Latest / Parsing the Truth: One Byte at a Time / Was it Suicide or Murder? The Leslie Hartman Case.

Transcript

Was it Suicide or Murder? The Leslie Hartman Case. · Parsing the Truth: One Byte at a Time

0:01
Join former FBI Senior Forensic Examiner's Becky Passmore and
0:05
Stacey Eldridge as they dig into the world of digital forensics
0:08
one bite at a time. Now leading their own consulting
0:11
firms and educating the next generation of cyber sleuths,
0:14
these badass babes of digital forensics bring sharp insight,
0:18
real world case experience, and a dose of humor to the bits and
0:21
bites that filled today's investigations.
0:23
From deep dives into business e-mail compromise and ransomware
0:26
attacks, Becky's specialty to cracking the complexities of
0:29
iPhone forensics, Stacy's obsession, this podcast delivers
0:33
insider knowledge for professionals, students, and
0:36
true crime techies alike. If you've ever wondered what
0:39
really happens when the digital trail is all that's left, TuneIn
0:42
and start parsing the truth. Welcome back to Parsing the
0:53
Truth One Bite at a Time. I'm Stacey Eldridge and with me,
0:57
as always, is my Co host, Becky Passmore.
1:00
And we dive into today's cases where we focus on digital
1:05
evidence and the artifacts that make up the facts that solves
1:09
the case. Becky, what are we going to talk
1:12
about tonight? Well, again tonight we have a
1:14
special guest with us. We are extremely excited to have
1:17
Founder and Chief Forensic Investigator Mario Merendez VX
1:23
Digital Defense with us. Mario has a great case to share
1:26
with us tonight. So thanks for being with us,
1:28
Mario. Hey, glad to be here.
1:30
So Mario, for our listeners, can you briefly introduce yourself
1:34
and give us a little bit about your background?
1:36
Yeah, absolutely. My name is Mario Mirandan.
1:38
I retired law enforcement after 19 years.
1:41
It was a beloved career that I absolutely loved.
1:44
You know, right now I'm in the private sector, own my own
1:47
business, VX Digital Defense. I get to cover still dealing
1:50
with criminal cases, dealing with civil cases and you name
1:54
it. It's just it's good to be in the
1:56
game still, so really love it. And what agency?
1:58
Where were you with? Was it the same one for 19
2:00
years? Nope.
2:01
I had a couple agencies that I, I started my career with Keller
2:04
Police Department and then did short sent over at Corinth
2:08
Police Department where I was mostly a detective during my
2:11
time there. That's where I really started
2:13
just really loving the job with crimes against children, working
2:17
for them, doing ICAT cases, getting introduced to how
2:21
digital forensics works, and then went over to Denton County
2:24
District Attorney's office and that's where this case took
2:27
place. And that's pretty much where my
2:29
digital forensic career took took off.
2:32
So awesome. Yeah.
2:32
So let's talk about the title of your case and what your role was
2:38
in this case. Yeah, absolutely.
2:39
This is a case that was the state of Texas first, Jay
2:44
Rotter. I had received a phone call late
2:46
at night about what appeared to be a potential suicide.
2:52
And then Police Department, we're investigating the case.
2:56
And as you know, working digital forensics for the county at the
2:59
DA's office, a lot of the a lot of the digital evidence came
3:03
over to my lab. So they had given me a call,
3:05
kind of gave me a rundown of what they were looking for.
3:09
And I know what really started was, like I said, on alleged
3:11
suicide and kind of just corroborating evidence from
3:15
statements taken about looking for a movie that they were
3:20
supposedly watching just to kind of corroborate some statements.
3:23
OK. So you were the main forensic
3:26
examiner on this case? Yes, ma'am, the lead.
3:28
OK. The only one after the liaison.
3:30
The only one. Probably a lot of people can
3:33
attest to these smaller. Yeah, you are the digital
3:38
forensics department. It was I love.
3:40
That how it works. Yeah.
3:42
Is there any limits on what you can say?
3:44
Is anything off the books that are?
3:47
I don't think so. My understanding it's, it's
3:50
already gone through the process.
3:51
We're done with the case. Yeah.
3:53
Just kind of sharing the good parts about, it's primarily for
3:56
the examiner's out there that do what we do.
3:58
That's right. Yeah.
3:59
So, Mario, let's dig in. Tell us all about your case.
4:02
Yeah, so like I said, this, this came in as a a suicide call.
4:07
And you know, I was, I did not go to the scene or anything like
4:11
that. There was CSI Denton PD that had
4:14
collected all of the evidence. You know, we had talked about it
4:16
on the phone, what they need to do, how to how to properly
4:19
secure the evidence and so forth.
4:21
And all that evidence was couple cell phones, computer, couple
4:26
computers and a lot of questions.
4:30
Then PD did a great job collecting that information.
4:32
But you know, this this involves the person that that this case
4:38
was against and who called 911 was an off duty sheriff's deputy
4:43
that, you know, this his girlfriend had allegedly killed
4:47
herself with his duty weapon. So, you know, automatically it's
4:51
just kind of like, you know, what's what's happening.
4:54
That's not normal, you know, So it's a high priority for for
4:58
Denton Police Department. You know, the victim had had a,
5:02
you know, suffered some, some setbacks in her life.
5:04
She was a quadriplegic or paraplegic rather.
5:08
And, you know, she had gone through some tough times.
5:10
So that was part of that was that was part of the narrative
5:13
that was, that was important to this.
5:15
And you know, kudos to Denton Police Department.
5:18
They, they were really good at collaborating with, with myself
5:22
and other and other people on this case that were in my, in my
5:26
opinion, was very instrumental to success, you know, no matter
5:29
which direction it went. So there was, you know, there
5:32
was a lot of physical evidence that my face value had looked
5:36
like a suicide. And so they wanted me to
5:39
corroborate some claims of watching a movie.
5:41
And, you know, they brought their evidence over and, you
5:44
know, just this was around COVID time as well.
5:47
So I had a lot of time to work on it.
5:50
I was like, that just made everything more difficult.
5:53
Yeah, right. So when it was COVID time and
5:56
you were working on it, were you still going to the agency and
5:59
working on it or were you moved to work?
6:01
Yeah, this was back in, this was more in September, I believe it
6:05
was August, September area time frame, the end of August.
6:08
So yeah, I was, you know, starting to get back into the
6:11
office and everything like that and everything getting back to
6:14
normal. Where, where were they watching
6:16
this movie on or what were they watching it on that?
6:19
Yeah. So they had mentioned that they
6:21
were, they were, they were at a desk like a computer desk
6:26
watching it on a computer. And so they had taken pictures
6:31
of the scene, obviously, because she was on front of the desk
6:35
where she was found, you know, so that came into play later on.
6:41
But yeah, so we're just, you know, you know how in
6:44
investigations, we whatever story that we're told or
6:48
whatever the whatever law enforcement is told, that's just
6:51
more information for us to, to look up to find out.
6:55
And it's not really to to back anyone in a corner, maybe in
6:59
some cases, but it is, you know, how many, how many things were
7:02
correct, how many things were wrong?
7:04
It gives us the totality of, of what we're what we're looking
7:07
at. So in this case, this was just
7:09
one of those let's check all the boxes.
7:12
Let's see what they're saying is true.
7:14
And what we all love about digital evidence.
7:17
It leaves a heck of a heck of a footprint beyond what we can
7:23
see. That was that was an exciting
7:27
part about it in any case that we're doing.
7:30
But yes, you know, we're I'm looking at it and.
7:34
What kind of pieces of it, what kind of evidence did you did you
7:37
get in and start looking up? Yeah.
7:39
So one of the main things that I was starting to look at was the
7:42
the main computer, the gaming computer, and it had multiple
7:45
drives in it. It's and they aren't small
7:48
drives either, right? You got a gaming computer,
7:50
multiple drives and some that are hidden on the other side,
7:53
not because they're trying to hide them, but just that's,
7:55
that's just the nomenclature of, you know, computer hardware.
7:58
So, you know, we're just I say we're law enforcement side, but
8:03
downloading everything being thorough and it takes some time
8:06
just to it takes time before we even get to the part of looking
8:10
at it and analyzing it. So, you know, I have multiple
8:14
pieces here. We've got computer stuff that I
8:16
can download in the lab. Believe I had also used the
8:20
services of Fort Worth Police Department and Dallas Police
8:23
Department because they had different capabilities.
8:26
And you know, in 2020, not everybody had an ability to get
8:30
a full file system. You know that was starting to to
8:33
pick up it was not everyone had the budget to get that type of
8:37
equipment so being. Well, that's still not changed
8:40
today either. Not everybody has the budget.
8:43
Yeah. But you know, so very, very
8:46
thankful for the people. You know, this was an
8:48
interagency effort just to just to grab data, right.
8:52
So, so we're going to Fort Worth to get a full file system there.
8:57
Then we got to go to Dallas Police Department to to get a,
9:00
you know, breakthrough, a locked phone, you know, or just to get
9:03
a full file system or what we can.
9:05
Maybe it was a physical, I forget, but which we'll come
9:08
back to later. But one of them was wiped.
9:10
One of those phones was wiped. So, yeah.
9:13
But yeah, you know, in the course of our work flows, I
9:16
think everyone's a little different.
9:18
But you know, we go through, we go through chats, we go through
9:21
web history, we go through the different applications, we go
9:24
through the images. And in this particular case, it
9:28
was 1 thumbnail that just kind of opened the case that I was
9:34
like, hey, what is this? And this time stamp is around
9:39
the time that this incident had apparently taken place so I can
9:44
share my screen. What?
9:45
What device? Share your screen.
9:47
Yeah, go ahead and share your screen.
9:48
What devices were you looking at?
9:50
Were you looking at A1 cell phone or more than one cell
9:54
phone? I was looking at multiple cell
9:56
phones. OK, but in this particular, in
10:01
this particular instance, I was looking at a computer, the
10:04
gaming computer. Yeah.
10:05
OK. And this does, the story does
10:08
merge both computers and and cell phones together.
10:13
So what you're seeing here is this gun, this picture of a gun
10:21
at a desk, you know, with the slide lock back and you have the
10:26
keyboard, you have the computer in the background and you've got
10:31
a lighter and a yellow pen right there.
10:34
So, but one thing not only did that stand out to me, but the
10:40
time stamp on this particular thumbnail was around the time
10:44
that this incident had occurred. So immediately, you know, the,
10:48
the collaboration between agencies was, was awesome.
10:51
And, and even to this day, even on the private, private side,
10:54
still have a good relationship with that department and the
10:58
people there. So.
11:00
So Mario, for for those of us who don't use guns, like what is
11:05
the significance of it being pulled back like that?
11:09
Does that mean anything? Or is it just catch your eye
11:12
because like it's a gun in front of a desk around the top?
11:15
Circumstances, it probably could catch your eye, you know,
11:19
whether it's slide log back with a mag in there.
11:21
I don't see a magazine inside of there.
11:23
But, but the main thing that stood out to me was gun, which,
11:28
you know, started in a desk with a computer and a time stamp.
11:32
So when I, when I e-mail the detective and say, hey, it's
11:37
like, does is this, I forgot my words that I, that I mentioned
11:41
them, but it's something along the lines, is this important?
11:44
You've seen the scene. I haven't seen the scene.
11:46
I was going to say, did you see the crime scene photos?
11:49
Because a lot of. The Times photos.
11:51
They don't let us see any of that stuff, and they don't.
11:53
And I think they're as little as are like that.
11:57
In this case, I, I, I did get to see more stuff later on during
12:02
our meetings, but not having seen that stuff yet, they are
12:07
like, yeah, this, that's the gun that was used.
12:11
That's his duty weapon. That's the desk that she was at.
12:15
And that's a man holding that gun.
12:16
I would say so. It kind of looked like there's
12:18
hair on the on the arm, on the left hand side.
12:21
Yeah. But it's hard to say.
12:23
Yeah. So, but at the very least with
12:26
the timestamp and everything, it started opening some questions
12:30
and they're asking where was that?
12:33
Who took that photo? And I'm like, I don't know yet.
12:37
And. It was on the computer.
12:40
This was on the computer. Oh, that doesn't even make any
12:43
sense. It doesn't, but it's a
12:44
thumbnail, so it's not even like a full like the full a full jpg
12:50
or whatever. No, it is a thumbnail and I've
12:53
blown it up here and it looks terrible fuzzy because, you
12:58
know, they're not that large. And, and to me, you know, all I
13:01
have is this file name, this F under score 0002F9.
13:07
And ultimately later on, I found a path to what this what this
13:13
led to. But it was, you know, I think a
13:17
lot of us just, we want our tools to give us most of
13:25
everything that's there. And I think a lot of people just
13:27
kind of depend on that. And I've learned over the years,
13:31
you know, as I get wiser and more experienced in forensics,
13:35
that the thrill of this is really finding it on your own
13:39
and, and recognizing that the tool can't do everything for us.
13:44
So that's really one of the biggest messages for this is
13:48
don't, don't completely rely on your tools.
13:52
They're good. They are very good.
13:53
And the programmers are really good, but you know, law
13:57
enforcement and examiners are really on the front lines of of
14:02
this and seeing new things, new trends aside from the
14:06
researchers that are behind the scenes as well, so.
14:09
I see a couple of things here. 1 you have on the screen it says
14:12
no chats were parsed by the tool.
14:15
And the other thing I noticed on this screen is that we talked
14:20
about it being a thumbnail. And so knowing that this was a
14:24
potential suicide, knowing I mean, those details, we
14:29
wouldn't, we as examiners may not always go look at the
14:34
pictures or even the thumbnails, right?
14:37
So like what in your mindset sent you in that direction?
14:42
Yeah. So just for one, having the
14:45
curiosity, having that I've got to know more about it, reading
14:51
through the listserv, reading through other tools that I'm
14:55
used to and just kind of knowing and having that experience, I
14:59
guess of what can each tool do that that this main tool was not
15:06
using? So, you know, I'm just, you got
15:09
to follow the path. Everything has a path.
15:12
And when you get to that path, what do you do?
15:14
So in this particular, in this particular case, you know, I'm,
15:21
I'm using Magna Axiom and generally they are a very good,
15:25
very good tool. But I've, I've known about an
15:30
open source tool, Chrome cache view.
15:34
And surprisingly, you know, when I kind of ask people like, have
15:37
you ever used Chrome cache view? They're like, I have no idea
15:39
what that is, but it, it allows us to dig a little bit deeper to
15:44
get behind the scenes of, you know, cache, whether it's in,
15:50
you know, web history, like related to your web history or
15:54
it's related to an application. And in this case, I discovered
15:57
that this thumbnail was associated with Discord.
16:01
And there was no mention of Discord at all during any of the
16:05
conversations that I was aware of.
16:07
So this thumbnail just kind of like, OK, what what's Discord
16:11
got to do with it? I know people chat on it all the
16:14
time. I know there's a digital
16:15
forensics channel on there that's pretty huge.
16:19
But how? Why is it relevant in this case?
16:23
And for the Chrome, say the name of the tool again Mario.
16:25
Chrome cache view. Does it work just on the Chrome
16:29
browser or is it Chromium based browsers?
16:32
I. I it's a, it's a.
16:35
From what I understand, it's like different browsers.
16:37
You can do Internet Explorer. The I guess we don't use
16:40
Internet Explorer anymore shows my Edge, but it's Edge we don't.
16:44
Know what you'd like to use that one either.
16:46
Yeah, all sorts of different browsers.
16:50
But cache, You know, cache folders as a whole.
16:54
Yeah, so people take note. Don't let the name fool you,
16:57
that is just for for crime. And so when I'm, when I'm
17:00
digging deeper, this takes me into this Discord area, right?
17:05
You know, some of us are used to pulling up, let's say iPhone
17:09
backups in app data, right in the app data folder, username,
17:13
App data roaming. And in this case, I found that
17:17
this this thumbnail was associated with with Discord and
17:22
then there was a discord folder inside of roaming.
17:24
So I started looking, just digging deep, you know, looking
17:28
at, and this was before I knew anything about level DBS, you
17:35
know, but here I'm looking at the low hanging fruit.
17:38
What's the low hanging fruit? Text files, log files.
17:41
And there were actually some that were in there.
17:43
And the best way I could describe it was this think of
17:46
like a key log. Think of, you know, it logs some
17:50
of your, what you're typing. It logs a little bit more of
17:53
that sentence and a little bit more of that sentence.
17:55
And it's just this cascading lines of chats.
17:59
I'm a visual person with my hands.
18:01
So it's cascading lines of chats with Unix timestamps.
18:06
OK, so at this point, I think we're in the one sixes at that
18:09
point, you know, Unix time stamps, was it 10 to 13 digit
18:13
time stamps? So I recognize them and I'm
18:16
like, you know, OK, the tools, the, you know, the main tools
18:20
not parsing it out because this is a, this is a raw log.
18:22
So I pull out decode, you know, 1 by 1 like what are these
18:26
timestamps? And with these chats, OI love
18:29
decode, you know, it's simple plug, plug in a time and I'm
18:32
like, OK, I'm getting somewhere. You know, this isn't that time
18:37
of night of this stuff, but you just keep reading down this log
18:40
and lo and behold, there's like things that are making sense,
18:43
things that are mentioning guns, things that are around this time
18:47
time frame. And I'm just like, well, this is
18:50
interesting. And and so I'm like, Oh my God,
18:53
I've got to make some sense of this because this has substance.
18:56
I don't know what I'm looking at and if any examiner tells you
18:59
differently, we don't know everything.
19:02
And. We probably knew we probably
19:04
learned something new in every case or have to do some research
19:08
and I had to do that here and then I learned that that Jay
19:12
Rotter had was in was talking to police in an interview and then
19:18
during. The subject or the the off duty
19:20
officer? Yep, the off duty officer that
19:22
he ended up wiping his phone during that time.
19:26
I was like, OK, why'd you wipe your?
19:28
See, Daisy, I, I accidentally wiped.
19:31
I wasn't there. Like he didn't do it while he
19:36
was like sitting there talking with them or anything, right?
19:38
It's just like right around the. Events I don't remember, I think
19:42
it was like during a quick break or you know, when they he may
19:45
have been out of for a little bit and he wiped his phone.
19:48
So if I may, I'll share my screen one more time.
19:52
And so did. He have two phones, a personal
19:54
phone and and his officer phone, his duty phone.
19:57
He did, yeah. He had different phones.
19:59
He was an he was, he was an undercover narcotics officer
20:04
too. So he had different phones.
20:07
And and so I'm learning like, OK, what what's on the phone and
20:12
if we know anything about phones is you wipe phones, that stuff
20:15
is gone with with encryption nowadays.
20:18
Yeah. So still try, you know, I think
20:23
that's the one I took to Dallas PD to to get a download on it.
20:27
But going back to Chrome cache view, I'm digging deeper into
20:31
this. You know you can see app data
20:35
roaming Discord and then I'm into cache Chrome cache view
20:40
take it to cache load that file and load that folder in there
20:44
and what it gives you a view of just all of the websites kind of
20:49
behind the scenes that are working in transmitting this
20:54
data with you know that's that's happening behind the scenes with
20:58
discord. So this is where the phone comes
21:01
into play is where you know Chrome cacheview again here we
21:06
go eleven O 8. This is 11 O 8:00 PM.
21:10
It was saved in in local time and it gave me you know I was
21:18
looking for that that thumbnail. So here in Chrome cache view,
21:23
you can't see it on this particular screen, but there was
21:27
that thumbnail file name and this link and what you can see
21:32
is you have IMG under score 2020 O 8/26 and knowing how androids
21:42
work when you take a photo that is the time stamp that that
21:46
photo was taken. So I'm like, OK, this we're on
21:52
to something. So this gun photo is now
21:56
associated with not only the thumbnail that I first saw it
21:59
with but also an actual file name that tells me it's an
22:03
Android phone. Now looking back, he only he was
22:08
the only one the the one phone that he wiped was a Motorola
22:11
phone. Everything else was an iPhone.
22:14
So it's like, OK. Put the clues together.
22:17
Yeah, right. But now I can't put this
22:20
particular clue to, you know, I can't go in there and say, Oh
22:23
yeah, I found this particular image because it's not wiped.
22:26
Because he wiped his phone. But you sometimes ruling out
22:30
stuff is good, right. So you're like, well, we know it
22:32
had come from the iPhones. Yeah.
22:34
So we don't expect it to see it see it there.
22:37
Based. On SO that was.
22:38
Naming convention. Right.
22:40
And that was another thing is how do I have an Android file
22:46
name, photo and file name in a gaming computer cache?
22:51
I'm like, OK, this is interesting.
22:54
So this takes research, this takes learning.
22:57
Yeah, I've never seen this before.
23:00
I don't think I've seen anything like it since in what, 6?
23:03
Years. I'm like just my mind, mind is
23:05
wandering as you talk through this.
23:07
I was like, do you have the Discord app on his phone and
23:09
then he had open on his computer and it was caching.
23:12
Is that what was happening here? That's exactly what happened.
23:15
That's exactly what happened. So being the nerd that I am, but
23:19
most importantly, I think, I think some examiners kind of
23:23
forget that when a tool doesn't tell you the stuff or when you
23:28
find something, you got to validate it.
23:31
Yeah, yeah. You absolutely do not want to go
23:33
on the stand and say what's Stacey?
23:36
'S thought that she had just now.
23:38
That is not sufficient. Right.
23:40
And we all know somebody who's done that or you know, and just
23:44
we hope that that's never the case, but you got to spend more
23:47
time on it. You can't be certain that you
23:49
found it. And that's just how it is,
23:51
because what if we didn't know this eleven O 8 was local time?
23:56
What if it was, you know, what if it was, you know, that was
24:02
UTC time or something like that. You got to test it.
24:05
You got to test it in the in the in the environments that you
24:08
find and that you know that are being used.
24:13
So in this particular case, putting together together, I
24:17
find the chats, right? Let me tell you about those
24:19
chats, right? Yeah, we have this cascading
24:23
chat, right? And I have to take some out, put
24:26
them into a log file. And he is talking about shooting
24:30
a milk bottle, an effing milk bottle.
24:32
He says, I, I killed that milk bomb.
24:34
And it's like, what? What's he talking about?
24:36
Right? Then he talked.
24:37
He actually spells out unpasteurized milk.
24:40
And then these have. Not like milk, is that?
24:42
Right. So you're like, whoa, what you
24:44
got against milk? And I think someone go, we'll
24:47
talk about later. But someone actually asking,
24:50
what's your problem with milk? So, but I'm only what I'm
24:55
learning is I'm only getting like one side of this chat right
25:00
here we go again, like why? Why am I not getting everything
25:03
else? Was he talking to someone else?
25:05
Or was he just like, hey, I'm going to write this stuff in
25:08
here and document what I'm doing?
25:10
Probably not. But the the one key was Oh my
25:13
time stamps here at 11:14 and 12:00 seconds Unix time stamp it
25:21
says I just sent A9 Millie in this effing hippie and.
25:26
Oh. Wow.
25:26
I'm, you know, asking the detective.
25:28
That is not milk. I'm like, I am asking the
25:33
detective, like, is this gun a 9mm?
25:35
And he's like, yeah, it is. And so you literally have a
25:40
smoking gun and you have almost a confession.
25:43
Correct, I was about to say. That is in this raw raw log
25:49
inside of discord that I didn't even know they kept that kind of
25:52
stuff. Well, yeah, and your local
25:54
computer too. Right, a local computer that's
25:57
associated with the phone. And he wiped the phone so.
26:00
Wiped the phone. You would have never had that
26:03
from his phone. Yeah, so I'm just kind of like,
26:06
wow, I found this, but now the real work happens.
26:10
How do I prove this? How can you validate that?
26:13
There was another thing that they had shared with me, which
26:17
again, props to the Police Department and their detectives
26:22
that they want to collaborate. Great.
26:25
We all want to be on the same page.
26:27
I absolutely love that. Communication is key.
26:29
Let's share what we have to kind of put this all together.
26:33
So I shared with them this stuff and this is like, here's what I
26:37
found. Is there additional physical
26:39
evidence that can back this, make the case stronger, make
26:43
some sense of it? Is this real?
26:45
Is this the right time stamp? Am I looking at the right stuff?
26:47
Because at this point, I'm sharing this, but I'm also
26:50
saying I've got to prove it. I've got to validate it.
26:53
And so I'm watching this Ring doorbell that's from across the
26:57
street that they had provided. But the time stamps match them
27:01
up. Everything is good.
27:02
And you hear a gunshot outside and it's really loud.
27:06
But your first thought is like, OK, we hear the gunshot and she
27:10
said, is that the one that killed her?
27:13
But she's inside, All right, So why would it be that loud?
27:17
Now, I'm not an audio expert. I will never claim to be an
27:20
audio expert unless I go that route later on.
27:23
But at the time of this, I'm just kind of listening.
27:27
I'm like, OK, he references a milk bottle.
27:30
So you have this timeline of you got a milk bottle that he says
27:34
he shot. You got this Ring doorbell that
27:37
you hear the crack of a gunshot and it's matching up.
27:41
He's like boom, gunshot outside loud.
27:44
And then you have chat about the milk bottle and then you have
27:48
what I, I hear what I thought I heard.
27:51
And you know, you can visualize the sound on like a little, I
27:55
don't know, like a analyzer or whatever.
27:57
Yeah, the waves. Yeah, the waves, I put that on
28:00
my screen and you see this little boom like what sounds
28:04
like a muffled gunshot from the Ring doorbell.
28:08
I don't think there was any audio X.
28:09
Maybe there wasn't a audio expert.
28:11
I don't know. Because you know, we're we're
28:13
under the rule. So at time of court we can't
28:16
hear them testify or anything. So but I don't remember if if
28:20
they had one that listened to that.
28:22
But you know, just kind of putting it all together and we
28:24
go off of a super timeline and like, what's next?
28:27
What do we see? Put it in that, you know, just
28:29
put it in that in that timeline it matched up.
28:33
But who knows. But I also, you know, talking
28:35
with the detectives, like if he shot a fish, we're all like if
28:39
he shot a round in the backyard, there should be a gun.
28:41
There should be a gun casing back there.
28:43
So they go back, they go back there, they find a gun casing in
28:48
the backyard and they found a broken milk bottle in the trash
28:52
can wheeled out to the curb. I recall correctly.
28:56
Just in time right before the trash goes and picks it up.
28:59
Yeah. So you were.
29:00
So you. Were Johnny on the spot?
29:02
But it's like, man, we have physical it's kind of roles
29:06
reverse, right, Because normally we get the physical evidence and
29:09
then we back it up with the with the digital evidence.
29:12
And in this case, the digital evidence pointed us to the
29:15
physical evidence. Wow that we didn't know about,
29:18
right. So I'm like on cloud 9 here.
29:21
And they probably are too because like, wow, like these
29:23
are things are coming together from initial thoughts of hey,
29:27
could this be have been a suicide?
29:30
And so, you know, we started putting all that together and
29:32
again, going back to this is the real work.
29:34
Now, how do I prove this? I have to back this up with some
29:38
sort of testing and research. So I load up a virtual machine
29:42
with Windows 10 same version, same everything, right?
29:47
You got it on the gaming computer emulate that
29:49
environment, install Discord on there.
29:53
I get an Android phone. I installed Discord on there.
29:56
Sign them in to the same account and I'm chatting with, you know,
30:01
I'd reached out for some help or some ideas like how do you know
30:04
how do I do this? Or because again, we don't know
30:06
everything. Tell me more about Discord.
30:08
You know, let's you know where am I looking?
30:11
What am I looking? At you even been on discord at
30:13
all before then? Really before but I had to like
30:18
I don't remember if I created a new account or I reset my
30:20
password or something. So like now I do and I never
30:25
looked at discord the same after it.
30:27
But so I am sending chats back and forth and I'm testing this
30:32
out on a phone. I'm testing on a computer.
30:35
Take a picture of my car with a known time stamp with
30:40
documenting everything like I have my I have my report and
30:44
then I have this testing and research.
30:46
And so I'm documenting the name of the picture when I sent it.
30:51
And I'm going into the virtual machine.
30:53
I'm collecting the exact same thing that I collected from the
30:56
gaming machine. Run it through the exact same
30:58
tool, Chromecast view, and I see the times match up, I see the
31:04
chats timing match up and I see my a file name right there in
31:09
Chrome cacheview. And I'm like, yes, like this is
31:13
making sense. This is all coming together.
31:16
But the you know, the one thing I still didn't have was who the
31:21
heck was this guy talking to you?
31:22
Yeah. Yeah.
31:25
Who else knows about this? I didn't know.
31:28
Again, this was another learning curve of OK, what's a Discord
31:33
channel? I know what a channel is, but
31:36
how does it appear in the actual, you know, in the, in the
31:41
evidence that I'm looking at in this case, I don't know, it's
31:44
like 20 digits or something like that, 20 something digits of a
31:47
channel ID that give this information to the detectives
31:52
and say, hey, write a search warrant.
31:53
I don't know what you're going to get.
31:54
This is the username that I'm finding.
31:56
This is all the information that I'm finding.
31:59
And you know, I will say that unfortunately, you know, we lost
32:03
Detective Mooningham with the Denton Police Department.
32:06
He was one of the lead detectives on there.
32:07
He was, he was the guy I sent, you know, this picture to and
32:11
that we were all talking him and Detective Potts and Detective
32:15
Bearden and these guys are awesome.
32:17
But you know, he, he died from COVID unfortunately.
32:20
So he didn't get to see this through and it, you know, with
32:24
that inherently kind of delays certain things.
32:26
So here we are about to go to trial and I'm like, you know,
32:32
still like, OK, we don't know who he's talking to, but they
32:35
come through, they get the Discord warrant return.
32:38
And this is almost like another test, right?
32:40
So I have my time stamps, I have my validation and my research,
32:46
which is well documented. And always document, always
32:49
document step by step. Send that with your discovery.
32:52
Get it out there ahead of time. You don't want that stuff
32:56
creeping back. Get it out there.
32:58
No surprises. This is part of our report.
33:00
And by the way, examiners, write a report can't tell you write a
33:04
report. Remind yourself, do yourself a
33:06
favor later on. Take notes.
33:09
Report together. Take great notes, document
33:12
everything tested, validated. Don't just trust your tool.
33:15
Get in there, dig deep, be curious when I'm finally when I
33:19
get this discord return and this is almost like a moment of
33:22
truth. It's like oh God how accurate
33:25
are my time stamps or how good is this?
33:27
Is my research enough and everything just fit together?
33:31
Like, oh. Nice took.
33:33
My log took my log and my time stamps took their log and time
33:39
stamps and what I've noticed was in the discord search warrant
33:43
return none of his chats were there.
33:46
What? Yeah, none of his chats were
33:49
there. I don't know if he erased them.
33:51
I don't know if they fell off or I don't know.
33:55
See, I don't think it would have wiped with the phone.
33:57
I think you would have had to have deleted that data within
34:01
Discord 1st is my guess. And then cover the tracks with
34:04
wiping the phone. I don't know.
34:07
I've not done a ton with Discord.
34:09
I've done a tiny bit and it's weird as as your return supports
34:13
what I've seen because like these Discord chats I was
34:17
supposed to grab weren't on the phone and the person was like,
34:21
I've kept my phone disconnected from the Internet because and in
34:25
the network and all the things, it's an airplane mode, no Wi-Fi,
34:28
no Bluetooth because I don't want these.
34:30
I'm afraid these chats will disappear because they will
34:33
delete them from the Discord server completely.
34:36
And so I'm like, OK, we'll get them off the phone.
34:39
But then they weren't on the phone, but they were still on
34:42
the Discord server. And so it's like, why is this
34:44
stuff disappearing? And it also depends, I guess, if
34:47
you're using just the web or you're using the application
34:50
itself and it's saved somewhere. Yeah, but you know, it was
34:55
crazy. And again, it was just like, OK,
34:59
thankfully things match up, but there's missing stuff.
35:03
But it completed the whole picture.
35:05
It gave context. We need context.
35:07
Digital forensics, in my opinion, gives that context that
35:11
a lot of people kind of forget about.
35:13
So I'm excited that these things were we're going together.
35:17
You know, Long story short here, here's another kicker that I
35:22
love it. You know, it was it was a
35:23
strange situation. But when I heard his name, I
35:26
knew exactly who he was when they called.
35:28
Oh, really? Yeah.
35:29
We, I had, I remember backing him up when I was at Keller
35:33
Police Department on a burglary call early on in our both of our
35:36
careers. And then we became semi friends,
35:38
acquaintances, kind of kept in touch a little bit over the
35:41
years, But I hadn't seen him in years, has seen him in years.
35:44
But when, when, when Denham Police Department called me and
35:47
told me who it was, I'm like, wow, OK, But you know, some
35:51
people might that kind of clouds your judgement or whatever.
35:53
Like, no, it doesn't. It's, I always say that our
35:56
loyalty lies with the data, right?
35:59
It doesn't, it doesn't matter. I've, I've been on both sides of
36:02
that where you're either convicting somebody or you're,
36:06
or you're keeping somebody out of jail.
36:08
It's there. It's, it's great to have no
36:11
matter what. So in this particular case, you
36:13
know, you know, I guess everybody thought that, you
36:16
know, every, there's no conflicts, which was good.
36:18
EA's office knew about it, Police Department knew about it.
36:20
Everybody knew. Well, it's not like you were
36:22
besties going over to each other's houses on the weekends.
36:26
No that. Might have been a little bit
36:28
different. I was about to say, you know,
36:30
yeah, I hung out with him years ago, years ago.
36:33
This is 2021 now and probably I think the last time in 2013 or
36:38
so, something like that. So it's been a while.
36:40
But yeah, it's just that part was a little strange and maybe a
36:43
little bit more motivating of like, just make sure you got
36:46
everything right. And I remember the the defense
36:49
attorney, I mean, he's just doing his job.
36:51
I get it. We all have our our roles and we
36:53
all have our jobs. But I remember they requested to
36:56
talk to me about the digital evidence.
36:58
DA's office were cool with it, you know, just being open and he
37:02
asked. Me do like a deposition then no.
37:05
It was a deposition. It was a it was a meeting just
37:07
at his office. And, and I remember him kind of
37:10
asking me, he's like just nonchalantly.
37:12
He's like, you didn't know, Jay, did you?
37:14
And I'm like, yeah, I did. Like I knew who he was.
37:17
And am I going to lie about that?
37:19
That's another thing. Examiners and law enforcement
37:21
don't lie about anything like that.
37:24
I mean, some even something that's simple like lying about
37:27
that. I could have impeached me, could
37:29
have been a reputation killer for the career and taken out a
37:34
lot of the digital evidence that was found.
37:37
So don't lie about that stuff. Yeah.
37:39
And he was probably trying to strategize how he was going to
37:43
question you like. He's doing his job and I.
37:47
Absolutely. Yeah, Those questions, when they
37:49
ask you those questions in those meetings, it's because they're
37:53
building a strategy to defend their client.
37:57
Like you said, they have a job to do.
37:59
Yeah, which respect. I get it.
38:02
Aren't you working with defense attorneys now?
38:04
I get it. But, yeah.
38:05
So all of that, you know, came together and, you know, the
38:08
victim, I you know, I haven't mentioned her name.
38:10
Leslie Hartman was her name. And, you know, she was very
38:13
loved. Lot of people knew her.
38:15
And, you know, she had she had gone through some tough times in
38:18
her life, but truth prevailed. And ultimately, J Rodder was
38:23
found guilty. Did they ever get a conviction?
38:28
I mean, did they ever get a statement from him as to like,
38:33
did he, did he do this? Why did he do this?
38:37
Does anybody know anything? From my recollection, I think
38:40
the, you know, it was that she did it to herself, that she was
38:44
depressed and that. And that.
38:46
Was always that's why she took an opportunity and had
38:50
supposedly shot herself with his gun.
38:52
But digital evidence? That he was actually the one
38:57
that shot her, like you said, somewhat confessed on it on.
39:02
Very much so. That Discord channel, yeah.
39:05
And how long did you have to testify in?
39:09
Trying to remember it was a few hours.
39:12
I mean, it was probably a good half to most of the day if I
39:16
recall. Yeah, it's been, it's been a
39:18
little bit like a couple years now.
39:21
Yeah. Did you have to testify about
39:23
your testing and validation? Did they?
39:25
I sure did that at all. I sure did.
39:29
And then so did that come in with your prosecuting attorney?
39:32
First it did, yeah. So on initial, you know, my
39:36
initial testimony, it did come in as to like how did you know
39:41
that this happened? How did you test?
39:43
Like what did you do to understand that these were the
39:46
right time stamps and so forth? And so I went through the entire
39:51
entire thing and we just kind of get in front of it.
39:53
You know, we're, we're laying out the groundwork of and the
39:56
validity of what I'm finding. Because I think like I would
40:00
say, even attorneys on both sides are just used to some sort
40:04
of forensic tool that is like here it is, this is what this
40:07
is, this is a time stamp. You can read it, it's there.
40:11
And in this case, it's a, it's a big case.
40:13
It's a major case and a major. You've got to document it.
40:17
It's not like you're taking the place of that forensic tool, but
40:20
they would expect to see, and our job as an examiner is just
40:23
to put that into some sort of just something that everyone can
40:27
understand. Right.
40:27
And we'll have to remember we're the voice of the victim.
40:31
Like, yeah, when we put those details together, you're
40:35
speaking for the victim that cannot speak for themselves.
40:38
Anymore. Exactly.
40:39
And yeah, and it's it's a heck of a feeling you know and.
40:43
And you, you got to get it right.
40:45
You absolutely have to get it right.
40:47
That's why I, you know, I tell students, you know, I teach
40:51
forensics both in college, I teach forensics for I Asus
40:56
mobile device forensics. And I just, I love that, right?
41:00
Because this is a passion. This is something that we love
41:03
to do. And we, we love the industry.
41:05
We love that the impact that we can make.
41:07
And that's, you know, not to jump too far ahead, but
41:11
sometimes we're the only ones that that get the opportunity to
41:16
find this. What if if any one of us had
41:18
just stopped at no, no, they were lying.
41:21
They weren't. They weren't watching the video
41:23
and that's it. Or you, since you knew this
41:28
officer and you had worked with him in the past, said this is
41:34
there's no way he could have done like you all of a sudden
41:37
became that bias forensic exam. It could easily have gone that
41:41
way for anyone. Especially when there was
41:44
nothing obvious at first, right? Yeah.
41:46
And that's where, you know, I think that some of us and gets a
41:50
little dependent on just what we see or have a time constraint.
41:55
I had a backlog. I think every forensic lab in
41:59
this country or another countries even have backlogs and
42:03
a shortage of staff with that, with that training and and
42:06
experience. So if we're just pressed for
42:08
time and we don't know what else could be out there or we can't
42:13
dedicate time to go look, what are we missing?
42:17
And, and so like, part of my message and like why I even
42:20
enjoy talking about it right now is if anything is just kind of
42:24
put some inspiration in other people's ear of like, hey, don't
42:29
take for granted the kind of role that we have and the kind
42:32
of things that we can uncover that other people cannot.
42:35
Because what if we just threw that into a portable case and
42:38
say, yeah, the I tagged this photo and I here's some web
42:42
history. Here you go, detectives.
42:45
Look at it. Yeah, and just left it at that.
42:49
Could very well been a suicide rate or classified as a suicide
42:53
and no one would have ever known.
42:55
And they would not have the understanding of how to take a
43:01
separate tool and do this testing and validation that you
43:04
did and do your comparison and decode your time stamps and use
43:11
those, those timelines and correlations of all that
43:19
evidence into a story because you told the story from all that
43:26
correlating of evidence. Yeah, it was, it's difficult,
43:30
right? And we just, it's almost like we
43:33
train this or we learn this and all of our stuff like, well, do
43:37
we really do any of that? Do we really do that here?
43:40
You know process, reader, report, portable.
43:43
Here you go. Go look at it.
43:45
Your chats are in there. That happens a lot.
43:47
It does it. It probably happens more often
43:50
than the opposite of us analyzing, right?
43:55
Yeah, right. Yeah.
43:57
So to see it all come to fruition, to see it all,
44:00
everything come in like almost like all of the training and
44:04
making sure everything is right speaking for those who can't
44:08
speak, you know, it's just, it's very, it's very validating
44:13
forensically and emotionally and.
44:15
You're like, I went to all this training, learned all these
44:18
things that I've finally got to put all to use in one single
44:23
case, right? Yeah.
44:24
You flexed a lot of muscles in that one.
44:26
You know, it was a it was a good, it was good, you know,
44:29
making sure you're thorough, but also nerve wracking.
44:32
Sure you have to testify to it. And again, thanking your past
44:37
self, Like, thank you for putting in this effort early on.
44:40
Thank you for taking notes. Thank you for writing this
44:43
report. Yes, and I think some people
44:45
forget to do. That exactly.
44:48
Well, especially in the testing, it can be hard because you're in
44:51
the middle of it. And once this is like lining up,
44:54
if you haven't taken good notes, you've got to stop and go back
44:57
and start over and take those good notes because they, you
45:01
know, it's going to need to come into court to back up what
45:04
you're saying on the stand. And then Speaking of that, did
45:07
you have to tell your prosecuting attorney, look, I
45:10
did all this testing and validating.
45:11
I need you to ask me about this on the stand.
45:14
Did you have to say that? I absolutely, you know, he, he
45:17
was very thorough, very good, very good DA And you know, he
45:22
just would listen and walk him through the steps and you have
45:27
to like remind them, you know, about best practices is like,
45:31
let's get out ahead of this. Let's let's talk about that.
45:34
This is why it's important. We can't just take it at face
45:37
value. It adds some credibility, it
45:39
adds some validation. It'll make sense.
45:41
And some people may not ask those questions, but I think
45:43
it's important to provide that context.
45:46
Feel like you're educating them. You know, you're educating what
45:51
you did to the prosecution, the DA, you're educating them to be
45:56
able to make and ask the right questions so that you can
45:59
explain and tell the story the way it should be told.
46:03
Exactly, exactly. And I think, you know, there's
46:06
lessons to be learned through each of these cases.
46:08
This one kind of combines a lot of lessons into one, but at the
46:11
same time, it's just, you know, we're always learning and every
46:15
case is different. What's important in one is not
46:18
important in the other. So just it's almost like you
46:21
just got to be on your game all the time.
46:22
And if you have to take a step back and and re evaluate and do
46:25
it. But like you, like you said,
46:27
take good notes because I don't know about you, but just getting
46:32
into that mental flow of like, you know, I'm doing what I need
46:36
to do. I'm feeling good about what I'm
46:37
looking at. Got a clear mind.
46:40
You got to get there. You got to get there and your
46:42
notes will help you get there again when you pick it up
46:44
because you're not solving. You're not solving a case like
46:47
this in a day. I think this took like 2 weeks,
46:50
two or three weeks or something like that.
46:51
So it's a process and. Then you might have a similar
46:53
case years from now, and then you can be like, what case was
46:56
that? And then you can go back and
46:57
look at your notes from that other case that you did
47:00
previously and help you be like, oh, is this similar or is this
47:04
the same? Do I need to do these same
47:05
things again instead of reinventing the wheel every
47:08
single time? Yeah.
47:10
The other thing I want to look back to as well was back the
47:13
Discord chat. So it was in a Discord chat
47:16
channel? Was it like a private channel
47:18
between him and one other person or were there many?
47:20
It was a. It was a private channel, but it
47:23
was it had like a handful of other people there.
47:27
OK. And when I say like everything
47:30
fit like a glove, like they were replying back to the chats that
47:34
I had found. Yeah.
47:36
So I mean, just think of it. If we just knew about Discord
47:41
and we or they wrote a search warrant and only had, you know,
47:44
these interactions, there would be be gaps in that.
47:48
If I just found his chat that was recording, that was logging
47:53
those chats, that would give no context to anything else.
47:57
So it was very validate. I had another level of
48:00
validation. Right.
48:01
Yeah. Well, it.
48:02
Also matters apparently what they asked for in that search
48:06
warrant, because if they would have just asked for like his
48:09
chats or his messages sent and you're saying that search
48:12
warrant didn't return anything, that it could have been nothing
48:14
at all. But since they asked for the
48:15
channel ID apparently or the chats in the channel, however
48:18
they worded it, you got the other side.
48:20
We got the other side and it was all based on that Channel and
48:24
his username that was in the computer.
48:27
So that was another learning thing is like, did I find his
48:31
true username? And that's another thing that I
48:34
just had to validate with when I was doing my testing, I knew
48:37
what my ID was and I knew where to look and it was there.
48:40
That's awesome. So awesome.
48:41
Well, then I don't suppose you know, if anybody that was in the
48:44
channel that was chatting back and forth with him, did any of
48:46
those people come in and testify?
48:48
Not that I know of. Because you got, it sounded like
48:51
you got that search warrant back kind of late.
48:53
Was that close to when the trial was starting?
48:55
OK. So probably no time to do that
48:56
anyways. And I know you said the rule was
48:58
invoked. And so for the people who aren't
49:00
familiar the when the rule is invoked, that basically means
49:04
you can't talk to anybody else who is testifying during that
49:07
trial about the trial. Or listen to or listen.
49:11
Yeah. Or listen to it.
49:11
Yeah, Yeah, that's probably the the bigger thing.
49:13
So you can't go and sit in the courtroom and listen to
49:17
everybody who testified before you.
49:19
That's right. It was interesting.
49:21
It was nerve wracking. I bet you know literally someone
49:24
you know. Someone's fate relies on a lot
49:26
of our testimony. It's not easy, no matter how
49:29
many times we testify. I think there's some some aspect
49:32
of being nervous. You're literally taking
49:34
someone's freedom away with your testimony and.
49:37
If you've got to be right. I was gonna say if you don't get
49:40
it right. And I think like y'all had
49:42
mentioned earlier with, you know, what did the DA prosecutor
49:46
ask and things like that and want to walk through, I think
49:49
it's important to collaborate with them as well.
49:52
And, and so they know what is important because what is
49:56
important to an examiner might be easily overlooked by an
49:59
attorney or vice versa. If if we don't know, so we've
50:02
got a, we've got to really seek to understand why certain things
50:05
are important. Yeah, absolutely.
50:07
So I think Mario, we're kind of at the end.
50:10
Is there anything about this case that you thought was
50:13
specifically significant or educational from your
50:17
perspective that you want to highlight right now?
50:19
Yeah, just to kind of reiterate the importance and the impact
50:24
that we have that our training affords us, our experience
50:29
affords us. You can't go into this job
50:31
without having been curious, without wanting to dig a little
50:36
bit deeper. You just can't rely on the
50:37
tools, as good as they are. They will miss something.
50:40
So dig deep, be curious, and don't take your job for granted.
50:44
Yeah, we got cool titles. If we get to do cool things but
50:48
make it worth it, you're not just doing it for you, you're
50:51
doing it for a lot of people. I think it's just we can do good
50:53
things. Right.
50:54
And work with others. Well, like you said, you had a a
50:57
huge crew that other detectives, other agencies that you guys
51:02
just blended well together and communicated well together.
51:07
They are great guys over there. And then PD, it's on us.
51:10
A couple of them have already retired, but they worked hard.
51:14
You know, this forensic side was some key piece of evidence, but
51:18
that's just a minor part of everything that they did there.
51:21
So kudos to them. I mean, they tied it up in a bow
51:25
and presented it and did a great job.
51:27
We, we wouldn't be where we're at with without that whole crew.
51:30
So great to collaborate, collaborate examiners and
51:33
attorneys and, and detectives or whom, or investigators, wherever
51:37
they need to talk, they need to talk because I think that just
51:39
kind of just open UPS the channel of, of understanding of
51:43
what kind of things that each of us can provide.
51:46
So it's worth it. It's definitely worth it.
51:48
Very good. Was there anybody specifically
51:51
that you wanted to mention in the case now as we wrap up as
51:53
well? Just, you know, memory of of
51:56
Rodney Mooneyham. He was a great detective, did a
51:59
great job. I wish he was there to have seen
52:01
the end results for this Detective Pots and Detective
52:05
Bearden and the rest of the crew of it didn't Police Department,
52:08
they did great, you know, picking up where where
52:12
Mootingham left off and just just great people and very, very
52:16
privileged to have been a part of this case and just lucky in a
52:20
way, but curious and just just glad to be a part of it all to
52:23
to have found and find justice for Miss Hartman.
52:26
Well, we truly appreciate you giving us this story, this case,
52:32
the insight, the education, especially for all of our
52:35
listeners that come here to to learn more.
52:38
So you provided a case and some education and we truly
52:43
appreciate your time tonight. Thank.
52:45
You thanks so much. Appreciate y'all.
52:46
Yeah. All right, until until next
52:49
time, stay safe, stay sharp, and as always, keep parsing the
52:52
truth one bite at a time. If you enjoyed this episode,
52:57
make sure to follow us to get notified the next time a new
53:01
episode drops. If you can do more, head on over
53:04
to parsingthetruth.com and donate by clicking on the donate
53:09
button. Parsing the Truth is a nonprofit
53:11
organization and we are raising money to send a new digital
53:14
forensic examiner to I Asus training next year in Orlando.
53:18
Thanks. Yeah, yeah, yeah, yeah, yeah,
53:26
yeah, yeah, yeah.