Latest / Parsing the Truth: One Byte at a Time / Karen Read 1-3: Jessica Hyde Testimony Part 2

Transcript

Karen Read 1-3: Jessica Hyde Testimony Part 2 · Parsing the Truth: One Byte at a Time

• 0:01
  Join former FBI Senior Forensic Examiners Becky Passmore and
• 0:05
  Stacey Eldridge as they dig into the world of digital forensics
• 0:08
  one bite at a time. Now leading their own consulting
• 0:11
  firms and educating the next generation of cyber sleuths,
• 0:14
  these badass babes of digital forensics bring sharp insight,
• 0:18
  real world pace, experience, and a dose of humor to the bits and
• 0:21
  bites that filled today's investigations.
• 0:23
  From deep dives into business e-mail compromise and ransomware
• 0:26
  attacks, Becky's specialty, to cracking the complexities of
• 0:29
  iPhone forensics Stacey's obsession, this podcast delivers
• 0:33
  insider knowledge for professionals, students, and
• 0:36
  true crime techies alike. If you've ever wondered what
• 0:39
  really happens when the digital trail is all that's left, TuneIn
• 0:42
  and start parsing the truth. Parsing the Truth One Bite at a
• 0:53
  Time is proud to welcome our first sponsor, ACE Forensics.
• 0:57
  They are based near Chicago and they've been building systems
• 1:01
  since 1983. ACE Forensics delivers high
• 1:05
  performance digital forensics workstations, laptops, and
• 1:08
  servers to justice agencies across the United States and
• 1:12
  around the world. They offer unmatched value and
• 1:15
  the industry's only 5 five year digital forensics warranty Ace
• 1:20
  forensics build the systems your digital forensics software
• 1:23
  deserves. If you're procuring digital
• 1:26
  forensics equipment, reach out to them for competitive quote.
• 1:29
  Now on to our episode. Welcome back to parsing the
• 1:33
  truth one bite at a time. I'm Stacey Eldridge and with me,
• 1:37
  as always, is my fabulous Co host Becky Passmore.
• 1:40
  We focus on the digital evidence in today's modern crimes.
• 1:44
  Our focus is the facts and artifacts from evidence in these
• 1:48
  cases and we're digging into what the digital forensic
• 1:52
  examiners are doing and saying. So, Becky, what are we digging
• 1:57
  into tonight? So tonight, we are continuing
• 2:00
  our coverage of the first Karen retrial tonight.
• 2:04
  In tonight's episode, we're headed into Part 2 of the
• 2:07
  testimony of Jessica Hyde. So if you remember, she was
• 2:12
  called as an expert witness to discuss the digital evidence
• 2:15
  from Jennifer McCabe's iPhone. Part one of her testimony is in
• 2:21
  Season 1 Episode 43, so if you haven't listened to it yet, you
• 2:25
  might want to jump back and do that first.
• 2:28
  And a quick like 5 second summary about what she talked
• 2:31
  about in the first half of her testimony.
• 2:33
  She talked about those two main searches that she was brought
• 2:37
  in. And so she was focusing on House
• 2:39
  Long to die in cold and and how long to die in Kiki.
• 2:45
  She gave us some overview of like what an SQLite database is
• 2:50
  and a wall file and how they work to gave together.
• 2:53
  She gave us that great analogy about a wall file, but she's
• 2:57
  really spending a lot of time kind of starting to lay the
• 3:01
  ground about what is the browser state dot DB and what is this
• 3:06
  2:27 AM timestamp that shows up. And she's had one table up for
• 3:11
  people to look through that laid out some of that information as
• 3:14
  she laid out the timeline of different searches out.
• 3:17
  So we're going to jump right back in and discuss where now
• 3:20
  hide is called to then publish Table 2 from her report, which
• 3:26
  lists the locations that can potentially hold Safari data and
• 3:31
  what kind of data each location can hold.
• 3:35
  It helps the jury understand table one by breaking down the
• 3:39
  type of data you could find in each artifacts, such as whether
• 3:44
  it includes private or non private searches and whether it
• 3:48
  includes closed tabs. So Table 2 is titled Description
• 3:53
  of the file that stores Safari related data on iOS devices.
• 4:00
  Yes, I think we'll just run through the table here and
• 4:03
  again, we'll link to her report in our show notes if you want to
• 4:06
  go through and read this one. This one's actually pretty
• 4:10
  readable, but she notes that the history dot DB contains non
• 4:14
  private searches, close tabs, and the time stamp is the time
• 4:19
  that the user visited the site. Safari tabs dot DB contains both
• 4:24
  private and non private tabs, but only shows tabs that have
• 4:29
  not been closed. It's essentially an active tabs
• 4:33
  database. And of course browser state dot
• 4:36
  DB. We've been talking about it a
• 4:37
  lot. It contains non private
• 4:40
  searches, close tabs and shows a last viewed time.
• 4:45
  That's the name of the column. But that last viewed time column
• 4:49
  is about the tab itself, not the search or whatever website is
• 4:55
  listed in there. And she also noted that the name
• 4:58
  of a column in a database doesn't necessarily reflect its
• 5:03
  actual function. And then she finally also noted
• 5:07
  that com dot apple dot mobile safari dot P list records the
• 5:12
  time that something was queried, something was searched.
• 5:16
  Now, one of the things we want to stress here is again, the
• 5:21
  name of the column is not necessarily indicative of what
• 5:25
  it means. We don't know why Apple names
• 5:28
  things the way they do. They don't like there's no
• 5:31
  documentation of their source code out there for us to know
• 5:35
  the whys behind any of it. We don't know why so many
• 5:39
  columns start with the letter Z, and some of them have repeated
• 5:43
  Z's at the beginning of the column names.
• 5:45
  But they do like, I don't know if it's a race to be like the
• 5:47
  last column in the table or something.
• 5:49
  And so they're like, oh, there's ZZZZ, let me just set a fifth Z.
• 5:53
  And then I could be at the end, like, I don't know why.
• 5:56
  But something that's interesting to note with these column names
• 6:00
  is there's a difference between Celebrite and Axiom here.
• 6:03
  Celebrite will report the column name as it's reported in that
• 6:09
  native database, where Axiom does some of the interpretation
• 6:13
  for you when reporting that data from the database.
• 6:17
  And it's based on their research.
• 6:19
  And I think another key take away from all of this here is,
• 6:24
  you know, you have to do your own testing.
• 6:28
  You know, just take, don't just take the tool for its word,
• 6:31
  especially when it's super important to your case.
• 6:33
  Make sure you know what that column name actually means, what
• 6:37
  the actual significance of it is, just not the name, because
• 6:41
  especially some of the names don't really make much sense
• 6:44
  anyway. So you're going to have to
• 6:45
  figure something out at some point.
• 6:47
  That's right. So then the attorney asked Hide
• 6:50
  to explain to the jury how Sequel Lite databases relate to
• 6:54
  the wall file. After giving that high level
• 6:57
  overview, she was asked specifically about the interplay
• 7:01
  and complexities between the two.
• 7:03
  Hyde said one of the biggest incorrect assumptions people
• 7:07
  make is that because data exists in the wall file, the user must
• 7:13
  have taken action to delete it. That assumption often stems from
• 7:18
  forensics tools marking the artifact as recovered and
• 7:22
  putting an X on it, she said. It's more accurate to simply say
• 7:28
  the data was recovered. So the take away here is don't
• 7:32
  assume deleted. Don't jump to the word deleted
• 7:36
  as the default assumption. We know for a fact that the wall
• 7:41
  has both new data that needs to be added to the live database
• 7:46
  and then data that's been marked also for removal.
• 7:51
  She explained that to figure out whether the data in the wall is
• 7:55
  waiting to be committed or deleted or removed, whatever you
• 7:59
  want to call it is that you can make a copy of the database and
• 8:04
  then open it with a non forensic tool.
• 8:06
  So that means you have to have both the database and the wall
• 8:08
  file together in the same location, and then you can see
• 8:12
  what changes are actually made. Yeah.
• 8:15
  For sure. Then came the big question from
• 8:17
  the attorney. Why is it at your conclusion
• 8:21
  that those search terms were not deleted by the user?
• 8:27
  We have to remember that in Richard Green affidavit episode
• 8:30
  we discussed how Green stated in his affidavit that the user had
• 8:35
  deleted this. Search it also.
• 8:37
  States that users can delete tabs.
• 8:40
  Hide answers that from a functional perspective, there is
• 8:46
  no user deletion function for a tab.
• 8:50
  There was also no evidence that the search term was present
• 8:54
  prior to 24 AM. So just remember we talked about
• 8:58
  this in the last episode where neither Stacy or I were familiar
• 9:04
  with the ability to delete a tab or people saying they delete
• 9:08
  their tabs. What we stated previously
• 9:11
  matches the testimony Hyde gave in or open court.
• 9:15
  Yep, and she continued talking about the tabs.
• 9:18
  The action of a tab being closed would not mean that the search
• 9:23
  was deleted, because that would show up in a different database,
• 9:27
  one that pertains to the actual actual searches in history, not
• 9:31
  one that just pertains to tabs. She stated it's possible that
• 9:36
  the tab was closed, but that is not the same thing as deletion.
• 9:42
  And then she continues on and they have her published Figure 1
• 9:45
  from her report. And this shows the 16 instances
• 9:50
  of the house long to die in cold search from the browser state
• 9:54
  dot DB law file. And you can see in this figure
• 9:59
  it's all the same search term with the same time stamp,
• 10:03
  identical UUID's. And what it's doing is
• 10:07
  confirming a single search that was stored multiple times.
• 10:12
  And the title of that figure that she published was Instances
• 10:16
  of Google search house Long to die in cold from browser state
• 10:21
  dot DB. And I can tell from looking at
• 10:25
  this, and maybe I can't remember if she documented it or not, but
• 10:27
  this is coming from Sanderson's tool where she was looking at
• 10:31
  the browser state DB in the wall file.
• 10:33
  And this is just the artifacts limited strictly to that house
• 10:37
  long to die in search, so you can see the 16 instances of it
• 10:41
  that she spoke about earlier. That's right.
• 10:43
  So now hide explained that browser state dot DB doesn't
• 10:48
  track how many times something was searched.
• 10:52
  For that you would look at mobile safari dot P list and
• 10:56
  knowledge C dot DB. The 16 entries which were
• 11:01
  presented in Figure 1 all had the same time stamp and were
• 11:05
  simply stored in the wall file at multiple offsets.
• 11:10
  Then the attorney asks another great question.
• 11:13
  Great question in my opinion, He says.
• 11:15
  What conclusions was she able to reach about the time the website
• 11:20
  was actually viewed? And Hyde explained that the
• 11:23
  Apple Webkit time stamp shown in Figure 1.
• 11:28
  And she said that when it was decoded, it revealed a date and
• 11:32
  time of January 29th, 2022 at 2:00, 27 AM Eastern.
• 11:39
  And her analysis ended there on that point.
• 11:43
  Now, it's unclear what the purpose of that question was,
• 11:47
  because if it was to explain based on her answers, it's
• 11:50
  unclear to me now, right? Because when I heard that
• 11:53
  question, I was getting ready to, I would have explained
• 11:55
  something else. But she goes on to explain, and
• 11:58
  maybe I wasn't clear when I summarized it, but she just
• 12:00
  explains that you see a long string of numbers and it's
• 12:04
  actually an Apple Webkit timestamp.
• 12:07
  And when you convert it, you can see the actual time.
• 12:10
  And so she explains that and it just kind of ends there as you
• 12:14
  see as we continue the discussion.
• 12:15
  So I don't know if if he was asking her to explain that or if
• 12:20
  she just started there and didn't get a finish with the
• 12:23
  rest of her opinion, because then he continues on with with
• 12:27
  something else. So Becky, why don't you go into
• 12:30
  where they moved on next? Yeah, so hi then moved into
• 12:34
  testing to determine what the browser state dot DB timestamp
• 12:39
  actually reflects. She conducted testing using a
• 12:43
  jail broken iPhone so she could monitor data and storage in real
• 12:48
  time. She manipulated tabs, conducted
• 12:51
  Google searches, closed and moved tabs, and performed
• 12:55
  several different searches, all while following NIST guidelines
• 13:00
  for data set generation. Her testing was also peer
• 13:05
  reviewed and. She was actually briefly stopped
• 13:07
  during the testimony for using the word we.
• 13:11
  And I hear a lot of examiners do it.
• 13:12
  We just talked about we, we, we, we, we.
• 13:14
  So being asked about the word we, she was asked to clarify who
• 13:18
  else was involved and she that's where she explained that her
• 13:21
  work had been peer reviewed. But ultimately through her
• 13:25
  testing, she explained that she was able to observe how the
• 13:29
  browser state changed when she interacted with the tabs and
• 13:34
  when she was interacting with the tabs on a Mac using the same
• 13:37
  signed in Apple account. And she found that she could
• 13:40
  generate a timestamp in the browser state dot DB that was
• 13:45
  earlier than the current time. And she was able to do that
• 13:48
  through a variety of means. And that included manipulating
• 13:51
  tabs, closing them and opening them and switching the tabs,
• 13:55
  putting it in the foreground. And she said even viewing that
• 13:58
  tab on an on a different device, like going from the iPhone and
• 14:02
  then viewing it on a Mac or an iPad, played a role in all of
• 14:05
  those changes. Yeah, absolutely.
• 14:07
  So then the attorney asked Kai directly whether she observed
• 14:12
  any issues with Green's affidavit.
• 14:15
  She responded that Green drew a conclusion that a search
• 14:18
  occurred at 2:27 AM on January the 29th based on the artifact
• 14:23
  recovered from browser state dot DB as parsed by Celebrite, and
• 14:28
  that there were two errors with that assumption.
• 14:31
  The first error was treaty in the browser state dot DB time
• 14:36
  stamp at the time of the search when it is actually the time of
• 14:40
  the movement of the tab. The second error was concluding
• 14:44
  the data was deleted based on celebrate marking it as
• 14:48
  recovered. Now the attorney asked for her
• 14:51
  overall conclusions based on the totality of her analysis and
• 14:56
  testing, Right. So there's there's the open
• 14:58
  door. What do you want to say about
• 15:00
  all of this? So she went on and agreed at she
• 15:04
  agreed with Green that the phone was actually in use at 2:27 AM
• 15:08
  and that's when those Hockomock sports searches were occurring.
• 15:11
  And that was at that time and it and there was some browser
• 15:15
  activity that continued on past that.
• 15:17
  But she said she concluded that at 623 AMA search was initiated
• 15:23
  for how long T so TI And then at that point Apple started
• 15:28
  suggesting how long to digest food.
• 15:32
  She said the user did not take that that suggestion and instead
• 15:36
  completed the search as how long T die in Kikti.
• 15:40
  And then a new search was later conducted at 6:24 AM and that
• 15:46
  624 AM search was for house Long to die in cold and that became
• 15:53
  the last search made in that particular tab.
• 15:56
  And As for deletion, she said she found no evidence that any
• 16:01
  of those search term artifacts had been deleted.
• 16:04
  Yeah. So on cross examination, the
• 16:06
  defense attorney asked Hyde whether she had essentially
• 16:10
  concluded that the 2:27 AM time stamp was triggered by the
• 16:15
  closing of a tab. Hyde corrected him, clarifying
• 16:18
  that it is not a 227 time stamp on Google search.
• 16:23
  It is a time stamp on a tab. And so the defense attorney
• 16:28
  basically is opening with, you're explaining to the jurors
• 16:31
  what is a really complex set of facts that led you to conclude
• 16:35
  that this 2:27 AM time stamp on the Google search was triggered
• 16:39
  by closing a tab. And did I essentially sum that
• 16:43
  up correctly? And she clarified, like Becky
• 16:47
  said, it is not a Google search time stamp.
• 16:51
  It's about a tab. And then the defense attorney
• 16:55
  reviews the different artifacts sources that she's spoken about.
• 16:59
  And then the attorney asks, OK, this is where he's getting into
• 17:02
  it, right? He said, said, would you agree
• 17:05
  with me that another simple explanation for that 2:27 AM
• 17:10
  time stamp was that the user conducted the search at or
• 17:14
  before 2:27 AM on January 29th, 2022?
• 17:20
  Hide answers again, that time stamp is not indicative of a
• 17:25
  time of search. So then the attorney asks.
• 17:29
  What I'm saying is your analysis of the phone does not rule out
• 17:34
  that the user of the phone performed that Google search at
• 17:40
  or before 2:27 AM. Hide answers.
• 17:44
  There is no indication of a Google search at or before 2:27
• 17:50
  AM. So the defense attorney again
• 17:53
  says, I'm getting to whether you can rule that out.
• 17:57
  Ma'am, that's really the crux of my question.
• 18:00
  Can you rule out that the user of the phone conducted that
• 18:04
  search at or before 2:27 AM on January the 29th and hide
• 18:13
  answers? There is very likely
• 18:17
  possibility. There is a very unlikely
• 18:19
  possibility based on the fact that there is no evidence that
• 18:23
  the search occurred before that time, and it's just like saying
• 18:28
  that the user search for pandas at 2:27 AM.
• 18:33
  Could you rule that out? I can't rule out something that
• 18:36
  doesn't exist. Yeah, So this is what what she's
• 18:39
  coming, you know, that kind of line of questioning and what she
• 18:41
  was saying about like the pandas and I can't rule out something
• 18:45
  that doesn't exist. This line of questioning, you
• 18:47
  know, it's, it's one of those things, is it strategy?
• 18:51
  Is the question phrased in such a way that it's so hard that you
• 18:54
  can't give a correct answer or the question is so wrong,
• 18:58
  there's no correct answer to it. And you know, and what is the
• 19:01
  answer he wants ultimately, he probably wants the answer to be
• 19:05
  yes, it's possible that the search happened at 2:27 AM or
• 19:10
  before because you know, that was going to fit the defensive
• 19:14
  narrative. So that's why they're coming at
• 19:15
  that with, with that line of questioning.
• 19:18
  But to heights point, it's really hard to rule out
• 19:21
  something that doesn't exist, right?
• 19:24
  And I think that goes back to like in the legal system.
• 19:27
  That's why the state, the government has this burden of
• 19:31
  proof. They have to demonstrate that
• 19:33
  something happened. If you didn't do something,
• 19:37
  don't you think it's really hard to show evidence of not doing
• 19:41
  it, Becky? Yeah, for sure.
• 19:42
  I also think that again, this is the strategies from defense, the
• 19:47
  strategies from court testimony is that he's he, the attorney is
• 19:54
  trying to get Hyde to agree with him instead of testifying to
• 20:01
  what she's tested, what she's validated and what she has
• 20:04
  identified as the locations of this evidence.
• 20:10
  And that is why it's very important to go back and test
• 20:14
  and validate and confirm and then continue to repeat yourself
• 20:19
  because he's trying to get her to agree with him and.
• 20:25
  She embraces it. With what?
• 20:26
  Did you agree with me, you know? Yeah, and I and I, I really
• 20:32
  appreciate Hyde's testimony. I think people can learn from
• 20:36
  that. You don't have to get
• 20:38
  aggressive. You don't have to get combative.
• 20:40
  You don't have to get defensive. You have to do what she does and
• 20:44
  just repeat what she knows and repeat that what he's trying to
• 20:49
  get her to agree to is not accurate and true based on the
• 20:54
  evidence. Yeah, yeah, I agree.
• 20:56
  It was, you know, I, I think she was maybe a little frustrated
• 20:58
  because it's like, well, you know, like we all would be
• 21:01
  right. Like what's sure?
• 21:02
  How do I answer this question that is not phrased in any sort
• 21:06
  of way? I could logically answer it with
• 21:09
  with, you know, of course, wouldn't you agree with me?
• 21:12
  And how many times is he going to ask it to her in a different
• 21:16
  way and try to get a different result and she's going to
• 21:19
  continue to give the same result and the same answer?
• 21:22
  Yeah, yeah. So I don't know because she
• 21:24
  never did just go like, no, you know, she did give some
• 21:28
  explanation every time they were kind of going around that that
• 21:31
  line of questioning. And I don't know, you know,
• 21:33
  eventually she switched and said, you know, it's a good
• 21:36
  thing about the Panzas. And I can't rule out something
• 21:38
  that doesn't exist. But if she wouldn't have went
• 21:41
  down that lane, how much longer would he have kept harping on
• 21:43
  that? And at some point, would her
• 21:45
  lawyer have objected or where the judge finally said, let's
• 21:49
  move it along, right. And we'll see some other
• 21:53
  instances of that sort of situation go on with a trial
• 21:56
  about like the question being kind of weird and the person
• 22:00
  testifying, like struggling to answer it because it's kind of
• 22:05
  like, you know, what do you mean?
• 22:06
  You know? And it's, I think anytime you
• 22:08
  talk about something super technical with someone who kind
• 22:13
  of knows some stuff about it, like enough to be dangerous and
• 22:16
  they think they know this thing and then they're trying to ask
• 22:19
  you about it. And you're just like, those are
• 22:20
  not the words I would use. I'm you know, what is your
• 22:23
  point? So that that struggle is not
• 22:26
  like a rare thing, especially when it's not coming from your
• 22:29
  attorney or it's coming on the cross or it's coming on the
• 22:32
  redirect because again, redirect, you can't exactly
• 22:36
  prepare for that even though it's coming from your attorney
• 22:39
  as much as you can on the direct.
• 22:41
  That's right. So the defense attorney also
• 22:43
  questioned her about the limited scope of her examination.
• 22:47
  Hyde explained that Tully gave her a limited a limited scope,
• 22:51
  asking her only to look at the extraction as it related to
• 22:56
  Safari search history on January the 29th and any related
• 23:01
  artifacts showing the phone was in use at that time.
• 23:05
  She did not examine the call logs.
• 23:07
  There was no redirect from the prosecution after cross
• 23:12
  examination. So I think we've discussed a
• 23:14
  whole lot in this last episode about her testimony and in this
• 23:18
  episode trying to break it all down and give you some learning
• 23:21
  points. But I think the key take away
• 23:23
  here, the thing to remember is that just like Becky was just
• 23:27
  saying she had a very limited scope.
• 23:30
  And it's not every case where you get to run wild and do
• 23:32
  whatever you want to and look at whatever you want to.
• 23:35
  You could be very narrow focused.
• 23:37
  And that's also in the amount of information that they feed you
• 23:40
  to the stuff that they tell you about the case.
• 23:43
  Sometimes you get very little information going into it.
• 23:47
  Is it is that a good thing or a bad thing?
• 23:48
  Because they don't want you to be biased.
• 23:50
  But it's like I need to know a little bit about whatever was
• 23:54
  happening so I can try to figure out if that did or did not
• 23:57
  happen. What so I know where to look on
• 23:59
  the phone or the evidence for those things.
• 24:02
  But getting back to her testimony.
• 24:04
  So she was focused on those two searches, the house long to die
• 24:07
  in cold and how long to die and kick the and the artifacts
• 24:12
  related to that were that contain those trace evidence of
• 24:16
  those searches. And her conclusion ultimately
• 24:19
  was that search for house long to die in cold was not deleted.
• 24:25
  It was not a deleted search is not a deleted tab because she
• 24:29
  said a user can't delete a tab either.
• 24:31
  And we had said that before a couple episodes ago.
• 24:34
  With regards to that remark in Green's affidavit, she, you
• 24:38
  know, did say that that time stamp is present in that record
• 24:43
  in the browser state dot, but it doesn't reflect the date and the
• 24:48
  time of the search. And she said that at several
• 24:51
  different points in the testimony.
• 24:54
  I'm so I think it's good to repeat that.
• 24:56
  So, you know, that's good for the jury to hear your fact
• 25:01
  multiple times because they're going to hear a lot of stuff.
• 25:03
  And this is not like a simple 2 or 3D trial.
• 25:06
  This this goes on for a few weeks.
• 25:08
  So I think that repetitions good to distress that what that
• 25:13
  means. Exactly.
• 25:15
  Especially when there's contention on it over it,
• 25:17
  because we know the contention is coming based on that
• 25:20
  affidavit. So she knows that she and she
• 25:22
  knows she has a different opinion than Richard Green based
• 25:25
  on his affidavit and what she just said in the stand and what
• 25:29
  she wrote in her report. But so she's reiterating, you
• 25:32
  know, the significance of that time and what the browser state
• 25:35
  dot DB is doing. And, you know, I think she did a
• 25:39
  really good job doing that. And ultimately, you know, she
• 25:41
  concluded that that time stamp is related to the the movement
• 25:45
  of the tab itself based on the second-half of her testimony.
• 25:49
  Becky, anything else you want to dig into?
• 25:52
  Here, I just think that reinforcing and discussing the
• 25:57
  fact that how important it is to test and validate all of this
• 26:04
  evidence so that you're accurate, so that when an
• 26:07
  attorney comes at you and says why don't you agree with me,
• 26:11
  then you state the facts you stated right back to that is not
• 26:15
  the location, that is not the evidence, that is not what is
• 26:19
  happening here. And you can be confident because
• 26:22
  you tested, you validated, you verified, you reviewed, you
• 26:26
  analyzed, and now you're communicating about it through
• 26:30
  testimony. So I think highlighting and
• 26:33
  emphasizing that for examiners to understand, yeah, it takes
• 26:36
  time. It takes more time to do those
• 26:39
  kind of things things, but it gives you a lot more confidence
• 26:42
  to be able to talk about it on the stand.
• 26:44
  Yeah, it's that double check. And if you're like me, maybe you
• 26:48
  look at it three or four or five times just to make sure,
• 26:50
  especially if it's like in this case they're disagreeing.
• 26:54
  So yeah, I would double check that multiple times.
• 26:58
  And I also feel like in almost every case I work, especially on
• 27:04
  iPhones and Androids, if this is super important to the case, I'm
• 27:09
  probably not having to do a whole entire testing and
• 27:11
  validation for that thing every time.
• 27:14
  But I am always jumping out and out of the forensic tool and
• 27:19
  looking at the raw data in a database viewer so I can see if
• 27:24
  it's being interpreted correctly by the tool.
• 27:27
  And another important thing is that it's not missing anything,
• 27:30
  right? Like, is there war in there that
• 27:32
  could add to the story that the tool did not report?
• 27:37
  Sometimes there is, sometimes there isn't.
• 27:39
  But I always feel more comfortable matching those two
• 27:42
  things up again, that validation, yeah.
• 27:45
  Do things line up? Or are they different?
• 27:47
  Yeah. And then of course, if they're
• 27:48
  different now you've got to go and test and figure out or maybe
• 27:52
  you make that call to to the manufacturer and be like, hey,
• 27:56
  what's up with that, you know? Exactly.
• 27:59
  All right, so another great episode.
• 28:01
  Join us every week on Thursday as we continue to dive into
• 28:05
  Karen Reed's first trial. And who do we have next week,
• 28:09
  Becky, or who are we going to talk about next week?
• 28:12
  Next week's testimony, we'll be talking about and covering the
• 28:16
  testimony of Ian Whoopin. So really excited about that.
• 28:21
  So if you've enjoyed this episode, we're asking a favor.
• 28:24
  Can you share with share with your network?
• 28:26
  And as always, until next time, stay safe, stay sharp, and as
• 28:31
  always, keep parsing the truth, one bite at a time.
• 28:36
  If you enjoyed this episode, make sure to follow us to get
• 28:39
  notified the next time a new episode drops.
• 28:42
  If you can do more, head on over to parsingthetruth.com and
• 28:46
  donate by clicking on the donate button.
• 28:49
  Parsing the Truth is a nonprofit organization and we are raising
• 28:52
  money to send a new digital forensic examiner to I Asus
• 28:56
  training next year in Orlando. Thanks.
• 29:03
  Yeah, yeah, yeah, yeah. Yeah, yeah, yeah, yeah, yeah.