Latest / Parsing the Truth: One Byte at a Time / Karen Read 1-4: Ian Whiffin Testimony P1

Transcript

Karen Read 1-4: Ian Whiffin Testimony P1 · Parsing the Truth: One Byte at a Time

0:01
Join former FBI Senior Forensic Examiners Becky Passmore and
0:05
Stacey Eldridge as they dig into the world of digital forensics
0:08
one bite at a time. Now leading their own consulting
0:11
firms and educating the next generation of cyber sleuths,
0:14
these badass babes of digital forensics bring sharp insight,
0:18
real world case experience, and a dose of humor to the bits and
0:21
bites that filled today's investigations.
0:23
From deep dives into business e-mail compromise and ransomware
0:26
attacks, Becky's specialty to cracking the complexities of
0:29
iPhone forensics, Stacy's obsession, this podcast delivers
0:33
insider knowledge for professionals, students, and
0:36
true crime techies alike. If you've ever wondered what
0:39
really happens when the digital trail is all that's left, TuneIn
0:42
and start parsing the truth. Parsing the Truth One Bite at a
0:53
Time is proud to welcome our first sponsor, ACE Forensics.
0:57
They are based near Chicago and they've been building systems
1:01
since 1983. ACE Forensics delivers high
1:05
performance digital forensics workstations, laptops and
1:08
servers to justice agencies across the United States and
1:12
around the world. They offer unmatched value and
1:15
the industry's only five year digital forensics warranty.
1:20
ACE Forensics build the systems more digital forensics software
1:23
deserves. If you're procuring digital
1:26
forensics equipment, reach out to them for a competitive quote.
1:29
Now on to our episode. Welcome back to parsing the
1:33
truth One bite at a time. I am Stacey Eldridge and with
1:37
me, as always is my Co host Becky Passmore.
1:40
If this is your first episode, you should know we are the
1:43
podcast that focuses on digital forensics in today's modern
1:47
crimes. So yes, we're talking about true
1:49
crimes, but our focus is the and the artifacts that the digital
1:53
forensic examiners are finding or sometimes not finding in
1:57
digital evidence. Becky, what are we doing
2:00
tonight? Well, welcome.
2:01
Back everyone, today we're continuing our coverage of the
2:05
first Karen Reed trial and we're getting into the testimony of
2:10
the prosecution's second digital forensics expert in within.
2:15
And I have to say, Stacy, when I was going through my notes on
2:19
this, I kept having to slow down and reread things because the
2:25
technical detail here is dense, but it matters.
2:28
All of it matters. Every single piece of it matters
2:31
to to understanding what the data actually shows versus how
2:35
it was initially characterized. I totally agree, Becky.
2:39
And I think that's one of the things that makes this testimony
2:42
so important to go through carefully.
2:45
And if you think about it, you and I have listened to the
2:48
testimony more than a handful of times for each person.
2:52
We've referred to our notes about a million times.
2:55
So just imagine how the jury is feeling as they're hearing all
3:01
of this stuff. I mean, we're kind of coming at
3:03
it from two different angles, right?
3:05
Because they're looking at it from, you know, the if Karen
3:09
Reed did or did not do what she's accused of.
3:12
And we're looking at it from more of an educational
3:14
perspective. And we got to make sure that we
3:16
understand all these artifacts. But the point being is if the
3:20
jury doesn't understand something, then they tend to not
3:23
take it and then to regards, right?
3:26
And so, you know, I think people hear phrases whether it's on the
3:31
news or in the courtroom, they say stuff like Celebrite said.
3:36
And the celebrite in this case, it said the celebrite report
3:40
identified a search at 2:27 AM. Sounds very clean, sounds very
3:46
definite, right? It's a sure thing.
3:48
But what Ian Tiffin ends up doing over the course of his
3:52
testimony is he essentially pulls back all the artifacts and
3:56
things that make this up. He goes layer by layer, and he
4:00
shows the jury that there's a lot more going on.
4:03
It's just not this one artifact that tells the whole story.
4:07
The data doesn't lie, but the interpretation can be confusing
4:12
and misleading. So it's easy to understand why
4:17
people have strong feelings about this case, evidence, these
4:21
artifacts and these findings. So that's why we're walking
4:25
through it very carefully. Yeah.
4:27
And and we, we have to listen to and hear what's being said and
4:33
articulate that for a listener. So let's get into it.
4:36
All right, so the defense or excuse me, not the defense, the
4:40
prosecution's second digital forensic expert witness is Ian
4:44
Wiffin. He is the decoding product
4:46
manager at Celebrite. Now you should know that before
4:50
he started his employment with Celebrite, he was a law
4:54
enforcement officer in both the United Kingdom and Canada.
4:59
He states in his current role, he uses his knowledge of digital
5:02
forensics and the digital forensics community to assist
5:05
developers with creating and maintaining a program that the
5:09
examiners would want to actually use.
5:12
Right. He also developed his own
5:13
forensics tool called Artex which he has worked on for
5:18
around 5 years. He built it because as an
5:21
examiner he kept running into applications.
5:24
He needed a parse that the main vendors didn't support.
5:27
He has given it away free to the digital forensics community and
5:33
it now has approximately 500 users globally.
5:37
It is taught as part of SANS digital forensics training
5:41
course. He maintains a personal website
5:44
where he shares that research and those tools with the
5:47
community, and he has published articles related to the
5:51
artifacts found on mobile devices.
5:54
Yet I think I can't remember which one it was, if it was the
5:57
Magnet Forensics Virtual Summit or the Mesabi Fund.
6:00
But and one of those somebody during their presentation
6:02
specifically mentioned Art X. So, you know, people definitely
6:07
use it. 500 sounds small, but digital forensics isn't, you
6:10
know, like millions of people doing it at that level across
6:14
the globe. And I will say I personally
6:16
tried to use it in a case about, oh, it's coming up close on two
6:21
years ago because the other side had mentioned that they had used
6:24
it. So I was like, OK, well, let's
6:26
see what it's all about. And I was like, I didn't see a
6:29
need for me to use it at that time.
6:31
But Fast forward to a couple months ago, I did use it in a
6:35
case. So it definitely has its niche
6:38
uses a for sure. It's it's a solid tool.
6:41
He's got a really nice read me file that totally gets you up
6:44
and going and up to speed right away.
6:46
So if you're looking for a tool that does something that your
6:49
other tools don't do and it's free, you might want to check it
6:53
out for yourself and see if you can use it.
6:55
Yeah, for sure. But anyway, let's get back to
6:58
the testimony. So Celebrate also operates a
7:02
global e-mail address called Stumpers, and it's open to any
7:05
user. And the idea behind it is that
7:08
if an examiner comes across an artifact they can't explain,
7:11
they can e-mail this e-mail address.
7:14
And then Ian Wiffen and his colleagues, they'll research and
7:18
reply to the why. So you can get some information
7:21
about artifacts that way. Now, he was also asked as he was
7:25
getting on the stand, you know, about his prior court
7:28
experience. He said he has testified about
7:30
20 times, mostly in Canada, but also once in Michigan and once
7:36
in Australia and one more time in the UK, the United Kingdom.
7:41
So here's a fun fact. If you remember our guest at the
7:44
end of the mushroom murder series, Doctor Sorrell, he had
7:48
told me a while ago that he had actually testified in a trial
7:52
with a Mr. Whitman. They were both there.
7:55
I'm not sure who was on what side, but but that's so funny
7:58
that we had Doctor Sorrell on the show and he testified in the
8:02
same trial that Ian did. So it does show what a small
8:05
community we are, right? Agreed.
8:07
Agreed. Now let's talk about how Wiffin
8:09
got involved in this case. In September 2023, he was
8:13
initially contacted by a celebrite colleague who had been
8:16
asked about a confusing time stamp found on a device.
8:21
He asked the colleague to connect him with the
8:24
investigators and share any information that they could.
8:27
He was then advised that the full extraction of the device
8:30
had already been uploaded to Celebright's support network, so
8:34
he was able to access it directly and begin his analysis.
8:38
An extraction, he explained, is all of the files and folders
8:43
extracted from the same device saved in a zip file container in
8:47
a way that is as close to the original form from the device as
8:52
possible. Question he was asked to answer
8:54
was to explain the 2:27 AM time stamp that was associated with a
9:01
web history artifact. So very similar question was
9:05
posed to him that was posed to Jessica Hyde that we talked
9:09
about her testimony in the past two episodes.
9:11
And again, the investigators found this time Sam, it's simply
9:15
didn't make sense to them. And Wiffen is explaining this.
9:18
And then he also noted that several weeks later, around
9:22
December time frame, he was contacted by a police
9:26
investigator in Austria with a very similar question about a
9:30
different, different Internet search.
9:32
And then about a week after that, the defense expert in that
9:36
same Austrian case also contacted him and asked the same
9:40
question. Now in that case, the defense
9:42
expert was able to provide him with the database and then
9:46
weapon was able to provide the answer.
9:48
You know, commentary here. It's definitely not a one off
9:51
situation where examiners had questions about artifacts and
9:56
they contact Celebrite. And in this case it seems to be
9:59
the same artifact and multiple people are emailing Celebrite
10:03
about it. So they took the expected steps
10:06
here, right? They were trying to figure out
10:08
what the heck was going on with the time stamp.
10:10
And one valid research Ave. is to certainly call the tool
10:15
vendor that processes it out and asked they them like, how are
10:19
you populating that artifact? How are you parsing it out?
10:22
What is that coming from? And they can certainly validate
10:25
if they are parsing it out as expected, they might be able to
10:29
tell you more behind it. They might not.
10:31
They might just say, yes, it's parsing as expected.
10:34
And then you might have to go and figure out the significance
10:36
of that artifact and what it actually means.
10:39
But good first step to contact celebrate, right?
10:41
That's right, that's right. So within starts by walking the
10:45
jury through the Safari history database, history dot DB, and
10:49
once the exhibit is admitted, it's displayed on the screen for
10:53
everyone in the courtroom to see.
10:55
It contains a selection of records of the history dot DB,
10:59
he points out. Records highlighted in green are
11:02
from 2:27 AM and they are all connected to a website called
11:08
Hockomock Sports. There are four of them in total,
11:12
all just seconds apart from each other.
11:14
And he also notes that they that there are earlier visits going
11:19
back to 12:42 AM, also for Hockomock Sports.
11:24
So this is a site that I've been visited multiple times over the
11:28
course of several hours that night.
11:31
And before he gets into the substance of what those records
11:35
means, he takes some time to do some foundational explaining.
11:41
He explains what the Escalite database actually is and how it
11:45
works. He explains that every record in
11:48
the database is assigned a unique ID number, and that the
11:53
number is never reused. So here's us explaining it.
11:56
For example, if you're going through this database and you
11:59
see that these ID numbers jump, say you have 4:12, 4/13, and
12:04
then it jumps to 4:15, that gap tells you that record 414
12:10
existed at some point and now it's gone, so it's been deleted
12:15
from the database. Why is it gone?
12:17
That's some work you'll have to do as a forensic examiner to see
12:20
if you can determine that. But essentially this is a nice
12:24
paper trail that's built into the database itself.
12:28
And so he said when he looked at the records in the history dot
12:32
DB between early January and February 2nd, so before and
12:37
after the night in question, he found no gaps at all.
12:41
He said all the unique ID numbers were completely
12:44
contiguous and so that means from his analysis no records had
12:48
been deleted from that history dot DB during that time period.
12:54
That's going to become a really important point later, so it's
12:59
worth keeping in mind. Then they turn to a searched
13:03
items record parse from the browser state dot DB, and this
13:08
specific record from 2:27 AM is entered into evidence as Exhibit
13:15
615. Again, we'll put the link to the
13:17
exhibits in the show here. In the show notes within
13:21
explains that this record shown is what's called a derivative
13:27
item. It's not a primary record of a
13:29
website. It's constructed from web
13:31
history records and used to identify searches that were
13:36
conducted. Celebrite extracts the search
13:39
query and presents it in a readable form.
13:42
In this case, the value logged in that record was House Long to
13:48
Die in Cold. Also remember from Jessica
13:51
Hyde's testimony that the browser state dot DB is
13:55
responsible for tracking the Safari tabs.
13:59
I learned something here from his testimony.
14:01
Well, I learned lots of things from everybody's testimony, but
14:05
I'm not a big celebrate user. And so this he said that the
14:08
searched items was a derivative item.
14:11
I thought that was very interesting.
14:13
So there's not something, you know, a database that says
14:16
here's all the searched items, but they are looking for search
14:18
queries and putting it out here. So again, that's something
14:21
interesting and good to know about how your tool works.
14:24
Next up, a few different artifacts backs are discussed.
14:28
First, he describes the knowledge.
14:30
C dot DB is a system database that logs a large amount of
14:34
information about the device. He explains that it records
14:37
things like the backlight turning on and off when the
14:40
device is locked and unlocked, when an application is in focus,
14:44
and of course what that application is, and the length
14:48
of the time in focus. And he explained that in focus
14:52
simply means that that's the primary item visible to the
14:56
user. So if you're using a phone,
14:59
you're probably familiar with having multiple apps running all
15:02
at the same time, but generally you're going to look at 1:00 and
15:06
it's going to be on the top, and then everything else is behind
15:09
it in the background. And so in Apple terminology and
15:13
in the logs, the one you are actively using is considered the
15:16
one that is in focus. So something to think about here
15:20
is if you can see or determine what app is in the foreground,
15:24
then you might be able to determine what web page was in
15:29
focus as well. Interesting.
15:31
Then it's back to the browser state dot DB.
15:34
He states. It's just a name that Apple gave
15:37
to it, and he's careful to explain that the browser state
15:41
dot DB has a history. It's changed quite a bit over
15:45
different versions of iOS and iOS. 14 stored the state of open
15:51
browser tabs, but then starting with iOS 15 the behavior changed
15:56
significantly. Records are now only written to
15:59
browser state when a tab is closed, so it doesn't give you a
16:04
window into what's currently open, it's a log of what was
16:09
previously closed. And I again, this goes back to
16:14
why it's important to understand which iOS version you're
16:17
analyzing. Yep, and that distinction that
16:21
in this version it logs closed tabs, not open tabs is at the
16:27
heart of why this 2:27 AM time stamp has been so contested.
16:33
I think based on how it was an iOS 14 and then just the name of
16:39
some of the columns and stuff in here, people assume that that
16:43
time stamp represented when the search was conducted.
16:47
And again, as he's testifying here, he mentions that he
16:51
developed Art X and that he uses it for his own research
16:55
purposes. And he also mentioned that it
16:57
does have some capabilities that aren't available in other
17:00
commercial forensic tools. And so that's why he's able to
17:04
see certain things in the data that a standard analyst might
17:08
miss. OK, then he's asked directly why
17:12
does the browser state record from 2:27 AM appear as deleted,
17:18
and he says simply because it is deleted.
17:21
He explains that there are two ways a user can delete browsing
17:25
data. Either they wipe everything all
17:28
on the device, or they delete selectively, which could mean
17:32
deleting individual items or choosing a time window like the
17:36
last hour or the last two days. They start to ask him why he
17:41
doesn't believe the user was responsible for the deletion,
17:45
but there's an objection and a sidebar, and that line of
17:48
questioning gets dropped. Next, we move on to the mobile
17:52
safari dot P list. We talked about this in the last
17:55
two episodes, so it's a.com dot apple dot mobile dot safari dot
18:01
P list. And anyways, if you don't have
18:03
that memorized yet, you will soon, but we're going to just
18:06
kind of say it short with a mobile Safari P list to keep it
18:10
easy here. Anyways, this is another piece
18:13
of foundational information that the jury needs to understand
18:16
background information, refresher information from some
18:19
of you AP List is short for property list and this is how
18:23
Apple stores serialized data. Often mentioned that
18:26
specifically that it stores a serialized data.
18:29
Our commentary is you can think of it as a structured list with
18:34
names paired with values with and continues on.
18:38
It is primarily used to store your preferences.
18:42
Some examples of that would be like do you want light mode,
18:44
dark mode, how often your tabs would auto clear.
18:47
And he also explained, here's the interesting thing that
18:50
recent search history and the search method will be saved in
18:55
it. And here's a key detail that he
18:57
went over that you need to keep in mind.
18:59
For a search to be logged in this P list file, it has to be
19:03
typed into the built in Safari search search bar.
19:09
You're saying, well, what is the built in Safari search bar?
19:12
So on your iPhone, that's the one that appears just above your
19:16
keyboard on the iPhone. So if you would go to google.com
19:20
and type in whatever your search is into Google search bar window
19:26
there within the browser, like in the middle of the page, that
19:28
will not get logged into this P list.
19:31
The P list is only going to capture what is in Safaris
19:35
native little search bar there right above your keyboard.
19:38
And let's see this exhibit number, he shows it an exhibit
19:43
number. I didn't catch it, but all of
19:45
his exhibits go in order. So you can once you get the his
19:49
exhibits, you can go through an order and see them all.
19:51
There didn't seem to be any missing from what we link to,
19:54
but in this exhibit of the P list, he's showing three search
19:58
terms and they're in reverse order.
20:01
So the newest going down to the bottom, I call that reverse.
20:05
I always put the oldest on top. I don't know what everybody else
20:07
does, but that's my mind. Oldest on top, just like us,
20:10
right, Becky? But anyways, so it does show in
20:14
here these two important search terms.
20:16
And this is the point of his exhibit.
20:18
I believe it shows that House long to die in cold and how.
20:23
Long to die in Kikti are both in there and their search term time
20:29
stamps and UTC and then it has it local, but it matches what
20:32
we've been talking about with the house Long to die in cold at
20:35
6:24 and the How long to die to die in kikti is at 6:23 AM.
20:43
Glad you say those terms. He also addresses private
20:46
browsing directly. In private browsing mode, Safari
20:50
doesn't save searches. It doesn't save navigation
20:53
history. Nothing gets logged.
20:56
So if someone had conducted these searches in a private
20:59
browsing session, these records simply wouldn't exist.
21:03
He's asked whether, in his opinion, these searches were not
21:06
conducted in private browsing mode, and he says yes.
21:12
The existence of the records is itself proof that private
21:17
browsing was not active. Yeah.
21:19
And I thought the way the lawyer phrased that question was kind
21:23
of odd because he says yes, but you would think like the answer
21:26
you want is no. So again, you have to listen
21:29
carefully and answer carefully when you're answering these
21:32
questions. But hopefully he knew that this
21:34
is that this was coming. And of course, if you don't
21:36
understand, ask. So he goes on to explain
21:40
something else called failure to load.
21:42
And you should take no, because this is also going to become
21:45
central to understanding why a couple of these searches don't
21:48
appear in the history DB, and they'll talk about that later
21:52
on. So a bit of a preview.
21:53
Now we're giving you that tip. The jury didn't get that tip.
21:57
They can't like preview their testimony.
21:59
But anyways, Whiffen explains that when you navigate to a web
22:03
page, some data streams from the web to the device and then it
22:07
renders on your screen. And then at the completion of
22:11
that load event, a function wrote, a function runs and then
22:14
records that visit to history dot DB.
22:17
But if the page doesn't load, if it doesn't finish loading, if
22:21
you lose your Internet connection, something like that,
22:23
if you close the tab before it finishes or if you get an
22:26
explicit failure to load message, the function will never
22:30
run and nothing will get written to the history dot DB.
22:33
He does specifically note that he has seen some failures to
22:38
load events logged in the browser state dot DB before, but
22:43
they don't always show up there either.
22:45
But the point of all of this is to take away that a search can
22:49
be conducted, a page can be requested, and if it never
22:53
loads, the history DB won't show that it ever happened.
22:56
I'm not going to be. In there, he's asked whether the
22:59
P list saves all sorts of history.
23:03
He says no. Primarily used to save
23:06
preferences such as light mode or dark mode or settings like
23:10
when you want your tabs to auto clear.
23:12
It does have several days of search history, though he
23:16
doesn't know exactly how many days worth.
23:19
He explains that for a search to be saved there, it must be typed
23:23
into the Safari search bar that appears just above the keyboard
23:28
on the iPhone. Typing into the Google search
23:30
bar with the browser will not be logged.
23:32
There. So it's a good, some good
23:34
repetition going on there. I think it's good for the jury
23:36
to hear some of this stuff a couple of times to, you know,
23:39
get them to think and then maybe it'll be like, oh, we should go
23:41
back and reference some of this testimony.
23:44
But anyways, next he is asked what he observed about the two
23:48
searches at 6:23 and 6:24 AM. And he answers that they were
23:54
conducted using the built in Safari search bar, but they
23:58
don't appear anywhere in the history dot DB.
24:01
And since there are no deleted records in the history dot DB, I
24:05
think I would say missing from the there's no records is
24:08
missing from the history dot DB would be the better way to say
24:10
that. Anyways, he concludes that those
24:13
pages never successfully loaded. So next, he's then shown a
24:17
comparison document, a table that lines up search terms from
24:21
the Mobile Safari P list against corresponding entries in history
24:28
dot DB. For the vast majority of
24:30
searches, there's a match a matching entry in history dot DB
24:35
within about a second. But the two searches from 6:23
24:40
and 6:23 AM and 6:24 AM How long to D in D and house long to die
24:50
in the cold Die in cold. Those do not have any
24:53
corresponding entry in history dot DB.
24:57
So you need to remember this isn't all of the Internet
25:01
history. This is only the Google search
25:03
terms matched up with search terms in the P list so far.
25:07
For its to be present in the exhibit, the Google search term
25:12
has to be in both the P list and the history dot DB.
25:17
You see a search in both for Raining Maine on 1/27 at 4:49
25:23
PM. Supposed to be raining men,
25:25
sorry. You see a search in both for
25:28
raining men on 1/27 at 4:49 PM. We're assuming local time based
25:34
on other exhibits. We see Antoinette Oco and
25:39
Basketball on 1/28 at 11:38 PM, Nothing from the 29th.
25:46
Then BPD and John O'Keefe at 18 O 6:00 AM.
25:52
Then BPD and John O'Keefe at 1:30 at eight O 6.
25:59
AM and he's next asked about what he concludes from all of
26:02
that. His answer is that both searches
26:04
were entered using the built in Safari search bar.
26:08
The P list confirms that, but neither page ever successfully
26:11
loaded, otherwise there would be a record the map.
26:14
The absence of any matching entry in history dot DB combined
26:19
with the confirmed absence of any deleted records from the
26:22
history dot DB leads him to conclude that these pages simply
26:26
never finished loading. He reiterated again that the two
26:29
searches from 6:23 and 6:24 AM, the How long TD and Kikti and
26:36
House Long to die in. Cold he explains how browser
26:40
state dot DB works, again reiterating that in iOS 15 it is
26:45
only written to when a tab is closed.
26:49
In private browsing mode, records are never written to it
26:53
at all, So what it gives you is a list of previously closed
26:57
tabs, not of you of what is currently open.
27:00
He's then asked what the last view time field means.
27:04
Based on his research, it relates to one of four events.
27:08
When the user creates a brand new tab, when they switch tabs
27:12
and bring 1 back into focus, when they close a tab which
27:16
automatically brings a backgrounded tab into focus, or
27:21
when Safari has been completely closed and then reopened.
27:25
Now you might be asking yourself like we've been asking
27:28
ourselves, but what about the open tabs?
27:30
Where do they go? Don't they matter anymore?
27:33
So they went to Safari, tabs dot DB, and I believe that also
27:38
occurred in iOS 15. I definitely know it's present
27:42
in iOS 16 and logically it would make sense for that change to
27:48
occurred in iOS 15, right? Because where did the open tabs
27:51
go? Sometimes Apple doesn't make
27:53
sense. So make sure to test this out
27:55
for yourself if you're having to deal with this in your next
27:58
case. Now back to the testimony.
28:01
Wiffen was next asked to explain how an earlier time stamp could
28:05
be associated with a subsequent search.
28:09
So he explains that if he creates a 12:00 tab, minimizes
28:13
Safari, he could leave it for several hours, days, weeks, and
28:18
that this time difference of how long he's leaving you alone
28:20
doesn't really matter. But when you finally come back
28:23
to it and open it up again, open safari again from the
28:26
background. The time stamp is not going to
28:28
be updated, so it's still going to show 12:00 PM today of when
28:32
it was open, and it's going to show whatever the most recent
28:37
navigational event is. He's saying he could open
28:41
something 3 weeks later using the same tab that was open today
28:45
and the time stamp is still going to show today's date and
28:48
time. Is that crystal clear or clear
28:52
as mud? I don't know.
28:53
But the take away here is basically the time stamp does
28:58
not have anything to do with the value that URL that is present.
29:04
You have to keep remembering that this time stamp is about
29:07
the tab, not the browsing itself.
29:11
Next, he's shown the entire. Google.
29:13
URL entry for the browser state dot DB search.
29:18
It's exhibit 6/18. He explains the columns.
29:22
So again I'm going to read from the above screenshot, which is
29:27
also going to be LinkedIn your show notes.
29:30
When asked how this relates to earlier testimony, he says this
29:34
confirms the Safari search bar was used and matches the records
29:39
shown in the Safari P list shown earlier.
29:43
Next up is Exhibit 619. These are the live records in
29:48
the browser state dot DB. Now you might be wondering what
29:51
do you mean by live? These are all the records that
29:54
are actually sitting in the browser state dot DB file.
29:58
Think of it as a file for a second.
30:00
This data is not coming from the wall file.
30:05
Take note that there's only some records displayed.
30:08
There is 4021 through 4025 and then 4031 and 4032.
30:15
So you can see there are some records missing.
30:18
The search for house Long to die in cold is not shown and the
30:22
time stamp on the far right is under the field name last view
30:28
time stamp and it's shown in local time.
30:32
There's just a variety of different searches showed in
30:36
here, some related to Canton High School, logging into your
30:40
PayPal account, a different bank account, so miscellaneous stuff
30:45
is shown in that exhibit. And so then Next up is exhibit
30:49
620, and this is the entries from the wall file for browser
30:55
state dot DB. He's asked what he sees in the
30:58
exhibit, and he notes that some numbers are repeated and
31:02
explains that because there are different versions of the same
31:05
record, there are three records where the only difference
31:09
between them is the tab order. He also points out that there is
31:14
no page title on any of them, which is due to the page never
31:18
having completely loaded. He then confirms there are no
31:22
private browsing indicators logged here, noting that private
31:26
browsing activity isn't even recorded in browser state
31:29
anymore. That means these searches were
31:32
not conducted in private browsing mode.
31:35
He also explains that what a session is and how it applies in
31:40
this context. A session is essentially the
31:43
life of a particular tab, and all the activity within that tab
31:49
is considered part of the same browsing session.
31:52
Let's go ahead and wrap up the episode here.
31:55
It's a good stopping point. We're probably a little more
31:58
than halfway through his testimony, but I think it's a
32:01
good stopping point. We could take a minute discuss
32:03
anything that we've heard so far.
32:05
Becky, do you have any comments or anything you'd like to
32:08
rehash? Guys think Ian Wiffen does a
32:10
great job in explaining the differences.
32:15
There's a lot of databases, there's a lot of restored
32:19
information, and then there's different versions of the iOS's
32:23
that he's able to articulate where and what falls within each
32:30
one of these categories. And so I think he does a really
32:32
good job in breaking that down and making it clear and like you
32:36
said have some repeatable comments and testimony for his
32:40
testimony and to make it be able to under be understood by the.
32:45
Jurors yeah, definitely. And I think some of the exhibits
32:49
that were created are helping to put these things together like,
32:54
oh, it shows which search terms were both in the P list and the
32:58
history dot DB. And then he's working to
33:01
explain, well, why he, you know, they're talking about failure to
33:04
load and that's impact and why if there's a failure to load, it
33:09
doesn't show up in the history. DBI think the thing because I
33:12
want to hear as a forensic examiner is a little bit
33:15
different than what the jury wants to.
33:17
Hear right, of course. They have it all make sense.
33:20
But I I think it's, it's getting there.
33:22
I think it's a, you know, he's explaining the different things
33:26
and how they all kind of link together.
33:28
I think the story is building. Yeah.
33:30
And I and I like how he takes this and builds on top of the
33:34
story as the second digital forensic expert in this trial.
33:38
Yep. No analogies from him yet.
33:40
I mean Jessica Hyde had that great analogy for the wall file
33:45
with the in the restaurant. That was great, but sometimes
33:49
you don't need an analogy, correct?
33:50
Or it doesn't come up. Right, exactly.
33:52
So join us every week on Thursday as we continue to dive
33:55
into Karen Reed's first trial. Next week, we will be wrapping
33:59
up Ian Wiffin's testimony. If you've enjoyed this episode,
34:03
we'll just ask you a favor. Can you just leave us a review?
34:06
Wherever you listen? It helps new listeners find us.
34:10
So until next time, stay safe, stay sharp, and always keep
34:14
parsing the truth one bite at a time.
34:18
If you enjoyed this episode, make sure to follow us to get
34:21
notified the next time a new episode drops.
34:24
If you can do Morehead on over to parsingthetruth.com and
34:28
donate by clicking on the donate button.
34:31
Parsing the Truth is a nonprofit organization and we are raising
34:34
money to send a new digital forensic examiner to I Asus
34:38
training next year in Orlando. Thanks.
34:45
Yeah. Yeah, yeah, yeah, yeah, yeah,
34:49
yeah, yeah. Yeah.