbors $1000 just to do a sound clip of 911 recordings
• 11:21
  which didn't match with what? Anything with what she asked me
• 11:23
  about babysitting wanted me to actually get into her car and
• 11:26
  not tell anybody was wearing so or bring my cell phone and drive
• 11:30
  out of this neighborhood of cars.
• 11:31
  Make $1000 to do a 45 minute cell for 911 sound bite for
• 11:37
  them. She seems really creepy.
• 11:39
  So I actually I got in a car because like I I know martial
• 11:41
  arts. I can defend myself against this
• 11:43
  stupid lady that her car and then when she's like, oh, we're
• 11:45
  only going a block or two overstock leave My neighborhood
• 11:48
  is Oh, crap. I left my door and lock.
• 11:49
  She drove me back. I came in my house and I can't
• 11:52
  went back out. I'm like, I'm sorry, I can't
• 11:53
  help you. I have to go pick up my son from
• 11:55
  work. Then she's going to come back to
• 11:57
  my house. Wanted me to get in the car to
• 11:58
  drive me down to Saint Louis to supposedly pick up my kid who's
• 12:02
  actually down the street of the friend's house.
• 12:04
  He's driving on a neighborhood trying to pick up people.
• 12:06
  Is she currently in your neighborhood?
• 12:09
  It's currently in my neighborhood and I have her and
• 12:11
  her vehicle and license plate number on my security.
• 12:13
  OK, which that's why I had her pull my, my name is Carol.
• 12:17
  I actually had her pull into my driveway so I could get this
• 12:20
  stuff on my on my DVR recorded security system because if
• 12:25
  somebody goes get missing in my neighborhood because of this, we
• 12:27
  will not. Forget it.
• 12:28
  Yeah. So now what can I do with my
• 12:30
  search warrant? I can do a piggyback.
• 12:32
  I can expand that time frame and I expand the time frame and I
• 12:36
  could she she spent a lot of time driving around these lower
• 12:38
  socioeconomic areas. My assumption is she's trying to
• 12:41
  do the hey, I'm a Dateline NBC producer in Lorem.
• 12:45
  But the one thing I kept laughing about is that she kept
• 12:49
  going to she loved Dollar General.
• 12:51
  Oh my God, General constantly like Dollar General.
• 12:54
  Here's another Dollar General. I'm plotting Dollar General.
• 12:56
  Dollar General and one of our detectives, not a cyber guy, but
• 12:59
  on the team Rusty went. He kept hearing me talk about
• 13:04
  another Dollar General. She lives Dollar General.
• 13:05
  And he went, he ran down to Dollar General with another
• 13:08
  detective and what they found was several days before the
• 13:12
  homicide she had purchased several things that then show
• 13:15
  up. The most important one is the
• 13:17
  knife she batted away was a very odd, weird, cheapo knife, Poly
• 13:20
  Dollar General Sales. And so he put that together with
• 13:23
  the geolocation. We were able to tie together
• 13:26
  from geolocation not only Mr. Guppenberger being picked up and
• 13:30
  going, but also. Her going to Dollar General,
• 13:33
  purchasing the knife and the other things and it was just all
• 13:36
  tied together by incredible investigative work by our team
• 13:40
  that the here and me talk about Dollar General, Dollar General
• 13:43
  and going down there and and putting all that together so.
• 13:47
  That way and then the the other. Thing was, when I say digital
• 13:52
  evidence, you should go Ding and hear the bell.
• 13:54
  So you heard a cell phone. She calls 91, got a cell phone
• 13:56
  Ding. Now I know Cloud Cloud's going
• 13:58
  to be associated cell phone Ding.
• 14:00
  I said she'd drive around in GMC Acadia.
• 14:02
  Ding what? What time?
• 14:04
  It was brand new at the time. This is not easy, but I found
• 14:08
  AGMC master mechanic in our county and had that thing
• 14:12
  removed by a professional GMC master mechanic and because
• 14:17
  Berla wouldn't support it at the time we're talking about the
• 14:20
  infotainment center being removed from the vehicle, we
• 14:23
  didn't have the capabilities. So we had Berla and all that,
• 14:25
  but it didn't have that capability at that time.
• 14:28
  That was shipped off to Quantico and contractors working up
• 14:32
  Quantico worked at it. They couldn't do it.
• 14:34
  I had that master mechanic also removed the OnStar.
• 14:38
  And ship that. Off they don't keep.
• 14:41
  Anything worthwhile at that time that played out either?
• 14:43
  So that was like a but I'm telling you.
• 14:47
  I was hoping you were going to say that you found something
• 14:49
  amazing with OnStar. I was waiting for it.
• 14:52
  So, you know, we did. This.
• 14:53
  Sometimes that's the way it goes.
• 14:55
  You think? There it is.
• 14:56
  And then, well, maybe we can't get it.
• 14:59
  We don't have the ability. Doesn't mean we can't.
• 15:01
  Maybe. A year from now, or two years or
• 15:02
  whatever, But then the other thing too.
• 15:04
  Is we did do another search warrant on that phone because
• 15:08
  remember when I initially did the phone, I did another consent
• 15:11
  and we handed it. Right back to her and then I go
• 15:13
  to all my search warrants. But now that we know so we spent
• 15:16
  about a week I mean nobody slept It was it was really you know,
• 15:20
  I'm really proud of everybody and you'll see this in law
• 15:22
  enforcement. You guys have seen it, but.
• 15:24
  We were. Making people go home and they
• 15:26
  were mad about. Because they were just falling
• 15:28
  asleep at their desk. Like go home, get some rents.
• 15:30
  They didn't want to leave. They didn't want to miss
• 15:31
  anything. But.
• 15:32
  Once it took us about a week, but we put it all together and
• 15:35
  then we had a big meeting with the prosecutor.
• 15:38
  And this is like, you know, this is one of those points of my
• 15:40
  career I look back on and I love this, this hyper game.
• 15:43
  I love digital evidence because we walked through the whole case
• 15:46
  and my prosecutor who got it is in this meeting.
• 15:48
  Everybody's there and he looked. At me and he goes, Larry, how
• 15:51
  confident are and he goes would you do this like absolutely.
• 15:55
  So, you know, to be invested and asked from the prosecutors,
• 15:59
  putting his name on it. And what he's putting his name
• 16:02
  to is we, we got an arrest. Form.
• 16:05
  About a week later, I had went to the courthouse, got another
• 16:08
  search warrant for the phone, right.
• 16:10
  So what happened is we waited for her to leave her house
• 16:12
  because every morning she got up to get a soda.
• 16:15
  I think Renee Zellweger kind of makes a thing of the soda all
• 16:17
  the time, which is accurate, and she's leaving to go get her
• 16:20
  soda. And we took her down on traffic.
• 16:22
  They put her in handcuffs, they put her in the back of the
• 16:24
  patrol car. She wears up almost immediately.
• 16:27
  And then I go right in there and grab that Samsung that I had had
• 16:31
  before back out of the cup holder to rework it again,
• 16:35
  nothing really incredible to say about that second exam, just
• 16:40
  more of the same. So she didn't use that.
• 16:42
  But I will tell you that that with this case, look at I'm
• 16:46
  seeing photos that they took of that house.
• 16:48
  She has an office. And in that office in front of
• 16:52
  the desk is The Dirty carpet with that clean square right
• 16:57
  under her desk where that tower is missile.
• 17:01
  So there's a tower that was there that wasn't there when
• 17:04
  that house side happened. And I always think about that
• 17:06
  tower, man, I wouldn't and I did work and track trying to track
• 17:10
  down where it was. It's been a lot of information,
• 17:12
  but. Gone to history.
• 17:14
  Yeah, yeah. That's, that's, that's
• 17:17
  interesting that the computer tower was gone.
• 17:19
  I mean, there's a clean spot on the floor.
• 17:21
  Clearly there's an imprint. Where did it go?
• 17:25
  Yeah, there was. There was a little bit of.
• 17:26
  Information that went to Best Buy for for some service and I
• 17:29
  might have went to her son's house and we went there.
• 17:32
  And so I spent a lot of time. Chasing this tower just never,
• 17:35
  never materialized. Just Yeah, for sure.
• 17:37
  Yeah. So would the capabilities of
• 17:39
  today's tools have made a difference in your case or in
• 17:42
  this? Case.
• 17:43
  Well, it would have cut into my overtime.
• 17:45
  Because it would have made it much more.
• 17:47
  Shame. No, it's all about justice, you
• 17:51
  know. Yeah.
• 17:52
  First of all, search warrant return.
• 17:53
  Capabilities, the ability to process cloud data within
• 17:56
  forensic tools, of course, mine is is axioms, my main driver and
• 18:01
  that's where I work. So with just using the warrant
• 18:03
  return capabilities to ingest it.
• 18:04
  But we have it's not new, but I don't know if you guys are
• 18:07
  familiar with Axiom route view. Yeah, route view.
• 18:11
  Think about what I did with Google Earth.
• 18:13
  I could have just done the route view and I could have recorded
• 18:16
  it and I could have speed it up and slowed it down and you know,
• 18:19
  that would have made. A world of difference in dealing
• 18:21
  with. That you know what I haven't
• 18:23
  mentioned like. We did the cell tower records
• 18:26
  any electronic search warrant you can think of.
• 18:28
  I only mentioned that the the highlight ones, but I I wrote
• 18:32
  paper Diamine specs paper. I killed a lot of trees, sorry.
• 18:37
  Yeah, the the the tools today certainly route view, but but
• 18:41
  any of the tools? Processing capabilities because
• 18:44
  at that time the tool was Internet Evidence Finder and
• 18:47
  people might not even know that that's what magnets started with
• 18:50
  before Axiom became a full forensic platform.
• 18:53
  So not sure. What I don't think I missed
• 18:56
  anything. I'm very confident that I think
• 18:59
  I would have just been a lot quicker.
• 19:01
  I I would never went to trial as Stacey mentioned the beginning
• 19:04
  with the Alford plea, but boy it would have made for better
• 19:07
  demonstratives and even. Better report because it has the
• 19:10
  reporting capabilities now built in with our exhibit builder
• 19:15
  tool. So any of that would have made
• 19:16
  it prettier, better, quicker. Is is really where it would
• 19:20
  help? And.
• 19:21
  Ingesting those search warrants would have been huge because,
• 19:23
  you know, back in the day we'd just get the disk and we'd have
• 19:26
  to look at the spreadsheets and then find something I wouldn't
• 19:29
  have to deal with all. That, but I also wonder if one
• 19:31
  of the main differences, because you were doing it so long ago
• 19:35
  and you approached it first as I'm going to take some pictures
• 19:38
  of this phone. And so you saw all the blue
• 19:41
  lines and you're like, that's weird.
• 19:44
  What is that? And so you know, that might have
• 19:47
  been the starting point and it seems to me it was for you to
• 19:50
  like dig in deeper and be like, what are what are all these blue
• 19:54
  lines in the driving around versus today where we would have
• 19:57
  just done the extraction? I don't know, do you think you
• 20:00
  still would have picked it up or it wouldn't have been so fast on
• 20:04
  the uptake that happened? I I would have, I'll be honest
• 20:07
  with you, I probably should have just extracted it immediately.
• 20:11
  I did the photos 1st and I actually manipulated the screens
• 20:15
  with the finger to photograph the screens before I extracted
• 20:19
  because at that time and it depends on phones today can
• 20:22
  still extracting the device can take time.
• 20:25
  Oh yeah, but I did. The photos first because.
• 20:27
  Why do you think I did that? We'll make it a.
• 20:30
  Quiz Why do you. Think I did that.
• 20:31
  I think time was of the essence. Because it was on consent.
• 20:36
  And what he said consent, withdraw and I want my little.
• 20:40
  So I was racing. I I mean, I was screaming.
• 20:43
  Back to the lab. And again, we treated her as a
• 20:45
  victim, but you know, time's not on my side.
• 20:49
  So I wanted to get what I could get because if that phone was.
• 20:52
  Extracting the sheet, he said no.
• 20:55
  Then I'd have been nothing. And we probably we might not
• 20:58
  have ever. Gotten just sooner.
• 21:00
  Sooner. So let's talk about the consent
• 21:02
  more. Even in today's world, would you
• 21:04
  have done it the same because of the consent?
• 21:06
  And like, how long was that extraction going to take?
• 21:08
  Yeah, you do it the same. No, we again, there's plenty of
• 21:12
  investigators and examiners out there who who might want to
• 21:15
  argue that. Based on my experience, I would
• 21:17
  do that again. But the problem with you.
• 21:19
  Learned through your cases like what is important and what is
• 21:24
  what is it's almost like volatile versus non volatile.
• 21:28
  And what I need right now to make my case, if that consent is
• 21:33
  bold, it's it's all a chess game because what was the danger that
• 21:36
  I suffered was that someone could have sent a kill signal.
• 21:40
  Wasn't it a Faraday environment? So that might we could argue
• 21:44
  that might not have been a good move, but it is the move I made
• 21:47
  and in retrospect, I would do the same thing.
• 21:49
  That's Michael Lynette. We all it's all a chess game.
• 21:52
  We all make decisions. Some work out, some don't.
• 21:55
  Luckily most of them do, but technology certainly change and
• 21:58
  abilities to abstract and so those tools, you know, certainly
• 22:02
  if I had a Gray key, it went straight on there.
• 22:05
  I think it would just made it. Faster and easier to be honest.
• 22:08
  No indication as I do. I have another case and I always
• 22:12
  think about that. If we wouldn't.
• 22:13
  Have the capabilities to have digital forensic investigators,
• 22:16
  examiners, we would have never known this was a murder first.
• 22:19
  It would have just been seen as a crime of passion, which is a
• 22:22
  very different type of case, right?
• 22:24
  But the point is that I always think about people like you guys
• 22:27
  who are out there that have the capabilities and the
• 22:30
  intelligence and the knowledge. And we have a lot of great
• 22:33
  agencies that are doing that. But think about the areas in
• 22:35
  this country that don't have that or don't leverage it.
• 22:39
  You know, I'm telling you there's a lot of murder first
• 22:41
  out there. They're probably treated and
• 22:43
  then prosecuted as murder seconds and nobody ever knew it
• 22:46
  was premeditated because they did leverage the digital
• 22:48
  elements. So whatever scenario you can
• 22:50
  make this for a lot of cases. It bothers me sometimes thinking
• 22:54
  about agencies that don't have that ability.
• 22:57
  It's like I will tell you, I don't know why this kind of spin
• 23:01
  in there. I love when we have defense
• 23:05
  experts involved and here's why. The only appeal on a digital
• 23:09
  forensic case I ever had, and it was at state level here in the
• 23:11
  state of Missouri, it was on a child sexual assault material
• 23:15
  case. And the defendant appealed the
• 23:19
  case. He was prosecuted for for
• 23:22
  possession of child sexual assault material, but he
• 23:24
  appealed the case because he said.
• 23:26
  I asked my defense attorneys to hire an expert witness for me
• 23:30
  and they never do. That was overruled.
• 23:33
  They they didn't sustain that and I was a little surprised.
• 23:36
  I thought, seems like a legitimate argument.
• 23:38
  What they did was the attorney's nephew, who was an IT help desk
• 23:41
  guy. They brought him that you,
• 23:43
  you've probably seen this before, I'm sure, And it was
• 23:46
  really almost Crumb, right? Did did they did that to their
• 23:50
  client? They brought in the IT help desk
• 23:52
  guy, you know, he didn't even know the terminology.
• 23:54
  So I still think gaps that I see because I'm out there every day
• 23:58
  and all kinds of labs is we're not always leveraging the cloud
• 24:01
  and we could. We don't have defense experts
• 24:03
  involved that are going to help make these cases solid.
• 24:10
  You mean like the fear of a qualified defense expert to make
• 24:13
  the law enforcement side take it to the next level or go all the
• 24:19
  way? I love him.
• 24:21
  I I had one. Case where there was a defense
• 24:23
  expert in the area that sometimes, if I'm honest, would
• 24:26
  overextend himself and he would get pressured to say things by
• 24:29
  that attorney. I felt they were just.
• 24:31
  That is very real, I am asked to say and do.
• 24:35
  Things. All the time.
• 24:37
  And it's a it's a constant push and push back.
• 24:41
  Well, this guy got pushed hard and I would have to then I'd.
• 24:45
  Have to write a report. I'm like quit making me write
• 24:47
  all the reports but that was only one time.
• 24:50
  In the other cases, literally if you just follow the ones and
• 24:53
  zeros and then you can repeat what I did sometimes I think I
• 24:57
  don't know if you guys would agree with this might be a bad
• 24:59
  way to say it, but I think it defects expert that are worth is
• 25:02
  helping their attorney's client get a good guilty right and help
• 25:07
  actually with the client control.
• 25:09
  I convinced the client that look now the Lightning didn't strike
• 25:14
  the phone and download 500 images of CSAM or whatever it
• 25:17
  might be right. So it makes when we don't have
• 25:20
  that in place, it makes the system.
• 25:21
  Weaker. Yeah, I mean, Becky and I say it
• 25:23
  all the time, the facts are the facts.
• 25:26
  That's what we're what we're here to share.
• 25:28
  And that's why the. Geolocation information and I
• 25:30
  really think there's a lot of great evidence.
• 25:32
  It's not just the digital because we, we got really lucky.
• 25:35
  But I, I don't know, I wasn't there.
• 25:37
  But I think when the defense attorney sat down with Pam Hop
• 25:40
  and tried to, you know, move her towards his Alford play, if
• 25:43
  that's how that went down, pretty sure the digital
• 25:46
  evidence, the geolocation evidence was like, how are we
• 25:49
  going to overcome this? Well, with the geolocation
• 25:52
  evidence, did you see it? You eventually got to go further
• 25:54
  back in your search warrant to get more data from Google.
• 25:58
  But did it show her going to Carol Alford's house then?
• 26:02
  Not in that, do you recall? I I don't remember that I'm sure
• 26:07
  I looked at that. I did, just not sticking in my.
• 26:10
  Head that. That's where I'm back.
• 26:11
  I'll tell you the challenge that I had.
• 26:13
  This case had so much attention. It was so important to the.
• 26:17
  Community and then labor went kind of nationally.
• 26:19
  Viral that this technique that I used for the geolocation I had
• 26:24
  heard about we're kind of glancing over that because
• 26:27
  there's a lot of that now, but I can only find one other case
• 26:31
  where this hadn't happened before someone were to search
• 26:34
  warrant. I was like the first kid on my
• 26:36
  block and this wasn't a Geo fence, it was just.
• 26:38
  Here is the phone here on the Gmail.
• 26:41
  Give me the Geo location that was really.
• 26:44
  Groundbreaking. We're talking about an older
• 26:45
  case here, folks, and I found one guy who wrote a paper from a
• 26:50
  forensic standpoint, really kind of in a surfacy level about.
• 26:53
  Geo location information and Google.
• 26:56
  And he kind of it was billing himself as an an expert for
• 26:59
  hire. And I called him and I talked to
• 27:01
  him and my prosecutor basically think of Matlock.
• 27:06
  The guy knows that he knows more about DNA than doctors do,
• 27:09
  right? But one time I was explaining to
• 27:11
  him and I think. I'm good at this explaining some
• 27:14
  forensic principle in this case to him.
• 27:16
  As I would a juror and he goes, Larry, Larry, you're trying to
• 27:19
  explain. How do you say it?
• 27:21
  You're trying to explain auto mechanics to the Amish, is
• 27:24
  exactly what he said. OK, Phil.
• 27:27
  But Phil was like, no money, no expense.
• 27:29
  I've got unlimited budget. We'll throw whatever money you
• 27:32
  hire an expert. And so I talked to this guy one
• 27:35
  time and he would not call me back.
• 27:37
  I think he was like the reluctant astronaut.
• 27:39
  He was good to write in white papers, but he didn't want to
• 27:41
  get on the stand. He would not call me back.
• 27:43
  The other piece of digital? Evidence we should mention, too,
• 27:45
  is that. When I had the geolocation.
• 27:47
  Information and after Mr. Gumpernberger was picked up and
• 27:51
  went directly back to where he was murdered.
• 27:54
  Again, we plotted all this and there was a donut shop.
• 27:57
  Mine's got to be donut shop and it had a camera and that camera
• 28:01
  catches that GMC going past but. You know, briefly, and if you
• 28:05
  look at the picture and it's out there in this, it's a little
• 28:08
  grainy, it's a little shadowy, but in the passenger seat you
• 28:12
  can see a male subject. I believe there's content
• 28:15
  argument about this. You can see Mr. Gunfenberger
• 28:18
  sitting in the passenger seat, and he always wore the same
• 28:21
  distinct baseball cap for the University of Missouri or
• 28:24
  Mizzou, and you could see that that was massive.
• 28:29
  That was like. Here it is this bam.
• 28:32
  We got a picture of this guy, but it's grainy.
• 28:35
  It's shadowy. I did reach out to probably the
• 28:39
  top national expert on video stuff at the time.
• 28:42
  I think he's he's still out there.
• 28:44
  He teaches aquatic all the time. We'll just leave it at that.
• 28:46
  And. He said, yeah, you can't say it.
• 28:50
  He didn't believe his expert opinion was you cannot say that
• 28:53
  that is in fact him. But I'm telling you again, This
• 28:57
  is why. You got to be careful.
• 28:57
  You got to follow the evidence. You got to do the right thing.
• 29:00
  I look at it and I'm like, that's him, you can see him.
• 29:02
  We all said it, yeah, But I couldn't say it from a technical
• 29:06
  evidentiary standpoint. It was just, I still believe it,
• 29:10
  but so we, we never used it. They never came up in the case.
• 29:14
  Well, and if it would have went to trial, I mean, do you think
• 29:16
  you could have said like there was definitely a person in the
• 29:20
  car with her? And he yes, and we might have
• 29:23
  went. There it didn't become a need.
• 29:25
  But it's one of those inside baseball that that video, that
• 29:29
  very brief second that image was.
• 29:32
  Days of work and a lot of argument.
• 29:34
  But this part of making their. Sausage, right?
• 29:37
  Not not bad thing, but but as an examiner I was feeling a little
• 29:41
  pressure. I know whatever I wanted me to
• 29:44
  say and say as the expert when this I can say.
• 29:48
  The thing you. Have to think.
• 29:50
  About, you know, as the expert, what can I say?
• 29:52
  What are the what are the facts? What am I willing to go on the
• 29:54
  line because it's my butt up there in the chair in front of
• 29:58
  everybody. It's my name.
• 30:00
  What do I want to say? And I'm.
• 30:01
  Not trying to make it sound. Like they were really pressure
• 30:03
  me too bad but but internally I did feel a.
• 30:06
  Little. But, you know, in the end, you
• 30:09
  know, follow your ethics. It was an easy decision to make.
• 30:13
  It's just a lot of disappointed faces, you know?
• 30:16
  It's nice to be the hero. It was a hero when I had the
• 30:18
  geolocation. But that one, just like we, we,
• 30:21
  we, we, we can't go there. Everybody accepted it.
• 30:24
  And that was. You know they.
• 30:26
  Had faith in me and my abilities.
• 30:28
  Like I said, I, you know, I had spent a lot of time testifying a
• 30:31
  lot of cases as a regular detective before the cyber
• 30:33
  stuff. So was it as big an issue?
• 30:37
  And I don't know if this to our listeners is, is confusing
• 30:40
  because it's a hard story to tell.
• 30:42
  We're talking about initial homicide and a wrongful
• 30:46
  conviction. And then we have another
• 30:49
  homicide where the victim actually then turns out to be a
• 30:52
  suspect who lured the guy to his death, which is connected to the
• 30:55
  first one. But the bottom line is for our
• 30:58
  agency, for this high pressure kind of case, having that
• 31:02
  ability for someone who really understands the digital.
• 31:05
  Overlay of the crime scene, the digital crime scene and is able
• 31:08
  to say, OK, just give it to me or here's what we're going to do
• 31:12
  and be able to leverage that is huge.
• 31:14
  It's a, it's a big investment for nature.
• 31:16
  See not only tools and time. Like I said, I was away at a lot
• 31:20
  of training, but sure enough, when we needed it, we needed
• 31:24
  interestingly enough, I was there 10 years at cyber crime
• 31:29
  unit. I managed that unit and I was
• 31:31
  the forensic manager of the unit and we had some massive victims,
• 31:35
  right? And then I retired from law
• 31:38
  enforcement and now, you know, working here at Magnet
• 31:40
  Forensics, and there's been a couple chiefs since I left.
• 31:44
  The new chief came out with a policy and said no specialty
• 31:47
  assignments over five years. So the guy who replaced me after
• 31:51
  8 years they pulled him out and they they haven't replaced him
• 31:54
  and it is the. Second largest city in the metro
• 31:55
  region. They have no forensic examiner
• 31:58
  even after this story, and you have to look like, yeah, nuts.
• 32:02
  Five years is where you start to feel kind of comfortable, like.
• 32:05
  You know, maybe, maybe like. That's why I bring.
• 32:09
  Confidence. In five years is where you've
• 32:11
  got some confidence you. Got to be having a lot of cases
• 32:15
  at 5, you know, to feel that confident at 5:00.
• 32:18
  Years. So sometimes, you know, get
• 32:20
  these, these chiefs and their political point or whatever I'm
• 32:24
  not banging on. The the, the chief.
• 32:27
  Other than to say that all those immense successes, you're going
• 32:31
  to like, yeah, we're not going to have one right now.
• 32:33
  We'll just let the other people in the group work on it.
• 32:36
  And here was the power, you know, having someone in a task.
• 32:40
  Force it was a regional group that I promise you if the people
• 32:43
  signed my paycheck called. Guess what was going to happen?
• 32:46
  I'm running. I was going to go like this.
• 32:50
  Well, it's right in front of me. You know, I'm working on this
• 32:52
  case. Yeah, sure.
• 32:56
  I did. Wonder, did you ever serve any
• 32:58
  of the search warrants out to her cell phone provider to do
• 33:02
  anything with like the cell phone tower data or anything?
• 33:04
  Like that did that not only. Did her cell phone record We
• 33:08
  actually called in the casting? FBI.
• 33:11
  That cast team and that was a phenomenal guy that was in Saint
• 33:15
  Louis at that time. If you've ever heard of the cast
• 33:17
  team, for our listeners out there, FBI has specialists in
• 33:20
  cell, cell records, deal with call detail records.
• 33:23
  They'd go like that. The tower schools that, I mean,
• 33:25
  they're getting crazy deep into this stuff.
• 33:28
  So we we did bring them in. I did it myself.
• 33:30
  And then I found out about the guy.
• 33:32
  I think he'd just gotten the same.
• 33:33
  It was actually and then then he did that working fun.
• 33:35
  So yeah, we did that. That's awesome.
• 33:38
  Presumably like the cell phone tower data was lining up with
• 33:42
  what you were seeing with Google, which which you're also
• 33:45
  seeing with the security camera footage that you could pull up.
• 33:48
  Right. So yeah, you think about it,
• 33:49
  Phone. Cloud vehicle, so infotainment
• 33:52
  center and OnStar, I'll add that all of this camera footage that
• 33:56
  we have in there, the cell tower data, but there's this huge
• 34:00
  amount in just managing that. You know, I had a CSAM case one
• 34:05
  time trial sexual assault material case.
• 34:07
  It was 22 terabytes. Now I'm not say it was all
• 34:09
  allocated. But.
• 34:10
  Just the management of some of this volume of data.
• 34:13
  In all the. Moving pieces.
• 34:15
  Now I'm not saying this case had 22 terabytes, it did not, but
• 34:18
  but there's a lot of moving parts.
• 34:20
  We called them affectionately back in the days.
• 34:23
  This probably changed binder cases.
• 34:25
  You know, you open your third binder, now we got a fourth
• 34:27
  binder. You know, we got all these
• 34:28
  binders stacked. And sometimes just handling the
• 34:32
  digital evidence is a whole management tool and to itself.
• 34:35
  Well, it's also important to share what you're finding.
• 34:38
  And sometimes as you're going along the route and now maybe it
• 34:41
  was venting to you, but when you kept mentioning the dollar
• 34:45
  stores and the other detective was like, Ding, he ran off to
• 34:48
  the dollar store and then you were able to tie the knife into
• 34:53
  the crime. You better.
• 34:55
  I'll tell you another one. I don't.
• 34:56
  I don't think they've. Told this one before.
• 34:58
  I don't I'm. Pretty sure so from.
• 35:00
  You Stacy Beck? Yeah, I'm going to tell.
• 35:03
  You this part, so this was an interesting.
• 35:04
  One Phil, the guy, you know, auto mechanics to the Amish, was
• 35:09
  just really on this whole kick of money's no expense, you know,
• 35:12
  we're going to spend whatever. And he said, Larry, he had this
• 35:15
  big idea. Here's what I want you to do.
• 35:17
  This is like a year later. He's like Larry, I want you to.
• 35:20
  Buy that exact cell phone and you retrace the route and then
• 35:25
  we'll download it and be able to show that is an exemplar, you
• 35:30
  know, show a demonstrative to the jury because we're getting
• 35:32
  ready. To file that.
• 35:34
  You could say see here this is sub that.
• 35:36
  And I'm like, are you out of your mind?
• 35:39
  Why did I say that? It's not going to look anything
• 35:41
  like that. How many lights are going on?
• 35:43
  How many towers have been heads have been moved?
• 35:46
  I mean like what you know I mean.
• 35:49
  It needs to be done within days right of of the the crime or
• 35:57
  whatever the driving, whatever it needs.
• 36:00
  To a year later, that would have been a nightmare because again,
• 36:03
  it's a mesh network. How many Wi-Fi points are gone?
• 36:05
  How many people you know? Well, I I hate to one up you,
• 36:08
  Larry, but somebody asked me if I had done it seven years later,
• 36:12
  once I was hired and I was like, no, and I just and that was on
• 36:18
  the stand and I just left it at that because I was like,
• 36:22
  whatever I try to clap back with is going to sound like me going.
• 36:25
  That's not my job, you know, and I didn't want to sound like
• 36:28
  well. We.
• 36:29
  We spent a lot of time as examiners trying to explain
• 36:31
  these things. And so I'm like, well, Phil,
• 36:34
  that's an interesting idea, but let me explain why that's
• 36:36
  probably not the right choice for us.
• 36:39
  In the meantime, my head's going.
• 36:40
  Are you crazy? Well, they had a couple of the
• 36:45
  detectives when they were investigating Russ Faria's
• 36:49
  alibi. They drove the route and they
• 36:52
  survived. He should have arrived home like
• 36:54
  9 to 15 minutes faster. So he clearly had like that 10
• 36:58
  minute window to commit the crime.
• 37:00
  And it's like, well. Yeah, that's a big aspect on the
• 37:04
  1st homicide. He would.
• 37:05
  Had multiple witnesses. He's at a game night that they
• 37:08
  had, you know, they're having a game night and then he goes home
• 37:10
  and he actually had the receipts.
• 37:11
  He stops and gets a cheeseburger.
• 37:13
  And a soda. So hungry he ate at Arby's.
• 37:16
  Yeah, you're right. And so, you know, again, I don't
• 37:21
  want to be hypercritical and this has been several years, but
• 37:24
  I think if you look at that case, I think they're making
• 37:28
  some stretches to make that fit because it's it's pretty clear
• 37:32
  it would be pretty hard in the time frame that he had to make
• 37:36
  it home and stab somebody that many times, you know?
• 37:39
  But so the interesting thing about the Guppenberger, well,
• 37:45
  it's all interesting to me, but the Guppenberger homicide, you
• 37:48
  know, showed that Pam Hop really is a killer.
• 37:51
  At least one time she killed Mr. Guppenberger.
• 37:54
  She had to put a lot of planning, premeditation.
• 37:57
  There were a lot of moving things in that.
• 37:59
  So we know she is certainly capable.
• 38:01
  So based on that, there was a overturn up in Lincoln County
• 38:05
  where Betsy Free was killed. You know, a lot of people were
• 38:09
  unelected. A new prosecutor came in there
• 38:12
  and he really got elected on that.
• 38:14
  I'm going to make this right. And so they have.
• 38:20
  They have issued charges on Pam Hop for the murder of Betsy.
• 38:24
  For you, however, it keeps dragging on and dragging on.
• 38:27
  And that's how it works sometimes.
• 38:28
  But next year, at some point, Pam Hop is supposed to stand
• 38:31
  trial for the murder of Betsy. Yeah, it's scheduled for the
• 38:35
  summer. They have a jury selection date
• 38:38
  and they have a trial date, so we'll see.
• 38:41
  Speaking of that, do you think for any reason you'd be called
• 38:44
  to testify in the Betsy for a murder case?
• 38:48
  The guys who are working on that cold case, I know the people,
• 38:51
  but I make sure not to have any conversations.
• 38:54
  I haven't talked to them. I don't ask anybody about it
• 38:57
  just in case I could be called. I can't imagine being called on
• 39:00
  the House out of Betsy itself because I did the 10 computers
• 39:03
  which had no evidentiary value. Right, but if there is some.
• 39:06
  Nexus and they might not allow this to try to show that she is
• 39:10
  capable because she did this other murder that might bring me
• 39:14
  in. But that's the only Nexus that I
• 39:15
  can think of right now. I really don't think I will be,
• 39:18
  but you know, I've said that before.
• 39:20
  You know, I've been here at Magnet Forensics for seven
• 39:24
  years, but you know, just last year I I got a subpoena for a
• 39:29
  case from. You know a million years ago
• 39:33
  that you're like, what? You're going to send me that?
• 39:35
  Report, you know, so I still get called sometimes, but but so
• 39:38
  it's possible. Well, Larry, thanks so much for
• 39:41
  joining us and and sharing your time and your knowledge.
• 39:43
  It's been just insightful and just hearing about all the, you
• 39:50
  know, trails, digital trails that you followed and and the
• 39:54
  light bulbs that went on. I always love these stories.
• 39:57
  They make what we do for a living so much more fun.
• 40:01
  So we appreciate you and appreciate your time.
• 40:04
  Until next time, stay safe, stay sharp, and as always, keep
• 40:07
  parsing the truth one bite at a time.
• 40:11
  If you enjoyed this episode, make sure to follow us to get
• 40:14
  notified the next time a new episode drops.
• 40:17
  If you can do Morehead on over to parsingthetruth.com and
• 40:21
  donate by clicking on the donate button.
• 40:24
  Parsing the Truth is a nonprofit organization and we are raising
• 40:27
  money to send a new digital Forensic examiner to IASYS
• 40:31
  training next year in Orlando. Thanks.
• 40:40
  OK, so what's going on?