Latest / Parsing the Truth: One Byte at a Time / Mushroom Murders Part 2

Transcript

Mushroom Murders Part 2 · Parsing the Truth: One Byte at a Time

0:01
Join former FBI Senior Forensic Examiners Becky Passmore and
0:05
Stacey Eldridge as they dig into the world of digital forensics
0:08
one bite at a time. Now leading their own consulting
0:11
firms and educating the next generation of cyber sleuths,
0:14
these badass babes of digital forensics bring sharp insight,
0:18
real world case experience, and a dose of humor to the bits and
0:21
bites that filled today's investigations.
0:23
From deep dives into business e-mail compromise and ransomware
0:26
attacks, Becky's specialty to cracking the complexities of
0:29
iPhone forensics, Stacy's obsession, this podcast delivers
0:33
insider knowledge for professionals, students, and
0:36
true crime techies alike. If you've ever wondered what
0:39
really happens when the digital trail is all that's left, TuneIn
0:42
and start parsing the truth. Hello everybody, and welcome
0:53
back to Parsing the Truth One Bite at a Time.
0:56
We are the true crime podcast that digs into the digital
1:00
forensics in today's modern crimes.
1:02
And today we are starting Part 2 of The Mushroom Murders.
1:07
Becky, where did we let leave off last time?
1:11
Well, the last time we left off at some of the digital evidence
1:14
items, we were starting to talk about the browser history.
1:18
We're starting to talk about some of the artifacts.
1:20
So we're going to continue this episode on those artifacts and
1:25
into more of the digital devices.
1:28
Yes. So let's start off with some of
1:31
the mobile phones that were seized.
1:34
We know that there were mobile devices that she used them
1:37
because we'd already talked about the cell phone records
1:40
from the cellular service provider in the last episode.
1:44
So if you haven't listened to that, make sure to jump back and
1:47
do that first. Now, the first cell phone that
1:50
we're going to talk about that was seized was a Samsung mobile
1:53
phone that was seized from Aaron Patterson's house.
1:56
The investigators examined the phone and found Facebook group
2:01
chat messages, and in those Aaron was complaining about
2:04
about her husband and his family.
2:07
Photos recovered from that device were also presented to
2:11
the court, and one of these images had a black food
2:16
dehydrator sitting on a white kitchen bench.
2:21
Or like a kitchen counter, as we say here now.
2:24
The exhibit included a table of technical data about the image
2:28
itself, listing its file name, the file path, and the sizes.
2:33
The records indicate that this particular image had been
2:37
modified on April 30th, 2023. We don't have the created date
2:43
listed here, but so maybe it was modified or maybe that was just,
2:48
you know, the date they had from it being moved or copied or, or
2:51
something like that. But still, April 30th, not too
2:54
long before that deadly lunch. Now, during part of this
2:58
testimony, the court also discussed the Google Photos and
3:02
how it stored them and synchronized the images between
3:06
the cell phone and the Google Drive or Google Photos is where
3:12
the photos actually go. But you know, as you're using a
3:14
Samsung, which is an Android device that's very baked into
3:17
it. Now, there was some dispute over
3:20
the interpretation of the how those files actually appeared in
3:25
her account. Yeah.
3:27
And and then investigators also seized a Samsung tablet that was
3:34
seized from Aaron's home and analyzed.
3:37
And several photos from that device were shown as well to the
3:42
court. It depicted yellowish dried
3:44
mushrooms spread across a plastic tray.
3:48
Metadata showed that these photos were taken in April and
3:52
May as we discussed last episode around this time frame and it
3:58
was before lunch suggestion they may have been images of
4:03
mushrooms being dried in the food dehydrator that Aaron
4:07
bought on April the 28th. Photos that were retrieved from
4:12
Aaron Pattersons phone were shown to the court.
4:16
These were dated May 4th, 2023, included a picture showing a
4:22
cluster of large field mushrooms on a tray placed on a kitchen
4:27
scale. This suggests that the mushrooms
4:31
were being weighed. The same image had been
4:34
presented earlier in the trial when mushroom expert Doctor Tor
4:39
testified. He told the court that the
4:42
mushrooms in the picture appeared to be death cap
4:45
mushrooms, though, he cautioned, and that they could also display
4:50
characteristics consistent with other mushroom species.
4:56
OK, now the court was shown what appeared to be screenshots of
5:00
Internet searches recovered from her tablet.
5:04
These were not standard browser history records, but rather
5:08
screenshots that show the search results as they appeared on the
5:12
device screen. So it's unclear whether these
5:16
screenshots have been been created intentionally by the
5:19
user or automatically by the system.
5:23
Now, there are ways to tell that, but what we were provided
5:27
and what, you know, the press was sharing and stuff, that
5:30
detailed information wasn't available to us at this time.
5:33
And the important thing to note about these images, they were
5:36
dated about two months, maybe a little bit before the actual
5:41
deadly lunch. Now, these search results that
5:46
were in the screenshots show that Miss Patterson had been
5:49
looking up information about stage 4 cancer, stage 4 ovarian
5:54
cancer and brain lymphoma. When the trial later revisited
6:00
some of the earlier testimony, witness Ian Wilkinson reminded
6:04
the court that Erin Patterson had told her lunch guest that
6:08
she was suffering from cancer. And that was sort of the root
6:12
cause of why she wanted to have the lunch was to talk about that
6:16
now. Eventually, it emerged that this
6:18
claim was untrue and no medical records existed showing that she
6:23
had ever been diagnosed with cancer.
6:26
So the end of Mr. Fox Henny's testimony focuses on Miss
6:30
Patterson's mobile phones and here's a rundown of the devices.
6:35
During the trial it was revealed there was 3 phones, 2 Samsung's
6:39
and a Nokia, and that one of the Samsung's referred to Phone A
6:45
had never been recovered. Phone records indicated that
6:49
Phone A was the device that was primarily used by Patterson.
6:54
Phone records appeared to indicate that a SIM card was
6:57
switched between devices while police were actually searching
7:04
Patterson's home on August the 5th, 2023.
7:08
During the search, the phone was that that the phone that was
7:12
provided by Patterson to police at the end of that search was
7:19
Phone B, which was was subject to a remote factory reset after
7:25
it had been seized and taken into storage.
7:29
OK, wow. So we've got some SIM card
7:32
swapping going on. During a different.
7:35
Yeah, during a search and then a different phone that was not her
7:39
primary phone was turned into the police.
7:43
So that's why she reset swims, right?
7:45
Yeah. And then it was factory reset
7:47
while it was in their position, though.
7:49
It's crazy. Lots, lots of stuff going on
7:51
with the phones here, but let's talk about how they're tracking
7:55
all of these different phones because we've got like at least
7:58
three phones in play here. So we're going to dig into these
8:02
identifiers that you can use to track this evidence, these
8:05
devices being used. So both your phone and the SIM
8:10
card or an E SIM card, if that's what you have, instead have
8:14
unique identifiers. When you conduct an extraction
8:19
from the phone, this information is extracted from the devices.
8:23
So examiners can see this information.
8:25
If the SIM card is in there, we we see that information.
8:28
If there's an E SIM, we see what little information is in there
8:31
and we can also tell if that E SIM is active or not.
8:34
Some phones have both like a physical SIM card and an E SIM,
8:37
and we can tell all of that information when we do the
8:40
extraction from the device. We we get all that good info
8:45
when we bring it down. Now the average Jane can find
8:49
this information as well by going to their phone and looking
8:52
at the settings. Let's start talking about the
8:55
phone itself. It has an IMEI number.
9:00
This IMEI number is a unique fidget, is a unique 15 digit
9:07
number that's unique to every phone.
9:10
So the IMEI is going to identify the device, the physical phone
9:15
itself, Cellular providers will log your phone's IMEI because
9:22
it's the unique identifier that is transmitted to the network
9:26
when you're accessing it, and it is essential for your network
9:30
operations. It also is used for tracking
9:32
stolen devices. You can go on the Internet and
9:36
like check IMEI numbers to see if it's been like blacklisted.
9:40
If you're thinking about buying a used one, If you're buying a
9:42
used 1 and you have it and now it's not working, well, maybe it
9:45
was stolen and then then blacklisted and that's why it's
9:48
not working. And the final thing that IMEI
9:51
numbers are used for is for billing.
9:54
That mattered a lot more a long time ago, like when you were
9:57
paying like per text and for your, you know, you'd go over
9:59
your minutes and, and all that stuff or you know, you weren't
10:02
on the unlimited data plans is that kind of went out of a phase
10:05
for a while, but it is still used with the billing as well.
10:09
Now, providers will also use this information on their end to
10:13
manage their network, block the stolen phones and they can link
10:17
an IMEI number to a specific SIM card and therefore account for
10:23
services and legal reason. That's right.
10:26
And the next is the IMSI, which we refer to as the MZ from the
10:33
SIM card. This is a unique identifier
10:36
assigned to every single SIM card, so MZ identifies the
10:42
subscriber and your phone number.
10:45
It's also used for network management, authentication, and
10:52
billing purposes as well so your provider can see what device
10:56
you're using with what SIM card. So.
11:01
So Aaron allegedly starts using 2 mobile phones known as Phone A
11:06
and Phone B using a SIM card with the number ending in 7-8
11:12
three. The way this has been presented,
11:15
this appears to be the phone number and not the MZ number.
11:19
On July 11th, Aaron allegedly connects a new SIM card with the
11:24
number ending in 835. On August the 5th, a search
11:28
warrant is executed at Aaron's house where police seize Phone B
11:33
with SIM card number that ends with 835.
11:38
On August the 6th, Aaron allegedly remotely conducts a
11:42
factory reset of Phone B, which is still held by police, which
11:48
means it was not properly preserved.
11:51
Aaron allegedly continues to phone use Phone A, with the
11:55
number ending in 7-8 three, and police say they never recovered
12:01
this phone. That is like your worst
12:03
nightmare as law enforcement, as the custodian of the phone,
12:08
whoever has the evidence, you never want any alterations going
12:11
on. And then especially when you're
12:12
law enforcement, you certainly don't want your evidence wiped
12:15
while it's in possession for, I don't know, two or three
12:18
reasons, right? Like you don't want to lose your
12:20
evidence. You don't want to get accused of
12:22
mishandling the evidence and then three people go on later
12:26
and talk about how you didn't properly secure the evidence
12:30
and, and to prevent it from being wiped.
12:32
So what could they have done, Becky, to prevent that phone
12:37
from being wiped? I mean, there's a couple of
12:40
options. Yeah, I mean settings in the
12:42
phone, turn off Bluetooth, turn off Wi-Fi, turn off any network
12:47
connections, pull the SIM card, pull that SIM card out if it's
12:51
physically available to pull it out.
12:54
And that prevents it from communicating to the network,
12:57
which is what you don't want it to do and which is what we
12:59
train. Put it in a Faraday bag.
13:02
But this is how we train people so that you don't want that
13:06
remote access available, which obviously is not protected.
13:11
And what happened in this situation?
13:13
Right. And people use a, they're like I
13:16
got to use of a Faraday bag, but then they want to keep it
13:20
charged. So they have the phone in the
13:22
Faraday bag and where am I going with this, Becky?
13:24
They have, Yep, they're trying to keep it charged.
13:27
So now there's a little wire cable coming out, which
13:31
basically kind of acts like an antenna, right?
13:35
Letting the signal right back into the.
13:37
Phone. So that's right.
13:39
You know, it's hard people, people try, you know, because,
13:43
well, we don't want the phone to die because we want to get that
13:45
extraction after first unlock, not before unlock.
13:51
So, you know, they're they're worried about that.
13:53
And then, you know, there's just all sorts of things.
13:56
So, so the effort is there more often than not.
14:00
They didn't there wasn't any mention of the Faraday bag or
14:02
not. So we don't know what that
14:04
status of that was, but somehow that phone maintained connection
14:09
to the network and cough wiped. But because of that, the
14:13
investigators were unable to recover any data from that
14:16
device. Phone B that was factory reset
14:19
on August 6th, the day after it had been seized.
14:22
Now digital forensic expert Mr. Fox Henry explained that the
14:28
lack of recoverable information was due to that irreversible
14:32
reset of the phone. Now a table in the forensic
14:35
report documented 4 separate factory resets of Phone B.
14:41
These occurred on February 2nd, 2023, August 2nd, 2023, August
14:47
5th 2023 and August 6th 2023. Final three resets all took
14:53
place within that week following the fatal lunch.
14:58
Now, additional information in the report described each method
15:01
used for the reset and according to the data, the first three
15:05
wipes were performed locally on the device, while the final
15:09
reset was wiped remotely by the user.
15:13
Now, after presenting this evidence, Mr. Fox Henry was
15:16
excused from the witness stand. He later ended up returning to
15:20
court following the testimony from doctors and nurses who had
15:23
described the events that took place at the hospital.
15:26
Now, during his return to the stand, Mr. Fox Henry clarified
15:30
some specific dates and times that were contained in that
15:34
mobile phone report. So it sounds like they just
15:37
wanted to make sure that everybody was clear on the
15:40
timeline of events. Yeah.
15:42
So. Later, when the lead
15:44
investigator is called to the stand, he also talks about the
15:47
mobile devices and all the swapping.
15:50
Steven Eppingstall interesting fact in Australia they call the
15:56
lead investigator, the informant, not to be confused
16:00
with an informer who is providing information to the
16:03
police. SIM card was moved to the Nokia
16:06
phone. The court was shown a
16:08
highlighted phone record that was time spent, time stamped to
16:13
the afternoon when police were searching Aaron Patterson's
16:17
house about a week after the lunch.
16:20
Eppinstall testified that the phone records indicated a SIM
16:25
card had been swapped for a different one at 1 fourty 5:00
16:29
PM on the 5th of August 2023. The actual SIM card change from
16:36
phone A into a different phone. He added that the new device was
16:41
a Nokia mobile phone. So that's the beginning.
16:44
Well, I don't know, is that even really the beginning of the
16:46
swapping? There's a lot of swapping that
16:48
had been going on a long time for for these cell phones.
16:52
But around the same time frame as all this stuff is going on.
16:57
Patterson had told her Facebook friends that she had purchased a
17:00
new phone after hers was broken and that she had learned how to
17:04
perform a hard reboot. Later, police executed another
17:09
search warrant at her house. Now, this one was on November
17:12
22nd, 2023. And the purpose of this search
17:15
was to try to locate several items, including that second
17:19
mobile phone that have been discussed earlier, Phone A, that
17:24
they had not recovered on the first time because she did the
17:27
swapping and Epping stall stated that the second phone, the Phone
17:31
A, which was originally her primary phone, had never been
17:34
located by police. During this part of the
17:38
proceedings, the prosecution reviewed a lengthy set of phone
17:41
logs. They move very quickly, though,
17:44
through the various call logs, jumping between different times
17:47
and dates. While Epping Stall described how
17:51
long each call lasted, the prosecution did not go into
17:55
extensive detail about the individual calls.
17:59
So right now it makes no sense to us.
18:01
But here's the thing. Generally, if they want the jury
18:04
to be able to look at this information, they've got to have
18:07
somebody read it into the record.
18:08
So that's. Yeah, that's exactly right.
18:12
That's what he was doing. We don't have much context, but
18:14
evidently they wanted the jury to have this information.
18:17
Yeah. And.
18:18
And there were certainly lots of commentary from the courtroom
18:21
listeners about how it was hard to track what was going on with
18:25
all this SIM card and phone swapping.
18:29
And we get that because without a report and how they're
18:33
referencing phone A and phone B, it's hard to follow.
18:38
But The thing is, when you're describing all of this stuff,
18:42
you have to get the jury to understand what you're talking
18:47
about and why it matters. Absolutely.
18:51
Yeah, we continued to dig and it appears the police are alleging
18:56
that the SIM card was in phone B came out of a Samsung tablet.
19:02
Now remember this Phone B was the phone handed over to the
19:06
police during the search warrant in August.
19:10
Now, there was some commentary about why was the SIM card that
19:17
had the number ending with 835 and how do you know that it was
19:22
coming from a phone tablet versus a phone?
19:26
So we can review now what was said in the media and then we
19:29
can loop back around and give you some facts about that.
19:32
So here's the quote. And the phone contains a SIM
19:35
card that has barely been used for the purposes of being a
19:39
phone SIM card. It's been used as a tablet SIM
19:42
card. So it's got data, a couple of
19:45
SMS records, but it's not a SIM card, according to the police,
19:49
that has been extensively used for phone calls over a long
19:53
period. According to the police, it
19:55
doesn't reflect what a regular SIM card that is put in a phone
19:59
shows. And it doesn't have like a
20:01
mixture of phone calls and data and messages.
20:04
It doesn't look like this, according to the records.
20:07
So that's the end of the quote about what was said in the news.
20:11
So First off, does a SIM card that's used only for data have a
20:17
phone number? Yes, they actually do.
20:20
Most of them do. They are going to be assigned a
20:23
traditional phone number even if the user doesn't make the calls
20:27
or texts. Some might not, but for the most
20:30
part, they're going to have a phone number.
20:32
Now, just because it has a phone number doesn't mean that you can
20:35
call that phone number. That's that's a whole different
20:38
bag. Now, secondly, let's review the
20:40
statement about the SIM card and Phone B failing to show a
20:46
mixture of phone calls, data and messages.
20:49
Again, it's unclear what records they're talking about.
20:53
We don't know. Are they talking about records
20:55
from the mobile service provider or they talking about extraction
20:58
reports that came from the phone itself?
21:01
But let's talk about like what kind of data we typically see on
21:05
a SIM card today. Yeah, so many SIM cards can
21:09
store a small number of contacts, names and numbers like
21:13
some store SMS messages typically.
21:17
Older or. Unsynced messages though modern
21:21
phones store most SMS in internal memory, text message
21:26
settings, service center numbers that can be found, and some may
21:30
store a small amount of app specific information like
21:35
operator settings, where Internet access point names, and
21:40
so on. Examine the SIM card.
21:42
You're not going to be able to find much of anything about
21:47
usage, so you've got to either get the records from the device
21:51
itself or from the cellular providers, from the phone
21:56
cellular providers. But phone B in this case was
21:59
wiped several times, so really not much was retrieved from it
22:05
then it seems the implication is that the police are stating the
22:10
mobile service provider records didn't reveal anything that
22:15
indicated that this was a SIM card used in a phone for placing
22:21
and receiving calls, texts and mobile data usage on the go.
22:25
But today, a lot of people don't like to use their phones for
22:29
calling. They're like, I don't answer my
22:31
calls. Please don't call me, I won't
22:33
call you. It's, you know, it's used like a
22:36
handheld computer. We're using the apps we're we're
22:40
texting. And even texting is on a
22:43
downward sort of spiral. Most people are communicating
22:46
through apps. So think like WhatsApp and a
22:49
myriad of other apps that you can use in place of your
22:52
standard text message that comes through your cellular provider.
22:55
But even if you don't want any people to call you, and even if
22:59
you don't answer calls, we're generally all faced with the
23:02
telemarketers calling us. But the key take away from all
23:06
of this is just how the jury was going to have to put all of this
23:10
information together. And would they be able to do it?
23:13
Because they were shown numerous records related to the different
23:16
phones and the different SIM cards.
23:19
And so it did sound like people were confused at the beginning
23:24
about all these different phones and they seem to be wondering
23:28
what it all meant. Now based on some of the
23:31
reportering, eventually they seem to be able to figure it out
23:34
and tie it all together. So with all that being said
23:37
about all the different phones and the different SIM cards in
23:40
the swapping, what is the key take away from all of this fun?
23:44
Aaron was swapping SIM cards. She puts a SIM card that's from
23:48
a tablet into her phone, and that phone is not her primary
23:53
phone. And then she turns that into the
23:55
police when they're there on that first search warrant.
23:59
So basically, she's giving them something that she knows doesn't
24:04
have anything on it because she doesn't use it.
24:07
It's not her primary phone. And that SIM card certainly
24:09
wasn't from her primary phone either.
24:12
And that the phone that she did turn in was factory reset
24:15
several times before she even gave it to them.
24:17
Yeah. That's so bizarre.
24:19
So later the prosecution enters a picture from the CCTV of Aaron
24:26
at the hospital with a picture of her phone.
24:28
Then they show a picture of Aaron sliding her phone over to
24:32
the police the day of the search on August, which was a few days
24:37
after the hospital. The prosecutor then asked was
24:41
the phone shown in the CCTV video the same phone that was
24:47
turned over to the police and it was a matter of it was a matter
24:50
at that time of the jury to decide.
24:53
Now back to the testimony from the informant.
24:56
Remember the lead detective in Australia, he's testifying about
25:00
evidence from the computers seized from the house.
25:03
So this is the second testimony about evidence that was on the
25:07
computers. The prosecution described the
25:10
specific reports as artifacts of Chrome website visits made on
25:14
the computer. The report briefly flashed on
25:18
the screen and it included some visits to several different
25:21
pages on the I Naturalist website.
25:23
And he talked about the dates from May 18th and then either
25:27
March or May 28th of 2022. It was so quick the month was
25:34
unsure. But anyway, so more stuff on the
25:37
I naturalist website visits. I think I said earlier that they
25:40
were talking about the being being used as a search engine
25:43
and so it must have been an Edge browser being used because
25:46
that's the default for like Windows stuff.
25:48
But I guess for some reason this person is using Chrome with
25:52
being not my favorite search engine, but you know, use what
25:56
you like. Now another image was shown to
25:58
the jury, which was a screenshot of the I Naturalist website.
26:03
This screenshot displayed a world map with many red markers
26:06
across several areas, including a dense swath of red over
26:11
Europe. The search bar at the top of the
26:13
page showed the word death cap. Now this image that was
26:17
presented to the courtroom was taken in December 2024.
26:21
So this is, you know, early a year and a half.
26:24
After the lunch, the judge reminded the jury that aspects
26:28
of the site may have changed between the date of Patterson's
26:32
alleged visit to the sites in 2022.
26:35
So that's over 2 years earlier. And informant Epping Stall
26:40
explained that the red dots represented reporting sightings
26:44
of death cat mushrooms that had been.
26:46
Uploaded, So the court then viewed a screenshot focused on
26:51
the wider Melbourne region, still using the search term
26:58
death cap. And a list of recent death cap
27:01
sightings was generated in a column alongside that map.
27:05
So the investigator Epping stall noted that this 2024 screenshot
27:12
would display different sightings than the version that
27:16
Miss Patterson allegedly accessed in 2022.
27:21
Another image that was then shown was highlighted and it had
27:26
a specific specific death cap mushroom sighting listed on the
27:31
I Naturalist by a user with the pin located at Ricker Reserve in
27:39
Morbin, Melbourne's southeast for an observation dated May
27:44
2022. Let's talk about these 2024
27:49
screenshots and Epping stalls statement that this screenshot
27:53
would display different signing information than the version
27:56
Aaron would have accessed two years earlier in 2022.
28:00
And those you know that 2022 stuff is from her browser
28:03
history. So I'm wondering like why did
28:06
they decide to show this map from 2024?
28:10
Right. I mean like how is it relevant
28:13
that this map is going to be different than two years prior?
28:18
And why? I mean like, why would they do
28:20
that? Yeah, I don't know.
28:21
I think they're trying to demonstrate like, oh, there's
28:24
lots of reports on these death cap mushrooms, OK.
28:27
But there would have been a better way to show what it might
28:32
have looked like back in 2022, right?
28:35
Yeah, absolutely. They could have just used the
28:37
Wayback Machine. Right, exactly the wayback.
28:41
Use tool it is. An under underutilized tool?
28:45
Absolutely. And you know, there's we we have
28:49
no control over whatever has been archived, but it archives a
28:54
ton of sites. And you know, going from 2024
28:58
back to 2022, there is definitely still going to be
29:01
stuff there because we've gotten even way back in time.
29:03
Because remember we talked about this in the one of the Casey
29:07
Anthony wrap up cases where we were still able to pull stuff up
29:10
from like 2005. That's right.
29:12
So you can go way back on the Wayback Machine and see what it
29:16
looked. Like, yeah.
29:18
Yeah, you might have to make decision like OK, May 2022,
29:23
nothing archived that month. So do you want to go a little
29:26
before or you do want to go a little after?
29:28
You'd have to make that decision or, or maybe you do both, right,
29:31
you split the difference and be like, well, this is what it
29:33
looked like a month before and this is what it looked like in
29:35
the following month. You know, and this is as close
29:38
as we can get to what she might have seen on that page on that
29:42
day. That's right.
29:44
So I think you can go ahead, Becky you and kind of get back
29:47
into that testimony again. Sure.
29:48
Absolutely. So then the next Next, the court
29:51
viewed a being search for I Naturalist, which brought up a
29:56
list of results, the first of which was the I Naturalist
30:01
website, frequently discussed during the trial.
30:04
Eppingstall confirmed that these screenshots were generated by
30:10
taking URLs from the Digital Forensic Analysts forensic
30:15
analysis of Aaron Patterson's computer and entering them into
30:21
a browser. So after the Bing search
30:23
results, the court was shown the I Naturalist homepage.
30:28
Now the next. Stay testimony begins with the
30:31
cross examination of Epping Stall.
30:34
The defense noted that only a limited number of extracted
30:38
texts had been requested from the estranged husband's phone.
30:42
They asked Epping Stall questions regarding the cell
30:45
phone tower sites, a naturalist website, and about the Facebook
30:49
messages. He was also asked specifically
30:52
whether he thought things could have changed when looking at a
30:55
website two years later, to which he responded yes.
30:59
The defense reintroduced the Facebook post, this time showing
31:03
comments from the other members of the Facebook group that had
31:07
not been presented by the prosecution previously.
31:10
Now Epping Stall was also asked about his confidence regarding
31:14
the SIM card swapping, and he stated that once he sees a new
31:19
IMEI, he's confidence that the SIM card has been swapped.
31:23
Now, during the search of Miss Patterson's house, she was
31:27
allowed to use her phone while the police were present, except
31:31
for roughly a 14 minute period where she called her lawyer.
31:35
And so when she was calling her lawyer, the police were not with
31:38
her. And so remember that IMEI that
31:41
is assigned to the phone itself. So that's how you can see when
31:46
one SIM moves from one to another one.
31:50
You can see that on the cell phone records from the service
31:53
provider. He was also on the stand the
31:56
next day for the Cross, but nothing shocking was revealed
31:59
then. Yeah, so the prosecution rests
32:03
and now they call Aaron Patterson to the stand.
32:06
Aaron will be on the stand for eight days.
32:10
Aaron Patterson admitted to performing 3 factory resets on
32:14
her phone. Interesting.
32:16
Including while it was in police possession.
32:20
She told the court about several factory resets carried out on a
32:24
phone referred to in the trial as Phone B, which she handed to
32:29
police on August the 5th after they searched her home.
32:33
Miss Patterson explained that one of the resets occurred
32:36
because she panicked and the fact that her phone contained
32:41
all her apps, including Google account that stored her photos.
32:46
She stated. I knew that there there were
32:49
photos in there of mushrooms and the dehydrator and I just
32:54
panicked and I didn't want them the detectives searching the
32:57
house to see them my. Now, Miss Patterson also said
33:01
that she carried out another factory reset while her phone
33:05
was in a police locker, she told the court.
33:08
At some point after searching my house and the interview and the
33:12
detectives brought me home, I remember thinking, I wonder if I
33:17
can log into my Google account and see where all my devices
33:20
are. She continued on.
33:22
So I did that and I could see my phone and my children's devices
33:27
and it was really stupid, but I thought I wonder if they'd be
33:30
silly enough to leave it connected to the Internet.
33:33
So I hit factory reset to see what happened and it did hit
33:37
factory reset. So Miss Patterson stated she did
33:41
not remember performing any web searches for death cap
33:45
mushrooms. We kind of talked about it
33:48
earlier, but again, the remote wiping, how did it happen?
33:52
Were there options to stop it? Yes.
33:55
And that is where so much is missed during the preservation
33:59
phase of Digital Evidence. I know that there's a lot of
34:05
triage that can take place on digital evidence, but if you
34:10
don't properly preserve it in the state that it's in for it to
34:14
not be altered, these types of things are going to happen.
34:18
Right. And there's different situations
34:20
where you have to weigh like the pros and cons.
34:26
Sure. Of what you're doing with it.
34:28
Because in some situations, you know, and Larry McClain talked
34:32
about this when we were talking about the, the thing about Pam,
34:34
he had the phone on consent. And so he was going through and
34:38
previewing because he was trying to get as much info as he
34:41
believed he needed to try to get that search warrant to keep it
34:45
before the consent was revoked. And with today's phones, it's
34:49
getting harder and harder to shut off.
34:52
Oh yeah. The data, the Wi-Fi, all that
34:56
stuff, it used to be able, you could just put in an airplane
34:58
mode that need to know the pin. Easy peasy.
35:01
So now you're working against that.
35:03
Do you have an entire Faraday room that you can go in and
35:07
leave this phone on while you're doing this sort of stuff?
35:10
And then you're thinking about, oh, is it going to have enough
35:13
charge if I got it in a Faraday bag?
35:15
Because remember, your battery is going to drain super fast if
35:19
you have it like on and connected to a network and then
35:24
you put it in the Faraday bag, it's going to and you still have
35:27
the data and Wi-Fi enabled. It's just going to be pinging
35:30
like crazy trying to find a signal and it's going to drain
35:33
the battery super fast. So there's all these decisions
35:36
to make. Because we have to remember that
35:39
cell phones are designed to communicate to a network.
35:42
And if you take away that connection, it's still doing its
35:47
job, pinging back to a network, looking for a network, trying to
35:51
find service, to provide service for the customer.
35:56
O it's doing its job. And we as professionals have to
36:01
do our job too to disconnect it and maintain the integrity of
36:05
the device as well as keep it powered on to you can get an an
36:10
extraction from it. Yep, Yep.
36:13
And you know it's the same sort of thing like get trying to get
36:15
into the cell phones. Do you know that you will have
36:18
10 attempts at that bad pin code before it's going to reset
36:22
itself? That's right.
36:23
We only get 3, you know, So there's lots of things that even
36:27
if you know all the things and you try all the and you do
36:31
everything right like you're supposed to do.
36:35
You can still miss it. Yeah.
36:36
Yeah. You still miss.
36:38
Yeah. It can still get wiped.
36:40
It can still make a connection. It can still get updates.
36:43
It can, like all the things can still happen.
36:46
Yep. For sure.
36:49
Well, we're at a stopping point where on our next episode, we
36:53
will continue with Aaron's testimony on the stand.
36:56
So until next time, stay safe, stay sharp, and as always, keep
37:01
parsing the truth one bite at a time.
37:05
If you enjoyed this episode, make sure to follow us to get
37:09
notified the next time a new episode drops.
37:12
If you can do more, head on over to parsingthetruth.com and
37:16
donate by clicking on the donate button.
37:19
Parsing the Truth is a nonprofit organization and we are raising
37:22
money to send a new digital forensic examiner to I Asus
37:25
training next year in Orlando. Thanks.