Latest / Parsing the Truth: One Byte at a Time / Karen Read 1-10: Richard Green Testimony P2

Transcript

Karen Read 1-10: Richard Green Testimony P2 · Parsing the Truth: One Byte at a Time

0:01
Join former FBI Senior Forensic Examiners Becky Passmore and
0:05
Stacey Eldridge as they dig into the world of digital forensics
0:08
one bite at a time. Now leading their own consulting
0:11
firms and educating the next generation of cyber sleuths,
0:14
these badass babes of digital forensics bring sharp insight,
0:18
real world case experience, and a dose of humor to the bits and
0:21
bites that filled today's investigations.
0:23
From deep dives into business e-mail compromise and ransomware
0:26
attacks, Becky's specialty to cracking the complexities of
0:29
iPhone forensics, Stacy's obsession, this podcast delivers
0:33
insider knowledge for professionals, students, and
0:36
true crime techies alike. If you've ever wondered what
0:39
really happens when the digital trail is all that's left, TuneIn
0:42
and start parsing the truth. Parsing the Truth One Bite at a
0:53
Time is proud to welcome our first sponsor, ACE Forensics.
0:57
They are based near Chicago and they've been building systems
1:01
since 1983. ACE Forensics delivers high
1:05
performance digital forensics workstations, laptops and
1:08
servers to justice agencies across the United States and
1:12
around the world. They offer unmatched value and
1:15
the industry's only five year digital forensics warranty.
1:20
ACE Forensics build the systems digital forensics software
1:23
deserves. If you're procuring digital
1:26
forensics equipment, reach out to them for a competitive quote.
1:29
Now on to our episode. Welcome back to parsing the
1:33
truth one bite at a time. I'm Stacey Eldridge and with me,
1:37
as always, is my Co host Becky Passmore.
1:40
And we are the true crime podcast that focuses on digital
1:44
forensics and the facts and the artifacts of the case.
1:48
We talk court cases, our own cases, and we also bring other
1:52
digital forensic examiners on to share what they've learned from
1:55
their work. Tonight, we continue our focus
1:57
on court cases. Becky, what are we digging into
2:01
today? We're still in the Karen Reed
2:04
trial, and so today we are diving into the second-half of
2:09
Richard Greene's testimony. So if you recall last week, he
2:14
is the digital forensic expert called by the defense to testify
2:20
in the first Karen Reed trial. Here's a if you haven't listened
2:25
to last week's episode, you'll want to go back and listen to
2:28
Part 1 of Greene's testimony. Here's a quick refresher
2:33
regarding the first half of his testimony.
2:35
The big takeaways from the testimony included his finding
2:39
that O'Keefe arrived at 34 Fairview Rd. at 12/24/20 8:00
2:46
AM. That is supported by location
2:51
cache data and Apple Health records showing steps, distance
2:56
and floors climbed in that same window.
2:58
He also raised questions about time stamp reliability by
3:02
pointing to ways using a monotonic clock that ran about 3
3:06
minutes faster than the standard wall clock time.
3:10
The most consequential part of his testimony centers on
3:13
Jennifer Mccabes phone, where Green says he found a deleted
3:18
Google search for House Long to Die in cold time, stamped at or
3:23
before 2/20, 7:40 AM on January 29th.
3:28
And it's consequential for two reasons.
3:30
First, it directly conflicts with both the conclusions of
3:34
Jessica Hyde and Ian Whiffen, who testified for the
3:37
Commonwealth. And secondly, this search
3:40
implicates someone else in the death of Mr. O'Keefe.
3:45
Yeah. So let's pick back up with
3:47
Green's testimony. Remember that this is his direct
3:50
testimony and the defense counsel is asking the questions.
3:55
At this point, the testimony turns to exhibits regarding data
3:59
and exhibits from McCabe's phone.
4:02
Green is shown exhibit. MMM.
4:06
Contacts Uncle Brian. A A celebrate report that lists
4:09
out a deleted call record from McCabe's phone to Uncle Brian.
4:13
A. There's an objection and a
4:15
sidebar. It looks like it's entered as
4:19
Exhibit 655. Remember, we'll link the
4:22
exhibits to our show notes. And now there's another exhibit
4:26
shown in the court, and this one is a report from Celebrite from
4:29
McCabe's phone that lists the call log with a number of
4:33
deleted and live items. It's entered into court as
4:37
Exhibit 656. Now, when he's asked what he
4:41
found of note, he said it was the timing of the records, that
4:45
the deleted call records start at 5:33 AM on January 29th and
4:51
then end at 8:50 AM that same morning.
4:55
And the call logs that are still active, meaning still alive,
4:59
don't begin until 8:59 AM and then they continue on throughout
5:04
the day with no more deletions. OK.
5:07
So when asked what the difference was between the calls
5:11
at or after 8:59 AM versus the calls at or before 8:50 AM, he
5:18
answered that it was the state of the record deleted versus
5:21
live data and deleted data in the earlier time.
5:24
There's another question asked and the judge calls the council
5:29
up. When council returns, Green is
5:31
asked what percentage of the calls between AM and 8:50 AM
5:36
were deleted, and his answer was 100%.
5:40
Then he asked if he was aware of the term spontaneous deletion
5:46
and he said no. He knows what the individual
5:49
words mean though. When asked if he had an opinion
5:52
as to how those records would have been deleted from the
5:56
phone, he answered they would have been user deleted and that
6:00
ends the direct examination. So now.
6:03
We're going to be moving on to the cross examination, so this
6:06
is the Commonwealth. The prosecutor now has his
6:10
chance to ask Mr. Green the questions he would like answers
6:13
to. First up, he asked Mr. Green if
6:16
he knew who Jessica Hyde is and that she wrote a report and
6:21
asked if he had a chance to read it and he answered yes.
6:24
And then he asked Mr. Green the same questions about Ian Wiffin,
6:28
and Green also answered. Yes, and when he asked if he
6:32
understands that they both disagree with his findings, he
6:36
said yes. Then they got into his
6:38
certifications. What certifications does he have
6:41
with Celebrite? He states he has much broader
6:45
certifications. He doesn't have any Celebrite
6:47
certifications specifically, but he's attended Celebrite and
6:51
Belkisoft training classes, hundreds of them.
6:54
When asked directly you have no certification in terms of
6:57
celebrite and how to use it, he answered no.
7:01
And this is a common tactic from either side.
7:03
They're always going to ask you about certifications, degrees
7:08
and whatever and pick on whatever they can whenever they
7:11
can. And it's happened to me.
7:12
It's just tactic 1, 01 right now.
7:15
They're moving back into the case.
7:16
He was asked who he spoke with at Celebrite regarding the issue
7:21
of the House Long to die in cold search and he names 2
7:24
individuals and Technical Support who indicated that they
7:27
escalated the issue. He was asked if he was told he
7:30
was being it was being escalated to Mr. Wiffen's team.
7:34
He wasn't aware of that and no one reached out as far as he
7:37
knew. He agreed that the defense asked
7:40
him to look at O'keefe's, McCabe's, and Reid's phone, and
7:44
he was never asked to look at Roberson's phone.
7:47
They moved on to Reed's phone and whether it had any location
7:51
data. He said he found map tiles and
7:55
he said for those to breathe present, he said location
7:58
services had to be enabled. As far as I can tell with that
8:03
statement, Green is referring to the Apple Map tiles that make up
8:07
the images that you see when you were in the app Apple Maps.
8:11
And these map tiles are going to be generated even when you're
8:14
simply looking at stuff in Apple Maps as far as I know.
8:18
And as far as I know, you don't have to be driving or navigating
8:22
somewhere with like turn by turn directions to have Apple map
8:26
tiles generated. He didn't mention if he could
8:30
figure out if any of those locations or places identified
8:34
in the Apple Map tiles, what they were, where they were, nor
8:38
did he share any dates or times associated with these Apple Map
8:42
tiles. So I just don't know that
8:44
location services has to be enabled to use Apple Maps.
8:49
Now, Becky, my iPhone friend, do you ever use Apple Maps?
8:54
Does it force you to enable GPS even though you just like say
8:57
want to something up or just type in the address first?
9:01
How does it work for you as the user so?
9:04
You can use Apple Maps. I can choose Apple Maps, or I
9:06
can choose Google Maps. I prefer Google Maps over Apple
9:09
Maps just because I like the navigation process.
9:13
They're both on by default, so you have to turn, you have to
9:17
disable them, and then you are not forbidden from using.
9:21
Go ahead. I was gonna say you mean that
9:23
your GPS, your location data is on one by default on your iPhone
9:27
correct? And you'd have to take extra
9:29
steps to shut it off or disable it.
9:32
What disable? Your map services.
9:35
Well, yeah, but I'm just talking about like location data.
9:38
You can have it on or off. Absolutely.
9:40
Yeah, for. Sure.
9:40
Yeah, yeah, yeah. Same thing on the Android.
9:43
You can shut it on or off. So yeah, you're not forbidden.
9:47
I'm using Apple Maps if GPS location services is disabled,
9:51
but it's functionality will be severely limited.
9:57
You can still open the app, look at maps and search for
10:02
locations, but you'll not have a blue dot showing your current
10:05
location and turn by turn navigation will not work.
10:09
So they're not having it enabled.
10:12
There's restrictions versus having it enabled and
10:16
functioning like map tool. Right, but so the mere presence
10:21
of a map tile, an Apple map tile, does not indicate that
10:25
Location services is on or off. It doesn't do it either way.
10:29
That it was being used. Interesting.
10:30
Continuing with the testimony, Green states he doesn't know how
10:35
the phone was preserved. He doesn't know if they had done
10:38
things like airplane mode and Faraday bags, and whether that
10:43
that would have affected whether the location data remained.
10:46
But when he got the extraction, there was no location data
10:49
present when asked directly, so there was no GPS location data
10:55
present from what you observed. He said he found deleted
10:59
location data from April 2022. Next he was asked if he found
11:04
deleted web data from Reed's phone and he answered no, I
11:09
didn't observe it. Then when pushed, he was asked,
11:12
did you not or I guess the prosecution was stating, did you
11:15
not observe it or did you not look for it?
11:18
He ultimately answers he can't recall and he doesn't believe he
11:22
had reason to. Now there is a protocol for if
11:26
you can't remember stuff. Some courts are more strict than
11:29
others about like the protocol that you have to follow in order
11:32
to be able to like look at your notes and reports.
11:35
But this one seems to be pretty easy.
11:37
You can just say, you know, may I look at my notes?
11:39
May I look at my reports? You can even say, may I refresh
11:42
my memory? And generally the judge will
11:45
say, yes, you can do that. So don't think as an examiner
11:49
that you have to memorize all this stuff and your memory is
11:53
all that you have to go on in the courtroom.
11:56
Bring your notes. I even ask if I can just bring
11:59
in my tablet. And every time I've asked in the
12:02
last couple of years, they said yes.
12:04
So I didn't even have to print everything out.
12:07
So it just depends how you like to to work.
12:09
Do you like a big stack of paper binders with lots of tabs and
12:12
things? Or do you want to use your
12:13
tablet? But so so bring that in.
12:15
And I do not recall walking each and green walk to the stand if
12:19
he brought anything up with him or not.
12:22
But do all that pre work to make sure you can bring stuff up with
12:25
you. Find out what the rules are.
12:27
Ask your attorney that so you can come prepared.
12:30
So when they ask you a question or like everyone of us who's
12:33
been on the stand, you have that momentary what and you can't
12:37
remember something, look at your notes.
12:39
That's right. OK, so moving on next, there is
12:41
a question about location accuracy and it being within 3
12:45
feet and the exhibit that was created after Garino testified
12:49
and why it was created. Now remember this exhibit was
12:53
basically the first thing he talked about when he got on the
12:56
stand after they did all the introductory stuff about who he
12:59
was in his company. So he goes on to answer the
13:02
question. There's some rambling about it
13:05
and ultimately he kind of, you know, says he'd have to ask the
13:08
lawyer. He was then asked if he knew
13:11
that the three feet accuracy that was testifying about had
13:16
nothing to do with cell phone data and he said he didn't know.
13:20
He wasn't aware it wasn't. It was related to the cruiser
13:23
Cam video that Garano was testifying about earlier.
13:26
Didn't know and. That makes total sense.
13:29
I'm most certainly sure in this case the rule was invoked.
13:32
So it's not like he could be sitting in the courtroom
13:34
watching testimony and nobody can be telling him exactly what
13:39
was said. Nobody else that was testifying
13:41
could tell him what was said either.
13:43
So that that makes sense that he doesn't know exactly what was
13:45
going on with that. Next, he was asked if he was
13:48
aware of what Grino testified about yesterday.
13:52
He begins rambling again. You know, some of the things I
13:55
pulled out of that was he said it was vaguely familiar.
13:58
He said he was not trying to not answer.
14:02
Then he continues to discuss the question that was specifically
14:05
raised by his lawyer regarding whether GPS could be so accurate
14:09
within 3 feet. He answered that it's not known
14:12
to be, especially within Apple services.
14:15
And then he said he's happy to opine on location data.
14:18
And the prosecutor said that was not the question.
14:21
Then he was asked, isn't it true there's no way for a user to
14:26
delete a tab, but only to close it?
14:29
Wouldn't you agree with that? And he answered, yeah, well,
14:33
when you close a tab, you're taking it out of the active
14:36
state and is going to an inactive state that some people
14:40
could call deleted. Stacy, you and I have talked
14:44
about this before. We know people in general are
14:48
talking about interacting with the phones and Internet
14:52
browsers, and we've never known anyone to close deleted their
14:58
tabs or closed them. Like that Doesn't make sense.
15:02
Yeah, they don't say. Deleted.
15:04
No, they don't say all closing their tabs.
15:06
Deleted tabs. Yeah, yeah, now he continues.
15:10
He states that the Safari history will allow you to go in
15:13
and delete history by certain date ranges.
15:15
You can go into specific websites that you visited and
15:19
delete those as well. Regarding the wall file itself,
15:22
a user can't open it up and say I want to delete this record,
15:25
but the phone through different user interfaces will have an
15:28
effect of deleting data within that wall file.
15:32
So as digital forensic exam were often examining records that
15:36
have been deleted, sometimes the user took the action that
15:41
resulted into that record being deleted.
15:43
Other times it's the system operation that resulted in that
15:49
record being deleted. And those last couple sentences,
15:52
the so as digital forensic examiners, that's that's our
15:55
commentary on that. Not just to be clear, that was
15:57
not what he said on the stand. Then he was asked, isn't it also
16:01
true that Celebrate uses that red X to annotate that the
16:07
record is no longer active and has been recovered, and then
16:12
makes it incumbent upon the examiner being him in this
16:16
instance to determine if it was actually deleted?
16:21
He answered yes and then the prosecutor cut him off.
16:24
He goes on to confirm he also used the Sanderson's Forensic
16:28
SQLite tool and then he observed the House Long to die in cold
16:34
search in it. I've been very impressed in this
16:37
trial with the digital forensic examiner testimony.
16:39
There's not been a lot of cutting them off.
16:43
They've been allowed to talk even even on the cross.
16:45
So that was a rare one for him to be cut off.
16:47
But anyways, next he's asked if he independently verified the
16:51
cause of that time stamp that he observed, and he said yes.
16:56
When asked if it was his interpretation of that time
16:59
stamp that means the search appeared at the time that he's
17:04
stating and it was solely based on the naming of the field in
17:08
the database, he said no. Did he ask can a wall file
17:13
contain items that are so new that they are not yet committed
17:18
to the database? He said yes, that's the purpose
17:21
of it and the wall. And the wall file holds the
17:24
newest information until it's merged into the database,
17:29
including additions, deletions, changes all of those items
17:34
correct And the and he stated that is correct.
17:38
Next, he's asked if in his affidavit he stated that
17:42
McCabe's phone was an active use between 2:23 AM and 2:31 AM, and
17:48
he was asked what other searches he saw in that time frame and
17:52
where they were performed. He answered that there were a
17:55
number of websites, including the Reigning Men, which was in
17:59
an exhibit earlier, the Ozone basketball, the Hockomock
18:03
Sports, and he said similarly, the last entry is the browser
18:08
State DB entry. He says he has a couple of
18:11
thoughts on why that may I be regarding Miss Hyde's and Mr.
18:15
Weapons testimony, and he's happy to share that.
18:18
The attorney replies. I'm not asking you anything
18:21
about that. What I'm asking is, is it
18:23
possible for a change request in the wall file in the SQLite
18:28
database pertaining to one particular field, leaving the
18:31
other field as they were previously?
18:34
Green asked him to repeat. The lawyer repeats the question.
18:38
Green states he's having trouble answering this.
18:40
Green responds if I'm answering correctly.
18:44
Or excuse me, Green responds. If I'm understanding correctly,
18:48
when the wall file gets written to the database, it could have
18:53
made the change ending with this deleted record.
18:58
Is that the question? He continues.
19:00
I'm sorry, I want to answer you, I'm just a little lost on how
19:04
you're asking it. The lawyer asks.
19:06
Do you not understand the question?
19:08
The judge directs the council to move on.
19:10
So then he's asked, is it possible that the URL field
19:13
which has the website name was updated to the newest search
19:18
while the time stamp obtained the original search?
19:22
Is that possible? He answered no, not that way.
19:25
On this particular phone and this particular iOS and also
19:30
with the user interaction with it that would have been at 2:27
19:35
AM or before. The way this very specific iOS
19:39
was working is consistent with all the other ones that he
19:43
observed out there on the phone related to specific web searches
19:49
and activities. Then he was asked if it was
19:51
possible that the search for House Long to die in the cold at
19:56
6:24 AM was the most recent search completed in the tab.
20:01
He answered. Well, not in that tab, but I
20:04
certainly agree with you that there was a second search done
20:07
around that time. Then it was asked, is it also
20:10
possible that the search that you assert took place at 227 and
20:15
40 seconds in the morning is the same as a search took place at
20:21
624 and 51 seconds AM for that same search?
20:26
He answered. That's inconsistent with the
20:28
actual data that I'm seeing on this actual phone with this
20:33
precise iOS version. Then he was asked as far as the
20:36
search in Safari with the search stringthatincludedsmoot.apple.com.
20:43
Do you recall that search being a suggestion from Apple from the
20:48
iOS? As far as the the search with
20:51
how long to digest food Now our commentary, if you guys recall,
20:56
Jessica Hyde gave testimony on that previously and she
20:59
discussed that smoot dot apple dot being an Apple suggestion.
21:03
So you can always go back to her testimony and check that out
21:06
again. Now Green answers that he didn't
21:09
hear the whole question, but he heard the last part about how
21:12
long to digest food. His feeling on that is when the
21:17
house long to die in cold was put in.
21:20
That was because it was most likely an Apple suggestion.
21:24
He states he's done some testing, but his testing is
21:27
after the time period when he tested.
21:30
He could see that how long to digest food would come up.
21:35
He also noticed that specific phrase how long does it take to
21:39
die from hypothermia? So when trying to repeat this,
21:43
those are the two suggestions that came up.
21:46
We have to pause here and make a note that what you may see as a
21:50
user and what may be logs can be two totally different things.
21:55
It's unclear from Greene's testimony what exactly he was
22:00
looking at for the reason of his testing.
22:03
Was he simply looking at browser and seeing what was appearing in
22:08
the browser as he typed? That's a great point, Becky.
22:11
Was he trying different combinations of typing out the
22:14
words for how long to and then seeing what actually got logged
22:18
by that very specific iPhone running that very specific iOS?
22:23
It's unclear what he was looking at.
22:25
Let's go back to his testimony. The prosecutors asked was it
22:29
something that was a suggestion and not something that was
22:33
actually searched. He acknowledges that this is
22:36
different from his affidavit. He says, in fairness, he wants
22:39
to give his best knowledge, as he understands it, sitting here
22:42
today, including that this is after his review of Mr. Whiffin
22:47
and Miss Hyde's reports. And so since that time and doing
22:51
searching, he would notice that one of those things would come
22:56
up or one of these things would come up and that was a little
22:59
picture of a dinner place or something like that.
23:03
And it was actually very similar to, if not the same picture he
23:07
found and the artifacts of that iPhone.
23:10
The prosecutor says just to conclude that's not what you
23:14
said in your affidavit that was actually filed under pains and
23:18
penalties of perjury with this court.
23:20
He answered correct, yes. And on that day that is what my
23:26
true belief was. Since further testing, he now
23:29
believes that what was probably an automatic, it was probably
23:33
somewhat automatic, and if he's caused any distress, he
23:37
apologizes the. Prosecutor responds, You haven't
23:40
caused me any distress. That's what you filed because
23:42
that's what you thought at the time, correct?
23:45
Green says. Correct.
23:46
Then the prosecutor continues. Subsequently you've done further
23:50
testing and that's shown you were wrong and Green answers
23:53
correct. So prosecutor asked, according
23:56
to your affidavit, there was a search for how long to digest
24:00
food at 623 and 49 seconds in the AM that precedes the search
24:06
for how long to die in at 6/20 3:51 AM.
24:14
Is that correct? And he answered yes.
24:17
Next, he's asked, is it possible that the how long to digest food
24:22
was a predictive suggestion from Apple rather than a search
24:26
entered by the user? Is that also correct?
24:29
He answered. I don't know the answer to that,
24:32
he continues. He believes that it had picked
24:35
up on an earlier search from 2:27 AM of House Long to Die in
24:40
Cold, and then the user went in to retype it.
24:44
And the phone may have tried to give something similar during
24:49
that 623 and 6:24 AM. Now, to be fair, there's
24:54
probably a line somewhere in there and this is me talking
24:57
about what's predictive and what's a suggestion.
25:01
But if we just focus solely on that URL, the one that came that
25:07
contains the smoot in there with the how long to digest food, the
25:12
key take away needs to be that the user never typed in how long
25:19
to digest food. This, this was a suggestion that
25:23
came up. Now, what drove that suggestion?
25:26
That kind of comes in from the predictive stuff.
25:29
And that's the line. But I think like if this was
25:31
your testimony, you'd want to make it clear that someone did
25:35
not type that in. That's the key take away here in
25:38
my opinion. Yeah, and, and here's an
25:40
interesting note. He just got done testifying
25:44
several questions ago that he believed the how long to digest
25:48
food was a suggestion. So it's unclear if he's not
25:52
tracking the smooch dot apple key to identify the fact that
25:58
the how long to digest food was a suggestion from Apple, or if
26:02
he's trying to go deep into the weeds and figure out what words
26:05
the iPhone was predicting the user would type.
26:09
But if you're unclear on what the question is, you can always
26:13
try to rephrase to make sure everyone is on the same page.
26:16
Now we're going to move on because the prosecution isn't
26:20
going to ask any more questions about that as they are now
26:23
moving into the Apple health data.
26:27
Green is asked regarding Mr. O'keefe's health data.
26:30
Steps don't necessarily mean that someone is physically
26:33
taking steps, he answered. Based on his research, steps
26:37
tend to be to be a very accurate artifact, then asked.
26:40
So steps cannot also coincide with movement in a car or any
26:45
other sort of movement on the phone as far as health is
26:49
concerned, he. Answered that he did do some
26:52
testing with an actual iPhone 11, the same make and model, and
26:57
took a drive and tried to see if it would register steps.
27:01
It did not. He sat in a chair and tried to
27:03
duplicate how he thought he would walk to see if it recorded
27:07
steps. He did not.
27:08
He took the phone from the floor to the ceiling to see if it
27:12
would record a flight of stairs, and it did not.
27:14
Girl, we have all been there with this sort of testing, You
27:17
know, Can we drive with the phone?
27:19
What happens? Can we toss the phone around and
27:22
see what happens? My answer tends to be it might
27:26
log it, it might not. And the problem is because Apple
27:30
doesn't tell us how any of this stuff works, all of these
27:33
answers and conclusions we have drawn is from our own testing
27:39
and validating, other examiner's testing and validating.
27:42
And there are some actually some really good papers out there
27:45
that have been published that have been peer reviewed.
27:48
So so if you have to testify about this sort of thing, go and
27:52
look for those peer reviewed papers and see what they say.
27:55
Add that to your research, add that to your toolbox.
27:59
Now, who knows, we might just end up talking about this sort
28:02
of thing again, regarding testing a phone by tossing it
28:06
around in a future episode about some stuff that's going to be
28:09
coming up pretty soon. But back to his testimony.
28:13
Green says that with that iPhone 11, say make and model, he was
28:18
very consistent with him actually doing walking steps and
28:22
that whether it was held by his hand or his shirt pocket, pants
28:26
pocket clipped onto his belt. Then, when asked if that was his
28:29
testimony, he said yes. He was asked are you familiar
28:32
with GPS native locations? He said yes and continues that
28:37
GPS native locations takes data from a number of different
28:42
sources. True GPS takes it from the GPS
28:46
network. He says what you may may be
28:48
thinking of is assisted GPS which the iPhone uses and that
28:54
assisted GPS will try to source. It will look at cell towers,
29:02
Wi-Fi and a number of other devices to try to get you
29:06
enhanced GPS location and give you the best data possible.
29:11
He's then asked so it takes GPS native locations within an Apple
29:16
iOS device from four different sources, isn't that correct?
29:20
He answered. It tries to get it from a
29:22
variety of sources like he just mentioned, not all of which
29:26
would be available. Green also confirmed that he
29:29
looked at the GPS native location data on Mr. O'keefe's
29:33
phone. Then, when he was asked if he
29:35
would agree that the GPS native locations didn't record any
29:39
movement of that phone after 12:25 AM, he answered that he
29:44
would have to look at the exhibit to see what the time of
29:48
that last entry was. He didn't.
29:51
He doesn't want to misstate something.
29:52
Someone asked, you were asked about the elevation change in
29:56
three fours ascending and descending and you said you
30:01
couldn't pinpoint a time within that 12/21 to 12/24 time period
30:07
from the health data, Is that correct?
30:10
He answered correct. It happened somewhere within
30:12
that time. Ask could you pinpoint more
30:15
specifically if you looked at the GPS native location data?
30:19
He answered no. We are talking Apple Health and
30:23
GPS location. I think that I think what the
30:26
prosecutor is trying to get to here is that he's wondering if
30:30
Green made any correlation between these two different
30:35
artifacts. He's wondering what is happening
30:37
simultaneously and what that means.
30:39
The prosecutor states you said you couldn't pinpoint it, then
30:43
Green replies. I'm sorry, which one are you
30:45
asking about? The attorney replies.
30:48
What I'm asking is you said you couldn't pinpoint it within the
30:52
GPS or health data. If you had looked at the GPS
30:56
native location data, could you give a more specific pinpoint as
31:01
to where Mr. O'keefe's phone was?
31:04
There was an objection and the judge allowed the question in.
31:08
The prosecutor restates the question.
31:11
There is another objection and then a sidebar upon return.
31:15
The prosecutor asks earlier in your testimony, the elevation
31:20
change from 12/21 to 12/24 could not pinpoint specifically where
31:25
in that time period the elevation change occurred, he
31:29
answered. That's correct, the prosecutor
31:31
continues. So what I'm asking is, had you
31:34
looked at the GPS native location data, would you have
31:38
been able to more accurately or specifically pinpoint when that
31:42
occurred? He answered yes, there was
31:45
location data within that time period.
31:48
So ask, are you aware that Mister Keith's phone from the
31:52
GPS native location data was actually 1/2 mile away from 34
31:57
Fairview Rd. at the time that it made those recordings in the GPS
32:02
Apple Health data? He answered yes, he understands
32:06
he was using Waze and it could and it had made that recording,
32:10
Green continues. That's why the finding that the
32:13
three minute and one second offset brings into serious doubt
32:17
if that was that time was accurate.
32:19
And when you apply that to the location offset, then Apple
32:24
Health data and all the GPS align.
32:28
He states he has not decoded Waze and found out what
32:31
functions they were calling, but the light, the latest version
32:35
version of Axiom is bringing that up as an artifact, as a
32:39
timestamp related to ways, and in this case where minutes are
32:43
important, he thought it was proper to bring this to the
32:46
attention of the case as a possible explanation.
32:50
That was an interesting point that he said if that three
32:53
minute one second offset is accurate, then everything, the
32:57
Apple Health data and the GPS data aligns.
33:01
I don't know if we have enough information from the exhibits
33:06
that have been presented to, to draw that all out and really,
33:10
really dig into that. That'll be interesting.
33:12
Maybe we find some time to do that.
33:14
We'll we'll see and talk about that more on another episode
33:17
maybe. Or, for grins and giggles, some
33:20
of the listeners out there could do it and tell us what they
33:23
find. That's right.
33:24
That's right. Let us know if you've worked
33:26
that all out. If you're a digital forensic
33:28
examiner and you grab those exhibit and worked it out, let
33:31
us know. We'll bring you on the show and
33:33
talk about it. Yeah, absolutely.
33:35
OK. So next he's asked a question.
33:39
The three different clocks that you were talking about, are you
33:42
aware that those are actually associated with power usage and
33:46
not applications? He answered right.
33:49
The power usage was directly related to the Waze application
33:53
asked. So it's your testimony that
33:55
those three clocks applied to the Times and Waze, is that your
33:59
testimony? He answered the time stamps were
34:02
directly related to Waze. It was reported by Axiom that
34:06
when you applied the filter and said show me all the artifacts
34:09
related to Waze, these were the artifacts that came up related
34:13
to the Waze bundle. He says you need to give it the
34:15
weight it deserves. He's not decoded Waze, but he
34:18
thinks we need to consider that three minute offset as it
34:22
applies to giving significance to the Apple Health data and
34:26
Waze GPS. And I think I mentioned this
34:28
last week, but the power log from database is the only
34:33
database on the iPhone that that uses monotonic time.
34:36
Now during his testimony, Green didn't bring up any other
34:39
specific artifacts from ways that had any any specific times
34:44
associated with that. I would guess that there would
34:47
be some, but they have not been introduced.
34:51
So the prosecutor begins now turning to Miss McCabe's phone
34:55
again. As far as the search, what you
34:58
indicated as last few time, are you aware that that is actually
35:03
related to a time that was actually focused on the screen
35:08
as opposed to your interpretation of it?
35:11
He answered. He's aware that appears to be
35:14
the last date and time it was focused, and when it was no
35:19
longer in focus, that's when the timestamp was written.
35:23
And that's what's consistent with the other data on the
35:27
particular phone on this very specific iOS Next screen.
35:33
Agreed. He used our text and was aware
35:36
Mr. Whiffin created it. Then the prosecutors asked with
35:40
regard to this specific issue, as far as how this data is being
35:44
interpreted from the browser state DB versus the Knowledge C
35:47
database and the wall file and the P list and all those other
35:51
kind of things. Has the misinterpretation of the
35:54
data caused Mr. Whiffin and further revisions of Celebrite
35:58
to revise this so that this kind of error doesn't happen again?
36:02
Now, if you can't remember the Star common commentary, it's
36:05
been a minute, but basically all of this kind of got kicked off
36:08
because there's this search term being reported in Celebrite that
36:12
says House Long to die in cold. It has its URL and then the
36:16
infamous 2:27 AM timestamp that's being reported in
36:20
Celebrate in the area where it reports search queries.
36:24
So I'm sure like as a person who's using Celebrite regularly,
36:28
you're going to look for search queries and you're expecting to
36:31
see search queries that are coming from places that people
36:34
search for stuff like in Safari and their Internet browser.
36:38
And if they're using Safari, it's coming from history dot DB.
36:42
And I'm sure I'm over simplifying right now, but
36:44
basically what those that artifacts sections with the
36:48
search history does in Celebrate is kind of put anything in there
36:51
that looks like a search query into that artifact section.
36:54
So you can look at it. But remember, the tool is
36:57
searching based on coding and patterns up to the examiner to
37:01
dig in and interpret the data. So I mean, this is kind of where
37:04
it got it started. You know, Green called other
37:06
people, called on other cases, and was kind of like, what's up
37:10
with this search term in here coming from the browser?
37:13
State DB. That's right, he answered.
37:15
Mr. Wiffens testing was not done with this specific version of
37:20
the the iOS has been known to be changing the way this artifact
37:25
works. To do proper analysis or
37:27
research he would have needed to work with that same iOS.
37:31
With regards to the other question, they have two versions
37:35
of the Celebrate Physical Analyzer and they have a new
37:37
version called Insights and it's only the Insights version that
37:41
they have bothered updating and is no longer reporting on that
37:45
time. Their current physical analyzer
37:48
program. He tested this a few days ago,
37:51
still reports on that search occurring and that time stamp.
37:56
Currently Celebright is providing examiner's law
37:59
enforcement and people worldwide with two different versions
38:02
giving two different results. The prosecutor states that the
38:05
question was yes or no. Are you aware that Celebright
38:09
has had to modify their software based on misinterpretation of
38:15
data as you've done in this case?
38:17
He answered yes with Asterisk that they updated one of the two
38:23
programs. You know, and he's pointing out
38:25
that Celebrite is it has two different versions of the
38:28
software. One is giving one set of results
38:31
by showing that search result and the other one is omitting
38:34
it. And so it's giving a different
38:35
set of results. But we said it before, the data
38:39
is still there. If you were examining the
38:43
browser state dot DB, then you would still see that search and
38:48
you would still have to figure out what, if any significance
38:51
some of that data had to your case.
38:55
Will you manually open it if it's not provided to you?
38:59
I don't know. Depends what's pertinent to your
39:01
case. Is it really Internet history
39:03
heavy? Does that matter or does it not?
39:05
I don't know. Yeah, for sure.
39:07
But so with that, that is the end of his testimony under cross
39:13
examination from the prosecutor. The defense declined to ask him
39:16
any more questions. So this marks the end of Richard
39:20
Greene's testimony in the first Karen Reed trial.
39:23
Becky, any points you want to go back and discuss from this
39:26
episode or we can even go back to the last episode of something
39:30
from today. Got you thinking I.
39:32
Just say that this digital forensics is extremely technical
39:36
and can get lost in the weeds if if not documented, communicated,
39:43
done well. And that's why attention to
39:46
detail. And I'm not saying that he
39:49
didn't have attention to detail. I'm just saying that the way
39:53
these questions are being swung at him.
39:56
Yeah, right. Especially in the cross, you
40:00
don't know what's coming. Yeah, and it it's confusing and
40:04
the and and, you know, attorneys might be using strategic ways to
40:10
confuse people, especially the witness.
40:14
And so I would just say like Ian Wiffen and Jessica Hyde, they
40:20
would just, they wouldn't change their answer as the testimony
40:24
went. And I feel like Green might have
40:27
contradicted himself a few times in his testimony and and that
40:31
that it's just because of the way the question was being given
40:36
to him. Yeah, Yeah, there.
40:37
Was a couple of times he definitely contradicted himself
40:39
because you know and we talked about it in the last episode,
40:43
but you know a lot of it was about the arrival time of
40:46
Keith's phone at at the address and he said you know it arrived
40:51
here at this time. Boom, that was his testimony.
40:54
Simple, straightforward. But then later on they start
40:56
introducing some Apple health data.
40:59
And so now they're saying that the times are all in in question
41:04
and the monotonic time is throwing everything off.
41:07
But really, to figure all of that out, you would have to
41:12
spend a lot of time looking at a bunch of different artifacts and
41:16
you have have to correlate all of those different artifacts
41:19
together. Now, the one nice thing that
41:21
Axiom did do with that Waze artifact that he was looking at
41:25
in that monotonic time, it had the two other clocks listed
41:29
right there. So so you didn't even have to do
41:31
any math on your own. It's all right there.
41:34
So if you're there was a questioning of the times, you
41:37
could look at that. But again, that would only
41:40
pertain to the different artifacts that are using all the
41:44
monotonic time. So it's like, did you find one
41:47
artifact that is using monotonic time and you need to correlate
41:52
it to another artifact from somewhere else, something else
41:56
that is not using monotonic time?
41:59
Then that would be super slick to look an Axiom and be like, Oh
42:02
yeah, it says, you know, the clock time, the wall clock
42:06
display time, whatever your word you want to use, the display
42:08
time is this. And then, oh, I see that this is
42:11
this. So then you can interpret what
42:14
does that mean? You know, we don't know how much
42:16
time he was given in the case. That's always the struggle on
42:19
the defense, especially if you're working with the public
42:23
defender's office. It's like, here's 16 hours and
42:25
PS, we need you to write up a report within that 16 hours.
42:29
And report writing can take a long time.
42:32
And I mean, that affidavit was not short.
42:34
So I don't know how that long that took him to write up
42:38
either, but I don't think his attorneys did him any favors in
42:41
terms of the the line of questioning his own attorneys,
42:45
because it wasn't I was struggling to find like, what is
42:50
what is the story? What is the order?
42:52
What is driving this all together?
42:55
I didn't feel like there was that bill.
42:56
There was number connection between the dots.
42:59
I want you to tell me a story, connect the dots.
43:01
That's that's our job as examiners.
43:03
We've got to tell the story in a way that other people can
43:06
understand it and connect all the dots for them, especially
43:10
for the the jury. I mean, it's hard enough to do
43:13
it for each other sometimes. Like as we're sitting here
43:15
trying to explain this stuff on the podcast, and then we spent
43:18
like 40 billion hours looking at this Karen Reed trial, You know,
43:21
you know, it's possible I have may have spent more time
43:24
examining some of this stuff than he did.
43:27
And you, you got to do with with what you're given and and they
43:30
didn't do the thing with because sometimes your defense attorney
43:33
will say, how much have you been paid and how many hours have you
43:36
worked on that on this case? So then you kind of know that
43:38
going into it, Like if he said he got paid for 400 hours of
43:42
work on this, I'd be like, man. But if he said, oh, I got paid
43:46
for 16 hours and I'd be like, yeah, I, I see why your answers
43:49
are this way. And that's just something we
43:51
don't know. Yeah, that's exactly right.
43:54
Well, all right, if you are enjoying these episodes, please
43:57
leave us a review wherever you listen.
43:59
It really helps us expand our reach.
44:01
So join us next week for our final wrap up of the first Karen
44:06
Reed trial. Until next time, stay safe, stay
44:09
sharp, and as always, keep parsing the truth one bite at a
44:12
time. If you enjoyed this episode,
44:16
make sure to follow us to get notified the next time a new
44:20
episode drops. If you can do more, head on over
44:23
to parsingthetruth.com and donate by clicking on the Donate
44:28
button. Parsing the Truth is a nonprofit
44:30
organization and we are raising money to send a new Digital
44:33
Forensic Examiner to IASIS training next year in Orlando.
44:38
Thanks.