Latest / Parsing the Truth: One Byte at a Time / Karen Read 1-9: Richard Green Testimony P1

Transcript

Karen Read 1-9: Richard Green Testimony P1 · Parsing the Truth: One Byte at a Time

0:01
Join former FBI Senior Forensic Examiners Becky Passmore and
0:05
Stacey Eldridge as they dig into the world of digital forensics
0:08
one bite at a time. Now leading their own consulting
0:11
firms and educating the next generation of cyber sleuths,
0:14
these badass faves of digital forensics bring sharp insight,
0:18
real world case experience, and a dose of humor to the fits and
0:21
bites that filled today's investigations.
0:23
From deep dives into business e-mail compromise and ransomware
0:26
attacks, Becky's specialty to cracking the complexities of
0:29
iPhone forensics, Stacy's obsession, this podcast delivers
0:33
insider knowledge for professionals, students, and
0:36
true crime techies alike. If you've ever wondered what
0:39
really happens when the digital trail is all that's left, TuneIn
0:42
and start parsing the truth. Parsing the Truth One Bite at a
0:53
Time is proud to welcome our first sponsor, ACE Forensics.
0:57
They are based near Chicago and they've been building systems
1:01
since 1983. ACE Forensics delivers high
1:05
performance digital forensics workstations, laptops and
1:08
servers to justice agencies across the United States and
1:12
around the world. They offer unmatched value and
1:15
the industry's only five year digital forensics warranty.
1:20
ACE Forensics build the systems or digital forensics software
1:23
deserves. If you're procuring digital
1:26
forensics equipment, reach out to them for a competitive quote.
1:29
Now on to our episode. Welcome back to parsing the
1:33
truth one bite at a time. I'm Stacey Eldridge and with me,
1:37
as always is my Co host Becky Passmore.
1:40
We are the true crime podcast that focuses on digital
1:43
forensics in today's modern crimes and some not so modern
1:47
crimes anyways. Our focus is on the facts and
1:51
the artifacts that digital forensic examiners are examining
1:55
in today's digital evidence. Becky, what are we looking at
1:58
today? So today we are diving into the
2:01
testimony of Richard Green, the digital forensics expert called
2:07
by the defense to testify in the first Karen retrial.
2:12
Green is the President of United States Forensics since 2006.
2:19
His attorney referred to the company as USA Forensics during
2:23
the proceedings. Green holds an associate's
2:26
degree and ACCE, which is a Certified Computer Examiner
2:30
certification, a recognized credential in the digital
2:33
forensics field. Now, Green is no stranger to the
2:37
courtroom. He stated he has testified
2:39
approximately two dozen times as an expert witness, and he said
2:43
his firm handles about 120 cases per year.
2:48
I, I don't know if his firm means him or if there's other
2:51
people there, but so there's some high volume coming through
2:55
his, his company. I think 120 cases a year is a
2:59
lot, especially if it's just you doing them.
3:01
I was trying to remember back to my numbers from 10 years in the
3:05
FBI. I don't even think I worked 500
3:08
cases. I think it was closer to 4.
3:11
And I remember one year I even got an award for like the most
3:13
cases worked in the FBI. Like I was like working like
3:18
that's all I did when I was in LA.
3:20
I just worked and worked and worked in LA because traffic was
3:22
horrible. What else was I gonna do?
3:23
Sit, sit in traffic, right. So I mean, I'm not going to do
3:27
120 cases this year either, but some people just love to work,
3:31
work, work. Becky, what about you?
3:33
Do you have any recollection of your numbers in the FBI?
3:36
I. Mean, I wouldn't say that I
3:39
think we would cover together and there was a couple of people
3:43
in the in the lab. I think together we would cover
3:46
maybe 120 cases a year, but not like 500 a year or anything like
3:51
that. So yeah, a lot. 120 cases in a
3:55
year is a lot, especially if you're doing it by yourself.
3:57
But he has a firm so maybe has some examiners that work for him
4:01
as. Well, yeah.
4:02
And what are your plans for this year?
4:03
121 cases, Becky. Absolutely not.
4:09
But anyways, you know, to each their own, right?
4:11
Right, Sure. Back to the case now, He was
4:15
asked in this case to review the location data and determine when
4:19
O'Keefe arrived at 34 Fairview Rd. in Canton.
4:23
He was also asked to look at anything else related to the
4:26
location data. So some side notes.
4:29
We already know through the affidavit and such that he
4:31
examined the phones of Karen Reed and Jennifer McCabe in
4:34
addition to Mr. O'keefe's, but they haven't talked about that
4:38
yet. But we're just referring back to
4:39
that affidavit, so we probably know some of that stuff's going
4:43
to come into this testimony. Sure.
4:45
Green explained that what he received for examination was an
4:50
image file, but a forensic image.
4:52
He stated that an image file has a copy of the data that was
4:55
encapsulated into a single file, and in this instance it was a
4:59
zip file. I think we need to split out a
5:02
few different things here. First off, as examiners we
5:05
generally prefer to deal with forensic images and a forensic
5:10
images it's a bit for bit exact copy of the original storage
5:15
device such as hard drive or thumb drive or some other
5:19
drives. But when it comes to phones and
5:21
tablets it's a different story. We aren't imaging phones, We get
5:26
extractions from phones. Today.
5:29
Extractions are going to fall into a couple of categories, 3
5:33
general and major categories. First, there's that full file
5:37
system extraction, and this option provides the most data.
5:40
This is what you should strive to get every time you do an
5:44
extraction. Then there's the advanced
5:46
logical extraction. This doesn't have all the system
5:50
files. You'll get some databases, but
5:53
you won't get e-mail on a iPhone, but you'll have text and
5:57
call logs. Finally, there's that logical
6:00
extraction and this is where the examiner selects the types of
6:03
data they want, such as text messages and pictures.
6:07
With a logical extraction, you won't get any system files or
6:11
databases. You will only get the items that
6:13
you are picking or that are available to you because some
6:17
items may not even be available. Right, right, logical.
6:21
You're going to get the least correct.
6:22
Now, Green is correct in the fact that he did receive a zip
6:28
file, but I would call it an extraction myself.
6:32
I would not call it an image or forensic image or anything like
6:35
that. And then based on Jessica Hyde's
6:39
testimony and Ian Weapons testimony, we know that it was a
6:43
full file system extraction. Now, Green stated his specific
6:47
purpose in examining that data was to was to determine the
6:51
location information, particularly when O'Keefe
6:55
arrived at 34 Barrett Fairview Rd. in Canton, and that was the
7:00
central question he was brought on to answer.
7:03
Now in order to answer that question, he pulled the location
7:08
cache data from the phone and ran it through a program called
7:11
Sell Hawk and this is a tool that's used to analyze and map
7:15
location data from mobile devices.
7:17
This locations cache that he is speaking about is actually
7:21
another SQLite database named cache dot SQLite and it contains
7:27
the things like time stamps, latitude, longitude and even
7:31
speed. And there are several different
7:33
tables within this database that should be examined to see if any
7:37
data pertains to your case. From that, Green stated that
7:41
O'Keefe arrived at the driveway of 34 Fairview at 12:24 and 28
7:47
seconds at AM in the AM now the night before, Green testified,
7:52
he said the attorney directed him to filter the location data
7:57
to show only points with accuracy of three feet or less.
8:02
That filtered data was shown to Green on the stand, entered into
8:07
evidence and published to the courtroom for the jury to see.
8:11
But here's the thing, that filter return absolutely zero
8:16
data points at 3 feet or less accuracy.
8:19
So nothing was plotted on this exhibit.
8:22
No dots. So basically what they're having
8:24
the jury look at is a blank result when it comes to hyper
8:29
precise location data. Green said there were in fact
8:34
many data points that fell within 500 feet of accuracy, but
8:38
he was very deliberate and explaining that you can't just
8:43
treat the center of that circle as the location.
8:47
You have to consider the entire area within that circle because
8:51
the device could have been anywhere inside it.
8:55
The accuracy figure, he explained, is Apple's best
8:59
estimate. It is not a definitive pinpoint
9:02
location and that's all he had to say about that location data.
9:06
From there, the questioning is shifted to Apple Health data,
9:10
and Green was asked whether this type of data was considered
9:14
reliable. He explained that Apple Health
9:17
data comes from Apple's Health Kit framework, which is widely
9:21
recognized as containing important and meaningful data.
9:25
Those were his words, and he did note that the degree of accuracy
9:29
depends on the specific type of data that you're looking at from
9:33
the. Health data As a specific
9:35
example, Green pointed out that step count data is known to
9:41
carry approximately a 98% accuracy rate, which is quite
9:46
high. A document containing Apple
9:48
health data pulled from O'keefe's phone, specifically
9:52
from January the 29th, was then entered as an exhibit and
9:56
published to the courtroom. The examination of that data
9:59
started on page 2, beginning with.
10:02
Record 2. Now this record 2 showed a
10:05
distance of 87 meters that was recorded between 12:00, 21 and
10:12
12:24 AM. Then the next record that they
10:15
show documents 80 steps during that same time window of 12/21
10:21
to 12/20, 4:00 AM. So within those approximate 3
10:25
minutes, the phone was logging both distance travel and step
10:30
count simultaneously. And just so you know, this is
10:33
something you should typically see.
10:35
You would expect to see this, the steps and the distance being
10:38
logged simultaneously. Then there was a third record,
10:42
floors climbed. It showed three floors of
10:46
elevation change recorded between 12:22 and 12:24 AM.
10:52
This record starts at about one minute after the distance and
10:56
steps are recorded. During this testimony, Green
10:59
stated that the floors data does not indicate direction, does not
11:05
tell you whether those three floors were ascended going up or
11:10
descending going down. Well, I'm just gonna get back up
11:15
here on my soapbox one more time because this is my thing.
11:18
So Apple Health and the floors, first we have to look at the
11:23
databases that they are pulling this data from.
11:26
So in the exhibit in this one, you can see that these data
11:30
points are coming from Health DB under score secure dot SQ Lite
11:35
and health DB dot health DB under score.
11:39
Secure dot SQ Lite only contains flights climbed and climbed
11:46
means going up. It does not contain descended,
11:50
it does not contain floors going down.
11:53
It's not like an up or down pick your favorite sort of situation.
11:57
It is only up now. Descendant flights are recorded,
12:02
but they're in a totally different database.
12:05
Thank you for listening to my Ted Talk.
12:07
But back to the trial. The defense was asked whether it
12:10
was possible to determine exactly when within that 12:22
12:15
to 12:24 AM window when those stairs were used.
12:20
Green said no, it's not possible.
12:23
You cannot determine whether it happened like at the very start
12:26
of the window, somewhere in the middle, or right at the end.
12:29
The data does not have that level of granularity.
12:32
OK, The questioning then moved back to the location data and
12:36
was asked if that arrival time falls within the range of 12/21
12:41
and 12/24/30 seven seconds in the AM.
12:45
Green confirmed that there is an overlap and the Apple Health
12:49
data continues after the arrival time of 122048 seconds AM.
12:54
If you're doing the math at home, the arrival time from the
12:57
location data is not 9 seconds before the end of the Apple
13:02
Health records. So what is their point here?
13:04
Are they trying to say O'Keefe had not arrived yet?
13:06
Or are they trying to say the arrival time is wrong?
13:09
But Green said the arrival time was 12/24/28 seconds in the AM.
13:14
You can't have it both ways. You have to explain what's going
13:18
on here with these over lapping times.
13:22
I'm waiting for it at this point.
13:24
The attorney actually cut Green off mid dot and moved on to the
13:28
next line questioning. And I think that happens when it
13:33
starts to get convoluted and misunderstood that it's not
13:38
clear. And maybe it's not clear to the
13:40
attorney, maybe it's not clear to Green.
13:42
There's a miscommunication going on, so they just move on to the
13:46
next line of questioning. Yeah.
13:47
I mean, definitely when you're on cross, you tend to get cut
13:50
off a lot. They want you to the yes, no
13:52
point. But generally when it's your
13:54
attorney, the direct examination, they want you to
13:56
talk until the point is on. I don't know, maybe he said too
14:00
much like you said, maybe it was just going on and on or the
14:03
attorney don't know where it was going.
14:05
So anyways, he got cut off, the attorney switched lines of
14:09
questioning and now he starts asking about clocks.
14:12
And Green is asked if he is aware of the three different
14:15
internal clocks that Apple devices used.
14:19
And This is How It Work is worded clocks.
14:21
Are you familiar with the internal clocks?
14:23
And Green stated he's familiar with all three, and he listed
14:26
that they are the monotonic clock, the baseband clock, and
14:30
the wall clock, which is also called the display clock.
14:34
Now, when asked about the significant significance of the
14:37
clocks, Green states that developers can call upon any of
14:41
the three clocks. The best straightforward
14:44
definition of the monotonic clock we heard was from a Magnet
14:49
Forensics podcast featured on Forensic Focus, and the episode
14:53
is called Time Well Spent Precision, Precision Timing,
14:58
Monotonic Clocks and the Power Logs database for iOS and we'll
15:03
link it to here into our show notes.
15:07
The monotonic time is always running forward.
15:11
It's never affected by daylight savings time.
15:13
It will never jump forward or backward to daylight savings
15:17
time. They give a great example if you
15:20
were recording how long a function was taking.
15:24
If you used the display time during daylight saving time,
15:28
your results would not be accurate because you would
15:32
either gain or lose an hour if it ran over that time change
15:38
versus if you used the monotonic clock.
15:41
You don't have to worry about the daylight savings time
15:45
change. Two hours is 2 hours.
15:47
They used the monotonic clock in the power log to keep the
15:51
records in the correct. Order.
15:52
I also read another article about monotonic time from an
15:57
engineer with a PhD, and in summary he says to use it the
16:03
monotonic time whenever and anytime you are computing time
16:06
differences and measuring time. And we'll also link to that in
16:10
the show notes if you want to read this.
16:12
And all this stuff was available before the trial.
16:16
So jumping back to the trial in 2024, when Green was asked if he
16:20
found any examples of the different clocks being used,
16:24
Green said that he did find one when he was filtering the data
16:27
specifically for the Way navigation app and he was
16:31
filtering an Axiom. And from there he had found that
16:34
Waze was using the monotonic timestamps rather than the
16:38
standard wall clock. That exhibit is numbered 640.
16:42
It was shown to Green. It was displayed in the court
16:46
and in the filtering you can see that he has filtered down to
16:50
Waze. You can see that it was filtered
16:52
specifically for Waze and Axiom and the timestamps are clearly
16:57
shown. And so they are showing the
16:59
monotonic date and time, the baseband time and the display
17:04
time in that screenshot to the courtroom so.
17:07
When asked about the bundle ID shown in that exhibit, Green
17:13
explained that it identifies the app in this case, so confirming
17:17
it was indeed the Waze application.
17:20
And when asked what he noticed about the timestamps, Green
17:24
pointed out that the monotonic clock timestamps were running
17:28
approximately 3, and it's faster than the standard wall clock
17:32
time. And you should note Green is
17:35
saying wall clock, but in Axiom, the artifact says display time.
17:40
So if you're pulling up the exhibits, he's using wall clock
17:43
instead of display time for his terminology.
17:46
But let's talk about this exhibit a little bit more.
17:49
So this specifically that he's showing is the power log
17:54
application state artifact for ways.
17:58
And this artifact indicates that it's active, IE this means that
18:02
the app is being used or open, however you want to say that,
18:07
and it's providing all three clock time stamps, monotonic
18:10
baseband, and display. But here's the thing.
18:13
So if Waze is still being used at this time, according to the
18:17
power log, it makes sense that there's a log entry for it being
18:22
used in the power log. And we have to remember that
18:25
Green already testified that O'Keefe didn't arrive at 34
18:30
February Rd. until 12/24/20, 8:00 AM.
18:35
And it seems like they're trying to use this artifact to say,
18:40
hey, look, this monotonic time is almost 3 minutes faster.
18:44
And it seems like they're trying to use it to build doubt in
18:48
terms of how reliable are these timestamps?
18:51
You know, they're, they're all different, they're all off.
18:54
It's like they want to cast doubt on the timestamps.
18:57
But here, right here, here in this exhibit, this artifact
19:01
axiom has done a great job of calculating and displaying the
19:06
time differences to the examiner.
19:08
So it's all right there to figure out.
19:10
And you can continue to math all you want on any of the other
19:14
artifacts if time is of the question.
19:17
Right, so as of this record in the power log is the only
19:21
database that is recording the monotonic time.
19:25
But again, if this is important in your case, you're going to
19:28
have to dig it in. Dig deep with this 3 minute time
19:32
gap like this 3 minute time gap could be significant.
19:37
Will they discuss the other apps that are using the monotonic
19:40
time clocks? Will they?
19:42
Because we have to remember that even though Waze Monotonic
19:46
Client Monotonic clock timestamp from the power log said 12:22
19:52
AM, the display time said 12:19 AM, which is also before the set
19:57
arrival time. If the Apple Health data is not
20:00
using the Monotonic clock, which puts that Apple Health data
20:05
starting after this time stamp they've introduced in this
20:09
latest exhibit, then let's find out where they're going with
20:13
this. Is there any point to this being
20:16
introduced besides doubt? Yeah, let's let's keep talking
20:21
times. OK, our favorite thing times.
20:23
Now we're back back to the Apple Health data.
20:26
This exhibit once again goes back to Apple Health data that
20:30
they're showing. This exhibit is on page 2,
20:32
record 3. Here Green is identifying
20:36
another entry, and this one is showing 25.46 meters of travel
20:41
that was recorded between 12:31 and 12:32 AM.
20:46
Then moving to page 5, record 3, there was a corresponding entry
20:50
showing 36 steps between 12:31 and 12:32 AM, so again the exact
20:58
same window as the distance record.
21:00
So this is new movement being logged several minutes after the
21:06
arrival time. And this arrival time, you know,
21:11
remember Green said the phone arrived in the driveway at 12:24
21:15
AM and the last set of Apple health data that was discussed
21:19
was between 12:21 and 12:24 AM. So this is a little.
21:23
Bit later afterwards, that's right.
21:26
So now we're going to get into Jennifer McCabe's phone, and
21:30
this is arguably the most consequential part of Green's
21:35
testimony. Based on his affidavit that
21:39
we've previously discussed. Green was asked and testified
21:44
that he found an artifact of significant interest on McCabe's
21:49
phone. He stated it was a Google search
21:51
for House Long to Die in cold, and he stated that that search
21:56
occurred at or before 2:27 AM on January the 29th.
22:02
He found it within Safari. Within that Safari Suspended
22:07
Tabs artifact on the phone. More specifically, Green located
22:11
that search record inside a database called Browser State
22:15
DB. He actually misspoke during his
22:17
testimony and called it the Browser DB.
22:19
He also noted that there is a wall file associated with this
22:24
database. Green explained that the wall
22:26
file stands for Write ahead Log and data is written to the wall
22:29
before being committed to the main database and that occurs at
22:33
certain intervals. And the lawyer reiterates that
22:36
there is a wall file associated with the Browser State.
22:40
So when asked if he could find meaningful data in the wall
22:43
file, Green confirmed that he could.
22:46
As as far As for how he determined the specific time
22:50
stamp, Green stated that the time stamp was recorded in Apple
22:56
Coco Time which. And I don't know, I don't know
22:59
if it's Apple, Coco, Time or Cocoa, but he said Cocoa during
23:03
the testimony and I didn't bother to look it up, so I don't
23:06
know which one it really is. But do you know for sure?
23:09
No, I don't know. I don't know.
23:11
I it looks like it's the kind of cocoa I drink, so I just call it
23:16
Apple Coco Time, which measures the number of seconds elapsed
23:20
since January 1st, 2001. He converted that raw number
23:26
into human readable format and then accounted for the local
23:29
time, ultimately arriving at 227 and 40 seconds AM on January the
23:35
29th, 2022, and he found that record in a deleted state.
23:42
Green was then asked what he would have expected to find a
23:45
alongside that record in a complete non deleted state.
23:50
He said he would have expected to see the date and time and the
23:53
URL and the full browser history showing where that tab had been.
23:58
But he was only able to recover that one single artifact.
24:02
He could not recover anything else.
24:04
So when asked about the significance of not being able
24:08
to recover the full Internet history tied to that record,
24:12
Green explained that he wanted to go.
24:16
He used multiple forensic tools to try to do that Microsoft X,
24:21
Sanderson Forensics, Art X, as well as Axiom and Celebrate.
24:26
He noted that the data was consistent across all three
24:31
tools, even though there's more than three tools mentioned
24:34
there. They were consistent, but the
24:36
deleted state of the data made it difficult to get all the data
24:42
back. You should note that the tools
24:44
are consistently reporting the same data.
24:47
That's great. That's what we want to see.
24:50
However, the examiner still has to interpret the data.
24:55
No one is saying the tools reported a 2:27 AM timestamp
25:00
with different times. The examiners have different
25:03
differing opinions regarding what caused that time stamp to
25:07
be logged. Green elaborated further explain
25:10
it. He explaining he wanted to know
25:13
what else was going on during this time and that among all the
25:17
other items he observed in the data, that browser state entry
25:20
for House Long to Die in Cold was the last one
25:24
chronologically. Green was asked if he was able
25:26
to find any other examples of this behavior.
25:29
And he did. To illustrate his testimony,
25:31
Green was shown another exhibit, a screenshot from Axiom, showing
25:36
a record for its reigning men, with the records ordered from
25:41
newest to oldest. In that ordering, the Safari
25:44
Suspended State tab entry appeared as the last record in
25:49
the list. Green has filtered the data in
25:52
the exhibit and it only shows web related activity and
25:56
application data with the suspended State tab appearing at
26:01
the very end and as the last record.
26:04
OK, wait a minute. If it was displayed, he said
26:07
newest to oldest. If it was newest to oldest,
26:10
shouldn't the last record, the last thing that happened be at
26:14
the top and not at the bottom? Yes.
26:16
And aren't they highlighting that it's on the bottom?
26:19
It's a horrible screw. It's a horrible screenshot.
26:22
They it was always kind of fuzzy in the in the courtroom.
26:25
But isn't that what they're saying if it's last?
26:28
Because. He says it's the last record in
26:31
the list, so to me, last means on the bottom.
26:35
Yeah, so it should the. Screenshot's very hard to see
26:39
anything. But if we're just going off of
26:41
his words, newest to oldest, oldest, the last thing should be
26:47
on the top, correct? Because it's the most recent.
26:50
That's right. OK, OK, but his point is that
26:54
the house long to die and the cold search record from the
26:58
browser state dot DB was last. OK, but I'm just trying to
27:01
figure out what what he was saying and what he was showing
27:04
anyways. Right.
27:05
I just caught that when you were saying that.
27:07
Yeah, because it can get confusing.
27:09
If it gets confused, if it gets confusing for us, it gets
27:14
confusing for the jurors, it gets confusing for the
27:16
attorneys, it gets confusing for the judge.
27:19
That's why it's so many times going through these data points,
27:24
these time spent stamps, these articles, these artifacts.
27:28
It just gets really jumbled up. But it shouldn't.
27:33
At this point, you should be laying the foundation here.
27:37
It gets that way many times on Cross.
27:39
Yeah, yeah. Well, and that's the whole point
27:41
sometimes of having an exhibit is so everyone can have
27:44
something nice and orderly to look at.
27:47
Now next, Green is asked what it meant that the Safari suspended
27:53
tab was the last entry. And Green said that it tells us
27:57
that the Internet history happened before that.
28:01
And that the purpose of this tab on at least this particular
28:06
iPhone with this very specific iOS version is to record the
28:11
state of the tab when the user left that.
28:14
And that the whole purpose of that is if you're on Safari and
28:18
you're on a website and say you have to take a phone call or
28:22
answer a text message and navigate away from the Safari
28:25
app, that then when you come back to it, it remembers where
28:28
you are and allows you to pick up from there.
28:32
It also allows you to hit the the tab button and see what
28:35
other tabs you might have open and navigate to one of those
28:40
tabs. And those were his words.
28:42
Green was then asked to confirm the timestamp on it's It's
28:48
Raining men Safari Suspended tab and it was 2/27/30, 8:00 AM on
28:55
January the 29th, 2022. He answered this just moments
28:58
before the How long to die in Cold.
29:02
He answered this just moments before the House long to Die in
29:07
cold artifact. We should remind you that the
29:10
House Long to Die in Cold artifact was time stamped at
29:14
2:27, 40 seconds AM. Therefore, those two records are
29:20
separated by just two seconds. When asked what does this tell
29:24
you about whether Raining Men was either searched or or
29:27
accessed after or before 2/20, 7:38 AM, there was an objection
29:34
that was sustained. Asked again, given the timestamp
29:37
of 2/27/38 on 1/29 for that Safari suspended state tab with
29:43
its reigning men, what did that tell you about the timing of
29:46
when it's reigning men was accessed by the user?
29:50
Green answer. The indications would be that
29:52
the tab was brought up and then went away from in order to do
29:55
another tab. It can take less than a second,
29:58
it can be very fast. What I want is the timing of the
30:02
interaction when it's raining men by the actual iPhone user.
30:06
When did that actually happen? Green answered.
30:09
All of the activity that we have is all prior to the recording of
30:14
that time stamp in the browser. State Green confirmed this was
30:17
not unique behavior specific to this one phone.
30:21
He found many other examples of the same pattern on this device
30:26
when asked. Do you have an opinion as to the
30:28
timing of that first search for House Long to die in cold?
30:33
He answered that it would have happened at or before January
30:38
the 29th 2022 at 227 and 40 seconds in the AM.
30:43
Next he was asked, given your findings in researching these
30:47
issues and how this user used this iPhone with this iOS, do
30:52
you have an opinion to a reasonable degree of scientific
30:56
certainty as the time timing of that search for House long to
31:04
die in cold there was an objection that was sustained.
31:08
This time asked do you have an opinion to a reasonable degree
31:11
of scientific certainty as to when House long to die in cold
31:16
was search objection that was sustained?
31:20
Then there was a sidebar. I'm not exactly sure what all
31:22
these objections are about. I don't know what struck me.
31:26
I was wondering, like, are they objecting to the phrasing of
31:29
scientific certainty? I've been asked in a couple of
31:32
different cases to write that into my reports, and I won't.
31:36
I don't know, Becky, have you run across it?
31:38
Do you use it? I've not been asked about it on
31:42
the stand. I have not been asked to put it
31:44
in reports. And quite honestly, if I don't
31:47
feel like it belongs there, then I'm not going to.
31:51
I'm gonna see it, yeah. So, returning from the sidebar,
31:54
the defense then asked what is the basis of that opinion, and
31:59
Green explained that it was based on on how that specific
32:03
iPhone operates with that exact iOS version compared against
32:08
other data found on that same phone.
32:10
The way that everything presented itself.
32:12
And it was all consistent with that search having a cord
32:16
occurred at or before that time. Green was then asked what
32:20
conclusions he reached about how the 2:27 AM search record, about
32:27
how the 2:27 AM search record ended up in a deleted state.
32:33
He confirmed it was indeed found in deleted state and that he
32:37
found a lot of other things that would have been used or deleted
32:41
artifacts between midnight through the early morning hours
32:44
of January the 29th. Importantly, when asked whether
32:48
he was aware of any internal mechanisms within the phone that
32:52
could have caused that deletion automatically, Green answered
32:56
no. So at this point, we're about
32:58
halfway through his testimony by the clock and so it's about 45
33:03
minutes in. And I think this is a good
33:05
stopping point because after this they start discussing the
33:08
call logs. So at this point, let's go
33:11
through some of this testimony and see what they've been
33:16
talking about. South, the first thing I want to
33:19
know more about is this time stamp for O'keefe's arrival time
33:24
at 34 Fairview. The defense does not show an
33:28
exhibit with this time stamp. They show us how they plotted no
33:32
points, but they failed to show us this time stamp or the
33:36
location of it on a map or anything like that.
33:38
I have no idea what their point is with bringing up the
33:43
monotonic clock. Is the point that you have to
33:46
know which app is using what clock, and then you have to
33:49
account for time discrepancies? But we know the power log is the
33:55
only thing recording anything in monotonic time.
33:58
I also flipped back through Green O's testimony because
34:02
remember, all the state's witnesses went before the
34:05
defense. So Greena was up there on behalf
34:07
of the prosecution, and I looked at his written report, too.
34:12
And even in his written report, Greeno says that the phone
34:17
arrived at 12:24 AM. There was still some more plots
34:23
plotting, some points plotting I guess, but those points stopped
34:27
plotting at 12:25 AM and then there's no more movement after
34:32
that until 6:15 AM. During Greenos cross examination
34:40
by the defense, Reno agreed that John O'Keefe could not have been
34:44
at 34 Fairview Rd. at 12/20/14 AM because Weighs placed him on
34:50
Oakdale Rd. approximately half a mile away at that time.
34:55
And he also said that the Waze data led him to disregard or
35:01
fail to attribute the Apple Health data and the stair
35:05
climbing entry to O'Keefe at that moment.
35:08
But Green and Garino said the same thing.
35:11
They both agreed upon the time of O'keefe's arrival at 34
35:16
Fairview. So if you're saying he didn't
35:20
arrive here until this time, then they're both disregarding
35:23
the Apple Health data. Neither of them care about that
35:26
If they agree upon upon the arrival time.
35:29
So what? What am I missing, Harry?
35:32
If I I'm trying to say like kind of what you just said earlier,
35:35
right? If I'm saying what is the point
35:36
of this? What the heck is going on here?
35:38
I'm sure the jury is saying the same thing.
35:41
Or maybe they've already stopped disregarding all of this stuff.
35:44
If people don't understand this stuff, they're going to ignore
35:47
it. That's that's just human nature.
35:48
I don't know what this means. I'm just going to disregard it
35:51
because remembered they have to, you know, they have to go beyond
35:54
a reasonable doubt. Well, if I can't understand
35:57
what's going on, how can I use that to convict somebody of a
36:00
crime? If I don't know what it means,
36:02
they have to disregard it, right?
36:04
Yeah, yeah, for sure. And I think in the end, I think
36:09
that he understands. Green understands evidence to a
36:16
certain degree based on what he's analyzed.
36:19
But I think the whole point here is I don't like the questioning
36:26
from the defense who grain is very confusing.
36:31
I think there's not a well laid foundation and I think that's
36:35
what we're trying to understand. Yeah, I mean, you as examiner
36:39
again, we can't give a monologue.
36:42
We just have to answer the questions in the order they're
36:44
given. I feel like the questions are
36:46
kind of like a little bit of health data, a little bit of the
36:48
location data. Oh, here's a clock, let's do
36:51
some Apple health data. And I don't feel that it was
36:54
chronological either, because if you're going to present
36:56
something in chronological order, then you would have like
36:59
started at the bar and then been like, oh, here's some Apple
37:02
health data, but we're disregarding it or they wouldn't
37:05
have even talked about it if they were going to disregard it.
37:07
Because we agree he believed it this time.
37:09
And now we have this Apple Health data we do like for our
37:13
case. And now we're going to talk
37:15
about that Apple half data. But, you know, that's just like
37:18
throwing spaghetti at the wall and hoping it sticks.
37:22
Or the prosecution didn't understand the data well enough
37:26
to ask the right questions. Or they're just skipping
37:28
questions. Or, you know, maybe they just
37:31
didn't have much prep time. Like, I don't know who's paying
37:34
for what, you know, but let's, you know, sometimes like I do,
37:37
oh, here's 16 hours to work on this case.
37:39
OK, well, let's see see what we can squeeze in in 16 hours here.
37:44
So I don't know. I mean, there is more testimony
37:47
left, but if they're moving on to the call logs, theoretically
37:51
that's where they're going to focus.
37:52
And they're kind of away from these other artifacts on the
37:55
phone. They've they they briefly
37:57
introduced the house long to die in cold.
37:59
Obviously separately, you know, both Jessica Hyde and Ian Wiffin
38:03
talked about that way longer than Green did at this point.
38:07
But they are, they have differing opinions than him.
38:09
And they're, you know, it's important for the state with
38:12
those two witnesses to prove the doubt that anybody else could
38:17
have known that O'Keefe was on the lawn dying in the cold at
38:20
this point. So if they want your theory to
38:23
work, they've got to disprove this doubt and demonstrate why
38:28
this time stamp doesn't make any sense.
38:31
Time stamps are our favorite things.
38:33
Yeah, time. Well, we like time stamps, but
38:37
we don't like time changes. But we don't we don't like when
38:42
your whole case relies on what one time stamp.
38:45
We hate to get back into that corner because that's hard.
38:47
You got you got to use corroborating artifacts and like
38:52
he didn't mention all they're talking about is the browser
38:54
state DB that you know, need to say suspended state tabs.
38:58
They're not introducing like anything from the Internet
39:01
history. There's nothing from the history
39:03
dot DB mention that would corroborate some of this stuff
39:06
going on. But that's right.
39:08
No mentioned it. It's just like artifacts and
39:11
isolation. That's right.
39:13
You got to tie this stuff together.
39:15
Together. Yeah.
39:16
You got to timeline it out and tie it and tie it together.
39:19
You got to corroborate one to the next next, putting the right
39:22
time stamps in the right places to make it make sense for sure.
39:27
I was like, Becky, do you have anything else or did I kind of
39:30
go off of my own tangent here enough for the both of us?
39:33
No, I, I think we bring up those points that, you know, make this
39:39
a little more difficult to understand and to follow.
39:43
But again, you know, maybe that's, that's, that's their
39:47
strategy, right? I just want to make some, you
39:53
know, statements that confuse people.
39:56
Who knows? Yeah, yeah.
39:58
That's how it works. Well, we hope you are enjoying
40:00
these episodes on the first Karen Reed trial, so please
40:05
leave us a review wherever you listen.
40:08
It really helps us to be able to expand our reach.
40:10
Until next time, stay safe, stay sharp, and as always, keep
40:14
parsing the truth one bite at a time.
40:20
If you enjoyed this episode, make sure to follow us to get
40:23
notified the next time a new episode drops.
40:26
If you can do more, head on over to parsingthetruth.com and
40:30
donate by clicking on the donate button.
40:33
Parsing the Truth is a nonprofit organization and we are raising
40:36
money to send a new digital forensic examiner to I Asus
40:40
training next year in Orlando. Thanks.
40:47
Yeah, Yeah, yeah, yeah, yeah, yeah, yeah.